BlockPermissionChecker.php

Go to the documentation of this file.

<?php
 
namespace MediaWiki\Block;
 
use InvalidArgumentException;
use MediaWiki\Config\ServiceOptions;
use MediaWiki\MainConfigNames;
use MediaWiki\Permissions\Authority;
use MediaWiki\User\UserIdentity;
use Wikimedia\Rdbms\IDBAccessObject;
 
class BlockPermissionChecker {
    private $target;
 
    private $blockTargetFactory;
 
    private $performer;
 
    public const CONSTRUCTOR_OPTIONS = [
        MainConfigNames::EnableUserEmail,
    ];
 
    private ServiceOptions $options;
 
    public function __construct(
        ServiceOptions $options,
        BlockTargetFactory $blockTargetFactory,
        Authority $performer
    ) {
        $options->assertRequiredOptions( self::CONSTRUCTOR_OPTIONS );
        $this->options = $options;
        $this->blockTargetFactory = $blockTargetFactory;
        $this->performer = $performer;
    }
 
    public function setTarget( $target ) {
        $this->target = $this->blockTargetFactory->newFromLegacyUnion( $target );
    }
 
    public function checkBasePermissions( $checkHideuser = false ) {
        if ( !$this->performer->isAllowed( 'block' ) ) {
            return 'badaccess-group0';
        }
 
        if (
            $checkHideuser &&
            !$this->performer->isAllowed( 'hideuser' )
        ) {
            return 'unblock-hideuser';
        }
 
        return true;
    }
 
    public function checkBlockPermissions(
        $target = null,
        $freshness = IDBAccessObject::READ_NORMAL
    ) {
        if ( $target === null ) {
            if ( $this->target ) {
                wfDeprecatedMsg(
                    'Passing null to checkBlockPermissions() for $target is deprecated since 1.44',
                    '1.44' );
                $target = $this->target;
            } else {
                throw new InvalidArgumentException( 'A target is required' );
            }
        } elseif ( !( $target instanceof BlockTarget ) ) {
            $target = $this->blockTargetFactory->newFromLegacyUnion( $target );
            if ( !$target ) {
                throw new InvalidArgumentException( 'Invalid block target' );
            }
        }
 
        $block = $this->performer->getBlock( $freshness );
        if ( !$block ) {
            // User is not blocked, process as normal
            return true;
        }
 
        if ( !$block->isSitewide() ) {
            // T208965: Partially blocked admins should have full access
            return true;
        }
 
        $performerIdentity = $this->performer->getUser();
 
        if (
            $target instanceof UserBlockTarget &&
            $target->getUserIdentity()->getId() === $performerIdentity->getId()
        ) {
            // Blocked admin is trying to alter their own block
 
            // Self-blocked admins can always remove or alter their block
            if ( $block->getBlocker() && $performerIdentity->equals( $block->getBlocker() ) ) {
                return true;
            }
 
            // Users with 'unblockself' right can unblock themselves or alter their own block
            if ( $this->performer->isAllowed( 'unblockself' ) ) {
                return true;
            } else {
                return 'ipbnounblockself';
            }
        }
 
        if (
            $target instanceof UserBlockTarget &&
            $block->getBlocker() &&
            $target->getUserIdentity()->equals( $block->getBlocker() )
        ) {
            // T150826: Blocked admins can always block the admin who blocked them
            return true;
        }
 
        // User is blocked and no exception took effect
        return 'ipbblocked';
    }
 
    public function checkEmailPermissions() {
        return $this->options->get( MainConfigNames::EnableUserEmail ) &&
            $this->performer->isAllowed( 'blockemail' );
    }
}