Wiki Request Runtime en

Wiki Request Runtime

This page documents the current wiki.php main request path from source code.

Bootstrap Order

sequenceDiagram
    participant PHP as wiki.php
    participant Config as Config
    participant DB as WikiDB
    participant User as init_requests
    participant Session as _session_start
    participant Main as wiki_main

    PHP->>Config: getConfig("config.php")
    PHP->>PHP: require wikilib/cache/timer
    PHP->>Config: load_cached_site_config(host)
    PHP->>DB: new WikiDB(Config)
    PHP->>User: init_requests(options)
    User-->>PHP: options id, user prefs, theme data
    PHP->>Session: validate PHP/MONIWIKI cookies
    PHP->>PHP: set early cache/CORS headers
    PHP->>Main: wiki_main(options)

Loading

Important ordering detail: init_requests($options) runs before _session_start(). Therefore session cleanup must propagate back to the same $options array that is later passed to wiki_main($options).

Request Parsing In wiki_main

wiki_main($options) starts from $options['pagename'] or the configured front page.

For POST:

• removes reserved retstr and header fields from $_POST;
• derives action, value, goto, and popup;
• supports legacy raw-post and drawing paths;
• rejects empty POST requests without goto or action with Status: 405 Not allowed.

For GET/HEAD:

• removes reserved retstr and header fields from $_GET;
• reads action, value, goto, rev, refresh, and popup;
• only allows refresh for non-anonymous users.

Then it parses action modes such as action=Name/ajax or action=Name/macro, stores the normalized page/action in $options, and removes reserved call and prefix.

Page And Policy Setup

After parsing:

• pageToKeyname() is used to enforce page key length limits for action requests.
• local_pre_check($action, $options) may run if defined.
• configured rulesets may classify robots and add staff members.
• WikiPage is created and page instructions are loaded for existing pages.
• static page state is prepared for robots, GET, and HEAD.
• HEAD and conditional GET may return before normal rendering.

Show Path

When action is empty or show, the runtime:

• redirects value or goto through do_goto();
• maps missing pages to notfound unless auto_search applies;
• enforces read access when control_read is enabled;
• sends headers and title through Formatter;
• uses page HTML cache when cache settings and page instructions allow it;
• expands dynamic macros after cached HTML load;
• sends extra macros and footer.

Action Dispatch Path

For non-show actions:

flowchart TD
    Action["action string"] --> Alias["myplugins alias"]
    Alias --> Allowed["security->is_allowed(action, options)"]
    Allowed --> Mode{"action mode?"}
    Mode -->|ajax/macro| ModeAllowed["check full action permission"]
    Mode -->|none| Protected["POST protected action password check"]
    ModeAllowed --> DispatchMode["ajax_repl or macro_repl"]
    Protected --> Resolver["getPlugin(action)"]
    Resolver --> Include["include plugin basename"]
    Include --> Call["do_action or do_post_action"]

Loading

For POST action handlers, $_POST is merged into $options immediately before calling the handler. For GET action handlers, $_GET is merged for do_*, while do_post_* receives only selected values.

Main Identity Boundary

Authentication consistency is handled at _session_start() with the caller's $options array passed by reference. By the time plugin dispatch runs, authorization has already consumed $options['id'] in several places, so this central boundary is the right place to invalidate stale identity state.