Fix cross site scripting bug
[lhc/web/wiklou.git] / includes / SpecialIpblocklist.php
1 <?php
2 /**
3 *
4 * @package MediaWiki
5 * @subpackage SpecialPage
6 */
7
8 /**
9 *
10 */
11 function wfSpecialIpblocklist() {
12 global $wgUser, $wgOut, $wgRequest;
13
14 $ip = $wgRequest->getVal( 'wpUnblockAddress', $wgRequest->getVal( 'ip' ) );
15 $reason = $wgRequest->getText( 'wpUnblockReason' );
16 $action = $wgRequest->getText( 'action' );
17
18 $ipu = new IPUnblockForm( $ip, $reason );
19
20 if ( "success" == $action ) {
21 $msg = wfMsg( "ipusuccess", htmlspecialchars( $ip ) );
22 $ipu->showList( $msg );
23 } else if ( "submit" == $action && $wgRequest->wasPosted() ) {
24 if ( ! $wgUser->isSysop() ) {
25 $wgOut->sysopRequired();
26 return;
27 }
28 $ipu->doSubmit();
29 } else if ( "unblock" == $action ) {
30 $ipu->showForm( "" );
31 } else {
32 $ipu->showList( "" );
33 }
34 }
35
36 /**
37 *
38 * @package MediaWiki
39 * @subpackage SpecialPage
40 */
41 class IPUnblockForm {
42 var $ip, $reason;
43
44 function IPUnblockForm( $ip, $reason ) {
45 $this->ip = $ip;
46 $this->reason = $reason;
47 }
48
49 function showForm( $err )
50 {
51 global $wgOut, $wgUser, $wgLang;
52
53 $wgOut->setPagetitle( wfMsg( "unblockip" ) );
54 $wgOut->addWikiText( wfMsg( "unblockiptext" ) );
55
56 $ipa = wfMsg( "ipaddress" );
57 $ipr = wfMsg( "ipbreason" );
58 $ipus = htmlspecialchars( wfMsg( "ipusubmit" ) );
59 $titleObj = Title::makeTitle( NS_SPECIAL, "Ipblocklist" );
60 $action = $titleObj->escapeLocalURL( "action=submit" );
61
62 if ( "" != $err ) {
63 $wgOut->setSubtitle( wfMsg( "formerror" ) );
64 $wgOut->addHTML( "<p class='error'>{$err}</p>\n" );
65 }
66
67 $wgOut->addHTML( "
68 <form id=\"unblockip\" method=\"post\" action=\"{$action}\">
69 <table border='0'>
70 <tr>
71 <td align='right'>{$ipa}:</td>
72 <td align='left'>
73 <input tabindex='1' type='text' size='20' name=\"wpUnblockAddress\" value=\"" . htmlspecialchars( $this->ip ) . "\" />
74 </td>
75 </tr>
76 <tr>
77 <td align='right'>{$ipr}:</td>
78 <td align='left'>
79 <input tabindex='1' type='text' size='40' name=\"wpUnblockReason\" value=\"" . htmlspecialchars( $this->reason ) . "\" />
80 </td>
81 </tr>
82 <tr>
83 <td>&nbsp;</td>
84 <td align='left'>
85 <input tabindex='2' type='submit' name=\"wpBlock\" value=\"{$ipus}\" />
86 </td>
87 </tr>
88 </table>
89 </form>\n" );
90
91 }
92
93 function doSubmit() {
94 global $wgOut, $wgUser, $wgLang;
95
96 $block = new Block();
97 $this->ip = trim( $this->ip );
98
99 if ( $this->ip{0} == "#" ) {
100 $block->mId = substr( $this->ip, 1 );
101 } else {
102 $block->mAddress = $this->ip;
103 }
104
105 # Delete block (if it exists)
106 # We should probably check for errors rather than just declaring success
107 $block->delete();
108
109 # Make log entry
110 $log = new LogPage( 'block' );
111 $log->addEntry( 'unblock', Title::makeTitle( NS_USER, $this->ip ), $this->reason );
112
113 # Report to the user
114 $titleObj = Title::makeTitle( NS_SPECIAL, "Ipblocklist" );
115 $success = $titleObj->getFullURL( "action=success&ip=" . urlencode( $this->ip ) );
116 $wgOut->redirect( $success );
117 }
118
119 function showList( $msg ) {
120 global $wgOut;
121
122 $wgOut->setPagetitle( wfMsg( "ipblocklist" ) );
123 if ( "" != $msg ) {
124 $wgOut->setSubtitle( $msg );
125 }
126 $wgOut->addHTML( "<ul>" );
127 Block::enumBlocks( "wfAddRow", 0 );
128 $wgOut->addHTML( "</ul>\n" );
129 }
130 }
131
132 /**
133 * Callback function to output a block
134 */
135 function wfAddRow( $block, $tag ) {
136 global $wgOut, $wgUser, $wgLang, $wgContLang;
137
138 $sk = $wgUser->getSkin();
139
140 # Hide addresses blocked by User::spreadBlocks, for privacy
141 $addr = $block->mAuto ? "#{$block->mId}" : $block->mAddress;
142
143 $name = User::whoIs( $block->mBy );
144 $ulink = $sk->makeKnownLink( $wgContLang->getNsText( Namespace::getUser() ). ":{$name}", $name );
145 $formattedTime = $wgLang->timeanddate( $block->mTimestamp, true );
146
147 if ( $block->mExpiry === "" ) {
148 $formattedExpiry = "indefinite";
149 } else {
150 $formattedExpiry = $wgLang->timeanddate( $block->mExpiry, true );
151 }
152
153 $line = wfMsg( "blocklistline", $formattedTime, $ulink, $addr, $formattedExpiry );
154
155 $wgOut->addHTML( "<li>{$line}" );
156
157 if ( !$block->mAuto ) {
158 $titleObj = Title::makeTitle( NS_SPECIAL, "Contributions" );
159 $clink = "<a href=\"" . $titleObj->escapeLocalURL( "target={$block->mAddress}" ) . "\">" .
160 wfMsg( "contribslink" ) . "</a>";
161 $wgOut->addHTML( " ({$clink})" );
162 }
163
164 if ( $wgUser->isSysop() ) {
165 $titleObj = Title::makeTitle( NS_SPECIAL, "Ipblocklist" );
166 $ublink = "<a href=\"" .
167 $titleObj->escapeLocalURL( "action=unblock&ip=" . urlencode( $addr ) ) . "\">" .
168 wfMsg( "unblocklink" ) . "</a>";
169 $wgOut->addHTML( " ({$ublink})" );
170 }
171 if ( "" != $block->mReason ) {
172 $wgOut->addHTML( " <em>(" . htmlspecialchars( $block->mReason ) .
173 ")</em>" );
174 }
175 $wgOut->addHTML( "</li>\n" );
176 }
177
178
179 ?>