MediaWiki 1.17.3

[autoinstallsdev/mediawiki.git] / includes / resourceloader / ResourceLoader.php

diff --git a/includes/resourceloader/ResourceLoader.php b/includes/resourceloader/ResourceLoader.php
index 191bc9f047acdb22ca63d8993dd85aa7989747d5..b6354f0f234e6479bd11a6c2654de7b239fe72b3 100644 (file)
--- a/includes/resourceloader/ResourceLoader.php
+++ b/includes/resourceloader/ResourceLoader.php
@@ -161,7 +161,7 @@ class ResourceLoader {
                        $cache->set( $key, $result );
                } catch ( Exception $exception ) {
                        // Return exception as a comment
-                       $result = "/*\n{$exception->__toString()}\n*/\n";
+                       $result = $this->makeComment( $exception->__toString() );
                }
 
                wfProfileOut( __METHOD__ );
@@ -306,13 +306,20 @@ class ResourceLoader {
                ob_start();
 
                wfProfileIn( __METHOD__ );
-               $exceptions = '';
+               $errors = '';
 
                // Split requested modules into two groups, modules and missing
                $modules = array();
                $missing = array();
                foreach ( $context->getModules() as $name ) {
                        if ( isset( $this->moduleInfos[$name] ) ) {
+                               $module = $this->getModule( $name );
+                               // Do not allow private modules to be loaded from the web.
+                               // This is a security issue, see bug 34907.
+                               if ( $module->getGroup() === 'private' ) {
+                                       $errors .= $this->makeComment( "Cannot show private module \"$name\"" );
+                                       continue;
+                               }
                                $modules[$name] = $this->getModule( $name );
                        } else {
                                $missing[] = $name;
@@ -337,26 +344,21 @@ class ResourceLoader {
                        $this->preloadModuleInfo( array_keys( $modules ), $context );
                } catch( Exception $e ) {
                        // Add exception to the output as a comment
-                       $exceptions .= "/*\n{$e->__toString()}\n*/\n";
+                       $errors .= $this->makeComment( $e->__toString() );
                }
 
                wfProfileIn( __METHOD__.'-getModifiedTime' );
 
-               $private = false;
                // To send Last-Modified and support If-Modified-Since, we need to detect 
                // the last modified time
                $mtime = wfTimestamp( TS_UNIX, $wgCacheEpoch );
                foreach ( $modules as $module ) {
                        try {
-                               // Bypass Squid and other shared caches if the request includes any private modules
-                               if ( $module->getGroup() === 'private' ) {
-                                       $private = true;
-                               }
                                // Calculate maximum modified time
                                $mtime = max( $mtime, $module->getModifiedTime( $context ) );
                        } catch ( Exception $e ) {
                                // Add exception to the output as a comment
-                               $exceptions .= "/*\n{$e->__toString()}\n*/\n";
+                               $errors .= $this->makeComment( $e->__toString() );
                        }
                }
 
@@ -373,13 +375,8 @@ class ResourceLoader {
                        header( 'Cache-Control: private, no-cache, must-revalidate' );
                        header( 'Pragma: no-cache' );
                } else {
-                       if ( $private ) {
-                               header( "Cache-Control: private, max-age=$maxage" );
-                               $exp = $maxage;
-                       } else {
-                               header( "Cache-Control: public, max-age=$maxage, s-maxage=$smaxage" );
-                               $exp = min( $maxage, $smaxage );
-                       }
+                       header( "Cache-Control: public, max-age=$maxage, s-maxage=$smaxage" );
+                       $exp = min( $maxage, $smaxage );
                        header( 'Expires: ' . wfTimestamp( TS_RFC2822, $exp + time() ) );
                }
 
@@ -418,12 +415,12 @@ class ResourceLoader {
                $response = $this->makeModuleResponse( $context, $modules, $missing );
                
                // Prepend comments indicating exceptions
-               $response = $exceptions . $response;
+               $response = $errors . $response;
 
                // Capture any PHP warnings from the output buffer and append them to the
                // response in a comment if we're in debug mode.
                if ( $context->getDebug() && strlen( $warnings = ob_get_contents() ) ) {
-                       $response = "/*\n$warnings\n*/\n" . $response;
+                       $response = $this->makeComment( $warnings ) . $response;
                }
 
                // Remove the output buffer and output the response
@@ -433,6 +430,11 @@ class ResourceLoader {
                wfProfileOut( __METHOD__ );
        }
 
+       protected function makeComment( $text ) {
+               $encText = str_replace( '*/', '* /', $text );
+               return "/*\n$encText\n*/\n";
+       }
+
        /**
         * Generates code for a response
         * 
@@ -457,7 +459,7 @@ class ResourceLoader {
                                $blobs = MessageBlobStore::get( $this, $modules, $context->getLanguage() );
                        } catch ( Exception $e ) {
                                // Add exception to the output as a comment
-                               $exceptions .= "/*\n{$e->__toString()}\n*/\n";
+                               $exceptions .= $this->makeComment( $e->__toString() );
                        }
                } else {
                        $blobs = array();
@@ -509,7 +511,7 @@ class ResourceLoader {
                                }
                        } catch ( Exception $e ) {
                                // Add exception to the output as a comment
-                               $exceptions .= "/*\n{$e->__toString()}\n*/\n";
+                               $exceptions .= $this->makeComment( $e->__toString() );
 
                                // Register module as missing
                                $missing[] = $name;