SECURITY: Add permission check for suppressed account

[lhc/web/wiklou.git] / includes / specials / SpecialRedirect.php

diff --git a/includes/specials/SpecialRedirect.php b/includes/specials/SpecialRedirect.php
index 328aa11..8006048 100644 (file)
--- a/includes/specials/SpecialRedirect.php
+++ b/includes/specials/SpecialRedirect.php
@@ -33,16 +33,18 @@ class SpecialRedirect extends FormSpecialPage {
        /**
         * The type of the redirect (user/file/revision)
         *
+        * Example value: `'user'`
+        *
         * @var string $mType
-        * @example 'user'
         */
        protected $mType;
 
        /**
         * The identifier/value for the redirect (which id, which file)
         *
+        * Example value: `'42'`
+        *
         * @var string $mValue
-        * @example '42'
         */
        protected $mValue;
 
@@ -77,6 +79,11 @@ class SpecialRedirect extends FormSpecialPage {
                if ( $user->isAnon() ) {
                        return null;
                }
+               if ( $user->isHidden() && !MediaWikiServices::getInstance()->getPermissionManager()
+                       ->userHasRight( $this->getUser(), 'hideuser' )
+               ) {
+                       throw new PermissionsError( null, [ 'badaccess-group0' ] );
+               }
                $userpage = Title::makeTitle( NS_USER, $username );
 
                return $userpage->getFullURL( '', false, PROTO_CURRENT );
@@ -99,18 +106,18 @@ class SpecialRedirect extends FormSpecialPage {
                        return null;
                }
                // Default behavior: Use the direct link to the file.
-               $url = $file->getURL();
+               $url = $file->getUrl();
                $request = $this->getRequest();
                $width = $request->getInt( 'width', -1 );
                $height = $request->getInt( 'height', -1 );
 
                // If a width is requested...
                if ( $width != -1 ) {
-                       $mto = $file->transform( array( 'width' => $width, 'height' => $height ) );
+                       $mto = $file->transform( [ 'width' => $width, 'height' => $height ] );
                        // ... and we can
                        if ( $mto && !$mto->isError() ) {
                                // ... change the URL to point to a thumbnail.
-                               $url = $mto->getURL();
+                               $url = $mto->getUrl();
                        }
                }
 
@@ -133,9 +140,9 @@ class SpecialRedirect extends FormSpecialPage {
                        return null;
                }
 
-               return wfAppendQuery( wfScript( 'index' ), array(
+               return wfAppendQuery( wfScript( 'index' ), [
                        'oldid' => $oldid
-               ) );
+               ] );
        }
 
        /**
@@ -153,14 +160,14 @@ class SpecialRedirect extends FormSpecialPage {
                        return null;
                }
 
-               return wfAppendQuery( wfScript( 'index' ), array(
+               return wfAppendQuery( wfScript( 'index' ), [
                        'curid' => $curid
-               ) );
+               ] );
        }
 
        /**
         * Handle Special:Redirect/logid/xxx
-        * (by redirecting to index.php?title=Special:Log)
+        * (by redirecting to index.php?title=Special:Log&logid=xxx)
         *
         * @since 1.27
         * @return string|null Url to redirect to, or null if $mValue is invalid.
@@ -174,75 +181,8 @@ class SpecialRedirect extends FormSpecialPage {
                if ( $logid === 0 ) {
                        return null;
                }
-
-               $logparams = array(
-                       'log_id',
-                       'log_timestamp',
-                       'log_type',
-                       'log_user_text',
-               );
-
-               $dbr = wfGetDB( DB_SLAVE );
-
-               // Gets the nested SQL statement which
-               // returns timestamp of the log with the given log ID
-               $inner = $dbr->selectSQLText(
-                       'logging',
-                       array( 'log_timestamp' ),
-                       array( 'log_id' => $logid )
-               );
-
-               // Returns all fields mentioned in $logparams of the logs
-               // with the same timestamp as the one returned by the statement above
-               $logsSameTimestamps = $dbr->select(
-                       'logging',
-                       $logparams,
-                       array( "log_timestamp = ($inner)" )
-               );
-               if ( $logsSameTimestamps->numRows() === 0 ) {
-                       return null;
-               }
-
-               // Stores the row with the same log ID as the one given
-               $rowMain = array();
-               foreach ( $logsSameTimestamps as $row ) {
-                       if ( (int)$row->log_id === $logid ) {
-                               $rowMain = $row;
-                       }
-               }
-
-               array_shift( $logparams );
-
-               // Stores all the rows with the same values in each column
-               // as $rowMain
-               foreach ( $logparams as $cond ) {
-                       $matchedRows = array();
-                       foreach ( $logsSameTimestamps as $row ) {
-                               if ( $row->$cond === $rowMain->$cond ) {
-                                       $matchedRows[] = $row;
-                               }
-                       }
-                       if ( count( $matchedRows ) === 1 ) {
-                               break;
-                       }
-                       $logsSameTimestamps = $matchedRows;
-               }
-               $query = array( 'title' => 'Special:Log', 'limit' => count( $matchedRows ) );
-
-               // A map of database field names from table 'logging' to the values of $logparams
-               $keys = array(
-                       'log_timestamp' => 'offset',
-                       'log_type' => 'type',
-                       'log_user_text' => 'user'
-               );
-
-               foreach ( $logparams as $logKey ) {
-                       $query[$keys[$logKey]] = $matchedRows[0]->$logKey;
-               }
-               $query['offset'] = $query['offset'] + 1;
-               $url = $query;
-
-               return wfAppendQuery( wfScript( 'index' ), $url );
+               $query = [ 'title' => 'Special:Log', 'logid' => $logid ];
+               return wfAppendQuery( wfScript( 'index' ), $query );
        }
 
        /**
@@ -272,7 +212,6 @@ class SpecialRedirect extends FormSpecialPage {
                                $url = $this->dispatchLog();
                                break;
                        default:
-                               $this->getOutput()->setStatusCode( 404 );
                                $url = null;
                                break;
                }
@@ -294,7 +233,7 @@ class SpecialRedirect extends FormSpecialPage {
 
        protected function getFormFields() {
                $mp = $this->getMessagePrefix();
-               $ns = array(
+               $ns = [
                        // subpage => message
                        // Messages: redirect-user, redirect-page, redirect-revision,
                        // redirect-file, redirect-logid
@@ -303,22 +242,22 @@ class SpecialRedirect extends FormSpecialPage {
                        'revision' => $mp . '-revision',
                        'file' => $mp . '-file',
                        'logid' => $mp . '-logid',
-               );
-               $a = array();
-               $a['type'] = array(
+               ];
+               $a = [];
+               $a['type'] = [
                        'type' => 'select',
                        'label-message' => $mp . '-lookup', // Message: redirect-lookup
-                       'options' => array(),
+                       'options' => [],
                        'default' => current( array_keys( $ns ) ),
-               );
+               ];
                foreach ( $ns as $n => $m ) {
                        $m = $this->msg( $m )->text();
                        $a['type']['options'][$m] = $n;
                }
-               $a['value'] = array(
+               $a['value'] = [
                        'type' => 'text',
                        'label-message' => $mp . '-value' // Message: redirect-value
-               );
+               ];
                // set the defaults according to the parsed subpage path
                if ( !empty( $this->mType ) ) {
                        $a['type']['default'] = $this->mType;
@@ -353,19 +292,23 @@ class SpecialRedirect extends FormSpecialPage {
                $form->setMethod( 'get' );
        }
 
+       protected function getDisplayFormat() {
+               return 'ooui';
+       }
+
        /**
         * Return an array of subpages that this special page will accept.
         *
         * @return string[] subpages
         */
        protected function getSubpagesForPrefixSearch() {
-               return array(
+               return [
                        'file',
                        'page',
                        'revision',
                        'user',
                        'logid',
-               );
+               ];
        }
 
        /**