3 * This program is free software; you can redistribute it and/or modify
4 * it under the terms of the GNU General Public License as published by
5 * the Free Software Foundation; either version 2 of the License, or
6 * (at your option) any later version.
8 * This program is distributed in the hope that it will be useful,
9 * but WITHOUT ANY WARRANTY; without even the implied warranty of
10 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11 * GNU General Public License for more details.
13 * You should have received a copy of the GNU General Public License along
14 * with this program; if not, write to the Free Software Foundation, Inc.,
15 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
16 * http://www.gnu.org/copyleft/gpl.html
20 namespace MediaWiki\Permissions
;
26 use MediaWiki\Linker\LinkTarget
;
27 use MediaWiki\Special\SpecialPageFactory
;
38 * A service class for checking permissions
39 * To obtain an instance, use MediaWikiServices::getInstance()->getPermissionManager().
43 class PermissionManager
{
45 /** @var string Does cheap permission checks from replica DBs (usable for GUI creation) */
46 const RIGOR_QUICK
= 'quick';
48 /** @var string Does cheap and expensive checks possibly from a replica DB */
49 const RIGOR_FULL
= 'full';
51 /** @var string Does cheap and expensive checks, using the master as needed */
52 const RIGOR_SECURE
= 'secure';
54 /** @var SpecialPageFactory */
55 private $specialPageFactory;
57 /** @var string[] List of pages names anonymous user may see */
58 private $whitelistRead;
60 /** @var string[] Whitelists publicly readable titles with regular expressions */
61 private $whitelistReadRegexp;
63 /** @var bool Require users to confirm email address before they can edit */
64 private $emailConfirmToEdit;
66 /** @var bool If set to true, blocked users will no longer be allowed to log in */
67 private $blockDisablesLogin;
69 /** @var NamespaceInfo */
73 * @param SpecialPageFactory $specialPageFactory
74 * @param string[] $whitelistRead
75 * @param string[] $whitelistReadRegexp
76 * @param bool $emailConfirmToEdit
77 * @param bool $blockDisablesLogin
78 * @param NamespaceInfo $nsInfo
80 public function __construct(
81 SpecialPageFactory
$specialPageFactory,
88 $this->specialPageFactory
= $specialPageFactory;
89 $this->whitelistRead
= $whitelistRead;
90 $this->whitelistReadRegexp
= $whitelistReadRegexp;
91 $this->emailConfirmToEdit
= $emailConfirmToEdit;
92 $this->blockDisablesLogin
= $blockDisablesLogin;
93 $this->nsInfo
= $nsInfo;
97 * Can $user perform $action on a page?
99 * The method is intended to replace Title::userCan()
100 * The $user parameter need to be superseded by UserIdentity value in future
101 * The $title parameter need to be superseded by PageIdentity value in future
103 * @see Title::userCan()
105 * @param string $action
107 * @param LinkTarget $page
108 * @param string $rigor One of PermissionManager::RIGOR_ constants
109 * - RIGOR_QUICK : does cheap permission checks from replica DBs (usable for GUI creation)
110 * - RIGOR_FULL : does cheap and expensive checks possibly from a replica DB
111 * - RIGOR_SECURE : does cheap and expensive checks, using the master as needed
116 public function userCan( $action, User
$user, LinkTarget
$page, $rigor = self
::RIGOR_SECURE
) {
117 return !count( $this->getPermissionErrorsInternal( $action, $user, $page, $rigor, true ) );
121 * Can $user perform $action on a page?
123 * @todo FIXME: This *does not* check throttles (User::pingLimiter()).
125 * @param string $action Action that permission needs to be checked for
126 * @param User $user User to check
127 * @param LinkTarget $page
128 * @param string $rigor One of PermissionManager::RIGOR_ constants
129 * - RIGOR_QUICK : does cheap permission checks from replica DBs (usable for GUI creation)
130 * - RIGOR_FULL : does cheap and expensive checks possibly from a replica DB
131 * - RIGOR_SECURE : does cheap and expensive checks, using the master as needed
132 * @param array $ignoreErrors Array of Strings Set this to a list of message keys
133 * whose corresponding errors may be ignored.
135 * @return array Array of arrays of the arguments to wfMessage to explain permissions problems.
138 public function getPermissionErrors(
142 $rigor = self
::RIGOR_SECURE
,
145 $errors = $this->getPermissionErrorsInternal( $action, $user, $page, $rigor );
147 // Remove the errors being ignored.
148 foreach ( $errors as $index => $error ) {
149 $errKey = is_array( $error ) ?
$error[0] : $error;
151 if ( in_array( $errKey, $ignoreErrors ) ) {
152 unset( $errors[$index] );
154 if ( $errKey instanceof MessageSpecifier
&& in_array( $errKey->getKey(), $ignoreErrors ) ) {
155 unset( $errors[$index] );
163 * Check if user is blocked from editing a particular article
166 * @param LinkTarget $page Title to check
167 * @param bool $fromReplica Whether to check the replica DB instead of the master
171 * @throws MWException
173 public function isBlockedFrom( User
$user, LinkTarget
$page, $fromReplica = false ) {
174 $blocked = $user->isHidden();
176 // TODO: remove upon further migration to LinkTarget
177 $page = Title
::newFromLinkTarget( $page );
180 $block = $user->getBlock( $fromReplica );
182 // Special handling for a user's own talk page. The block is not aware
183 // of the user, so this must be done here.
184 if ( $page->equals( $user->getTalkPage() ) ) {
185 $blocked = $block->appliesToUsertalk( $page );
187 $blocked = $block->appliesToTitle( $page );
192 // only for the purpose of the hook. We really don't need this here.
193 $allowUsertalk = $user->isAllowUsertalk();
195 Hooks
::run( 'UserIsBlockedFrom', [ $user, $page, &$blocked, &$allowUsertalk ] );
201 * Can $user perform $action on a page? This is an internal function,
202 * with multiple levels of checks depending on performance needs; see $rigor below.
203 * It does not check wfReadOnly().
205 * @param string $action Action that permission needs to be checked for
206 * @param User $user User to check
207 * @param LinkTarget $page
208 * @param string $rigor One of PermissionManager::RIGOR_ constants
209 * - RIGOR_QUICK : does cheap permission checks from replica DBs (usable for GUI creation)
210 * - RIGOR_FULL : does cheap and expensive checks possibly from a replica DB
211 * - RIGOR_SECURE : does cheap and expensive checks, using the master as needed
212 * @param bool $short Set this to true to stop after the first permission error.
214 * @return array Array of arrays of the arguments to wfMessage to explain permissions problems.
217 private function getPermissionErrorsInternal(
221 $rigor = self
::RIGOR_SECURE
,
224 if ( !in_array( $rigor, [ self
::RIGOR_QUICK
, self
::RIGOR_FULL
, self
::RIGOR_SECURE
] ) ) {
225 throw new Exception( "Invalid rigor parameter '$rigor'." );
228 # Read has special handling
229 if ( $action == 'read' ) {
231 'checkPermissionHooks',
232 'checkReadPermissions',
233 'checkUserBlock', // for wgBlockDisablesLogin
235 # Don't call checkSpecialsAndNSPermissions, checkSiteConfigPermissions
236 # or checkUserConfigPermissions here as it will lead to duplicate
237 # error messages. This is okay to do since anywhere that checks for
238 # create will also check for edit, and those checks are called for edit.
239 } elseif ( $action == 'create' ) {
241 'checkQuickPermissions',
242 'checkPermissionHooks',
243 'checkPageRestrictions',
244 'checkCascadingSourcesRestrictions',
245 'checkActionPermissions',
250 'checkQuickPermissions',
251 'checkPermissionHooks',
252 'checkSpecialsAndNSPermissions',
253 'checkSiteConfigPermissions',
254 'checkUserConfigPermissions',
255 'checkPageRestrictions',
256 'checkCascadingSourcesRestrictions',
257 'checkActionPermissions',
263 foreach ( $checks as $method ) {
264 $errors = $this->$method( $action, $user, $errors, $rigor, $short, $page );
266 if ( $short && $errors !== [] ) {
275 * Check various permission hooks
277 * @param string $action The action to check
278 * @param User $user User to check
279 * @param array $errors List of current errors
280 * @param string $rigor One of PermissionManager::RIGOR_ constants
281 * - RIGOR_QUICK : does cheap permission checks from replica DBs (usable for GUI creation)
282 * - RIGOR_FULL : does cheap and expensive checks possibly from a replica DB
283 * - RIGOR_SECURE : does cheap and expensive checks, using the master as needed
284 * @param bool $short Short circuit on first error
286 * @param LinkTarget $page
288 * @return array List of errors
290 * @throws MWException
292 private function checkPermissionHooks(
300 // TODO: remove when LinkTarget usage will expand further
301 $page = Title
::newFromLinkTarget( $page );
302 // Use getUserPermissionsErrors instead
304 if ( !Hooks
::run( 'userCan', [ &$page, &$user, $action, &$result ] ) ) {
305 return $result ?
[] : [ [ 'badaccess-group0' ] ];
307 // Check getUserPermissionsErrors hook
308 if ( !Hooks
::run( 'getUserPermissionsErrors', [ &$page, &$user, $action, &$result ] ) ) {
309 $errors = $this->resultToError( $errors, $result );
311 // Check getUserPermissionsErrorsExpensive hook
313 $rigor !== self
::RIGOR_QUICK
314 && !( $short && count( $errors ) > 0 )
315 && !Hooks
::run( 'getUserPermissionsErrorsExpensive', [ &$page, &$user, $action, &$result ] )
317 $errors = $this->resultToError( $errors, $result );
324 * Add the resulting error code to the errors array
326 * @param array $errors List of current errors
327 * @param array $result Result of errors
329 * @return array List of errors
331 private function resultToError( $errors, $result ) {
332 if ( is_array( $result ) && count( $result ) && !is_array( $result[0] ) ) {
333 // A single array representing an error
335 } elseif ( is_array( $result ) && is_array( $result[0] ) ) {
336 // A nested array representing multiple errors
337 $errors = array_merge( $errors, $result );
338 } elseif ( $result !== '' && is_string( $result ) ) {
339 // A string representing a message-id
340 $errors[] = [ $result ];
341 } elseif ( $result instanceof MessageSpecifier
) {
342 // A message specifier representing an error
343 $errors[] = [ $result ];
344 } elseif ( $result === false ) {
345 // a generic "We don't want them to do that"
346 $errors[] = [ 'badaccess-group0' ];
352 * Check that the user is allowed to read this page.
354 * @param string $action The action to check
355 * @param User $user User to check
356 * @param array $errors List of current errors
357 * @param string $rigor One of PermissionManager::RIGOR_ constants
358 * - RIGOR_QUICK : does cheap permission checks from replica DBs (usable for GUI creation)
359 * - RIGOR_FULL : does cheap and expensive checks possibly from a replica DB
360 * - RIGOR_SECURE : does cheap and expensive checks, using the master as needed
361 * @param bool $short Short circuit on first error
363 * @param LinkTarget $page
365 * @return array List of errors
367 * @throws MWException
369 private function checkReadPermissions(
377 // TODO: remove when LinkTarget usage will expand further
378 $page = Title
::newFromLinkTarget( $page );
380 $whitelisted = false;
381 if ( User
::isEveryoneAllowed( 'read' ) ) {
382 # Shortcut for public wikis, allows skipping quite a bit of code
384 } elseif ( $user->isAllowed( 'read' ) ) {
385 # If the user is allowed to read pages, he is allowed to read all pages
387 } elseif ( $this->isSameSpecialPage( 'Userlogin', $page )
388 ||
$this->isSameSpecialPage( 'PasswordReset', $page )
389 ||
$this->isSameSpecialPage( 'Userlogout', $page )
391 # Always grant access to the login page.
392 # Even anons need to be able to log in.
394 } elseif ( is_array( $this->whitelistRead
) && count( $this->whitelistRead
) ) {
395 # Time to check the whitelist
396 # Only do these checks is there's something to check against
397 $name = $page->getPrefixedText();
398 $dbName = $page->getPrefixedDBkey();
400 // Check for explicit whitelisting with and without underscores
401 if ( in_array( $name, $this->whitelistRead
, true )
402 ||
in_array( $dbName, $this->whitelistRead
, true ) ) {
404 } elseif ( $page->getNamespace() == NS_MAIN
) {
405 # Old settings might have the title prefixed with
406 # a colon for main-namespace pages
407 if ( in_array( ':' . $name, $this->whitelistRead
) ) {
410 } elseif ( $page->isSpecialPage() ) {
411 # If it's a special page, ditch the subpage bit and check again
412 $name = $page->getDBkey();
413 list( $name, /* $subpage */ ) =
414 $this->specialPageFactory
->resolveAlias( $name );
416 $pure = SpecialPage
::getTitleFor( $name )->getPrefixedText();
417 if ( in_array( $pure, $this->whitelistRead
, true ) ) {
424 if ( !$whitelisted && is_array( $this->whitelistReadRegexp
)
425 && !empty( $this->whitelistReadRegexp
) ) {
426 $name = $page->getPrefixedText();
427 // Check for regex whitelisting
428 foreach ( $this->whitelistReadRegexp
as $listItem ) {
429 if ( preg_match( $listItem, $name ) ) {
436 if ( !$whitelisted ) {
437 # If the title is not whitelisted, give extensions a chance to do so...
438 Hooks
::run( 'TitleReadWhitelist', [ $page, $user, &$whitelisted ] );
439 if ( !$whitelisted ) {
440 $errors[] = $this->missingPermissionError( $action, $short );
448 * Get a description array when the user doesn't have the right to perform
449 * $action (i.e. when User::isAllowed() returns false)
451 * @param string $action The action to check
452 * @param bool $short Short circuit on first error
453 * @return array Array containing an error message key and any parameters
455 private function missingPermissionError( $action, $short ) {
456 // We avoid expensive display logic for quickUserCan's and such
458 return [ 'badaccess-group0' ];
461 // TODO: it would be a good idea to replace the method below with something else like
462 // maybe callback injection
463 return User
::newFatalPermissionDeniedStatus( $action )->getErrorsArray()[0];
467 * Returns true if this title resolves to the named special page
469 * @param string $name The special page name
470 * @param LinkTarget $page
474 private function isSameSpecialPage( $name, LinkTarget
$page ) {
475 if ( $page->getNamespace() == NS_SPECIAL
) {
476 list( $thisName, /* $subpage */ ) =
477 $this->specialPageFactory
->resolveAlias( $page->getDBkey() );
478 if ( $name == $thisName ) {
486 * Check that the user isn't blocked from editing.
488 * @param string $action The action to check
489 * @param User $user User to check
490 * @param array $errors List of current errors
491 * @param string $rigor One of PermissionManager::RIGOR_ constants
492 * - RIGOR_QUICK : does cheap permission checks from replica DBs (usable for GUI creation)
493 * - RIGOR_FULL : does cheap and expensive checks possibly from a replica DB
494 * - RIGOR_SECURE : does cheap and expensive checks, using the master as needed
495 * @param bool $short Short circuit on first error
497 * @param LinkTarget $page
499 * @return array List of errors
500 * @throws MWException
502 private function checkUserBlock(
510 // Account creation blocks handled at userlogin.
511 // Unblocking handled in SpecialUnblock
512 if ( $rigor === self
::RIGOR_QUICK ||
in_array( $action, [ 'createaccount', 'unblock' ] ) ) {
516 // Optimize for a very common case
517 if ( $action === 'read' && !$this->blockDisablesLogin
) {
521 if ( $this->emailConfirmToEdit
522 && !$user->isEmailConfirmed()
523 && $action === 'edit'
525 $errors[] = [ 'confirmedittext' ];
528 $useReplica = ( $rigor !== self
::RIGOR_SECURE
);
529 $block = $user->getBlock( $useReplica );
531 // If the user does not have a block, or the block they do have explicitly
532 // allows the action (like "read" or "upload").
533 if ( !$block ||
$block->appliesToRight( $action ) === false ) {
537 // Determine if the user is blocked from this action on this page.
538 // What gets passed into this method is a user right, not an action name.
539 // There is no way to instantiate an action by restriction. However, this
540 // will get the action where the restriction is the same. This may result
541 // in actions being blocked that shouldn't be.
543 if ( Action
::exists( $action ) ) {
544 // TODO: this drags a ton of dependencies in, would be good to avoid WikiPage
545 // instantiation and decouple it creating an ActionPermissionChecker interface
546 $wikiPage = WikiPage
::factory( Title
::newFromLinkTarget( $page, 'clone' ) );
547 // Creating an action will perform several database queries to ensure that
548 // the action has not been overridden by the content type.
549 // FIXME: avoid use of RequestContext since it drags in User and Title dependencies
550 // probably we may use fake context object since it's unlikely that Action uses it
551 // anyway. It would be nice if we could avoid instantiating the Action at all.
552 $actionObj = Action
::factory( $action, $wikiPage, RequestContext
::getMain() );
553 // Ensure that the retrieved action matches the restriction.
554 if ( $actionObj && $actionObj->getRestriction() !== $action ) {
559 // If no action object is returned, assume that the action requires unblock
560 // which is the default.
561 if ( !$actionObj ||
$actionObj->requiresUnblock() ) {
562 if ( $this->isBlockedFrom( $user, $page, $useReplica ) ) {
563 // @todo FIXME: Pass the relevant context into this function.
564 $errors[] = $block->getPermissionsError( RequestContext
::getMain() );
572 * Permissions checks that fail most often, and which are easiest to test.
574 * @param string $action The action to check
575 * @param User $user User to check
576 * @param array $errors List of current errors
577 * @param string $rigor One of PermissionManager::RIGOR_ constants
578 * - RIGOR_QUICK : does cheap permission checks from replica DBs (usable for GUI creation)
579 * - RIGOR_FULL : does cheap and expensive checks possibly from a replica DB
580 * - RIGOR_SECURE : does cheap and expensive checks, using the master as needed
581 * @param bool $short Short circuit on first error
583 * @param LinkTarget $page
585 * @return array List of errors
587 * @throws MWException
589 private function checkQuickPermissions(
597 // TODO: remove when LinkTarget usage will expand further
598 $page = Title
::newFromLinkTarget( $page );
600 if ( !Hooks
::run( 'TitleQuickPermissions',
601 [ $page, $user, $action, &$errors, ( $rigor !== self
::RIGOR_QUICK
), $short ] )
606 $isSubPage = $this->nsInfo
->hasSubpages( $page->getNamespace() ) ?
607 strpos( $page->getText(), '/' ) !== false : false;
609 if ( $action == 'create' ) {
611 ( $this->nsInfo
->isTalk( $page->getNamespace() ) &&
612 !$user->isAllowed( 'createtalk' ) ) ||
613 ( !$this->nsInfo
->isTalk( $page->getNamespace() ) &&
614 !$user->isAllowed( 'createpage' ) )
616 $errors[] = $user->isAnon() ?
[ 'nocreatetext' ] : [ 'nocreate-loggedin' ];
618 } elseif ( $action == 'move' ) {
619 if ( !$user->isAllowed( 'move-rootuserpages' )
620 && $page->getNamespace() == NS_USER
&& !$isSubPage ) {
621 // Show user page-specific message only if the user can move other pages
622 $errors[] = [ 'cant-move-user-page' ];
625 // Check if user is allowed to move files if it's a file
626 if ( $page->getNamespace() == NS_FILE
&& !$user->isAllowed( 'movefile' ) ) {
627 $errors[] = [ 'movenotallowedfile' ];
630 // Check if user is allowed to move category pages if it's a category page
631 if ( $page->getNamespace() == NS_CATEGORY
&& !$user->isAllowed( 'move-categorypages' ) ) {
632 $errors[] = [ 'cant-move-category-page' ];
635 if ( !$user->isAllowed( 'move' ) ) {
636 // User can't move anything
637 $userCanMove = User
::groupHasPermission( 'user', 'move' );
638 $autoconfirmedCanMove = User
::groupHasPermission( 'autoconfirmed', 'move' );
639 if ( $user->isAnon() && ( $userCanMove ||
$autoconfirmedCanMove ) ) {
640 // custom message if logged-in users without any special rights can move
641 $errors[] = [ 'movenologintext' ];
643 $errors[] = [ 'movenotallowed' ];
646 } elseif ( $action == 'move-target' ) {
647 if ( !$user->isAllowed( 'move' ) ) {
648 // User can't move anything
649 $errors[] = [ 'movenotallowed' ];
650 } elseif ( !$user->isAllowed( 'move-rootuserpages' )
651 && $page->getNamespace() == NS_USER
&& !$isSubPage ) {
652 // Show user page-specific message only if the user can move other pages
653 $errors[] = [ 'cant-move-to-user-page' ];
654 } elseif ( !$user->isAllowed( 'move-categorypages' )
655 && $page->getNamespace() == NS_CATEGORY
) {
656 // Show category page-specific message only if the user can move other pages
657 $errors[] = [ 'cant-move-to-category-page' ];
659 } elseif ( !$user->isAllowed( $action ) ) {
660 $errors[] = $this->missingPermissionError( $action, $short );
667 * Check against page_restrictions table requirements on this
668 * page. The user must possess all required rights for this
671 * @param string $action The action to check
672 * @param User $user User to check
673 * @param array $errors List of current errors
674 * @param string $rigor One of PermissionManager::RIGOR_ constants
675 * - RIGOR_QUICK : does cheap permission checks from replica DBs (usable for GUI creation)
676 * - RIGOR_FULL : does cheap and expensive checks possibly from a replica DB
677 * - RIGOR_SECURE : does cheap and expensive checks, using the master as needed
678 * @param bool $short Short circuit on first error
680 * @param LinkTarget $page
682 * @return array List of errors
684 private function checkPageRestrictions(
692 // TODO: remove & rework upon further use of LinkTarget
693 $page = Title
::newFromLinkTarget( $page );
694 foreach ( $page->getRestrictions( $action ) as $right ) {
695 // Backwards compatibility, rewrite sysop -> editprotected
696 if ( $right == 'sysop' ) {
697 $right = 'editprotected';
699 // Backwards compatibility, rewrite autoconfirmed -> editsemiprotected
700 if ( $right == 'autoconfirmed' ) {
701 $right = 'editsemiprotected';
703 if ( $right == '' ) {
706 if ( !$user->isAllowed( $right ) ) {
707 $errors[] = [ 'protectedpagetext', $right, $action ];
708 } elseif ( $page->areRestrictionsCascading() && !$user->isAllowed( 'protect' ) ) {
709 $errors[] = [ 'protectedpagetext', 'protect', $action ];
717 * Check restrictions on cascading pages.
719 * @param string $action The action to check
720 * @param User $user User to check
721 * @param array $errors List of current errors
722 * @param string $rigor One of PermissionManager::RIGOR_ constants
723 * - RIGOR_QUICK : does cheap permission checks from replica DBs (usable for GUI creation)
724 * - RIGOR_FULL : does cheap and expensive checks possibly from a replica DB
725 * - RIGOR_SECURE : does cheap and expensive checks, using the master as needed
726 * @param bool $short Short circuit on first error
728 * @param LinkTarget $page
730 * @return array List of errors
732 private function checkCascadingSourcesRestrictions(
740 // TODO: remove & rework upon further use of LinkTarget
741 $page = Title
::newFromLinkTarget( $page );
742 if ( $rigor !== self
::RIGOR_QUICK
&& !$page->isUserConfigPage() ) {
743 # We /could/ use the protection level on the source page, but it's
744 # fairly ugly as we have to establish a precedence hierarchy for pages
745 # included by multiple cascade-protected pages. So just restrict
746 # it to people with 'protect' permission, as they could remove the
748 list( $cascadingSources, $restrictions ) = $page->getCascadeProtectionSources();
749 # Cascading protection depends on more than this page...
750 # Several cascading protected pages may include this page...
751 # Check each cascading level
752 # This is only for protection restrictions, not for all actions
753 if ( isset( $restrictions[$action] ) ) {
754 foreach ( $restrictions[$action] as $right ) {
755 // Backwards compatibility, rewrite sysop -> editprotected
756 if ( $right == 'sysop' ) {
757 $right = 'editprotected';
759 // Backwards compatibility, rewrite autoconfirmed -> editsemiprotected
760 if ( $right == 'autoconfirmed' ) {
761 $right = 'editsemiprotected';
763 if ( $right != '' && !$user->isAllowedAll( 'protect', $right ) ) {
765 foreach ( $cascadingSources as $wikiPage ) {
766 $wikiPages .= '* [[:' . $wikiPage->getPrefixedText() . "]]\n";
768 $errors[] = [ 'cascadeprotected', count( $cascadingSources ), $wikiPages, $action ];
778 * Check action permissions not already checked in checkQuickPermissions
780 * @param string $action The action to check
781 * @param User $user User to check
782 * @param array $errors List of current errors
783 * @param string $rigor One of PermissionManager::RIGOR_ constants
784 * - RIGOR_QUICK : does cheap permission checks from replica DBs (usable for GUI creation)
785 * - RIGOR_FULL : does cheap and expensive checks possibly from a replica DB
786 * - RIGOR_SECURE : does cheap and expensive checks, using the master as needed
787 * @param bool $short Short circuit on first error
789 * @param LinkTarget $page
791 * @return array List of errors
794 private function checkActionPermissions(
802 global $wgDeleteRevisionsLimit, $wgLang;
804 // TODO: remove & rework upon further use of LinkTarget
805 $page = Title
::newFromLinkTarget( $page );
807 if ( $action == 'protect' ) {
808 if ( count( $this->getPermissionErrorsInternal( 'edit', $user, $page, $rigor, true ) ) ) {
809 // If they can't edit, they shouldn't protect.
810 $errors[] = [ 'protect-cantedit' ];
812 } elseif ( $action == 'create' ) {
813 $title_protection = $page->getTitleProtection();
814 if ( $title_protection ) {
815 if ( $title_protection['permission'] == ''
816 ||
!$user->isAllowed( $title_protection['permission'] )
820 // TODO: get rid of the User dependency
821 User
::whoIs( $title_protection['user'] ),
822 $title_protection['reason']
826 } elseif ( $action == 'move' ) {
827 // Check for immobile pages
828 if ( !$this->nsInfo
->isMovable( $page->getNamespace() ) ) {
829 // Specific message for this case
830 $errors[] = [ 'immobile-source-namespace', $page->getNsText() ];
831 } elseif ( !$page->isMovable() ) {
832 // Less specific message for rarer cases
833 $errors[] = [ 'immobile-source-page' ];
835 } elseif ( $action == 'move-target' ) {
836 if ( !$this->nsInfo
->isMovable( $page->getNamespace() ) ) {
837 $errors[] = [ 'immobile-target-namespace', $page->getNsText() ];
838 } elseif ( !$page->isMovable() ) {
839 $errors[] = [ 'immobile-target-page' ];
841 } elseif ( $action == 'delete' ) {
842 $tempErrors = $this->checkPageRestrictions( 'edit', $user, [], $rigor, true, $page );
843 if ( !$tempErrors ) {
844 $tempErrors = $this->checkCascadingSourcesRestrictions( 'edit',
845 $user, $tempErrors, $rigor, true, $page );
848 // If protection keeps them from editing, they shouldn't be able to delete.
849 $errors[] = [ 'deleteprotected' ];
851 if ( $rigor !== self
::RIGOR_QUICK
&& $wgDeleteRevisionsLimit
852 && !$this->userCan( 'bigdelete', $user, $page ) && $page->isBigDeletion()
854 $errors[] = [ 'delete-toobig', $wgLang->formatNum( $wgDeleteRevisionsLimit ) ];
856 } elseif ( $action === 'undelete' ) {
857 if ( count( $this->getPermissionErrorsInternal( 'edit', $user, $page, $rigor, true ) ) ) {
858 // Undeleting implies editing
859 $errors[] = [ 'undelete-cantedit' ];
861 if ( !$page->exists()
862 && count( $this->getPermissionErrorsInternal( 'create', $user, $page, $rigor, true ) )
864 // Undeleting where nothing currently exists implies creating
865 $errors[] = [ 'undelete-cantcreate' ];
872 * Check permissions on special pages & namespaces
874 * @param string $action The action to check
875 * @param User $user User to check
876 * @param array $errors List of current errors
877 * @param string $rigor One of PermissionManager::RIGOR_ constants
878 * - RIGOR_QUICK : does cheap permission checks from replica DBs (usable for GUI creation)
879 * - RIGOR_FULL : does cheap and expensive checks possibly from a replica DB
880 * - RIGOR_SECURE : does cheap and expensive checks, using the master as needed
881 * @param bool $short Short circuit on first error
883 * @param LinkTarget $page
885 * @return array List of errors
887 private function checkSpecialsAndNSPermissions(
895 // TODO: remove & rework upon further use of LinkTarget
896 $page = Title
::newFromLinkTarget( $page );
898 # Only 'createaccount' can be performed on special pages,
899 # which don't actually exist in the DB.
900 if ( $page->getNamespace() == NS_SPECIAL
&& $action !== 'createaccount' ) {
901 $errors[] = [ 'ns-specialprotected' ];
904 # Check $wgNamespaceProtection for restricted namespaces
905 if ( $page->isNamespaceProtected( $user ) ) {
906 $ns = $page->getNamespace() == NS_MAIN ?
907 wfMessage( 'nstab-main' )->text() : $page->getNsText();
908 $errors[] = $page->getNamespace() == NS_MEDIAWIKI ?
909 [ 'protectedinterface', $action ] : [ 'namespaceprotected', $ns, $action ];
916 * Check sitewide CSS/JSON/JS permissions
918 * @param string $action The action to check
919 * @param User $user User to check
920 * @param array $errors List of current errors
921 * @param string $rigor One of PermissionManager::RIGOR_ constants
922 * - RIGOR_QUICK : does cheap permission checks from replica DBs (usable for GUI creation)
923 * - RIGOR_FULL : does cheap and expensive checks possibly from a replica DB
924 * - RIGOR_SECURE : does cheap and expensive checks, using the master as needed
925 * @param bool $short Short circuit on first error
927 * @param LinkTarget $page
929 * @return array List of errors
931 private function checkSiteConfigPermissions(
939 // TODO: remove & rework upon further use of LinkTarget
940 $page = Title
::newFromLinkTarget( $page );
942 if ( $action != 'patrol' ) {
944 // Sitewide CSS/JSON/JS changes, like all NS_MEDIAWIKI changes, also require the
945 // editinterface right. That's implemented as a restriction so no check needed here.
946 if ( $page->isSiteCssConfigPage() && !$user->isAllowed( 'editsitecss' ) ) {
947 $error = [ 'sitecssprotected', $action ];
948 } elseif ( $page->isSiteJsonConfigPage() && !$user->isAllowed( 'editsitejson' ) ) {
949 $error = [ 'sitejsonprotected', $action ];
950 } elseif ( $page->isSiteJsConfigPage() && !$user->isAllowed( 'editsitejs' ) ) {
951 $error = [ 'sitejsprotected', $action ];
952 } elseif ( $page->isRawHtmlMessage() ) {
953 // Raw HTML can be used to deploy CSS or JS so require rights for both.
954 if ( !$user->isAllowed( 'editsitejs' ) ) {
955 $error = [ 'sitejsprotected', $action ];
956 } elseif ( !$user->isAllowed( 'editsitecss' ) ) {
957 $error = [ 'sitecssprotected', $action ];
962 if ( $user->isAllowed( 'editinterface' ) ) {
963 // Most users / site admins will probably find out about the new, more restrictive
964 // permissions by failing to edit something. Give them more info.
965 // TODO remove this a few release cycles after 1.32
966 $error = [ 'interfaceadmin-info', wfMessage( $error[0], $error[1] ) ];
976 * Check CSS/JSON/JS sub-page permissions
978 * @param string $action The action to check
979 * @param User $user User to check
980 * @param array $errors List of current errors
981 * @param string $rigor One of PermissionManager::RIGOR_ constants
982 * - RIGOR_QUICK : does cheap permission checks from replica DBs (usable for GUI creation)
983 * - RIGOR_FULL : does cheap and expensive checks possibly from a replica DB
984 * - RIGOR_SECURE : does cheap and expensive checks, using the master as needed
985 * @param bool $short Short circuit on first error
987 * @param LinkTarget $page
989 * @return array List of errors
991 private function checkUserConfigPermissions(
999 // TODO: remove & rework upon further use of LinkTarget
1000 $page = Title
::newFromLinkTarget( $page );
1002 # Protect css/json/js subpages of user pages
1003 # XXX: this might be better using restrictions
1005 if ( $action === 'patrol' ) {
1009 if ( preg_match( '/^' . preg_quote( $user->getName(), '/' ) . '\//', $page->getText() ) ) {
1010 // Users need editmyuser* to edit their own CSS/JSON/JS subpages.
1012 $page->isUserCssConfigPage()
1013 && !$user->isAllowedAny( 'editmyusercss', 'editusercss' )
1015 $errors[] = [ 'mycustomcssprotected', $action ];
1017 $page->isUserJsonConfigPage()
1018 && !$user->isAllowedAny( 'editmyuserjson', 'edituserjson' )
1020 $errors[] = [ 'mycustomjsonprotected', $action ];
1022 $page->isUserJsConfigPage()
1023 && !$user->isAllowedAny( 'editmyuserjs', 'edituserjs' )
1025 $errors[] = [ 'mycustomjsprotected', $action ];
1028 // Users need editmyuser* to edit their own CSS/JSON/JS subpages, except for
1029 // deletion/suppression which cannot be used for attacks and we want to avoid the
1030 // situation where an unprivileged user can post abusive content on their subpages
1031 // and only very highly privileged users could remove it.
1032 if ( !in_array( $action, [ 'delete', 'deleterevision', 'suppressrevision' ], true ) ) {
1034 $page->isUserCssConfigPage()
1035 && !$user->isAllowed( 'editusercss' )
1037 $errors[] = [ 'customcssprotected', $action ];
1039 $page->isUserJsonConfigPage()
1040 && !$user->isAllowed( 'edituserjson' )
1042 $errors[] = [ 'customjsonprotected', $action ];
1044 $page->isUserJsConfigPage()
1045 && !$user->isAllowed( 'edituserjs' )
1047 $errors[] = [ 'customjsprotected', $action ];