Merge "Clear block cookie if the value is invalid"

diff --combined includes/block/BlockManager.php
index 4a5df8e,a5035bd..f92dd1e
--- 1/includes/block/BlockManager.php
--- 2/includes/block/BlockManager.php
+++ b/includes/block/BlockManager.php
@@@ -21,7 -21,6 +21,7 @@@
  namespace MediaWiki\Block;
  
  use DateTime;
 +use DateTimeZone;
  use DeferredUpdates;
  use IP;
  use MediaWiki\Config\ServiceOptions;
@@@ -224,7 -223,7 +224,7 @@@ class BlockManager 
  
        /**
         * Try to load a block from an ID given in a cookie value. If the block is invalid
-        * or doesn't exist, remove the cookie.
+        * doesn't exist, or the cookie value is malformed, remove the cookie.
         *
         * @param UserIdentity $user
         * @param WebRequest $request
@@@ -234,9 -233,13 +234,13 @@@
                UserIdentity $user,
                WebRequest $request
        ) {
-               $blockCookieId = $this->getIdFromCookieValue( $request->getCookie( 'BlockID' ) );
+               $cookieValue = $request->getCookie( 'BlockID' );
+               if ( is_null( $cookieValue ) ) {
+                       return false;
+               }
  
-               if ( $blockCookieId !== null ) {
+               $blockCookieId = $this->getIdFromCookieValue( $cookieValue );
+               if ( !is_null( $blockCookieId ) ) {
                        // TODO: remove dependency on DatabaseBlock
                        $block = DatabaseBlock::newFromID( $blockCookieId );
                        if (
@@@ -245,9 -248,10 +249,10 @@@
                        ) {
                                return $block;
                        }
-                       $this->clearBlockCookie( $request->response() );
                }
  
+               $this->clearBlockCookie( $request->response() );
+ 
                return false;
        }
  
@@@ -436,11 -440,7 +441,11 @@@
                }
  
                // Set the cookie. Reformat the MediaWiki datetime as a Unix timestamp for the cookie.
 -              $expiryValue = DateTime::createFromFormat( 'YmdHis', $expiryTime )->format( 'U' );
 +              $expiryValue = DateTime::createFromFormat(
 +                      'YmdHis',
 +                      $expiryTime,
 +                      new DateTimeZone( 'UTC' )
 +              )->format( 'U' );
                $cookieOptions = [ 'httpOnly' => false ];
                $cookieValue = $this->getCookieValue( $block );
                $response->setCookie( 'BlockID', $cookieValue, $expiryValue, $cookieOptions );