From: Brad Jorsch <bjorsch@wikimedia.org>
Date: Wed, 3 Feb 2016 17:33:25 +0000 (-0500)
Subject: Avoid unstubbing $wgUser before the end of Setup.php in User::getBlockedStatus()
X-Git-Tag: 1.31.0-rc.0~8084^2
X-Git-Url: http://git.cyclocoop.org/%40spipnet%40?a=commitdiff_plain;h=6eec9fb3553d759190f010b38db39d01645922bb;p=lhc%2Fweb%2Fwiklou.git

Avoid unstubbing $wgUser before the end of Setup.php in User::getBlockedStatus()

Autocreation needs to check if the current IP is blocked from account
creation.

There are two ways we could go here: treat $wgUser as logged-out, or
assume it will eventually be the user name specified by the session.
This patch chooses the former, by the logic that at this early point in
the setup process we don't have a logged-in user determined yet so no
username can really be considered to match the logged-in user.

Bug: T124367
Change-Id: I631bec85291b57f07c378cf6554a8f06cf3fb00c
---

diff --git a/includes/user/User.php b/includes/user/User.php
index 8e3b2ecbc9..3635f5c0d6 100644
--- a/includes/user/User.php
+++ b/includes/user/User.php
@@ -1535,10 +1535,16 @@ class User implements IDBAccessObject {
 		# We only need to worry about passing the IP address to the Block generator if the
 		# user is not immune to autoblocks/hardblocks, and they are the current user so we
 		# know which IP address they're actually coming from
-		if ( !$this->isAllowed( 'ipblock-exempt' ) && $this->equals( $wgUser ) ) {
-			$ip = $this->getRequest()->getIP();
-		} else {
-			$ip = null;
+		$ip = null;
+		if ( !$this->isAllowed( 'ipblock-exempt' ) ) {
+			// $wgUser->getName() only works after the end of Setup.php. Until
+			// then, assume it's a logged-out user.
+			$globalUserName = $wgUser->isSafeToLoad()
+				? $wgUser->getName()
+				: IP::sanitizeIP( $wgUser->getRequest()->getIP() );
+			if ( $this->getName() === $globalUserName ) {
+				$ip = $this->getRequest()->getIP();
+			}
 		}
 
 		// User/IP blocking