Merge "Use the request object provided in User::setCookies"

[lhc/web/wiklou.git] / includes / User.php

diff --git a/includes/User.php b/includes/User.php
index ad4ce60..7025717 100644 (file)
--- a/includes/User.php
+++ b/includes/User.php
@@ -134,6 +134,7 @@ class User implements IDBAccessObject {
                'import',
                'importupload',
                'ipblock-exempt',
+               'managechangetags',
                'markbotedits',
                'mergehistory',
                'minoredit',
@@ -3008,20 +3009,24 @@ class User implements IDBAccessObject {
         * Add the user to the given group.
         * This takes immediate effect.
         * @param string $group Name of the group to add
+        * @return bool
         */
        public function addGroup( $group ) {
-               if ( Hooks::run( 'UserAddGroup', array( $this, &$group ) ) ) {
-                       $dbw = wfGetDB( DB_MASTER );
-                       if ( $this->getId() ) {
-                               $dbw->insert( 'user_groups',
-                                       array(
-                                               'ug_user' => $this->getID(),
-                                               'ug_group' => $group,
-                                       ),
-                                       __METHOD__,
-                                       array( 'IGNORE' ) );
-                       }
+               if ( !Hooks::run( 'UserAddGroup', array( $this, &$group ) ) ) {
+                       return false;
+               }
+
+               $dbw = wfGetDB( DB_MASTER );
+               if ( $this->getId() ) {
+                       $dbw->insert( 'user_groups',
+                               array(
+                                       'ug_user' => $this->getID(),
+                                       'ug_group' => $group,
+                               ),
+                               __METHOD__,
+                               array( 'IGNORE' ) );
                }
+
                $this->loadGroups();
                $this->mGroups[] = $group;
                // In case loadGroups was not called before, we now have the right twice.
@@ -3034,31 +3039,39 @@ class User implements IDBAccessObject {
                $this->mRights = null;
 
                $this->invalidateCache();
+
+               return true;
        }
 
        /**
         * Remove the user from the given group.
         * This takes immediate effect.
         * @param string $group Name of the group to remove
+        * @return bool
         */
        public function removeGroup( $group ) {
                $this->load();
-               if ( Hooks::run( 'UserRemoveGroup', array( $this, &$group ) ) ) {
-                       $dbw = wfGetDB( DB_MASTER );
-                       $dbw->delete( 'user_groups',
-                               array(
-                                       'ug_user' => $this->getID(),
-                                       'ug_group' => $group,
-                               ), __METHOD__ );
-                       // Remember that the user was in this group
-                       $dbw->insert( 'user_former_groups',
-                               array(
-                                       'ufg_user' => $this->getID(),
-                                       'ufg_group' => $group,
-                               ),
-                               __METHOD__,
-                               array( 'IGNORE' ) );
+               if ( !Hooks::run( 'UserRemoveGroup', array( $this, &$group ) ) ) {
+                       return false;
                }
+
+               $dbw = wfGetDB( DB_MASTER );
+               $dbw->delete( 'user_groups',
+                       array(
+                               'ug_user' => $this->getID(),
+                               'ug_group' => $group,
+                       ), __METHOD__
+               );
+               // Remember that the user was in this group
+               $dbw->insert( 'user_former_groups',
+                       array(
+                               'ufg_user' => $this->getID(),
+                               'ufg_group' => $group,
+                       ),
+                       __METHOD__,
+                       array( 'IGNORE' )
+               );
+
                $this->loadGroups();
                $this->mGroups = array_diff( $this->mGroups, array( $group ) );
 
@@ -3068,6 +3081,8 @@ class User implements IDBAccessObject {
                $this->mRights = null;
 
                $this->invalidateCache();
+
+               return true;
        }
 
        /**
@@ -3353,10 +3368,15 @@ class User implements IDBAccessObject {
         *  false: Force NOT setting the secure attribute when setting the cookie
         *  null (default): Use the default ($wgCookieSecure) to set the secure attribute
         * @param array $params Array of options sent passed to WebResponse::setcookie()
+        * @param WebRequest|null $request WebRequest object to use; $wgRequest will be used if null
+        *        is passed.
         */
-       protected function setCookie( $name, $value, $exp = 0, $secure = null, $params = array() ) {
+       protected function setCookie( $name, $value, $exp = 0, $secure = null, $params = array(), $request = null ) {
+               if ( $request === null ) {
+                       $request = $this->getRequest();
+               }
                $params['secure'] = $secure;
-               $this->getRequest()->response()->setcookie( $name, $value, $exp, $params );
+               $request->response()->setcookie( $name, $value, $exp, $params );
        }
 
        /**
@@ -3421,7 +3441,7 @@ class User implements IDBAccessObject {
                        if ( $value === false ) {
                                $this->clearCookie( $name );
                        } else {
-                               $this->setCookie( $name, $value, 0, $secure );
+                               $this->setCookie( $name, $value, 0, $secure, array(), $request );
                        }
                }
 
@@ -3922,6 +3942,20 @@ class User implements IDBAccessObject {
                return MWCryptRand::generateHex( 32 );
        }
 
+       /**
+        * Get the embedded timestamp from a token.
+        * @param string $val Input token
+        * @return int|null
+        */
+       public static function getEditTokenTimestamp( $val ) {
+               $suffixLen = strlen( self::EDIT_TOKEN_SUFFIX );
+               if ( strlen( $val ) <= 32 + $suffixLen ) {
+                       return null;
+               }
+
+               return hexdec( substr( $val, 32, -$suffixLen ) );
+       }
+
        /**
         * Check given value against the token value stored in the session.
         * A match should confirm that the form was submitted from the
@@ -3939,12 +3973,10 @@ class User implements IDBAccessObject {
                        return $val === self::EDIT_TOKEN_SUFFIX;
                }
 
-               $suffixLen = strlen( self::EDIT_TOKEN_SUFFIX );
-               if ( strlen( $val ) <= 32 + $suffixLen ) {
+               $timestamp = self::getEditTokenTimestamp( $val );
+               if ( $timestamp === null ) {
                        return false;
                }
-
-               $timestamp = hexdec( substr( $val, 32, -$suffixLen ) );
                if ( $maxage !== null && $timestamp < wfTimestamp() - $maxage ) {
                        // Expired token
                        return false;