Merge "Add new authentication-related hooks (and remove one) replacing some AuthPlugi...

diff --combined RELEASE-NOTES-1.26
index 19309a8,9d07d04..47c751e
--- 1/RELEASE-NOTES-1.26
--- 2/RELEASE-NOTES-1.26
+++ b/RELEASE-NOTES-1.26
@@@ -30,6 -30,17 +30,17 @@@ production
  * Custom LESS functions (defined via $wgResourceLoaderLESSFunctions)
    have been removed, after being deprecated in 1.24.
  * $wgAlwaysUseTidy has been removed.
+ * ResetSessionID hook has been removed. Nothing seems to use it.
+ * Certain AuthPlugin methods are deprecated in favor of new hooks:
+ ** AuthPlugin::initUser() is replaced by LocalUserCreated.
+ ** AuthPlugin::updateUser() is replaced by UserLoggedIn.
+ ** AuthPlugin::updateExternalDB() is replaced by the existing UserSaveSettings.
+ ** AuthPlugin::updateExternalDBGroups() is replaced by UserGroupsChanged.
+ ** AuthPluginUser::isHidden() is replaced by UserIsHidden.
+ ** AuthPluginUser::isLocked() is replaced by UserIsLocked.
+ * The UserRights hook is deprecated in favor of the new UserGroupsChanged hook.
+ * AuthPlugin::initUser() and AuthPlugin::updateUser() should no longer replace
+   the passed User object.
  
  === New features in 1.26 ===
  * (T51506) Now action=info gives estimates of actual watchers for a page.
@@@ -187,9 -198,6 +198,9 @@@ changes to languages because of Phabric
  * Watchlist tokens, SpecialResetTokens, and User::getTokenFromOption()
    are deprecated. Applications using those can work via the OAuth
    extension instead. New tokens types should not be added.
 +* DatabaseBase::errorCount() was removed (unused).
 +* $wgDeferredUpdateList was removed.
 +* DeferredUpdates::addHTMLCacheUpdate() was removed.
  
  == Compatibility ==
  

diff --combined docs/hooks.txt
index f5999a5,4184aed..0b9f249
--- 1/docs/hooks.txt
--- 2/docs/hooks.txt
+++ b/docs/hooks.txt
@@@ -662,8 -662,7 +662,8 @@@ $oldPageID: the page ID of the revisio
  
  'ArticleRevisionVisibilitySet': Called when changing visibility of one or more
  revisions of an article.
 -&$title: Title object of the article
 +$title: Title object of the article
 +$ids: Ids to set the visibility for
  
  'ArticleRollbackComplete': After an article rollback is completed.
  $wikiPage: the WikiPage that was edited
@@@ -1272,21 -1271,20 +1272,21 @@@ $user: User being checke
  $confirmed: Whether or not the email address is confirmed
  
  'EmailUser': Before sending email from one user to another.
 -$to: address of receiving user
 -$from: address of sending user
 +$to: MailAddress object of receiving user
 +$from: MailAddress object of sending user
  $subject: subject of the mail
  $text: text of the mail
 +&$error: Out-param for an error
  
  'EmailUserCC': Before sending the copy of the email to the author.
 -$to: address of receiving user
 -$from: address of sending user
 +$to: MailAddress object of receiving user
 +$from: MailAddress object of sending user
  $subject: subject of the mail
  $text: text of the mail
  
  'EmailUserComplete': After sending email from one user to another.
 -$to: address of receiving user
 -$from: address of sending user
 +$to: MailAddress object of receiving user
 +$from: MailAddress object of sending user
  $subject: subject of the mail
  $text: text of the mail
  
@@@ -1846,6 -1844,10 +1846,10 @@@ optional localisation message
  &$ignored: Array of ignored message keys
  &$optional: Array of optional message keys
  
+ 'LocalUserCreated': Called when a local user has been created
+ $user: User object for the created user
+ $autocreated: Boolean, whether this was an auto-creation
+ 
  'LogEventsListGetExtraInputs': When getting extra inputs to display on
  Special:Log for a specific log type
  $type: String of log type being displayed
@@@ -2449,10 -2451,6 +2453,6 @@@ $context: (IContextSource) The RequestC
  $user: The user having their password expiration reset
  &$newExpire: The new expiration date
  
- 'ResetSessionID': Called from wfResetSessionID
- $oldSessionID: old session id
- $newSessionID: new session id
- 
  'ResourceLoaderForeignApiModules': Called from ResourceLoaderForeignApiModule.
  Use this to add dependencies to 'mediawiki.ForeignApi' module when you wish
  to override its behavior. See the module docs for more information.
@@@ -3205,6 -3203,11 +3205,11 @@@ $context: IContextSource objec
  $user: User to get rights for
  &$rights: Current rights
  
+ 'UserGroupsChanged': Called after user groups are changed.
+ $user: User whose groups changed
+ $added: Groups added
+ $removed: Groups removed
+ 
  'UserIsBlockedFrom': Check if a user is blocked from a specific page (for
  specific block exemptions).
  $user: User in question
@@@ -3222,6 -3225,14 +3227,14 @@@ $ip: User's IP addres
  false if a UserGetRights hook might remove the named right.
  $right: The user right being checked
  
+ 'UserIsHidden': Check if the user's name should be hidden. See User::isHidden().
+ $user: User in question.
+ &$hidden: Set true if the user's name should be hidden.
+ 
+ 'UserIsLocked': Check if the user is locked. See User::isLocked().
+ $user: User in question.
+ &$locked: Set true if the user should be locked.
+ 
  'UserLoadAfterLoadFromSession': Called to authenticate users on external or
  environmental means; occurs after session is loaded.
  $user: user object being loaded
@@@ -3245,6 -3256,9 +3258,9 @@@ database
  $user: User object
  &$options: Options, can be modified.
  
+ 'UserLoggedIn': Called after a user is logged in
+ $user: User object for the logged-in user
+ 
  'UserLoginComplete': After a user has logged in.
  $user: the user object that was created on login
  $inject_html: Any HTML to inject after the "logged in" message.
@@@ -3290,8 -3304,9 +3306,9 @@@ message(s)
  $user: user retrieving new talks messages
  $talks: array of new talks page(s)
  
- 'UserRights': After a user's group memberships are changed.
- $user: User object that was changed
+ 'UserRights': DEPRECATED! Use UserGroupsChanged instead.
+ After a user's group memberships are changed.
+ &$user: User object that was changed
  $add: Array of strings corresponding to groups added
  $remove: Array of strings corresponding to groups removed
  

diff --combined includes/GlobalFunctions.php
index 58927dc,8b6043f..486926f
--- 1/includes/GlobalFunctions.php
--- 2/includes/GlobalFunctions.php
+++ b/includes/GlobalFunctions.php
@@@ -3216,7 -3216,6 +3216,7 @@@ function wfUsePHP( $req_ver ) 
   *
   * @see perldoc -f use
   *
 + * @deprecated since 1.26, use the "requires' property of extension.json
   * @param string|int|float $req_ver The version to check, can be a string, an integer, or a float
   * @throws MWException
   */
@@@ -3467,7 -3466,6 +3467,6 @@@ function wfResetSessionID() 
                $_SESSION = $tmp;
        }
        $newSessionId = session_id();
-       Hooks::run( 'ResetSessionID', array( $oldSessionId, $newSessionId ) );
  }
  
  /**

diff --combined includes/User.php
index 6df41ee,6fff8cd..e3636a0
--- 1/includes/User.php
--- 2/includes/User.php
+++ b/includes/User.php
@@@ -1430,8 -1430,8 +1430,8 @@@ class User implements IDBAccessObject 
                foreach ( $toPromote as $group ) {
                        $this->addGroup( $group );
                }
- 
                // update groups in external authentication database
+               Hooks::run( 'UserGroupsChanged', array( $this, $toPromote, array() ) );
                $wgAuth->updateExternalDBGroups( $this, $toPromote );
  
                $newGroups = array_merge( $oldGroups, $toPromote ); // all groups
@@@ -1591,7 -1591,7 +1591,7 @@@
                # We only need to worry about passing the IP address to the Block generator if the
                # user is not immune to autoblocks/hardblocks, and they are the current user so we
                # know which IP address they're actually coming from
 -              if ( !$this->isAllowed( 'ipblock-exempt' ) && $this->getID() == $wgUser->getID() ) {
 +              if ( !$this->isAllowed( 'ipblock-exempt' ) && $this->equals( $wgUser ) ) {
                        $ip = $this->getRequest()->getIP();
                } else {
                        $ip = null;
@@@ -1993,6 -1993,7 +1993,7 @@@
                global $wgAuth;
                $authUser = $wgAuth->getUserInstance( $this );
                $this->mLocked = (bool)$authUser->isLocked();
+               Hooks::run( 'UserIsLocked', array( $this, &$this->mLocked ) );
                return $this->mLocked;
        }
  
@@@ -2010,6 -2011,7 +2011,7 @@@
                        global $wgAuth;
                        $authUser = $wgAuth->getUserInstance( $this );
                        $this->mHideName = (bool)$authUser->isHidden();
+                       Hooks::run( 'UserIsHidden', array( $this, &$this->mHideName ) );
                }
                return $this->mHideName;
        }