From 6eec9fb3553d759190f010b38db39d01645922bb Mon Sep 17 00:00:00 2001 From: Brad Jorsch Date: Wed, 3 Feb 2016 12:33:25 -0500 Subject: [PATCH] Avoid unstubbing $wgUser before the end of Setup.php in User::getBlockedStatus() Autocreation needs to check if the current IP is blocked from account creation. There are two ways we could go here: treat $wgUser as logged-out, or assume it will eventually be the user name specified by the session. This patch chooses the former, by the logic that at this early point in the setup process we don't have a logged-in user determined yet so no username can really be considered to match the logged-in user. Bug: T124367 Change-Id: I631bec85291b57f07c378cf6554a8f06cf3fb00c --- includes/user/User.php | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/includes/user/User.php b/includes/user/User.php index 8e3b2ecbc9..3635f5c0d6 100644 --- a/includes/user/User.php +++ b/includes/user/User.php @@ -1535,10 +1535,16 @@ class User implements IDBAccessObject { # We only need to worry about passing the IP address to the Block generator if the # user is not immune to autoblocks/hardblocks, and they are the current user so we # know which IP address they're actually coming from - if ( !$this->isAllowed( 'ipblock-exempt' ) && $this->equals( $wgUser ) ) { - $ip = $this->getRequest()->getIP(); - } else { - $ip = null; + $ip = null; + if ( !$this->isAllowed( 'ipblock-exempt' ) ) { + // $wgUser->getName() only works after the end of Setup.php. Until + // then, assume it's a logged-out user. + $globalUserName = $wgUser->isSafeToLoad() + ? $wgUser->getName() + : IP::sanitizeIP( $wgUser->getRequest()->getIP() ); + if ( $this->getName() === $globalUserName ) { + $ip = $this->getRequest()->getIP(); + } } // User/IP blocking -- 2.20.1