Maggi Federico wrote: $_POST/$_GET/$_SESSION/$_REQUEST ? However, MediaWiki encapsulates them, mainly with WebRequest.php

Maggi Federico wrote: Does "HTTP responses" include content generation? I'm going to assume not, since otherwise something most of the codebase will qualify. The WebRequest instance describing the current request is kept in the global variable $wgRequest -- you may want to grep for that, or for methods specific to the WebRequest class. You'll find that a lot of code uses that class to access things like URL parameters, though. There's also a WebResponse class (available via $wgRequest->response()), but it doesn't really do much (just duplicates the PHP header() function and provides a wrapper around setcookie() which seems to be called from exactly one place in the code). Anyway, you should catch any uses of it by grepping for $wgRequest, but you should also grep for the standard PHP header() and setcookie() functions. The WebRequest class also provides functions for accessing session data, but they don't actually seem to be used -- everything just accesses the PHP superglobal $_SESSION array directly. Also, note that all this is true for the main UI code. The API code (found in api.php and under includes/api) and the AJAX code (includes/Ajax*.php) may do things somewhat differently. -- Ilmari Karonen