Getting the masked URL values in Mediawiki

Question

I have successfully masked the URL in Mediawiki. By using the following scripts in .htaccess and localsettings.php files in Mediawiki, i.e.:

.htaccess:

Options +FollowSymLinks

RewriteEngine on
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d

RewriteRule ^(.*)/(.*)$ /mediawiki/index.php?title=$1&actions=$2 [L]

Localsettings.php:

$wgScriptPath       = "/lib/mediawiki";
$wgArticlePath      = "/lib/mediawiki/$1/$2";

It is working fine with required URL. But my problem is I want to consider the second parameter as a querystring for my pages. But I could not get the second parameter in my file. I tried with $wgrequest function but it is only giving the first parameter as title. I tried with $_REQUEST also, it is sometimes give the value of $_REQUEST['actions']. But many times not. I cant understand what is the problem.

Answer 1

I will start by saying you should not use $_REQUEST for something like this, it grabs not only from the URL string, but depending on how it is set up it can grab from $_POST data and $_COOKIE data, which means it is a bit of a security risk.

I would suggest you use the $_GET variable ($_GET['actions']) as you are grabbing it from the URL and I would test it against times when you know actions is either set or not set.

I would imagine that what might be happening is URLs are being accessed that do not have this parameter set in them, this is based on the fact your .htaccess file looks fine. In this case what I would suggest is that you have some sort of default action set up for when it is blank.

$actions = isset($_GET['actions']) ? $_GET['actions'] : 'my_default_action';

You would also want to throw some security into this to not trust anything from $_GET until you have cleaned it up or whitelisted it somehow.