aboutsummaryrefslogtreecommitdiffstats
path: root/includes/api/ApiBlock.php
Commit message (Collapse)AuthorAgeFilesLines
* block: Add autoblock filtering parametersTim Starling2025-03-211-8/+2
| | | | | | | | Add $auto parameter to DatabaseBlockStore::newFromTarget and ::newListFromTarget, to help callers filter autoblocks from result lists. Change-Id: Iad92d205517eb50ab0ce5e8caae58ee761fe19d5
* block: Don't modify an autoblock when the user specifies an IPTim Starling2025-03-201-1/+8
| | | | | Bug: T389452 Change-Id: Id7a3f565821231647fe75a24e9ef7efeeb157c5d
* block: Increase page restriction limit in multiblocks modeTim Starling2025-03-121-2/+4
| | | | | | | | | | | | User consultations uncovered a need for restricting blocks to a list of more than 10 pages. With multiblocks, an admin in this situation could split up the block into several blocks, each with 10 pages, which is a tedious workaround. Discourage this by increasing the limit to 50. This was already implemented on the client side. Bug: T388505 Change-Id: I034b9e2fbf38e715255ca84065ec5a63534f86ad
* block: Add a BlockTarget class hierarchyTim Starling2025-02-191-9/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Main change: * Add a class hierarchy representing block targets, representing a target and type. * Add BlockTargetFactory, replacing BlockUtils. * Add CrossWikiBlockTargetFactory, replacing BlockUtilsFactory. * Construct a BlockTarget object early in the request flow and pass it down through the layers, instead of having every layer interpret UserIdentity|string target specifications. Also: * Remove Block::TYPE_ID. Nothing uses it in code search, so there's no point in porting it to the new system. * Stop using the type constants as specificity scores. Add BlockTarget::getSpecificity(). * Add DatabaseBlockStore::newUnsaved() to replace direct construction of DatabaseBlock in insertBlock() callers. There are many such callers in tests. This is part of the effort to remove the service container usage in DatabaseBlock::__construct(). * Make DatabaseBlock::getRangeStart() and getRangeEnd() return null if the block is not a range, since that is convenient for their only caller following the resolution of T51504. * Add DatabaseBlock::getIpHex() which similarly maps to a DB field in the new schema. * In ApiBlock and ApiUnblock, have ParamValidator provide UserIdentity objects instead of converting to a string and back to a UserIdentity again. Bug: T382106 Change-Id: I2ce1a82f3fbb3cf18aa2d17986d46dbdcc70c761
* block: Fix vague target requirements in BlockPermissionCheckerTim Starling2025-02-131-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The doc comment of newBlockPermissionChecker() describes the $target parameter as being optional. The returned object does not need or use a target when checkBasePermissions() or checkEmailPermissions() are called. But failing to pass a target when calling checkBlockPermissions() is incorrect. This was the subject of the linked bug. If an admin is performing a block, self-unblock permissions need to be checked, this is not optional. This could be enforced at runtime, but it seems safer and simpler to enforce it statically. So, move $target from being a constructor parameter to being a formal parameter of checkBlockPermissions(). This formal parameter will be statically required after a deprecation period. Deprecate newBlockPermissionChecker() and introduce newChecker(), using a name with a slightly less than conventional verbosity to allow us to change the parameter order. There is no $target parameter to newChecker(). Backwards compatibility is supported by adding an internal mutator method setTarget(). This can easily be removed after the deprecation period is over. In Special:Block, checkBlockPermissions() was called with $target=null on form entry, meaning that the user could unblock themselves if the target was specified in the URL, but could not unblock themselves by searching with the form. This seems inconsistent. So allow blocked admins to see the search form, but show an error when they try to block or unblock someone other than themselves. Bug: T384716 Change-Id: I8c26cdcc9b87b74bc458fe731cf7f170a2607150
* Revert "API: Use ExpiryDef for action=block expiry parameter"Tim Starling2025-02-101-4/+1
| | | | | | | | | | | A block action done with the API no longer shows the relative timestamp in the log. So revert the parts of 257d6f3ba0517265471165cfdf4ba8576cc4 which switched ApiBlock to use ExpiryDef. The change to errorformat is not reverted. Bug: T248196 Change-Id: I3c277a5612e2c00d1120012354c4657c6fb02b47
* API: Use ExpiryDef for action=block expiry parameterSam Wilson2025-01-291-1/+4
| | | | | | | | | | | * Use the ExpiryDef validation for the action=block expiry parameter. * Change the errorformat used by Special:Block to get validation messages in HTML and the right language, and map these to form error messages. Bug: T384241 Bug: T248196 Change-Id: Ic7a080d02e317bbdddb609bf724e3c7c2c393983
* ApiBlock: Remove unused ApiBlockInfoTraitBartosz Dziewoński2024-12-171-1/+0
| | | | Change-Id: Ifcaeb9dd161db547fb7fe40ee9055629b926a4d2
* block: Multiblocks block APITim Starling2024-12-161-69/+158
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In ApiBlock: * Add an "id" parameter. If this is given, update the specified block. * Add a "newblock" parameter. If this is given, always add a new block, don't check if the target is already blocked. * If "reblock" is given and the target has more than one block, fail with an "ambiguous-block" error. Supporting changes: * Add BlockUserFactory::newUpdateBlock(), which takes a DatabaseBlock instead of a target union to act on. The block is passed through to the BlockUser constructor. * Rename the first parameter to BlockUser::placeBlock() from $reblock to $conflictMode, and style it like an enum. Add the CONFLICT_NEW value, to support the "newblock" API option. * In DatabaseBlockStore::newFromId(), add $fromPrimary, so that ApiBlock can pass data to BlockUserFactory with equivalent freshness to the LHS. Also: * In BlockUser, memoize prior blocks loaded from the DB * Move T287798 autoblock check to the memoized accessor. Just don't return autoblocks. * Move "TODO handle failure" comment in BlockUser to the called method. It really can't fail. * In DatabaseBlockStore::newFromId(), add an $includeExpired parameter and default to false although it was previously implicitly true. Based on a brief review of callers, I think this is beneficial. Bug: T378147 Change-Id: Iea5b77cb27006b33f3dde61660be5ad2c374a425
* api: Use type-declaration for string arg in ApiBase::__constructUmherirrender2024-10-171-14/+1
| | | | | | | Also for all sub-classes Remove simple doc-blocks without further information Change-Id: I981934efe32d44f52e5ab865a9b887be5bd0f41e
* Add namespace to includes/api classesJames D. Forrester2024-09-251-0/+5
| | | | | Bug: T353458 Change-Id: I3ea6b08c5018ba03ba45c5766e1f46e12f6b8597
* Add MediaWiki\Watchlist namespace to the related classesEbrahim Byagowi2024-05-221-0/+1
| | | | | | | | | This adds MediaWiki\Watchlist namespace to the classes of watchlist directory and adds deprecation notice since 1.43 to the just created unnamespaced aliases of the classes. Bug: T353458 Change-Id: I4234f8fe62bb3bde6f5271c7ba31a2420b0f4b90
* Merge "Add 'temp' to allowed user types in various APIs"jenkins-bot2023-11-301-1/+1
|\
| * Add 'temp' to allowed user types in various APIsThalia2023-11-301-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Why: * Before this task, when an API parameter specifies allowed user types, temporary users and permanent users are in the same category: 'name'. * However, it is useful to separate them out, and sometimes allow a permanent user but not a temporary user (e.g. ApiResetPassword, since temporary users don't have passwords). * We therefore re-defined the 'name' type only to refer to permanent (named) users, and add a new 'temp' type. * This fixes params that currently intend to allow temp users, and that use 'name' to do so, by adding 'temp'. What: * Based on a search for `UserDef::PARAM_ALLOWED_USER_TYPES`, add the 'temp' type where necessary. * The following were not updated, because they shouldn't apply to temporary users: - owners for includes/api/ApiQueryWatchlist.php, includes/api/ApiQueryWatchlistRaw.php - users for includes/api/ApiResetPassword.php, includes/api/ApiUserrights.php, includes/api/ApiValidatePassword.php Bug: T350701 Change-Id: If5ccf1d469327791acff74d013343307e411cca9
* | Move user options related classes into its own namespaceMartin Urbanec2023-11-291-1/+1
|/ | | | | | | | | | | | | There are a couple of user options related classes already, and the T321527 work on dynamic defaults is going to add even more. Let's move them into a separate namespace to make core a bit more organized. Old name is kept as an alias for compatibility purposes. Bug: T321527 Bug: T352284 Change-Id: I9822eb1553870b876d0b8a927e4e86c27d83bd52
* Use real type hints for services etc. in api/ except ApiQuery*.phpBartosz Dziewoński2023-08-291-20/+7
| | | | | | | | | | | | | | | Mostly used find-and-replace: Find: /\*[\*\s]+@var (I?[A-Z](\w+)(?:Interface)?)[\s\*]+/\s*(private|protected|public) (\$[a-z]\w+;\n)((?=\s*/\*[\*\s]+@var (I?[A-Z](\w+)(?:Interface)?))\n|) Replace with: \3 \1 \4 Followed by some manual review to make sure I'm not changing too much, omitting some changes that looked too complicated and anything that caused test failures, and some whitespace fixes. Change-Id: I6ec7587607df4f1a4f448a096c3e44c4e5270b70
* ApiBlock: Report the correct value for 'hidename' in responseThalia2023-08-081-1/+1
| | | | | | | | | | Report what the block actually does, rather than what was requested, since these might not always match. E.g. a request to hide an IP address may result in a block being made that does not hide the IP address. Bug: T343749 Change-Id: Iebe62179cfc77835dca78ac672f9ba3edfadbfed
* Api: Fix some very old copyright statements for RoanJames D. Forrester2023-03-161-1/+1
| | | | Change-Id: I820a2d388922653a6a5b9048b0feaafbb4297d91
* Reorg: Namespace the Title classJames D. Forrester2023-03-021-0/+1
| | | | | | | | | | | | | | | | | | | This is moderately messy. Process was principally: * xargs rg --files-with-matches '^use Title;' | grep 'php$' | \ xargs -P 1 -n 1 sed -i -z 's/use Title;/use MediaWiki\\Title\\Title;/1' * rg --files-without-match 'MediaWiki\\Title\\Title;' . | grep 'php$' | \ xargs rg --files-with-matches 'Title\b' | \ xargs -P 1 -n 1 sed -i -z 's/\nuse /\nuse MediaWiki\\Title\\Title;\nuse /1' * composer fix Then manual fix-ups for a few files that don't have any use statements. Bug: T166010 Follows-Up: Ia5d8cb759dc3bc9e9bbe217d0fb109e2f8c4101a Change-Id: If8fc9d0d95fc1a114021e282a706fc3e7da3524b
* Reorg: Move Title-related classes to title/Amir Sarabadani2022-11-261-0/+1
| | | | | | | | | | | | | | These three classes: - TitleArray - TitleArrayFromResult - TitleFactory We need to move these and the rest of files under title/ to Title/ (and namespace them) but the patch will become way too big given that Title class is also one of them. Bug: T321882 Change-Id: Iac1688172ee457348a08a470c86e047571feb8e0
* Use short array destructuring instead of list()Tim Starling2022-10-211-1/+1
| | | | | | | | Introduced in PHP 7.1. Because it's shorter and looks nice. I used regex replacement. Change-Id: I0555e199d126cd44501f859cb4589f8bd49694da
* Call IContextSource::getAuthority instead of IContextSource::getUserUmherirrender2022-06-291-1/+1
| | | | | | | Change to use Authority object where possible to use the interface instead of implementation Change-Id: Ia7e9ce2a2f05ef2ae1cf981bf96faf48b04cf58d
* api: Replace numerous more deprecated constantsReedy2022-06-061-1/+1
| | | | Change-Id: I498a315b8b4b56d5e2f939e797adbe0487cd7d07
* api: Replace numerous deprecated constantsReedy2022-06-061-13/+14
| | | | Change-Id: I34ffcb70efbfa257da8dab6e0790aa0d697caf5b
* Use MainConfigNames instead of string literals, #2Aryeh Gregor2022-04-131-5/+7
| | | | | | | This covers all occurrences of /onfig->.*get( '/ in includes/. Undoubtedly there are still plenty more to go. Change-Id: I33196c4153437778496f40436bcde399638ac361
* Use PHP's [ $this, 'fn' ] callback syntax where possibleThiemo Kreuz2021-12-031-3/+4
| | | | | | | | | | | | PHP 8.1 will give us "first class callables" that look like e.g. $result = array_map( $this->fn(...), $array ); For now we can use $result = array_map( [ $this, 'fn' ], $array ); Change-Id: I7278c80c075d162da73aa45af1b6578310ce0624
* api: Handle invalid/non-existent titles in ApiBlockSam Smith2021-07-271-4/+13
| | | | | | | | Defer to the TitleDef type definition for page titles to validate values passed to the pagerestrictions parameter. Bug: T279689 Change-Id: Ia2e116d1bc476b178d85a6331dec17d7a8df74ba
* Convert BlockUtils::parseBlockTarget to UserIdentityAlexander Vorwerk2021-07-201-9/+5
| | | | | Bug: T286490 Change-Id: Ice96180690828bcf2efd60faf6ad10d64307713d
* api: Inject services into ApiWatchlistTraitUmherirrender2021-07-061-3/+13
| | | | | Bug: T259960 Change-Id: I73596f8c924ec4a02a7042608d19a35f82bb752a
* api: Replace User::whoIs in ApiBlockUmherirrender2021-06-301-9/+8
| | | | | | Inject and use the new UserIdentityLookup service Change-Id: I56b0ba599b5e86f568a5d7db6d27776ba52e1dc5
* Allow partial action blocks to be made via ApiBlockThalia2021-05-041-2/+33
| | | | | Bug: T280522 Change-Id: I114e3c76cfb6dd2f79b5217aee4b3da34df00850
* Hard-deprecate AbstractBlock::parseTargetPetr Pchelko2021-03-191-2/+9
| | | | | Bug: T276610 Change-Id: I2f10ae5da1d9b1ca4aa20492b943e0c94d32a0b6
* Convert (Un)BlockUser to AuthorityPetr Pchelko2021-03-181-1/+1
| | | | Change-Id: I5084b5523f15b7d55b2f5dc67ae19ec7059799ad
* Use static closures where safe to useUmherirrender2021-02-111-1/+1
| | | | | | | | | This is micro-optimization of closure code to avoid binding the closure to $this where it is not needed. Created by I25a17fb22b6b669e817317a0f45051ae9c608208 Change-Id: I0ffc6200f6c6693d78a3151cb8cea7dce7c21653
* Reduce SpecialBlock/Api logic duplicationAmmar Abdulhamid2021-01-221-6/+5
| | | | | | | Add PageRestriction::newFromTitle() to create from Title instance or title string. Change-Id: Id4c8117b916be05edc863bcd7a15c74fb28a833a
* ApiBlock: Add user watch only after block successAmmar Abdulhamid2020-10-061-4/+4
| | | | | | | | | | I believe it does not make sense to go on with peripheral action when the primary action did not succeed. If the blocker decides to attempt the block again, they can also decide whether to add watch or not at that time. Change-Id: I64880ce254e33378642bb9f1952c88ce490ef490
* Add WatchlistExpiry support to ApiBlockAmmar Abdulhamid2020-10-011-9/+43
| | | | | Bug: T248515 Change-Id: I253bcb5a74a65cbd9834b5eabcd1ed7a1993a5d9
* Ignore block restrictions if block is not specified as partialThalia2020-09-281-13/+12
| | | | | | | | | | | | | | | | In SpecialBlock, ignore restrictions if the 'sitewide' radio was selected. In ApiBlock, ignore restrictions if the 'partial' parameter was falsey. In both cases, ignoring restrictions means not passing them to BlockUser. This restores the behaviour prior to a656d03597d2, that a block is sitewide unless it is marked as partial, even if restrictions options are set. Bug: T189073 Change-Id: I4d2e08b744b9d59909ce24cc5f167b676478970d
* Pass correct parameters to BlockUser from ApiBlock and SpecialBlockThalia2020-09-231-1/+2
| | | | | | | | | | | | Pass 'partial' parameter from ApiBlock. Pass 'DisableEmail' parameter from SpecialBlock only after confirming it is set. Follow-up to a656d03597d29dedf37a962ec0fddf552609a8ef Bug: T189073 Change-Id: I5acbb1c5d49b216bb235936cd479829128beac77
* Introduce backend class for blocking usersMartin Urbanec2020-09-221-80/+75
| | | | | | | | | | | | | | Rather than having to do DatabaseBlock calls directly, and then ManualLogEntry calls to facilitate logging, let's create a BlockUser service, capable of blocking users and logging, optionally with permission checking. This should make blocking users easier for developers, for instance, AbuseFilter or CheckUser can easily benefit from this commit. Bug: T189073 Change-Id: Ifdced735b694b85116cb0e43dadbfa8e4cdb8cab
* Remove unnecessary calls to SpecialBlock::getTargetAndTypeThalia2020-09-211-2/+3
| | | | | | | | | | | | | | | | Refactor this method to make clearer that it returns the return value of AbstractBlock::parseTarget and does nothing additional when called without a WebRequest. Update callers that do that to call parseTarget directly instead. SpecialBlock::getTargetAndType (added in 97e2c97578c) predates AbstractBlock::parseTarget (added in f64f960d9a4). The callers being updated here called getTargetAndType since before parseTarget was available. Bug: T250940 Change-Id: I366e1076b10ab7c2dc4bb04920908b3286b77b73
* Do not call SpecialBlock::canBlockEmail in ApiBlockMartin Urbanec2020-09-191-1/+28
| | | | | Bug: T263327 Change-Id: Ic63178ba1ac2756b5b305d4fa8ea53ab40f9b011
* Use UserNameUtils in ApiBlockUmherirrender2020-08-051-1/+3
| | | | Change-Id: I6f2a8847076dbf91055a1b98bd5a2af8ae833dc8
* Remove $wgEnablePartialBlocks config and always enable partial blocksThalia2020-03-041-29/+13
| | | | | Bug: T242912 Change-Id: Icf737140dd112dc4d222274ae40e225cb7a9d3fc
* API: Use ParamValidator libraryBrad Jorsch2020-02-041-0/+3
| | | | | | | | | | | | | | | | | This brings significant modularization to the Action API's parameter validation, and allows the Action API and MW REST API to share validation code. Note there are several changes in this patch that may affect other code; see the entries in RELEASE-NOTES-1.35 for details. Bug: T142080 Bug: T232672 Bug: T21195 Bug: T34675 Bug: T154774 Change-Id: I1462edc1701278760fa695308007006868b249fc Depends-On: I10011be060fe6d27c7527312ad41218786b3f40d
* Better grouping for code adding elements to arraysDaimona Eaytoy2019-09-031-1/+2
| | | | | Change-Id: I7cc8c810f0dcf1ee84b9d5f14967ec2568e3e0be Follow-up: I50377746f01749b058c39fd8229f9d566224cc43
* Unsuppress more phan issues (part 5)Daimona Eaytoy2019-09-011-0/+1
| | | | | | Bug: T231636 Depends-On: I6e5fba7bd273219b1206559420b5bdb78734aa84 Change-Id: I50377746f01749b058c39fd8229f9d566224cc43
* Replace User::isAllowed with PermissionManager.Petr Pchelko2019-08-201-1/+2
| | | | | | | | Covers root includes, actions, api, block, changes, changetags, diff and PermissionManager itself. Bug: T220191 Change-Id: Ic027d32f5dd8f4c74865df0c8a9fcf91123c889c
* SECURITY: API: Respect $wgBlockCIDRLimit in action=blockKunal Mehta2019-06-061-0/+5
| | | | | | | | | | | | | | $wgBlockCIDRLimit states how large rangeblocks are allowed to be for IPv4 and IPv6. The API now calls SpecialBlock::validateTarget() to perform that validation step. As a minor thing, SpecialBlock::checkUnblockSelf() is now called twice by the API, but that can probably be cleaned up at another time. Tests included. Bug: T199540 Change-Id: Ic7d60240d9ebd9580c0eb3b41e4befceab69bd81
* Rename Block to MediaWiki\Block\DatabaseBlockThalia2019-05-281-3/+5
| | | | | | | | | | | | Keep Block as a deprecated class alias for DatabaseBlock. Update calls to the Block constructor and Block static methods from external classes. Also update documentation in several places that refer to blocks as Blocks. Bug: T222737 Change-Id: I6d96b63ca0a84bee19486471e0a16a53a79d768a
generated by cgit v1.2.3 (git 2.25.1) at 2025-04-25 13:47:45 +0000