Commit graph

154 commits

Author SHA1 Message Date
Amir Sarabadani
09b18a8f4c Reorg: Move Title-related classes to title/
These three classes:
 - TitleArray
 - TitleArrayFromResult
 - TitleFactory

We need to move these and the rest of files under title/ to Title/ (and
namespace them) but the patch will become way too big given that Title class is
also one of them.

Bug: T321882
Change-Id: Iac1688172ee457348a08a470c86e047571feb8e0
2022-11-26 09:30:32 +00:00
Tim Starling
0077c5da15 Use short array destructuring instead of list()
Introduced in PHP 7.1. Because it's shorter and looks nice.

I used regex replacement.

Change-Id: I0555e199d126cd44501f859cb4589f8bd49694da
2022-10-21 15:33:37 +11:00
Umherirrender
a5abaeba10 Call IContextSource::getAuthority instead of IContextSource::getUser
Change to use Authority object where possible
to use the interface instead of implementation

Change-Id: Ia7e9ce2a2f05ef2ae1cf981bf96faf48b04cf58d
2022-06-29 22:22:44 +02:00
Reedy
f45fefec0e api: Replace numerous more deprecated constants
Change-Id: I498a315b8b4b56d5e2f939e797adbe0487cd7d07
2022-06-06 02:24:41 +01:00
Reedy
0b5084f868 api: Replace numerous deprecated constants
Change-Id: I34ffcb70efbfa257da8dab6e0790aa0d697caf5b
2022-06-06 00:18:50 +01:00
Aryeh Gregor
666ca1bdf3 Use MainConfigNames instead of string literals, #2
This covers all occurrences of /onfig->.*get( '/ in includes/.
Undoubtedly there are still plenty more to go.

Change-Id: I33196c4153437778496f40436bcde399638ac361
2022-04-13 18:55:46 +03:00
Thiemo Kreuz
0c5802ec4e Use PHP's [ $this, 'fn' ] callback syntax where possible
PHP 8.1 will give us "first class callables" that look like e.g.

 $result = array_map( $this->fn(...), $array );

For now we can use

 $result = array_map( [ $this, 'fn' ], $array );

Change-Id: I7278c80c075d162da73aa45af1b6578310ce0624
2021-12-03 09:08:57 +01:00
Sam Smith
9f1e946109 api: Handle invalid/non-existent titles in ApiBlock
Defer to the TitleDef type definition for page titles to validate values
passed to the pagerestrictions parameter.

Bug: T279689
Change-Id: Ia2e116d1bc476b178d85a6331dec17d7a8df74ba
2021-07-27 14:41:32 +01:00
Alexander Vorwerk
825ac0232c Convert BlockUtils::parseBlockTarget to UserIdentity
Bug: T286490
Change-Id: Ice96180690828bcf2efd60faf6ad10d64307713d
2021-07-20 22:12:26 +02:00
Umherirrender
d146800ee8 api: Inject services into ApiWatchlistTrait
Bug: T259960
Change-Id: I73596f8c924ec4a02a7042608d19a35f82bb752a
2021-07-06 20:15:30 +00:00
Umherirrender
9a3c1add97 api: Replace User::whoIs in ApiBlock
Inject and use the new UserIdentityLookup service

Change-Id: I56b0ba599b5e86f568a5d7db6d27776ba52e1dc5
2021-06-30 20:31:54 +02:00
Thalia
6cb1016594 Allow partial action blocks to be made via ApiBlock
Bug: T280522
Change-Id: I114e3c76cfb6dd2f79b5217aee4b3da34df00850
2021-05-04 17:48:21 +01:00
Petr Pchelko
f984d3f83b Hard-deprecate AbstractBlock::parseTarget
Bug: T276610
Change-Id: I2f10ae5da1d9b1ca4aa20492b943e0c94d32a0b6
2021-03-19 07:22:48 -06:00
Petr Pchelko
c04328bdef Convert (Un)BlockUser to Authority
Change-Id: I5084b5523f15b7d55b2f5dc67ae19ec7059799ad
2021-03-18 02:10:45 +00:00
Umherirrender
8de3b7d324 Use static closures where safe to use
This is micro-optimization of closure code to avoid binding the closure
to $this where it is not needed.

Created by I25a17fb22b6b669e817317a0f45051ae9c608208

Change-Id: I0ffc6200f6c6693d78a3151cb8cea7dce7c21653
2021-02-11 00:13:52 +00:00
Ammar Abdulhamid
a68281552e Reduce SpecialBlock/Api logic duplication
Add PageRestriction::newFromTitle() to create from Title instance
or title string.

Change-Id: Id4c8117b916be05edc863bcd7a15c74fb28a833a
2021-01-22 05:49:50 +01:00
Ammar Abdulhamid
3922dfd68b ApiBlock: Add user watch only after block success
I believe it does not make sense to go on with peripheral action when
the primary action did not succeed.

If the blocker decides to attempt the block again, they can also decide
whether to add watch or not at that time.

Change-Id: I64880ce254e33378642bb9f1952c88ce490ef490
2020-10-06 09:48:20 +00:00
Ammar Abdulhamid
3565eebd14 Add WatchlistExpiry support to ApiBlock
Bug: T248515
Change-Id: I253bcb5a74a65cbd9834b5eabcd1ed7a1993a5d9
2020-10-01 15:42:15 +01:00
Thalia
fb8622d6d9 Ignore block restrictions if block is not specified as partial
In SpecialBlock, ignore restrictions if the 'sitewide' radio was
selected. In ApiBlock, ignore restrictions if the 'partial' parameter
was falsey.

In both cases, ignoring restrictions means not passing them to
BlockUser.

This restores the behaviour prior to a656d03597, that a block is
sitewide unless it is marked as partial, even if restrictions options
are set.

Bug: T189073
Change-Id: I4d2e08b744b9d59909ce24cc5f167b676478970d
2020-09-28 17:23:43 +01:00
Thalia
b893a95035 Pass correct parameters to BlockUser from ApiBlock and SpecialBlock
Pass 'partial' parameter from ApiBlock.

Pass 'DisableEmail' parameter from SpecialBlock only after confirming
it is set.

Follow-up to a656d03597

Bug: T189073
Change-Id: I5acbb1c5d49b216bb235936cd479829128beac77
2020-09-23 14:44:19 +01:00
Martin Urbanec
a656d03597 Introduce backend class for blocking users
Rather than having to do DatabaseBlock calls directly,
and then ManualLogEntry calls to facilitate logging,
let's create a BlockUser service, capable of blocking users
and logging, optionally with permission checking.

This should make blocking users easier for developers,
for instance, AbuseFilter or CheckUser can easily
benefit from this commit.

Bug: T189073
Change-Id: Ifdced735b694b85116cb0e43dadbfa8e4cdb8cab
2020-09-22 14:14:01 +01:00
Thalia
9982b791c0 Remove unnecessary calls to SpecialBlock::getTargetAndType
Refactor this method to make clearer that it returns the return value
of AbstractBlock::parseTarget and does nothing additional when called
without a WebRequest.

Update callers that do that to call parseTarget directly instead.

SpecialBlock::getTargetAndType (added in 97e2c97578) predates
AbstractBlock::parseTarget (added in f64f960d9a). The callers being
updated here called getTargetAndType since before parseTarget was
available.

Bug: T250940
Change-Id: I366e1076b10ab7c2dc4bb04920908b3286b77b73
2020-09-21 21:00:44 +01:00
Martin Urbanec
dd4f247e98 Do not call SpecialBlock::canBlockEmail in ApiBlock
Bug: T263327
Change-Id: Ic63178ba1ac2756b5b305d4fa8ea53ab40f9b011
2020-09-19 20:12:24 +02:00
Umherirrender
fb2821a9d1 Use UserNameUtils in ApiBlock
Change-Id: I6f2a8847076dbf91055a1b98bd5a2af8ae833dc8
2020-08-05 22:16:06 +02:00
Thalia
3db547e99b Remove $wgEnablePartialBlocks config and always enable partial blocks
Bug: T242912
Change-Id: Icf737140dd112dc4d222274ae40e225cb7a9d3fc
2020-03-04 13:45:44 +00:00
Brad Jorsch
c2b1525908 API: Use ParamValidator library
This brings significant modularization to the Action API's parameter
validation, and allows the Action API and MW REST API to share
validation code.

Note there are several changes in this patch that may affect other code;
see the entries in RELEASE-NOTES-1.35 for details.

Bug: T142080
Bug: T232672
Bug: T21195
Bug: T34675
Bug: T154774
Change-Id: I1462edc1701278760fa695308007006868b249fc
Depends-On: I10011be060fe6d27c7527312ad41218786b3f40d
2020-02-04 13:36:14 -05:00
Daimona Eaytoy
9881ea93be Better grouping for code adding elements to arrays
Change-Id: I7cc8c810f0dcf1ee84b9d5f14967ec2568e3e0be
Follow-up: I50377746f01749b058c39fd8229f9d566224cc43
2019-09-03 19:38:57 +02:00
Daimona Eaytoy
e2e543f7c2 Unsuppress more phan issues (part 5)
Bug: T231636
Depends-On: I6e5fba7bd273219b1206559420b5bdb78734aa84
Change-Id: I50377746f01749b058c39fd8229f9d566224cc43
2019-09-01 09:48:31 +00:00
Petr Pchelko
1d286560d2 Replace User::isAllowed with PermissionManager.
Covers root includes, actions, api, block, changes,
changetags, diff and PermissionManager itself.

Bug: T220191
Change-Id: Ic027d32f5dd8f4c74865df0c8a9fcf91123c889c
2019-08-20 14:43:51 -07:00
Kunal Mehta
756827cae7 SECURITY: API: Respect $wgBlockCIDRLimit in action=block
$wgBlockCIDRLimit states how large rangeblocks are allowed to be for IPv4
and IPv6. The API now calls SpecialBlock::validateTarget() to perform
that validation step.

As a minor thing, SpecialBlock::checkUnblockSelf() is now called twice by
the API, but that can probably be cleaned up at another time.

Tests included.

Bug: T199540
Change-Id: Ic7d60240d9ebd9580c0eb3b41e4befceab69bd81
2019-06-06 16:54:15 +00:00
Thalia
e65a5b5882 Rename Block to MediaWiki\Block\DatabaseBlock
Keep Block as a deprecated class alias for DatabaseBlock.
Update calls to the Block constructor and Block static
methods from external classes.

Also update documentation in several places that refer to
blocks as Blocks.

Bug: T222737
Change-Id: I6d96b63ca0a84bee19486471e0a16a53a79d768a
2019-05-28 12:20:48 +01:00
daniel
9f973228d5 Restore ApiQueryUserInfo::getBlockInfo() as a stub.
Fixes unintended breaking change made by I84ed21641c44b2f65ebe.
ApiQueryUserInfo::getBlockInfo() is restoed as a hard deprecated stub.

This renames the method in the new ApiBlockInfoTrait to
getBlockDetails.

Depends-On: I9f40666a31bd4af50762c197c2ce5bf089a5e68c
Change-Id: If47a93878f87d69800e5f305404c22528dac5e94
2019-05-11 07:33:25 +00:00
Amir Sarabadani
693c8b2f5a Move ApiQueryUserInfo::getBlockInfo() to ApiBase
ApiBase directly uses this method causing a cyclic dependency between
ApiBase and ApiQueryUserInfo

Change-Id: I84ed21641c44b2f65ebe1980b0893d1846db3b34
2019-05-06 00:06:30 +02:00
David Barratt
e86a060284
Deprecate User::isBlocked()
The method User::isBlocked() attempts to answer two questions:
(1) Does the user have a block?
(2) Is the user prevented from performing this action?
The method can answer #1, but it cannot answer #2. Since User::getBlock() can
also answer #1, this method is redundant. The method cannot answer #2 because
there is not enough context in order to answer that question.

If access is being checked against a Title object, all access checks can be
performed with PermissionManager:userCan() which will also check the user's
blocks.

If performing all access checks is not desirable, using
PermissionManager::isBlockedFrom() is also acceptable for only checking if the
user is blocked. This method does *not* determine if the action is allowed,
only that the user's block applies to that Title.

If access is being checked without an existing Title, User::getBlock() can be
used to get the user's block. Then Block::appliesToRight() can be used to
determine if the block applies explicitly to a right (or returns null if
it is unknown or false if explicitly allowed). If the user is creating a new
Title, but the text of the title is not yet known (as in the case of Wikibase),
access should be checked with Block::appliesToNamespace().

Bug: T209004
Change-Id: Ic0ad1b92e957797fee8dcd00bd1092fe69fa58f1
2019-04-25 11:47:44 -04:00
Thalia
1b9ca741a7 Remove reliance on Block properties being public
Use getters and setters for $mReason, $mTimestamp, $mExpiry and
$mHideName; use Block::getType to check if a block is an autoblock
instead of checking $mAuto; no change needed for $mParentBlockId,
which is not accessed externally.

Change-Id: I767ed44ce4c2e21f53962d75fb86891add2282f6
2019-03-22 21:17:22 +00:00
Thalia
f589214d0f Add namespace restrictions to Special:Block and API
This adds a UI for blocking namespaces to Special:Block
and a namespacerestrictions parameter to the block API.

The number of namespace restrictions in a single block
is not limited as page restrictions are.

The checkbox allowing the blocker to specify whether
the target can edit their own user page is normally
disabled for a partial block, but is re-enabled if
the block is to the user talk namespace.

If the config $wgBlockAllowsUTEdit is set to false, the
checkbox will not appear, and the target will not be
able to edit their own user talk page if they are
sitewide-blocked, namespace-blocked from the user talk
namespace, or page-blocked from their user talk page.

Bug: T204986
Change-Id: I9e231ad109d7285486ec332b26780339592b8df7
2019-01-22 12:48:55 +00:00
Brad Jorsch
0867b6e8df ApiBlock: Avoid PHP warning when partial blocks are enabled but not used
If partial blocks are available but a sitewide block is being made,
$params['pagerestrictions'] is null and implode() raises a warning.
Since null casts to the empty array, it's easy enough to work around.

Also add a test hitting this case.

Change-Id: Id7e2559d7569031b7c1228adb0c0a14b3c1527c3
2018-12-19 11:14:50 -05:00
Thalia
9c8e1aaa4c Set API limits for page restrictions to 10
Bug: T212142
Change-Id: Ide0f2f86df2101194155be53a4b9012ddefbbcaf
2018-12-17 17:53:27 +00:00
David Barratt
0813c46daa Update Special:Block to set Partial Blocks
Make the necessary UI changes to Special:Block in order to set/update
partial blocks.

Bug: T197109
Change-Id: Ib3067824b5dcbdd893ab1f165d169a35d0716cb2
2018-10-24 00:47:08 +00:00
Aryeh Gregor
6e93b3bfaa Improve test coverage for ApiBlock.php to 100%
The code coverage tool still reports that line 50 ("$status,") is not
covered, but this is just a parameter to a function that is in fact
called and does show up as covered, so I'm pretty sure it's a bug.

I replaced a couple of sanity checks that reported "incomplete" on
failure with actual assertions so that the test would fail properly if
the sanity check failed.

The testing could still probably be expanded considerably.

Change-Id: Ib6ba7227af23bcb50c7e3bafb0b51395e8acf03f
2018-03-26 18:17:32 +03:00
Umherirrender
c9d303d39e Remove "Created on" from file header comments
It is the job of git and svn to provide this information/metadata.
The form was different, some with short, some with long month name
some with leading zero at the day, some without.
The year is also present in the Copyright clause

Change-Id: If006907b82b9e45f13cfa2e45d41107a95570e1a
2018-01-26 23:12:40 +00:00
Umherirrender
255d76f2a1 build: Updating mediawiki/mediawiki-codesniffer to 15.0.0
Clean up use of @codingStandardsIgnore
- @codingStandardsIgnoreFile -> phpcs:ignoreFile
- @codingStandardsIgnoreLine -> phpcs:ignore
- @codingStandardsIgnoreStart -> phpcs:disable
- @codingStandardsIgnoreEnd -> phpcs:enable

For phpcs:disable always the necessary sniffs are provided.
Some start/end pairs are changed to line ignore

Change-Id: I92ef235849bcc349c69e53504e664a155dd162c8
2018-01-01 14:10:16 +01:00
Brad Jorsch
162af2aba0 ApiBlock: Improve username validation
The current username validation lets any invalid username through, on
the assumption that it's an IP address. We can do better: call the
backend to get the actual type and target, and reject anything with
TYPE_USER where the actual input name is invalid (regardless of
underlying mangling for stuff like T31797).

Bug: T183211
Change-Id: I676642eee1222447df22a1c32b24f55e6273bcec
2017-12-19 10:03:11 -05:00
Baha
036b9c4167 Make API documentation links language aware
Links generated by the API are now aware of the user's preferred
language and will show documents in that language if available.

To test, log in to mediawiki.org and set your language preference to 'es',
then on an MediaWiki installation with this patch view the generated
expanded API help at `api.php?action=help&recursivesubmodules=1&modules=main`.
Each link to documentation on mediawiki.org should take you to its
translated /es subpage, if one exists.

Bug: T104518
Change-Id: I339a1f3ae1bce9d759cf251899d57c32b1def91e
2017-04-05 11:08:25 -04:00
James D. Forrester
50e796e948 includes/api: Replace implicitly-Bugzilla bug numbers with Phab ones
It's unreasonable to expect newbies to know that "bug 12345" means "Task T14345"
except where it doesn't, so let's just standardise on the real numbers.

Change-Id: I49e2a10350a328a8572fcedd44012751a29e1068
2017-02-24 16:41:47 +00:00
jenkins-bot
892b17237b Merge "Add parameter to API modules to apply change tags to log entries" 2017-01-13 17:42:04 +00:00
This, that and the other
f3f2df07ec Add parameter to API modules to apply change tags to log entries
Adds support for tagging log entries for the block, import,
managetags, and move API modules, using a 'tags' parameter.

Bug: T97720
Change-Id: I9d75d2cece317a7704c4bc6d734ad3cafe24544e
2017-01-12 16:30:17 -06:00
Brad Jorsch
a066419628 ApiResult: Add ApiResult::formatExpiry()
This allows for removing $wgContLang from many API modules where it was
only used to call $wgContLang->formatExpiry() in a way in which the
results don't actually depend on the language.

Change-Id: Ib0f25f288b9b87d2e4131297c552e5971696db87
2017-01-11 11:11:19 -08:00
Subin Siby
395fe60176 Block API: Allow blocking/unblocking by user's ID
Add feature to block/unblock users by their ID. For this,a new
parameter `userid` is added to block & unblock API request.

Bug: T34496
Change-Id: I084a4e275cd937053c505cd388a365b316990ece
2016-12-13 18:16:24 +05:30
Brad Jorsch
4e6810e4a2 API: i18n for warnings and errors
API warnings and error messages are currently hard-coded English
strings. This patch changes that.

With a few exceptions, this patch should be compatible with non-updated
extensions:
* The change to ApiBase::$messageMap will blow up anything trying to
  mess with it.
* The changes to the 'ApiCheckCanExecute' hook will cause a wrong
  (probably unparsed) error message to be emitted for extensions not
  already using an ApiMessage. Unless they're currently broken like
  Wikibase.

Bug: T37074
Bug: T47843
Depends-On: Ia2b66b57cd4eaddc30b3ffdd7b97d6ca3e02d898
Depends-On: I2e1bb975bb0045476c03ebe6cdec00259bae22ec
Depends-On: I53987bf87c48f6c00deec17a8e957d24fcc3eaa6
Depends-On: Ibf93a459eb62d30f7c70d20e91ec9faeb80d10ed
Depends-On: I3cf889811f44a15935e454dd42f081164d4a098c
Depends-On: Ieae527de86735ddcba34724730e8730fb277b99b
Depends-On: I535344c29d51521147c2a26c341dae38cec3e931
Change-Id: Iae0e2ce3bd42dd4776a9779664086119ac188412
2016-12-06 10:20:48 -05:00