Hi all,
I am running MediaWiki 1.26, and trying to force it to be all-SSL, all the time, excepting
a particular Special: page. To that end, I have code which makes the following method call
from a 'BeforeInitialize' hook:
$this->output->redirect($https_url, 301);
However, by the time processing gets to OutputPage:output() method, the
OutputPage::$mRedirect attribute is empty. I think this is because our wiki is also
configured to require logins to read, and when accessing it as anonymous user on plaintext
port, OutputPage::prepareErrorPage gets run AFTER we send the SSL redirect, but BEFORE the
actual output rendering occurs.
My simple solution to this is to forcibly invoke OutputPage::Output on the spot, right
there in the 'BeforeInitialize' hook:
$this->output->redirect($https_url, 301);
$this->output->output();
However, while it LOOKS safe (because OutputPage::output does a return after setting
redirects, rather than continue on to process output), I still have a bad feeling about
this. I don't like messing with order-of-execution in such a crude manner.
Can anyone either confirm that it's safe, or offer a superior alternative - a way of
forcing a redirect safely, even if an ErrorPage would be rendered otherwise?
I know that I can use PHP's 'header' method directly, but that also skips
MediaWiki housekeeping, so I don't particularly like that route either.
Thanks in advance!