2011-01-24 18:00:29 +01:00
|
|
|
<?php
|
|
|
|
|
2011-07-04 21:03:36 +02:00
|
|
|
/**
|
|
|
|
* @group conduit
|
|
|
|
*/
|
2012-03-10 00:46:25 +01:00
|
|
|
final class PhabricatorConduitConsoleController
|
2011-01-24 18:00:29 +01:00
|
|
|
extends PhabricatorConduitController {
|
|
|
|
|
|
|
|
private $method;
|
|
|
|
|
|
|
|
public function willProcessRequest(array $data) {
|
2012-04-27 07:25:05 +02:00
|
|
|
$this->method = $data['method'];
|
2011-01-24 18:00:29 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
public function processRequest() {
|
2011-01-31 03:52:29 +01:00
|
|
|
|
|
|
|
$request = $this->getRequest();
|
2013-07-01 21:36:34 +02:00
|
|
|
$viewer = $request->getUser();
|
2011-01-31 03:52:29 +01:00
|
|
|
|
2013-07-01 21:36:34 +02:00
|
|
|
$method = id(new PhabricatorConduitMethodQuery())
|
|
|
|
->setViewer($viewer)
|
|
|
|
->withMethods(array($this->method))
|
|
|
|
->executeOne();
|
|
|
|
|
|
|
|
if (!$method) {
|
2012-04-27 07:25:05 +02:00
|
|
|
return new Aphront404Response();
|
2011-01-24 18:00:29 +01:00
|
|
|
}
|
|
|
|
|
2013-07-01 21:36:34 +02:00
|
|
|
$status = $method->getMethodStatus();
|
|
|
|
$reason = $method->getMethodStatusDescription();
|
2012-04-18 23:25:27 +02:00
|
|
|
|
|
|
|
$status_view = null;
|
2012-04-27 07:25:05 +02:00
|
|
|
if ($status != ConduitAPIMethod::METHOD_STATUS_STABLE) {
|
2012-04-18 23:25:27 +02:00
|
|
|
$status_view = new AphrontErrorView();
|
|
|
|
switch ($status) {
|
|
|
|
case ConduitAPIMethod::METHOD_STATUS_DEPRECATED:
|
|
|
|
$status_view->setTitle('Deprecated Method');
|
|
|
|
$status_view->appendChild(
|
2013-02-07 01:53:49 +01:00
|
|
|
nonempty($reason, "This method is deprecated."));
|
2012-04-18 23:25:27 +02:00
|
|
|
break;
|
|
|
|
case ConduitAPIMethod::METHOD_STATUS_UNSTABLE:
|
|
|
|
$status_view->setSeverity(AphrontErrorView::SEVERITY_WARNING);
|
|
|
|
$status_view->setTitle('Unstable Method');
|
|
|
|
$status_view->appendChild(
|
2013-02-07 01:53:49 +01:00
|
|
|
nonempty(
|
|
|
|
$reason,
|
|
|
|
"This method is new and unstable. Its interface is subject ".
|
|
|
|
"to change."));
|
2012-04-18 23:25:27 +02:00
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
2011-01-24 18:00:29 +01:00
|
|
|
|
2013-07-01 21:36:34 +02:00
|
|
|
$error_types = $method->defineErrorTypes();
|
2011-01-24 18:00:29 +01:00
|
|
|
if ($error_types) {
|
2013-02-05 23:30:29 +01:00
|
|
|
$error_description = array();
|
2011-01-24 18:00:29 +01:00
|
|
|
foreach ($error_types as $error => $meaning) {
|
2013-02-05 21:49:46 +01:00
|
|
|
$error_description[] = hsprintf(
|
|
|
|
'<li><strong>%s:</strong> %s</li>',
|
|
|
|
$error,
|
|
|
|
$meaning);
|
2011-01-24 18:00:29 +01:00
|
|
|
}
|
2013-02-05 23:30:29 +01:00
|
|
|
$error_description = phutil_tag('ul', array(), $error_description);
|
2011-01-24 18:00:29 +01:00
|
|
|
} else {
|
|
|
|
$error_description = "This method does not raise any specific errors.";
|
|
|
|
}
|
|
|
|
|
|
|
|
$form = new AphrontFormView();
|
|
|
|
$form
|
2011-01-31 03:52:29 +01:00
|
|
|
->setUser($request->getUser())
|
2011-01-24 18:00:29 +01:00
|
|
|
->setAction('/api/'.$this->method)
|
Detect missing 'params' in Conduit calls
Summary:
Suhosin has about 50 options for filtering input variables, doucmented here:
http://www.hardened-php.net/suhosin/configuration.html
The default behavior of Suhosin is to drop the variable entirely if it violates any of the rules, then continue with the request. It doesn't affect 'php://input' and doesn't drop other variables, so it evades existing detection, and we can't figure out that it's happened at runtime. We could add blanket checks (Suhosin enabled + suhosin.filter.action set to nothing means this may happen, and will be undetectable if it does happen) but can't tailor a check or recovery to this specific problem.
Instead, raise a better error in the specific case where we encounter this, which is Conduit calls of "arc diff" of files over 1MB (the default POST limit). In these cases, Suhosin drops the variable entirely. If there is no 'params', scream. We never encounter this case normall (`arc`, including `arc call-conduit`, always sends this parameter) although other clients might omit it. The only exception is the web console with `conduit.ping`, which submits nothing; make it submit something so it keeps working.
See also https://github.com/facebook/phabricator/issues/233#issuecomment-11186074
Test Plan: Brought up a Debian + Suhosin box, verified the behavior of Suhosin, made requests with and without 'params'.
Reviewers: btrahan, vrana
Reviewed By: btrahan
CC: aran
Differential Revision: https://secure.phabricator.com/D4144
2012-12-11 23:01:18 +01:00
|
|
|
->addHiddenInput('allowEmptyParams', 1)
|
2011-01-24 18:00:29 +01:00
|
|
|
->appendChild(
|
|
|
|
id(new AphrontFormStaticControl())
|
|
|
|
->setLabel('Description')
|
2013-07-01 21:36:34 +02:00
|
|
|
->setValue($method->getMethodDescription()))
|
2011-01-24 18:00:29 +01:00
|
|
|
->appendChild(
|
|
|
|
id(new AphrontFormStaticControl())
|
|
|
|
->setLabel('Returns')
|
2013-07-01 21:36:34 +02:00
|
|
|
->setValue($method->defineReturnType()))
|
2011-01-24 18:00:29 +01:00
|
|
|
->appendChild(
|
2011-01-24 20:36:53 +01:00
|
|
|
id(new AphrontFormMarkupControl())
|
2011-01-24 18:00:29 +01:00
|
|
|
->setLabel('Errors')
|
|
|
|
->setValue($error_description))
|
2013-02-07 23:39:04 +01:00
|
|
|
->appendChild(hsprintf(
|
2011-01-24 18:00:29 +01:00
|
|
|
'<p class="aphront-form-instructions">Enter parameters using '.
|
|
|
|
'<strong>JSON</strong>. For instance, to enter a list, type: '.
|
2013-02-07 23:39:04 +01:00
|
|
|
'<tt>["apple", "banana", "cherry"]</tt>'));
|
2011-01-24 18:00:29 +01:00
|
|
|
|
2013-07-01 21:36:34 +02:00
|
|
|
$params = $method->defineParamTypes();
|
2011-01-24 18:00:29 +01:00
|
|
|
foreach ($params as $param => $desc) {
|
|
|
|
$form->appendChild(
|
|
|
|
id(new AphrontFormTextControl())
|
|
|
|
->setLabel($param)
|
|
|
|
->setName("params[{$param}]")
|
2013-02-05 22:23:05 +01:00
|
|
|
->setCaption($desc));
|
2011-01-24 18:00:29 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
$form
|
|
|
|
->appendChild(
|
|
|
|
id(new AphrontFormSelectControl())
|
|
|
|
->setLabel('Output Format')
|
|
|
|
->setName('output')
|
|
|
|
->setOptions(
|
|
|
|
array(
|
|
|
|
'human' => 'Human Readable',
|
|
|
|
'json' => 'JSON',
|
|
|
|
)))
|
|
|
|
->appendChild(
|
|
|
|
id(new AphrontFormSubmitControl())
|
2013-07-01 21:36:34 +02:00
|
|
|
->addCancelButton($this->getApplicationURI())
|
2011-01-24 18:00:29 +01:00
|
|
|
->setValue('Call Method'));
|
|
|
|
|
2013-09-25 20:23:29 +02:00
|
|
|
$form_box = id(new PHUIObjectBoxView())
|
2013-08-27 00:45:58 +02:00
|
|
|
->setHeaderText($method->getAPIMethodName())
|
|
|
|
->setForm($form);
|
|
|
|
|
2014-01-14 00:32:37 +01:00
|
|
|
if ($status_view) {
|
|
|
|
$form_box->setErrorView($status_view);
|
|
|
|
}
|
|
|
|
|
2013-07-01 21:36:34 +02:00
|
|
|
$crumbs = $this->buildApplicationCrumbs();
|
2013-12-19 02:47:34 +01:00
|
|
|
$crumbs->addTextCrumb($method->getAPIMethodName());
|
2011-01-24 18:00:29 +01:00
|
|
|
|
2013-07-01 21:36:34 +02:00
|
|
|
return $this->buildApplicationPage(
|
2012-04-18 23:25:27 +02:00
|
|
|
array(
|
2013-07-01 21:36:34 +02:00
|
|
|
$crumbs,
|
2013-08-27 00:45:58 +02:00
|
|
|
$form_box,
|
2012-04-18 23:25:27 +02:00
|
|
|
),
|
2011-01-24 18:00:29 +01:00
|
|
|
array(
|
2013-07-01 21:36:34 +02:00
|
|
|
'title' => $method->getAPIMethodName(),
|
|
|
|
'device' => true,
|
2011-01-24 18:00:29 +01:00
|
|
|
));
|
|
|
|
}
|
|
|
|
|
|
|
|
}
|