BlockPermissionChecker.php

Go to the documentation of this file.

<?php
 
namespace MediaWiki\Block;
 
use MediaWiki\Config\ServiceOptions;
use MediaWiki\MainConfigNames;
use MediaWiki\Permissions\Authority;
use MediaWiki\User\UserIdentity;
 
class BlockPermissionChecker {
    private $target;
 
    private $performer;
 
    public const CONSTRUCTOR_OPTIONS = [
        MainConfigNames::EnableUserEmail,
    ];
 
    private $options;
 
    public function __construct(
        ServiceOptions $options,
        BlockUtils $blockUtils,
        $target,
        Authority $performer
    ) {
        $options->assertRequiredOptions( self::CONSTRUCTOR_OPTIONS );
        $this->options = $options;
        [ $this->target, ] = $blockUtils->parseBlockTarget( $target );
        $this->performer = $performer;
    }
 
    public function checkBasePermissions( $checkHideuser = false ) {
        if ( !$this->performer->isAllowed( 'block' ) ) {
            return 'badaccess-group0';
        }
 
        if (
            $checkHideuser &&
            !$this->performer->isAllowed( 'hideuser' )
        ) {
            return 'unblock-hideuser';
        }
 
        return true;
    }
 
    public function checkBlockPermissions() {
        $block = $this->performer->getBlock(); // TODO: pass disposition parameter
        if ( !$block ) {
            // User is not blocked, process as normal
            return true;
        }
 
        if ( !$block->isSitewide() ) {
            // T208965: Partially blocked admins should have full access
            return true;
        }
 
        $performerIdentity = $this->performer->getUser();
 
        if (
            $this->target instanceof UserIdentity &&
            $this->target->getId() === $performerIdentity->getId()
        ) {
            // Blocked admin is trying to alter their own block
 
            // Self-blocked admins can always remove or alter their block
            if ( $block->getBlocker() && $performerIdentity->equals( $block->getBlocker() ) ) {
                return true;
            }
 
            // Users with 'unblockself' right can unblock themselves or alter their own block
            if ( $this->performer->isAllowed( 'unblockself' ) ) {
                return true;
            } else {
                return 'ipbnounblockself';
            }
        }
 
        if (
            $this->target instanceof UserIdentity &&
            $block->getBlocker() &&
            $this->target->equals( $block->getBlocker() )
        ) {
            // T150826: Blocked admins can always block the admin who blocked them
            return true;
        }
 
        // User is blocked and no exception took effect
        return 'ipbblocked';
    }
 
    public function checkEmailPermissions() {
        return $this->options->get( MainConfigNames::EnableUserEmail ) &&
            $this->performer->isAllowed( 'blockemail' );
    }
}