From 9ee4e74e3174b8abab063008ebc7e4fce1bdcd41 Mon Sep 17 00:00:00 2001
From: "This, that and the other" <at.light@live.com.au>
Date: Tue, 25 Apr 2017 13:55:26 +1000
Subject: [PATCH] Expire the cache of a User object when a group membership is
 set to expire

To avoid user permissions persisting for up to 1 hour beyond their expiry
time.

Bug: T163691
Change-Id: I85b578e6b7816639c3d0101d66efb1efedb17af6
---
 includes/user/User.php | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/includes/user/User.php b/includes/user/User.php
index b8a36b8601..3edd49f783 100644
--- a/includes/user/User.php
+++ b/includes/user/User.php
@@ -509,6 +509,17 @@ class User implements IDBAccessObject {
 
 				$ttl = $cache->adaptiveTTL( wfTimestamp( TS_UNIX, $this->mTouched ), $ttl );
 
+				// if a user group membership is about to expire, the cache needs to
+				// expire at that time (T163691)
+				foreach ( $this->mGroupMemberships as $ugm ) {
+					if ( $ugm->getExpiry() ) {
+						$secondsUntilExpiry = wfTimestamp( TS_UNIX, $ugm->getExpiry() ) - time();
+						if ( $secondsUntilExpiry > 0 && $secondsUntilExpiry < $ttl ) {
+							$ttl = $secondsUntilExpiry;
+						}
+					}
+				}
+
 				return $data;
 
 			},
-- 
2.20.1