From b03f828ea5956f42c4b6fb600608e7d2c77ccbd9 Mon Sep 17 00:00:00 2001
From: Aaron Schulz <aaron@users.mediawiki.org>
Date: Tue, 21 Apr 2009 04:43:22 +0000
Subject: [PATCH] * Fixed unblocking of hidden names (bug 18543) * Added
 permission check

---
 includes/specials/SpecialBlockip.php     | 20 +++++++++++---------
 includes/specials/SpecialIpblocklist.php | 23 ++++++++++++++++-------
 2 files changed, 27 insertions(+), 16 deletions(-)

diff --git a/includes/specials/SpecialBlockip.php b/includes/specials/SpecialBlockip.php
index 1fc5f699eb..b8c92e8e6b 100644
--- a/includes/specials/SpecialBlockip.php
+++ b/includes/specials/SpecialBlockip.php
@@ -445,7 +445,7 @@ class IPBlockForm {
 					$log_action = 'reblock';
 					# Unset _deleted fields if requested
 					if( $currentBlock->mHideName && !$this->BlockHideName ) {
-						$this->unsuppressUserName( $this->BlockAddress, $userId );
+						self::unsuppressUserName( $this->BlockAddress, $userId );
 					}
 				}
 			} else {
@@ -455,7 +455,7 @@ class IPBlockForm {
 
 			# Set *_deleted fields if requested
 			if( $this->BlockHideName ) {
-				$this->suppressUserName( $this->BlockAddress, $userId );
+				self::suppressUserName( $this->BlockAddress, $userId );
 			}
 
 			if ( $this->BlockWatchUser &&
@@ -486,17 +486,17 @@ class IPBlockForm {
 		}
 	}
 	
-	private function suppressUserName( $name, $userId ) {
+	public static function suppressUserName( $name, $userId ) {
 		$op = '|'; // bitwise OR
-		return $this->setUsernameBitfields( $name, $userId, $op );
+		return self::setUsernameBitfields( $name, $userId, $op );
 	}
 	
-	private function unsuppressUserName( $name, $userId ) {
+	public static function unsuppressUserName( $name, $userId ) {
 		$op = '&'; // bitwise AND
-		return $this->setUsernameBitfields( $name, $userId, $op );
+		return self::setUsernameBitfields( $name, $userId, $op );
 	}
 	
-	private function setUsernameBitfields( $name, $userId, $op ) {
+	private static function setUsernameBitfields( $name, $userId, $op ) {
 		if( $op !== '|' && $op !== '&' ) return false; // sanity check
 		$dbw = wfGetDB( DB_MASTER );
 		$delUser = Revision::DELETED_USER | Revision::DELETED_RESTRICTED;
@@ -509,8 +509,10 @@ class IPBlockForm {
 		# current bitfields with the inverse of Revision::DELETED_USER. The
 		# username bit is made to 0 (x & 0 = 0), while others are unchanged (x & 1 = x).
 		# The same goes for the sysop-restricted *_deleted bit.
-		if( $op == '&' ) $delUser = "~{$delUser}";
-		if( $op == '&' ) $delAction = "~{$delAction}";
+		if( $op == '&' ) {
+			$delUser = "~{$delUser}";
+			$delAction = "~{$delAction}";
+		}
 		# Hide name from live edits
 		$dbw->update( 'revision', array("rev_deleted = rev_deleted $op $delUser"),
 			array('rev_user' => $userId), __METHOD__ );
diff --git a/includes/specials/SpecialIpblocklist.php b/includes/specials/SpecialIpblocklist.php
index ae808e3d5c..02d862f21e 100644
--- a/includes/specials/SpecialIpblocklist.php
+++ b/includes/specials/SpecialIpblocklist.php
@@ -162,7 +162,7 @@ class IPUnblockForm {
 	 * @return array array(message key, parameters) on failure, empty array on success
 	 */
 
-	static function doUnblock(&$id, &$ip, &$reason, &$range = null) {
+	static function doUnblock(&$id, &$ip, &$reason, &$range = null, $blocker=null) {
 		if ( $id ) {
 			$block = Block::newFromID( $id );
 			if ( !$block ) {
@@ -184,8 +184,7 @@ class IPUnblockForm {
 				if ( !$block ) {
 					return array('ipb_cant_unblock', htmlspecialchars($id));
 				}
-				if( $block->mRangeStart != $block->mRangeEnd
-						&& !strstr( $ip, "/" ) ) {
+				if( $block->mRangeStart != $block->mRangeEnd && !strstr( $ip, "/" ) ) {
 					/* If the specified IP is a single address, and the block is
 					 * a range block, don't unblock the range. */
 					 $range = $block->mAddress;
@@ -195,11 +194,22 @@ class IPUnblockForm {
 		}
 		// Yes, this is really necessary
 		$id = $block->mId;
+		
+		# If the name was hidden and the blocking user cannot hide
+		# names, then don't allow any block removals...
+		if( $blocker && $block->mHideName && !$blocker->isAllowed('hideuser') ) {
+			return array('ipb_cant_unblock', htmlspecialchars($id));
+		}
 
 		# Delete block
 		if ( !$block->delete() ) {
 			return array('ipb_cant_unblock', htmlspecialchars($id));
 		}
+		
+		# Unset _deleted fields as needed
+		if( $block->mHideName ) {
+			IPBlockForm::unsuppressUserName( $block->mAddress, $block->mUser );
+		}
 
 		# Make log entry
 		$log = new LogPage( 'block' );
@@ -208,10 +218,9 @@ class IPUnblockForm {
 	}
 
 	function doSubmit() {
-		global $wgOut;
-		$retval = self::doUnblock($this->id, $this->ip, $this->reason, $range);
-		if(!empty($retval))
-		{
+		global $wgOut, $wgUser;
+		$retval = self::doUnblock($this->id, $this->ip, $this->reason, $range, $wgUser);
+		if( !empty($retval) ) {
 			$key = array_shift($retval);
 			$this->showForm(wfMsgReal($key, $retval));
 			return;
-- 
2.20.1