RestrictionStore.php

Go to the documentation of this file.

<?php
 
namespace MediaWiki\Permissions;
 
use MediaWiki\CommentStore\CommentStore;
use MediaWiki\Config\ServiceOptions;
use MediaWiki\Deferred\LinksUpdate\ImageLinksTable;
use MediaWiki\Deferred\LinksUpdate\LinksTable;
use MediaWiki\Deferred\LinksUpdate\TemplateLinksTable;
use MediaWiki\HookContainer\HookContainer;
use MediaWiki\HookContainer\HookRunner;
use MediaWiki\Linker\LinksMigration;
use MediaWiki\MainConfigNames;
use MediaWiki\Page\CacheKeyHelper;
use MediaWiki\Page\LinkCache;
use MediaWiki\Page\PageIdentity;
use MediaWiki\Page\PageIdentityValue;
use MediaWiki\Page\PageStore;
use MediaWiki\Title\Title;
use MediaWiki\Title\TitleValue;
use stdClass;
use Wikimedia\ObjectCache\WANObjectCache;
use Wikimedia\Rdbms\Database;
use Wikimedia\Rdbms\DBAccessObjectUtils;
use Wikimedia\Rdbms\IDBAccessObject;
use Wikimedia\Rdbms\IReadableDatabase;
use Wikimedia\Rdbms\LBFactory;
 
class RestrictionStore {
 
    public const CONSTRUCTOR_OPTIONS = [
        MainConfigNames::NamespaceProtection,
        MainConfigNames::RestrictionLevels,
        MainConfigNames::RestrictionTypes,
        MainConfigNames::SemiprotectedRestrictionLevels,
        MainConfigNames::VirtualDomainsMapping,
    ];
 
    private ServiceOptions $options;
    private WANObjectCache $wanCache;
    private LBFactory $loadBalancerFactory;
    private LinkCache $linkCache;
    private LinksMigration $linksMigration;
    private CommentStore $commentStore;
    private HookContainer $hookContainer;
    private HookRunner $hookRunner;
    private PageStore $pageStore;
 
    private $cache = [];
 
    public function __construct(
        ServiceOptions $options,
        WANObjectCache $wanCache,
        LBFactory $loadBalancerFactory,
        LinkCache $linkCache,
        LinksMigration $linksMigration,
        CommentStore $commentStore,
        HookContainer $hookContainer,
        PageStore $pageStore
    ) {
        $options->assertRequiredOptions( self::CONSTRUCTOR_OPTIONS );
        $this->options = $options;
        $this->wanCache = $wanCache;
        $this->loadBalancerFactory = $loadBalancerFactory;
        $this->linkCache = $linkCache;
        $this->linksMigration = $linksMigration;
        $this->commentStore = $commentStore;
        $this->hookContainer = $hookContainer;
        $this->hookRunner = new HookRunner( $hookContainer );
        $this->pageStore = $pageStore;
    }
 
    public function getRestrictions( PageIdentity $page, string $action ): array {
        $page->assertWiki( PageIdentity::LOCAL );
 
        // Optimization: Avoid repeatedly fetching page restrictions (from cache or DB)
        // for repeated PermissionManager::userCan calls, if this action cannot be restricted
        // in the first place. This is primarily to improve batch rendering on RecentChanges,
        // where as of writing this will save 0.5s on a 8.0s response. (T341319)
        $restrictionTypes = $this->listApplicableRestrictionTypes( $page );
        if ( !in_array( $action, $restrictionTypes ) ) {
            return [];
        }
 
        $restrictions = $this->getAllRestrictions( $page );
        return $restrictions[$action] ?? [];
    }
 
    public function getAllRestrictions( PageIdentity $page ): array {
        $page->assertWiki( PageIdentity::LOCAL );
 
        if ( !$this->areRestrictionsLoaded( $page ) ) {
            $this->loadRestrictions( $page );
        }
        return $this->cache[CacheKeyHelper::getKeyForPage( $page )]['restrictions'] ?? [];
    }
 
    public function getRestrictionExpiry( PageIdentity $page, string $action ): ?string {
        $page->assertWiki( PageIdentity::LOCAL );
 
        if ( !$this->areRestrictionsLoaded( $page ) ) {
            $this->loadRestrictions( $page );
        }
        return $this->cache[CacheKeyHelper::getKeyForPage( $page )]['expiry'][$action] ?? null;
    }
 
    public function getCreateProtection( PageIdentity $page ): ?array {
        $page->assertWiki( PageIdentity::LOCAL );
 
        $protection = $this->getCreateProtectionInternal( $page );
        // TODO: the remapping below probably need to be migrated into other method one day
        if ( $protection ) {
            if ( $protection['permission'] == 'sysop' ) {
                $protection['permission'] = 'editprotected'; // B/C
            }
            if ( $protection['permission'] == 'autoconfirmed' ) {
                $protection['permission'] = 'editsemiprotected'; // B/C
            }
        }
        return $protection;
    }
 
    public function deleteCreateProtection( PageIdentity $page ): void {
        $page->assertWiki( PageIdentity::LOCAL );
 
        $dbw = $this->loadBalancerFactory->getPrimaryDatabase();
        $dbw->newDeleteQueryBuilder()
            ->deleteFrom( 'protected_titles' )
            ->where( [ 'pt_namespace' => $page->getNamespace(), 'pt_title' => $page->getDBkey() ] )
            ->caller( __METHOD__ )->execute();
        $this->cache[CacheKeyHelper::getKeyForPage( $page )]['create_protection'] = null;
    }
 
    public function isSemiProtected( PageIdentity $page, string $action = 'edit' ): bool {
        $page->assertWiki( PageIdentity::LOCAL );
 
        $restrictions = $this->getRestrictions( $page, $action );
        $semi = $this->options->get( MainConfigNames::SemiprotectedRestrictionLevels );
        if ( !$restrictions || !$semi ) {
            // Not protected, or all protection is full protection
            return false;
        }
 
        // Remap autoconfirmed to editsemiprotected for BC
        foreach ( array_keys( $semi, 'editsemiprotected' ) as $key ) {
            $semi[$key] = 'autoconfirmed';
        }
        foreach ( array_keys( $restrictions, 'editsemiprotected' ) as $key ) {
            $restrictions[$key] = 'autoconfirmed';
        }
 
        return !array_diff( $restrictions, $semi );
    }
 
    public function isProtected( PageIdentity $page, string $action = '' ): bool {
        $page->assertWiki( PageIdentity::LOCAL );
 
        // Special pages have inherent protection (TODO: remove after switch to ProperPageIdentity)
        if ( $page->getNamespace() === NS_SPECIAL ) {
            return true;
        }
 
        // Check regular protection levels
        $applicableTypes = $this->listApplicableRestrictionTypes( $page );
 
        if ( $action === '' ) {
            foreach ( $applicableTypes as $type ) {
                if ( $this->isProtected( $page, $type ) ) {
                    return true;
                }
            }
            return false;
        }
 
        if ( !in_array( $action, $applicableTypes ) ) {
            return false;
        }
 
        return (bool)array_diff(
            array_intersect(
                $this->getRestrictions( $page, $action ),
                $this->options->get( MainConfigNames::RestrictionLevels )
            ),
            [ '' ]
        );
    }
 
    public function isCascadeProtected( PageIdentity $page ): bool {
        $page->assertWiki( PageIdentity::LOCAL );
 
        return $this->shouldUseVirtualDomains()
            ? $this->getCascadeProtectionSourcesInternal( $page )[0] !== []
            : $this->getCascadeProtectionSourcesInternalJoined( $page )[0] !== [];
    }
 
    public function listApplicableRestrictionTypes( PageIdentity $page ): array {
        $page->assertWiki( PageIdentity::LOCAL );
 
        if ( !$page->canExist() ) {
            return [];
        }
 
        $types = $this->listAllRestrictionTypes( $page->exists() );
 
        if ( $page->getNamespace() !== NS_FILE ) {
            // Remove the upload restriction for non-file titles
            $types = array_values( array_diff( $types, [ 'upload' ] ) );
        }
 
        if ( $this->hookContainer->isRegistered( 'TitleGetRestrictionTypes' ) ) {
            $this->hookRunner->onTitleGetRestrictionTypes(
                Title::newFromPageIdentity( $page ), $types );
        }
 
        return $types;
    }
 
    public function listAllRestrictionTypes( bool $exists = true ): array {
        $types = $this->options->get( MainConfigNames::RestrictionTypes );
        if ( $exists ) {
            // Remove the create restriction for existing titles
            return array_values( array_diff( $types, [ 'create' ] ) );
        }
 
        // Only the create restrictions apply to non-existing titles
        return array_values( array_intersect( $types, [ 'create' ] ) );
    }
 
    public function loadRestrictions(
        PageIdentity $page, int $flags = IDBAccessObject::READ_NORMAL
    ): void {
        $page->assertWiki( PageIdentity::LOCAL );
 
        if ( !$page->canExist() ) {
            return;
        }
 
        $readLatest = DBAccessObjectUtils::hasFlags( $flags, IDBAccessObject::READ_LATEST );
 
        if ( $this->areRestrictionsLoaded( $page ) && !$readLatest ) {
            return;
        }
 
        $cacheEntry = &$this->cache[CacheKeyHelper::getKeyForPage( $page )];
 
        $cacheEntry['restrictions'] = [];
 
        // XXX Work around https://phabricator.wikimedia.org/T287575
        if ( $readLatest ) {
            $page = $this->pageStore->getPageByReference( $page, $flags ) ?? $page;
        }
        $id = $page->getId();
        if ( $id ) {
            $fname = __METHOD__;
            $loadRestrictionsFromDb = static function ( IReadableDatabase $dbr ) use ( $fname, $id ) {
                return iterator_to_array(
                    $dbr->newSelectQueryBuilder()
                        ->select( [ 'pr_type', 'pr_expiry', 'pr_level', 'pr_cascade' ] )
                        ->from( 'page_restrictions' )
                        ->where( [ 'pr_page' => $id ] )
                        ->caller( $fname )->fetchResultSet()
                );
            };
 
            if ( $readLatest ) {
                $dbr = $this->loadBalancerFactory->getPrimaryDatabase();
                $rows = $loadRestrictionsFromDb( $dbr );
            } else {
                $this->pageStore->getPageForLink( TitleValue::newFromPage( $page ) )->getId();
                $latestRev = $this->linkCache->getGoodLinkFieldObj( $page, 'revision' );
                if ( !$latestRev ) {
                    // This method can get called in the middle of page creation
                    // (WikiPage::doUserEditContent) where a page might have an
                    // id but no revisions, while checking the "autopatrol" permission.
                    $rows = [];
                } else {
                    $rows = $this->wanCache->getWithSetCallback(
                        // Page protections always leave a new dummy revision
                        $this->wanCache->makeKey( 'page-restrictions', 'v1', $id, $latestRev ),
                        $this->wanCache::TTL_DAY,
                        function ( $curValue, &$ttl, array &$setOpts ) use ( $loadRestrictionsFromDb ) {
                            $dbr = $this->loadBalancerFactory->getReplicaDatabase();
                            $setOpts += Database::getCacheSetOptions( $dbr );
                            if ( $this->loadBalancerFactory->hasOrMadeRecentPrimaryChanges() ) {
                                // TODO: cleanup Title cache and caller assumption mess in general
                                $ttl = WANObjectCache::TTL_UNCACHEABLE;
                            }
 
                            return $loadRestrictionsFromDb( $dbr );
                        }
                    );
                }
            }
 
            $this->loadRestrictionsFromRows( $page, $rows );
        } else {
            $titleProtection = $this->getCreateProtectionInternal( $page );
 
            if ( $titleProtection ) {
                $now = wfTimestampNow();
                $expiry = $titleProtection['expiry'];
 
                if ( !$expiry || $expiry > $now ) {
                    // Apply the restrictions
                    $cacheEntry['expiry']['create'] = $expiry ?: null;
                    $cacheEntry['restrictions']['create'] =
                        explode( ',', trim( $titleProtection['permission'] ) );
                } else {
                    // Get rid of the old restrictions
                    $cacheEntry['create_protection'] = null;
                }
            } else {
                $cacheEntry['expiry']['create'] = 'infinity';
            }
        }
    }
 
    public function loadRestrictionsFromRows(
        PageIdentity $page, array $rows
    ): void {
        $page->assertWiki( PageIdentity::LOCAL );
 
        $cacheEntry = &$this->cache[CacheKeyHelper::getKeyForPage( $page )];
 
        $restrictionTypes = $this->listApplicableRestrictionTypes( $page );
 
        foreach ( $restrictionTypes as $type ) {
            $cacheEntry['restrictions'][$type] = [];
            $cacheEntry['expiry'][$type] = 'infinity';
        }
 
        $cacheEntry['cascade'] = false;
 
        if ( !$rows ) {
            return;
        }
 
        // New restriction format -- load second to make them override old-style restrictions.
        $now = wfTimestampNow();
 
        // Cycle through all the restrictions.
        foreach ( $rows as $row ) {
            // Don't take care of restrictions types that aren't allowed
            if ( !in_array( $row->pr_type, $restrictionTypes ) ) {
                continue;
            }
 
            $dbr = $this->loadBalancerFactory->getReplicaDatabase();
            $expiry = $dbr->decodeExpiry( $row->pr_expiry );
 
            // Only apply the restrictions if they haven't expired!
            // XXX Why would !$expiry ever be true? It should always be either 'infinity' or a
            // string consisting of 14 digits. Likewise for the ?: below.
            if ( !$expiry || $expiry > $now ) {
                $cacheEntry['expiry'][$row->pr_type] = $expiry ?: null;
                $cacheEntry['restrictions'][$row->pr_type]
                    = explode( ',', trim( $row->pr_level ) );
                if ( $row->pr_cascade ) {
                    $cacheEntry['cascade'] = true;
                }
            }
        }
    }
 
    private function getCreateProtectionInternal( PageIdentity $page ): ?array {
        // Can't protect pages in special namespaces
        if ( !$page->canExist() ) {
            return null;
        }
 
        // Can't apply this type of protection to pages that exist.
        if ( $page->exists() ) {
            return null;
        }
 
        $cacheEntry = &$this->cache[CacheKeyHelper::getKeyForPage( $page )];
 
        if ( !$cacheEntry || !array_key_exists( 'create_protection', $cacheEntry ) ) {
            $dbr = $this->loadBalancerFactory->getReplicaDatabase();
            $commentQuery = $this->commentStore->getJoin( 'pt_reason' );
            $row = $dbr->newSelectQueryBuilder()
                ->select( [ 'pt_user', 'pt_expiry', 'pt_create_perm' ] )
                ->from( 'protected_titles' )
                ->where( [ 'pt_namespace' => $page->getNamespace(), 'pt_title' => $page->getDBkey() ] )
                ->queryInfo( $commentQuery )
                ->caller( __METHOD__ )
                ->fetchRow();
 
            if ( $row ) {
                $cacheEntry['create_protection'] = [
                    'user' => $row->pt_user,
                    'expiry' => $dbr->decodeExpiry( $row->pt_expiry ),
                    'permission' => $row->pt_create_perm,
                    'reason' => $this->commentStore->getComment( 'pt_reason', $row )->text,
                ];
            } else {
                $cacheEntry['create_protection'] = null;
            }
 
        }
 
        return $cacheEntry['create_protection'];
    }
 
    public function getCascadeProtectionSources( PageIdentity $page ): array {
        $page->assertWiki( PageIdentity::LOCAL );
 
        return $this->shouldUseVirtualDomains()
            ? $this->getCascadeProtectionSourcesInternal( $page )
            : $this->getCascadeProtectionSourcesInternalJoined( $page );
    }
 
    private function getCascadeProtectionSourcesInternal(
        PageIdentity $page
    ): array {
        if ( !$page->canExist() ) {
            return [ [], [], [], [] ];
        }
 
        $cacheEntry = &$this->cache[CacheKeyHelper::getKeyForPage( $page )];
 
        if ( isset( $cacheEntry['cascade_sources'] ) ) {
            return $cacheEntry['cascade_sources'];
        }
 
        $dbr = $this->loadBalancerFactory->getReplicaDatabase();
        $now = wfTimestampNow();
 
        $cascadeRestrictions = $dbr->newSelectQueryBuilder()
            ->select( [
                'pr_page',
                'pr_expiry',
                'page_namespace',
                'page_title',
                'pr_type',
                'pr_level'
            ] )
            ->from( 'page_restrictions' )
            ->join( 'page', null, 'page_id=pr_page' )
            ->where( [ 'pr_cascade' => 1 ] )
            ->caller( __METHOD__ )
            ->fetchResultSet();
 
        if ( $cascadeRestrictions->numRows() === 0 ) {
            return [ [], [], [], [] ];
        }
 
        $restrictionsByPage = [];
        foreach ( $cascadeRestrictions as $row ) {
            $expiry = $dbr->decodeExpiry( $row->pr_expiry );
            if ( $expiry > $now ) {
                if ( !isset( $restrictionsByPage[$row->pr_page] ) ) {
                    $restrictionsByPage[$row->pr_page] = [
                        'title' => PageIdentityValue::localIdentity(
                            (int)$row->pr_page,
                            (int)$row->page_namespace,
                            $row->page_title
                        ),
                        'restrictions' => [
                            $row->pr_type => $row->pr_level
                        ]
                    ];
                } else {
                    $restrictionsByPage[$row->pr_page]['restrictions'][$row->pr_type] = $row->pr_level;
                }
            }
        }
 
        if ( $restrictionsByPage === [] ) {
            return [ [], [], [], [] ];
        }
 
        $title = TitleValue::newFromPage( $page );
 
        $templateLinksDb = $this->loadBalancerFactory->getReplicaDatabase( TemplateLinksTable::VIRTUAL_DOMAIN );
        $templateLinks = $templateLinksDb->newSelectQueryBuilder()
            ->select( 'tl_from' )
            ->from( 'templatelinks' )
            ->where( [ 'tl_from' => array_keys( $restrictionsByPage ) ] )
            ->andWhere( $this->linksMigration->getLinksConditions( 'templatelinks', $title ) )
            ->caller( __METHOD__ )
            ->fetchResultSet();
 
        $tlSources = [];
        $ilSources = [];
        $pageRestrictions = [];
 
        foreach ( $templateLinks as $link ) {
            $pageData = $restrictionsByPage[$link->tl_from];
            $tlSources[$link->tl_from] = $pageData['title'];
            foreach ( $pageData['restrictions'] as $type => $level ) {
                if ( !isset( $pageRestrictions[$type] ) ) {
                    $pageRestrictions[$type] = [];
                }
 
                if ( !in_array( $level, $pageRestrictions[$type] ) ) {
                    $pageRestrictions[$type][] = $level;
                }
            }
        }
 
        if ( $page->getNamespace() === NS_FILE ) {
            $imageLinksDb = $this->loadBalancerFactory->getReplicaDatabase( ImageLinksTable::VIRTUAL_DOMAIN );
            $imageLinks = $imageLinksDb->newSelectQueryBuilder()
                ->select( 'il_from' )
                ->from( 'imagelinks' )
                ->where( [ 'il_from' => array_keys( $restrictionsByPage ) ] )
                ->andWhere( $this->linksMigration->getLinksConditions( 'imagelinks', $title ) )
                ->caller( __METHOD__ )
                ->fetchResultSet();
 
            foreach ( $imageLinks as $link ) {
                $pageData = $restrictionsByPage[$link->il_from];
                $ilSources[$link->il_from] = $pageData['title'];
                foreach ( $pageData['restrictions'] as $type => $level ) {
                    if ( !isset( $pageRestrictions[$type] ) ) {
                        $pageRestrictions[$type] = [];
                    }
 
                    if ( !in_array( $level, $pageRestrictions[$type] ) ) {
                        $pageRestrictions[$type][] = $level;
                    }
                }
            }
        }
 
        $sources = array_replace( $tlSources, $ilSources );
 
        $cacheEntry['cascade_sources'] = [ $sources, $pageRestrictions, $tlSources, $ilSources ];
 
        return $cacheEntry['cascade_sources'];
    }
 
    private function getCascadeProtectionSourcesInternalJoined( PageIdentity $page ): array {
        if ( !$page->canExist() ) {
            return [ [], [], [], [] ];
        }
 
        $cacheEntry = &$this->cache[CacheKeyHelper::getKeyForPage( $page )];
 
        if ( isset( $cacheEntry['cascade_sources'] ) ) {
            return $cacheEntry['cascade_sources'];
        }
 
        $title = TitleValue::newFromPage( $page );
 
        $dbr = $this->loadBalancerFactory->getReplicaDatabase();
        $baseQuery = $dbr->newSelectQueryBuilder()
            ->select( [
                'pr_expiry',
                'pr_page',
                'page_namespace',
                'page_title',
                'pr_type',
                'pr_level'
            ] )
            ->from( 'page_restrictions' )
            ->join( 'page', null, 'page_id=pr_page' )
            ->where( [ 'pr_cascade' => 1 ] );
 
        $templateQuery = clone $baseQuery;
        $templateQuery->join( 'templatelinks', null, 'tl_from=pr_page' )
            ->fields( [ 'type' => $dbr->addQuotes( 'tl' ) ] )
            ->andWhere( $this->linksMigration->getLinksConditions( 'templatelinks', $title ) );
 
        if ( $page->getNamespace() === NS_FILE ) {
            $imageQuery = clone $baseQuery;
            $imageQuery->join( 'imagelinks', null, 'il_from=pr_page' )
                ->fields( [ 'type' => $dbr->addQuotes( 'il' ) ] )
                ->andWhere( $this->linksMigration->getLinksConditions( 'imagelinks', $title ) );
 
            $unionQuery = $dbr->newUnionQueryBuilder()
                ->add( $imageQuery )
                ->add( $templateQuery )
                ->all();
            $res = $unionQuery->caller( __METHOD__ )->fetchResultSet();
        } else {
            $res = $templateQuery->caller( __METHOD__ )->fetchResultSet();
        }
 
        $tlSources = [];
        $ilSources = [];
        $pageRestrictions = [];
        $now = wfTimestampNow();
 
        foreach ( $res as $row ) {
            $expiry = $dbr->decodeExpiry( $row->pr_expiry );
            if ( $expiry > $now ) {
                if ( $row->type === 'il' ) {
                    $ilSources[$row->pr_page] = PageIdentityValue::localIdentity(
                        (int)$row->pr_page,
                        (int)$row->page_namespace,
                        $row->page_title
                    );
                } elseif ( $row->type === 'tl' ) {
                    $tlSources[$row->pr_page] = PageIdentityValue::localIdentity(
                        (int)$row->pr_page,
                        (int)$row->page_namespace,
                        $row->page_title
                    );
                }
 
                // Add groups needed for each restriction type if its not already there
                // Make sure this restriction type still exists
 
                if ( !isset( $pageRestrictions[$row->pr_type] ) ) {
                    $pageRestrictions[$row->pr_type] = [];
                }
 
                if ( !in_array( $row->pr_level, $pageRestrictions[$row->pr_type] ) ) {
                    $pageRestrictions[$row->pr_type][] = $row->pr_level;
                }
            }
        }
 
        $sources = array_replace( $tlSources, $ilSources );
 
        $cacheEntry['cascade_sources'] = [ $sources, $pageRestrictions, $tlSources, $ilSources ];
 
        return $cacheEntry['cascade_sources'];
    }
 
    private function shouldUseVirtualDomains(): bool {
        $virtualDomains = $this->options->get( MainConfigNames::VirtualDomainsMapping );
        return isset( $virtualDomains[LinksTable::VIRTUAL_DOMAIN] );
    }
 
    public function areRestrictionsLoaded( PageIdentity $page ): bool {
        $page->assertWiki( PageIdentity::LOCAL );
 
        return isset( $this->cache[CacheKeyHelper::getKeyForPage( $page )]['restrictions'] );
    }
 
    public function areCascadeProtectionSourcesLoaded( PageIdentity $page ): bool {
        $page->assertWiki( PageIdentity::LOCAL );
 
        return isset( $this->cache[CacheKeyHelper::getKeyForPage( $page )]['cascade_sources'] );
    }
 
    public function areRestrictionsCascading( PageIdentity $page ): bool {
        $page->assertWiki( PageIdentity::LOCAL );
 
        if ( !$this->areRestrictionsLoaded( $page ) ) {
            $this->loadRestrictions( $page );
        }
        return $this->cache[CacheKeyHelper::getKeyForPage( $page )]['cascade'] ?? false;
    }
 
    public function flushRestrictions( PageIdentity $page ): void {
        $page->assertWiki( PageIdentity::LOCAL );
 
        unset( $this->cache[CacheKeyHelper::getKeyForPage( $page )] );
    }
 
}