Code Coverage
 
Lines
Functions and Methods
Classes and Traits
Total
86.67% covered (warning)
86.67%
26 / 30
75.00% covered (warning)
75.00%
3 / 4
 CRAP
0.00% covered (danger)
0.00%
0 / 1
BlockPermissionChecker
86.67% covered (warning)
86.67%
26 / 30
75.00% covered (warning)
75.00%
3 / 4
 18.77
0.00% covered (danger)
0.00%
0 / 1
 __construct
0.00% covered (danger)
0.00%
0 / 4
0.00% covered (danger)
0.00%
0 / 1
 2
 checkBasePermissions
100.00% covered (success)
100.00%
6 / 6
100.00% covered (success)
100.00%
1 / 1
 4
 checkBlockPermissions
100.00% covered (success)
100.00%
18 / 18
100.00% covered (success)
100.00%
1 / 1
 11
 checkEmailPermissions
100.00% covered (success)
100.00%
2 / 2
100.00% covered (success)
100.00%
1 / 1
 2
1<?php
2
3/**
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License as published by
6 * the Free Software Foundation; either version 2 of the License, or
7 * (at your option) any later version.
8 *
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
13 *
14 * You should have received a copy of the GNU General Public License along
15 * with this program; if not, write to the Free Software Foundation, Inc.,
16 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
17 * http://www.gnu.org/copyleft/gpl.html
18 *
19 * @file
20 */
21
22namespace MediaWiki\Block;
23
24use MediaWiki\Config\ServiceOptions;
25use MediaWiki\MainConfigNames;
26use MediaWiki\Permissions\Authority;
27use MediaWiki\User\UserIdentity;
28
29/**
30 * Block permissions
31 *
32 * This class is responsible for making sure a user has permission to block.
33 *
34 * This class is usable for both blocking and unblocking.
35 *
36 * @since 1.35
37 */
38class BlockPermissionChecker {
39    /**
40     * @var UserIdentity|string|null Block target or null when unknown
41     */
42    private $target;
43
44    /**
45     * @var Authority Block performer
46     */
47    private $performer;
48
49    /**
50     * @internal only for use by ServiceWiring and BlockPermissionCheckerFactory
51     */
52    public const CONSTRUCTOR_OPTIONS = [
53        MainConfigNames::EnableUserEmail,
54    ];
55
56    private ServiceOptions $options;
57
58    /**
59     * @param ServiceOptions $options
60     * @param BlockUtils $blockUtils
61     * @param UserIdentity|string|null $target
62     * @param Authority $performer
63     */
64    public function __construct(
65        ServiceOptions $options,
66        BlockUtils $blockUtils,
67        $target,
68        Authority $performer
69    ) {
70        $options->assertRequiredOptions( self::CONSTRUCTOR_OPTIONS );
71        $this->options = $options;
72        [ $this->target, ] = $blockUtils->parseBlockTarget( $target );
73        $this->performer = $performer;
74    }
75
76    /**
77     * Check the base permission that applies to either block or unblock
78     *
79     * @since 1.36
80     * @param bool $checkHideuser
81     * @return bool|string
82     */
83    public function checkBasePermissions( $checkHideuser = false ) {
84        if ( !$this->performer->isAllowed( 'block' ) ) {
85            return 'badaccess-group0';
86        }
87
88        if (
89            $checkHideuser &&
90            !$this->performer->isAllowed( 'hideuser' )
91        ) {
92            return 'unblock-hideuser';
93        }
94
95        return true;
96    }
97
98    /**
99     * Checks block-related permissions (doesn't check any other permissions)
100     *
101     * T17810: Site-wide blocked admins should not be able to block/unblock
102     * others with one exception; they can block the user who blocked them,
103     * to reduce advantage of a malicious account blocking all admins (T150826).
104     *
105     * T208965: Partially blocked admins can block and unblock others as normal.
106     *
107     * @return bool|string True when checks passed, message code for failures
108     */
109    public function checkBlockPermissions() {
110        $block = $this->performer->getBlock(); // TODO: pass disposition parameter
111        if ( !$block ) {
112            // User is not blocked, process as normal
113            return true;
114        }
115
116        if ( !$block->isSitewide() ) {
117            // T208965: Partially blocked admins should have full access
118            return true;
119        }
120
121        $performerIdentity = $this->performer->getUser();
122
123        if (
124            $this->target instanceof UserIdentity &&
125            $this->target->getId() === $performerIdentity->getId()
126        ) {
127            // Blocked admin is trying to alter their own block
128
129            // Self-blocked admins can always remove or alter their block
130            if ( $block->getBlocker() && $performerIdentity->equals( $block->getBlocker() ) ) {
131                return true;
132            }
133
134            // Users with 'unblockself' right can unblock themselves or alter their own block
135            if ( $this->performer->isAllowed( 'unblockself' ) ) {
136                return true;
137            } else {
138                return 'ipbnounblockself';
139            }
140        }
141
142        if (
143            $this->target instanceof UserIdentity &&
144            $block->getBlocker() &&
145            $this->target->equals( $block->getBlocker() )
146        ) {
147            // T150826: Blocked admins can always block the admin who blocked them
148            return true;
149        }
150
151        // User is blocked and no exception took effect
152        return 'ipbblocked';
153    }
154
155    /**
156     * Check permission to block emailing
157     *
158     * @since 1.36
159     * @return bool
160     */
161    public function checkEmailPermissions() {
162        return $this->options->get( MainConfigNames::EnableUserEmail ) &&
163            $this->performer->isAllowed( 'blockemail' );
164    }
165}