r55632 MediaWiki - Code Review archive

Repository:MediaWiki
Revision:r55631‎ | r55632 | r55633 >
Date:17:07, 27 August 2009
Author:catrope
Status:resolved (Comments)
Tags:
Comment:
API: Add optional API request logging to a file or UDP; intending to use this on the cluster to get some data about API usage and things like which queries are expensive
Modified paths:
  • /trunk/phase3/api.php (modified) (history)
  • /trunk/phase3/includes/DefaultSettings.php (modified) (history)

Diff [purge]

Index: trunk/phase3/includes/DefaultSettings.php
@@ -3823,6 +3823,12 @@
38243824 $wgAPIMaxUncachedDiffs = 1;
38253825
38263826 /**
 3827+ * Log file or URL (TCP or UDP) to log API requests to, or false to disable
 3828+ * API request logging
 3829+ */
 3830+$wgAPIRequestLog = false;
 3831+
 3832+/**
38273833 * Parser test suite files to be run by parserTests.php when no specific
38283834 * filename is passed to it.
38293835 *
Index: trunk/phase3/api.php
@@ -38,6 +38,7 @@
3939 require (dirname(__FILE__) . '/includes/WebStart.php');
4040
4141 wfProfileIn('api.php');
 42+$starttime = microtime( true );
4243
4344 // URL safety checks
4445 //
@@ -118,9 +119,21 @@
119120 wfDoUpdates();
120121
121122 // Log what the user did, for book-keeping purposes.
 123+$endtime = microtime( true );
122124 wfProfileOut('api.php');
123125 wfLogProfilingData();
124126
 127+// Log the request
 128+if ( $wgAPIRequestLog ) {
 129+ wfErrorLog( implode( ',', array(
 130+ wfTimestamp( TS_MW ),
 131+ $endtime - $starttime,
 132+ wfGetIP(),
 133+ wfArrayToCGI( $wgRequest->getValues() )
 134+ ) ) . "\n", $wgAPIRequestLog );
 135+ wfDebug( "Logged API request to $wgAPIRequestLog\n" );
 136+}
 137+
125138 // Shut down the database
126139 wfGetLBFactory()->shutdown();
127140

Comments

#Comment by Brion VIBBER (talk | contribs)   20:15, 27 August 2009

This'll include all GET and POST parameters including username and password for API logins, and edit tokens. Serious privacy breech. :)

#Comment by Werdna (talk | contribs)   13:33, 28 August 2009

Does not block deployment, as it will be deactivated on Wikimedia.

#Comment by Catrope (talk | contribs)   13:34, 28 August 2009

Fixed in r55643

Status & tagging log