73224f4f8b
This patch adds an ug_expiry column to the user_groups table, a timestamp giving a date when the user group expires. A new UserGroupMembership class, based on the Block class, manages entries in this table. When the expiry date passes, the row in user_groups is ignored, and will eventually be purged from the DB when UserGroupMembership::insert is next called. Old, expired user group memberships are not kept; instead, the log entries are available to find the history of these memberships, similar to the way it has always worked for blocks and protections. Anyone getting user group info through the User object will get correct information. However, code that reads the user_groups table directly will now need to skip over rows with ug_expiry < wfTimestampNow(). See UsersPager for an example of how to do this. NULL is used to represent infinite (no) expiry, rather than a string 'infinity' or similar (except in the API). This allows existing user group assignments and log entries, which are all infinite in duration, to be treated the same as new, infinite-length memberships, without special casing everything. The whole thing is behind the temporary feature flag $wgDisableUserGroupExpiry, in accordance with the WMF schema change policy. The opportunity has been taken to refactor some static user-group-related functions out of User into UserGroupMembership, and also to add a primary key (ug_user, ug_group) to the user_groups table. There are a few breaking changes: - UserRightsProxy-like objects are now required to have a getGroupMemberships() function. - $user->mGroups (on a User object) is no longer present. - Some protected functions in UsersPager are altered or removed. - The UsersPagerDoBatchLookups hook (unused in any Wikimedia Git-hosted extension) has a change of parameter. Bug: T12493 Depends-On: Ia9616e1e35184fed9058d2d39afbe1038f56d7fa Depends-On: I86eb1d5619347ce54a5f33a591417742ebe5d6f8 Change-Id: I93c955dc7a970f78e32aa503c01c67da30971d1a
72 lines
2.2 KiB
PHP
72 lines
2.2 KiB
PHP
<?php
|
|
/**
|
|
* This program is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License as published by
|
|
* the Free Software Foundation; either version 2 of the License, or
|
|
* (at your option) any later version.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License along
|
|
* with this program; if not, write to the Free Software Foundation, Inc.,
|
|
* 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
|
|
* http://www.gnu.org/copyleft/gpl.html
|
|
*
|
|
* @file
|
|
*/
|
|
|
|
/**
|
|
* Show an error when a user tries to do something they do not have the necessary
|
|
* permissions for.
|
|
*
|
|
* @since 1.18
|
|
* @ingroup Exception
|
|
*/
|
|
class PermissionsError extends ErrorPageError {
|
|
public $permission, $errors;
|
|
|
|
/**
|
|
* @param string|null $permission A permission name or null if unknown
|
|
* @param array $errors Error message keys or [key, param...] arrays; must not be empty if
|
|
* $permission is null
|
|
* @throws \InvalidArgumentException
|
|
*/
|
|
public function __construct( $permission, $errors = [] ) {
|
|
global $wgLang;
|
|
|
|
if ( $permission === null && !$errors ) {
|
|
throw new \InvalidArgumentException( __METHOD__ .
|
|
': $permission and $errors cannot both be empty' );
|
|
}
|
|
|
|
$this->permission = $permission;
|
|
|
|
if ( !count( $errors ) ) {
|
|
$groups = [];
|
|
foreach ( User::getGroupsWithPermission( $this->permission ) as $group ) {
|
|
$groups[] = UserGroupMembership::getLink( $group, RequestContext::getMain(), 'wiki' );
|
|
}
|
|
|
|
if ( $groups ) {
|
|
$errors[] = [ 'badaccess-groups', $wgLang->commaList( $groups ), count( $groups ) ];
|
|
} else {
|
|
$errors[] = [ 'badaccess-group0' ];
|
|
}
|
|
}
|
|
|
|
$this->errors = $errors;
|
|
|
|
// Give the parent class something to work with
|
|
parent::__construct( 'permissionserrors', Message::newFromSpecifier( $errors[0] ) );
|
|
}
|
|
|
|
public function report() {
|
|
global $wgOut;
|
|
|
|
$wgOut->showPermissionsErrorPage( $this->errors, $this->permission );
|
|
$wgOut->output();
|
|
}
|
|
}
|