RawAction: Vary on the usual headers.patch
No One
Actions

Authored By

	Anomie
	Feb 23 2016, 3:50 PM

Size

1 KB

Referenced Files

None

Subscribers

None

RawAction: Vary on the usual headers.patch
View Options

	From 63819034ceb86bed30962f6b5324287ac0f46393 Mon Sep 17 00:00:00 2001
	From: Brad Jorsch <bjorsch@wikimedia.org>
	Date: Sun, 31 Jan 2016 15:43:00 -0500
	Subject: [PATCH] SECURITY: RawAction: Vary on the usual headers

	This avoids edge cases where the user isn't logged in but we still need
	varying for proper cache behavior.

	Bug: T125283
	Change-Id: I43cde3a48371e62a16bda1291b1b51986e60fe4c
	---
	includes/OutputPage.php \| 5 +++++
	includes/actions/RawAction.php \| 6 ++++++
	2 files changed, 11 insertions(+)

	diff --git a/includes/OutputPage.php b/includes/OutputPage.php
	index 93ba702..93f4c3a 100644
	--- a/includes/OutputPage.php
	+++ b/includes/OutputPage.php
	@@ -2032,6 +2032,11 @@ class OutputPage extends ContextSource {
	* @return string
	*/
	public function getVaryHeader() {
	+ // If we vary on cookies, let's make sure it's always included here too.
	+ if ( $this->getCacheVaryCookies() ) {
	+ $this->addVaryHeader( 'Cookie' );
	+ }
	+
	foreach ( SessionManager::singleton()->getVaryHeaders() as $header => $options ) {
	$this->addVaryHeader( $header, $options );
	}
	diff --git a/includes/actions/RawAction.php b/includes/actions/RawAction.php
	index b371848..6cc5e0b 100644
	--- a/includes/actions/RawAction.php
	+++ b/includes/actions/RawAction.php
	@@ -80,6 +80,12 @@ class RawAction extends FormlessAction {
	}
	}

	+ // Set standard Vary headers so cache varies on cookies and such (T125283)
	+ $response->header( $this->getOutput()->getVaryHeader() );
	+ if ( $config->get( 'UseKeyHeader' ) ) {
	+ $response->header( $this->getOutput()->getKeyHeader() );
	+ }
	+
	$response->header( 'Content-type: ' . $contentType . '; charset=UTF-8' );
	// Output may contain user-specific data;
	// vary generated content for open sessions on private wikis
	--
	2.7.0

File Metadata

Mime Type: text/x-diff
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 3397012
Default Alt Text: RawAction: Vary on the usual headers.patch (1 KB)

RawAction: Vary on the usual headers.patchNo OneActions

RawAction: Vary on the usual headers.patchView Options

File Metadata

Event Timeline

RawAction: Vary on the usual headers.patch
No One
Actions

RawAction: Vary on the usual headers.patch
View Options