* Fixed unblocking of hidden names (bug 18543)

* Added permission check

diff --git a/includes/specials/SpecialBlockip.php b/includes/specials/SpecialBlockip.php
index 1fc5f69..b8c92e8 100644 (file)
--- a/includes/specials/SpecialBlockip.php
+++ b/includes/specials/SpecialBlockip.php
@@ -445,7 +445,7 @@ class IPBlockForm {
                                        $log_action = 'reblock';
                                        # Unset _deleted fields if requested
                                        if( $currentBlock->mHideName && !$this->BlockHideName ) {
-                                               $this->unsuppressUserName( $this->BlockAddress, $userId );
+                                               self::unsuppressUserName( $this->BlockAddress, $userId );
                                        }
                                }
                        } else {
@@ -455,7 +455,7 @@ class IPBlockForm {
 
                        # Set *_deleted fields if requested
                        if( $this->BlockHideName ) {
-                               $this->suppressUserName( $this->BlockAddress, $userId );
+                               self::suppressUserName( $this->BlockAddress, $userId );
                        }
 
                        if ( $this->BlockWatchUser &&
@@ -486,17 +486,17 @@ class IPBlockForm {
                }
        }
        
-       private function suppressUserName( $name, $userId ) {
+       public static function suppressUserName( $name, $userId ) {
                $op = '|'; // bitwise OR
-               return $this->setUsernameBitfields( $name, $userId, $op );
+               return self::setUsernameBitfields( $name, $userId, $op );
        }
        
-       private function unsuppressUserName( $name, $userId ) {
+       public static function unsuppressUserName( $name, $userId ) {
                $op = '&'; // bitwise AND
-               return $this->setUsernameBitfields( $name, $userId, $op );
+               return self::setUsernameBitfields( $name, $userId, $op );
        }
        
-       private function setUsernameBitfields( $name, $userId, $op ) {
+       private static function setUsernameBitfields( $name, $userId, $op ) {
                if( $op !== '|' && $op !== '&' ) return false; // sanity check
                $dbw = wfGetDB( DB_MASTER );
                $delUser = Revision::DELETED_USER | Revision::DELETED_RESTRICTED;
@@ -509,8 +509,10 @@ class IPBlockForm {
                # current bitfields with the inverse of Revision::DELETED_USER. The
                # username bit is made to 0 (x & 0 = 0), while others are unchanged (x & 1 = x).
                # The same goes for the sysop-restricted *_deleted bit.
-               if( $op == '&' ) $delUser = "~{$delUser}";
-               if( $op == '&' ) $delAction = "~{$delAction}";
+               if( $op == '&' ) {
+                       $delUser = "~{$delUser}";
+                       $delAction = "~{$delAction}";
+               }
                # Hide name from live edits
                $dbw->update( 'revision', array("rev_deleted = rev_deleted $op $delUser"),
                        array('rev_user' => $userId), __METHOD__ );

diff --git a/includes/specials/SpecialIpblocklist.php b/includes/specials/SpecialIpblocklist.php
index ae808e3..02d862f 100644 (file)
--- a/includes/specials/SpecialIpblocklist.php
+++ b/includes/specials/SpecialIpblocklist.php
@@ -162,7 +162,7 @@ class IPUnblockForm {
         * @return array array(message key, parameters) on failure, empty array on success
         */
 
-       static function doUnblock(&$id, &$ip, &$reason, &$range = null) {
+       static function doUnblock(&$id, &$ip, &$reason, &$range = null, $blocker=null) {
                if ( $id ) {
                        $block = Block::newFromID( $id );
                        if ( !$block ) {
@@ -184,8 +184,7 @@ class IPUnblockForm {
                                if ( !$block ) {
                                        return array('ipb_cant_unblock', htmlspecialchars($id));
                                }
-                               if( $block->mRangeStart != $block->mRangeEnd
-                                               && !strstr( $ip, "/" ) ) {
+                               if( $block->mRangeStart != $block->mRangeEnd && !strstr( $ip, "/" ) ) {
                                        /* If the specified IP is a single address, and the block is
                                         * a range block, don't unblock the range. */
                                         $range = $block->mAddress;
@@ -195,11 +194,22 @@ class IPUnblockForm {
                }
                // Yes, this is really necessary
                $id = $block->mId;
+               
+               # If the name was hidden and the blocking user cannot hide
+               # names, then don't allow any block removals...
+               if( $blocker && $block->mHideName && !$blocker->isAllowed('hideuser') ) {
+                       return array('ipb_cant_unblock', htmlspecialchars($id));
+               }
 
                # Delete block
                if ( !$block->delete() ) {
                        return array('ipb_cant_unblock', htmlspecialchars($id));
                }
+               
+               # Unset _deleted fields as needed
+               if( $block->mHideName ) {
+                       IPBlockForm::unsuppressUserName( $block->mAddress, $block->mUser );
+               }
 
                # Make log entry
                $log = new LogPage( 'block' );
@@ -208,10 +218,9 @@ class IPUnblockForm {
        }
 
        function doSubmit() {
-               global $wgOut;
-               $retval = self::doUnblock($this->id, $this->ip, $this->reason, $range);
-               if(!empty($retval))
-               {
+               global $wgOut, $wgUser;
+               $retval = self::doUnblock($this->id, $this->ip, $this->reason, $range, $wgUser);
+               if( !empty($retval) ) {
                        $key = array_shift($retval);
                        $this->showForm(wfMsgReal($key, $retval));
                        return;