ApiUserrights.php

Go to the documentation of this file.

<?php
 
namespace MediaWiki\Api;
 
use MediaWiki\ChangeTags\ChangeTags;
use MediaWiki\MainConfigNames;
use MediaWiki\ParamValidator\TypeDef\UserDef;
use MediaWiki\Title\Title;
use MediaWiki\User\MultiFormatUserIdentityLookup;
use MediaWiki\User\Options\UserOptionsLookup;
use MediaWiki\User\UserGroupAssignmentService;
use MediaWiki\User\UserGroupManager;
use MediaWiki\User\UserIdentity;
use MediaWiki\Watchlist\WatchedItemStoreInterface;
use MediaWiki\Watchlist\WatchlistManager;
use MediaWiki\WikiMap\WikiMap;
use Wikimedia\ParamValidator\ParamValidator;
use Wikimedia\ParamValidator\TypeDef\ExpiryDef;
use Wikimedia\Rdbms\IDBAccessObject;
 
class ApiUserrights extends ApiBase {
 
    use ApiWatchlistTrait;
 
    private $mUser = null;
 
    public function __construct(
        ApiMain $mainModule,
        string $moduleName,
        private readonly UserGroupManager $userGroupManager,
        WatchedItemStoreInterface $watchedItemStore,
        WatchlistManager $watchlistManager,
        UserOptionsLookup $userOptionsLookup,
        private readonly UserGroupAssignmentService $userGroupAssignmentService,
        private readonly MultiFormatUserIdentityLookup $multiFormatUserIdentityLookup,
    ) {
        parent::__construct( $mainModule, $moduleName );
        $this->watchedItemStore = $watchedItemStore;
 
        // Variables needed in ApiWatchlistTrait trait
        $this->watchlistExpiryEnabled = $this->getConfig()->get( MainConfigNames::WatchlistExpiry );
        $this->watchlistMaxDuration =
            $this->getConfig()->get( MainConfigNames::WatchlistExpiryMaxDuration );
        $this->watchlistManager = $watchlistManager;
        $this->userOptionsLookup = $userOptionsLookup;
    }
 
    public function execute() {
        $pUser = $this->getUser();
 
        // Deny if the user is blocked and doesn't have the full 'userrights' permission.
        // This matches what Special:UserRights does for the web UI.
        if ( !$this->getAuthority()->isAllowed( 'userrights' ) ) {
            $block = $pUser->getBlock( IDBAccessObject::READ_LATEST );
            if ( $block && $block->isSitewide() ) {
                $this->dieBlocked( $block );
            }
        }
 
        $params = $this->extractRequestParams();
 
        // Figure out expiry times from the input
        $expiry = (array)$params['expiry'];
        $add = (array)$params['add'];
        if ( !$add ) {
            $expiry = [];
        } elseif ( count( $expiry ) !== count( $add ) ) {
            if ( count( $expiry ) === 1 ) {
                $expiry = array_fill( 0, count( $add ), $expiry[0] );
            } else {
                $this->dieWithError( [
                    'apierror-toofewexpiries',
                    count( $expiry ),
                    count( $add )
                ] );
            }
        }
 
        // Validate the expiries
        $groupExpiries = [];
        foreach ( $expiry as $index => $expiryValue ) {
            $group = $add[$index];
            $groupExpiries[$group] = UserGroupAssignmentService::expiryToTimestamp( $expiryValue );
 
            if ( $groupExpiries[$group] === false ) {
                $this->dieWithError( [ 'apierror-invalidexpiry', wfEscapeWikiText( $expiryValue ) ] );
            }
 
            // not allowed to have things expiring in the past
            if ( $groupExpiries[$group] && $groupExpiries[$group] < wfTimestampNow() ) {
                $this->dieWithError( [ 'apierror-pastexpiry', wfEscapeWikiText( $expiryValue ) ] );
            }
        }
 
        $user = $this->getUrUser( $params );
 
        $tags = $params['tags'];
 
        // Check if user can add tags
        if ( $tags !== null ) {
            $ableToTag = ChangeTags::canAddTagsAccompanyingChange( $tags, $this->getAuthority() );
            if ( !$ableToTag->isOK() ) {
                $this->dieStatus( $ableToTag );
            }
        }
 
        $r = [];
        $r['user'] = $user->getName();
        $r['userid'] = $user->getId( $user->getWikiId() );
        [ $r['added'], $r['removed'] ] = $this->userGroupAssignmentService->saveChangesToUserGroups(
            $this->getUser(),
            $user,
            $add,
            // Don't pass null to saveChangesToUserGroups() for array params, cast to empty array
            (array)$params['remove'],
            $groupExpiries,
            $params['reason'],
            (array)$tags
        );
 
        $userPage = Title::makeTitle( NS_USER, $user->getName() );
        $watchlistExpiry = $this->getExpiryFromParams( $params, $userPage, $this->getUser() );
        $watchuser = $params['watchuser'];
        if ( $watchuser && $user->getWikiId() === UserIdentity::LOCAL ) {
            $this->setWatch( 'watch', $userPage, $this->getUser(), null, $watchlistExpiry );
        } else {
            $watchuser = false;
            $watchlistExpiry = null;
        }
        $r['watchuser'] = $watchuser;
        if ( $watchlistExpiry !== null ) {
            $r['watchlistexpiry'] = $this->getWatchlistExpiry(
                $this->watchedItemStore,
                $userPage,
                $this->getUser()
            );
        }
 
        $result = $this->getResult();
        ApiResult::setIndexedTagName( $r['added'], 'group' );
        ApiResult::setIndexedTagName( $r['removed'], 'group' );
        $result->addValue( null, $this->getModuleName(), $r );
    }
 
    private function getUrUser( array $params ) {
        if ( $this->mUser !== null ) {
            return $this->mUser;
        }
 
        $this->requireOnlyOneParameter( $params, 'user', 'userid' );
 
        $userDesignator = $params['user'] ?? '#' . $params['userid'];
 
        // T422085: Check userrights-interwiki permission BEFORE looking up the user,
        // to prevent user enumeration on private/remote wikis.
        // This mirrors the fix applied to SpecialUserRights in Gerrit change I15306e63.
        if ( isset( $params['user'] ) ) {
            $interwikiDelimiter = $this->getConfig()->get( MainConfigNames::UserrightsInterwikiDelimiter );
            if ( str_contains( $userDesignator, $interwikiDelimiter ) ) {
                $targetParts = explode( $interwikiDelimiter, $userDesignator );
                $remoteWikiId = $targetParts[1] ?? '';
                if (
                    $remoteWikiId !== '' &&
                    !WikiMap::isCurrentWikiId( $remoteWikiId ) &&
                    !$this->getAuthority()->isAllowed( 'userrights-interwiki' )
                ) {
                    $this->dieWithError( 'apierror-permissiondenied-userrights-interwiki', 'permissiondenied' );
                }
            }
        }
 
        $status = $this->multiFormatUserIdentityLookup->getUserIdentity( $userDesignator, $this->getAuthority() );
        if ( !$status->isOK() ) {
            $this->dieStatus( $status );
        }
 
        $user = $status->value;
        $canHaveRights = $this->userGroupAssignmentService->targetCanHaveUserGroups( $user );
        if ( !$canHaveRights ) {
            // Return different errors for anons and temp. accounts to keep consistent behavior
            $this->dieWithError(
                $user->isRegistered() ? [ 'userrights-no-group', $user->getName() ] : 'nosuchusershort'
            );
        }
 
        $this->mUser = $user;
 
        return $user;
    }
 
    public function mustBePosted() {
        return true;
    }
 
    public function isWriteMode() {
        return true;
    }
 
    public function getAllowedParams( $flags = 0 ) {
        $allGroups = $this->userGroupManager->listAllGroups();
 
        if ( $flags & ApiBase::GET_VALUES_FOR_HELP ) {
            sort( $allGroups );
        }
 
        $params = [
            'user' => [
                ParamValidator::PARAM_TYPE => 'user',
                UserDef::PARAM_ALLOWED_USER_TYPES => [ 'name', 'id' ],
            ],
            'userid' => [
                ParamValidator::PARAM_TYPE => 'integer',
                ParamValidator::PARAM_DEPRECATED => true,
            ],
            'add' => [
                ParamValidator::PARAM_TYPE => $allGroups,
                ParamValidator::PARAM_ISMULTI => true
            ],
            'expiry' => [
                ParamValidator::PARAM_ISMULTI => true,
                ParamValidator::PARAM_ALLOW_DUPLICATES => true,
                ParamValidator::PARAM_DEFAULT => 'infinite',
            ],
            'remove' => [
                ParamValidator::PARAM_TYPE => $allGroups,
                ParamValidator::PARAM_ISMULTI => true
            ],
            'reason' => [
                ParamValidator::PARAM_DEFAULT => ''
            ],
            'token' => [
                // Standard definition automatically inserted
                ApiBase::PARAM_HELP_MSG_APPEND => [ 'api-help-param-token-webui' ],
            ],
            'tags' => [
                ParamValidator::PARAM_TYPE => 'tags',
                ParamValidator::PARAM_ISMULTI => true
            ],
            'watchuser' => false,
        ];
 
        // Params appear in the docs in the order they are defined,
        // which is why this is here and not at the bottom.
        // @todo Find better way to support insertion at arbitrary position
        if ( $this->watchlistExpiryEnabled ) {
            $params += [
                'watchlistexpiry' => [
                    ParamValidator::PARAM_TYPE => 'expiry',
                    ExpiryDef::PARAM_MAX => $this->watchlistMaxDuration,
                    ExpiryDef::PARAM_USE_MAX => true,
                ]
            ];
        }
 
        return $params;
    }
 
    public function needsToken() {
        return 'userrights';
    }
 
    protected function getWebUITokenSalt( array $params ) {
        return $this->getUrUser( $params )->getName();
    }
 
    protected function getExamplesMessages() {
        return [
            'action=userrights&user=FooBot&add=bot&remove=sysop|bureaucrat&token=123ABC'
                => 'apihelp-userrights-example-user',
            'action=userrights&userid=123&add=bot&remove=sysop|bureaucrat&token=123ABC'
                => 'apihelp-userrights-example-userid',
            'action=userrights&user=SometimeSysop&add=sysop&expiry=1%20month&token=123ABC'
                => 'apihelp-userrights-example-expiry',
        ];
    }
 
    public function getHelpUrls() {
        return 'https://www.mediawiki.org/wiki/Special:MyLanguage/API:User_group_membership';
    }
}
 
class_alias( ApiUserrights::class, 'ApiUserrights' );