Merge "Apply IP blocks to X-Forwarded-For header"

[lhc/web/wiklou.git] / includes / User.php

diff --git a/includes/User.php b/includes/User.php
index 2b7c787..dc68502 100644 (file)
--- a/includes/User.php
+++ b/includes/User.php
@@ -1271,7 +1271,7 @@ class User {
         *                    done against master.
         */
        private function getBlockedStatus( $bFromSlave = true ) {
-               global $wgProxyWhitelist, $wgUser;
+               global $wgProxyWhitelist, $wgUser, $wgApplyIpBlocksToXff;
 
                if ( -1 != $this->mBlockedby ) {
                        return;
@@ -1317,6 +1317,25 @@ class User {
                        }
                }
 
+               # (bug 23343) Apply IP blocks to the contents of XFF headers, if enabled
+               if ( !$block instanceof Block
+                       && $wgApplyIpBlocksToXff
+                       && $ip !== null
+                       && !$this->isAllowed( 'proxyunbannable' )
+                       && !in_array( $ip, $wgProxyWhitelist )
+               ) {
+                       $xff = $this->getRequest()->getHeader( 'X-Forwarded-For' );
+                       $xff = array_map( 'trim', explode( ',', $xff ) );
+                       $xff = array_diff( $xff, array( $ip ) );
+                       $xffblocks = Block::getBlocksForIPList( $xff, $this->isAnon(), !$bFromSlave );
+                       $block = Block::chooseBlock( $xffblocks, $xff );
+                       if ( $block instanceof Block ) {
+                               # Mangle the reason to alert the user that the block
+                               # originated from matching the X-Forwarded-For header.
+                               $block->mReason = wfMessage( 'xffblockreason', $block->mReason )->text();
+                       }
+               }
+
                if ( $block instanceof Block ) {
                        wfDebug( __METHOD__ . ": Found block.\n" );
                        $this->mBlock = $block;
@@ -1330,7 +1349,7 @@ class User {
                        $this->mAllowUsertalk = false;
                }
 
-               # Extensions
+               // Extensions
                wfRunHooks( 'GetBlockedStatus', array( &$this ) );
 
                wfProfileOut( __METHOD__ );