Page MenuHomePhabricator
Files F3997064

T125283-master.patch
dpatrick (Darian Anthony Patrick)
Actions

Authored By
• dpatrick
May 11 2016, 9:17 PM
Size
1 KB
Referenced Files
None
Subscribers
None

T125283-master.patch
View Options

From 20535abcca5af5face9db57aaf5f7cb7770e78f5 Mon Sep 17 00:00:00 2001
From: Brad Jorsch <bjorsch@wikimedia.org>
Date: Sun, 31 Jan 2016 15:43:00 -0500
Subject: [PATCH] SECURITY: RawAction: Vary on the usual headers
This avoids edge cases where the user isn't logged in but we still need
varying for proper cache behavior.
Bug: T125283
Change-Id: I43cde3a48371e62a16bda1291b1b51986e60fe4c
---
includes/OutputPage.php | 5 +++++
includes/actions/RawAction.php | 6 ++++++
2 files changed, 11 insertions(+)
diff --git a/includes/OutputPage.php b/includes/OutputPage.php
index c724207..bf37436 100644
--- a/includes/OutputPage.php
+++ b/includes/OutputPage.php
@@ -2026,6 +2026,11 @@ class OutputPage extends ContextSource {
* @return string
*/
public function getVaryHeader() {
+ // If we vary on cookies, let's make sure it's always included here too.
+ if ( $this->getCacheVaryCookies() ) {
+ $this->addVaryHeader( 'Cookie' );
+ }
+
foreach ( SessionManager::singleton()->getVaryHeaders() as $header => $options ) {
$this->addVaryHeader( $header, $options );
}
diff --git a/includes/actions/RawAction.php b/includes/actions/RawAction.php
index c7b18a4..5bf24f6 100644
--- a/includes/actions/RawAction.php
+++ b/includes/actions/RawAction.php
@@ -80,6 +80,12 @@ class RawAction extends FormlessAction {
}
}
+ // Set standard Vary headers so cache varies on cookies and such (T125283)
+ $response->header( $this->getOutput()->getVaryHeader() );
+ if ( $config->get( 'UseKeyHeader' ) ) {
+ $response->header( $this->getOutput()->getKeyHeader() );
+ }
+
$response->header( 'Content-type: ' . $contentType . '; charset=UTF-8' );
// Output may contain user-specific data;
// vary generated content for open sessions on private wikis
--
2.7.4 (Apple Git-66)

File Metadata

Mime Type
text/x-diff
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
3717974
Default Alt Text
T125283-master.patch (1 KB)

Event Timeline

Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL