SECURITY: Better controls for logout interface buttons

[lhc/web/wiklou.git] / includes / skins / SkinTemplate.php

diff --git a/includes/skins/SkinTemplate.php b/includes/skins/SkinTemplate.php
index f348135..cde4197 100644 (file)
--- a/includes/skins/SkinTemplate.php
+++ b/includes/skins/SkinTemplate.php
@@ -208,7 +208,7 @@ class SkinTemplate extends Skin {
         * Initialize various variables and generate the template
         */
        function outputPage() {
-               Profiler::instance()->setTemplated( true );
+               Profiler::instance()->setAllowOutput();
                $out = $this->getOutput();
 
                $this->initPage( $out );
@@ -376,6 +376,7 @@ class SkinTemplate extends Skin {
                                        /** @var CreditsAction $action */
                                        $action = Action::factory(
                                                'credits', $this->getWikiPage(), $this->getContext() );
+                                       '@phan-var CreditsAction $action';
                                        $tpl->set( 'credits',
                                                $action->getCredits( $wgMaxCredits, $wgShowCreditsIfMax ) );
                                } else {
@@ -594,7 +595,7 @@ class SkinTemplate extends Skin {
                # $this->getTitle() will just give Special:Badtitle, which is
                # not especially useful as a returnto parameter. Use the title
                # from the request instead, if there was one.
-               if ( $this->getUser()->isAllowed( 'read' ) ) {
+               if ( $permissionManager->userHasRight( $this->getUser(), 'read' ) ) {
                        $page = $this->getTitle();
                } else {
                        $page = Title::newFromText( $request->getVal( 'title', '' ) );
@@ -635,7 +636,7 @@ class SkinTemplate extends Skin {
                                'active' => ( $href == $pageurl )
                        ];
 
-                       if ( $this->getUser()->isAllowed( 'viewmywatchlist' ) ) {
+                       if ( $permissionManager->userHasRight( $this->getUser(), 'viewmywatchlist' ) ) {
                                $href = self::makeSpecialUrl( 'Watchlist' );
                                $personal_urls['watchlist'] = [
                                        'text' => $this->msg( 'mywatchlist' )->text(),
@@ -674,6 +675,7 @@ class SkinTemplate extends Skin {
                        if ( $request->getSession()->canSetUser() ) {
                                $personal_urls['logout'] = [
                                        'text' => $this->msg( 'pt-userlogout' )->text(),
+                                       'data-mw' => 'interface',
                                        'href' => self::makeSpecialUrl( 'Userlogout',
                                                // Note: userlogout link must always contain an & character, otherwise we might not be able
                                                // to detect a buggy precaching proxy (T19790)
@@ -688,9 +690,8 @@ class SkinTemplate extends Skin {
                                $useCombinedLoginLink = false;
                        }
 
-                       $loginlink = $this->getUser()->isAllowed( 'createaccount' ) && $useCombinedLoginLink
-                               ? 'nav-login-createaccount'
-                               : 'pt-login';
+                       $loginlink = $permissionManager->userHasRight( $this->getUser(), 'createaccount' )
+                                                && $useCombinedLoginLink ? 'nav-login-createaccount' : 'pt-login';
 
                        $login_url = [
                                'text' => $this->msg( $loginlink )->text(),
@@ -726,7 +727,7 @@ class SkinTemplate extends Skin {
 
                        if (
                                $authManager->canCreateAccounts()
-                               && $this->getUser()->isAllowed( 'createaccount' )
+                               && $permissionManager->userHasRight( $this->getUser(), 'createaccount' )
                                && !$useCombinedLoginLink
                        ) {
                                $personal_urls['createaccount'] = $createaccount_url;
@@ -884,6 +885,7 @@ class SkinTemplate extends Skin {
                $out = $this->getOutput();
                $request = $this->getRequest();
                $user = $this->getUser();
+               $permissionManager = MediaWikiServices::getInstance()->getPermissionManager();
 
                $content_navigation = [
                        'namespaces' => [],
@@ -895,7 +897,7 @@ class SkinTemplate extends Skin {
                // parameters
                $action = $request->getVal( 'action', 'view' );
 
-               $userCanRead = $title->quickUserCan( 'read', $user );
+               $userCanRead = $permissionManager->quickUserCan( 'read', $user, $title );
 
                // Avoid PHP 7.1 warning of passing $this by reference
                $skinTemplate = $this;
@@ -965,8 +967,9 @@ class SkinTemplate extends Skin {
                                }
 
                                // Checks if user can edit the current page if it exists or create it otherwise
-                               if ( $title->quickUserCan( 'edit', $user )
-                                       && ( $title->exists() || $title->quickUserCan( 'create', $user ) )
+                               if ( $permissionManager->quickUserCan( 'edit', $user, $title ) &&
+                                        ( $title->exists() ||
+                                                $permissionManager->quickUserCan( 'create', $user, $title ) )
                                ) {
                                        // Builds CSS class for talk page links
                                        $isTalkClass = $isTalk ? ' istalk' : '';
@@ -1031,7 +1034,7 @@ class SkinTemplate extends Skin {
                                                'href' => $title->getLocalURL( 'action=history' ),
                                        ];
 
-                                       if ( $title->quickUserCan( 'delete', $user ) ) {
+                                       if ( $permissionManager->quickUserCan( 'delete', $user, $title ) ) {
                                                $content_navigation['actions']['delete'] = [
                                                        'class' => ( $onPage && $action == 'delete' ) ? 'selected' : false,
                                                        'text' => wfMessageFallback( "$skname-action-delete", 'delete' )
@@ -1040,7 +1043,7 @@ class SkinTemplate extends Skin {
                                                ];
                                        }
 
-                                       if ( $title->quickUserCan( 'move', $user ) ) {
+                                       if ( $permissionManager->quickUserCan( 'move', $user, $title ) ) {
                                                $moveTitle = SpecialPage::getTitleFor( 'Movepage', $title->getPrefixedDBkey() );
                                                $content_navigation['actions']['move'] = [
                                                        'class' => $this->getTitle()->isSpecial( 'Movepage' ) ? 'selected' : false,
@@ -1051,13 +1054,14 @@ class SkinTemplate extends Skin {
                                        }
                                } else {
                                        // article doesn't exist or is deleted
-                                       if ( $title->quickUserCan( 'deletedhistory', $user ) ) {
+                                       if ( $permissionManager->quickUserCan( 'deletedhistory', $user, $title ) ) {
                                                $n = $title->isDeleted();
                                                if ( $n ) {
                                                        $undelTitle = SpecialPage::getTitleFor( 'Undelete', $title->getPrefixedDBkey() );
                                                        // If the user can't undelete but can view deleted
                                                        // history show them a "View .. deleted" tab instead.
-                                                       $msgKey = $title->quickUserCan( 'undelete', $user ) ? 'undelete' : 'viewdeleted';
+                                                       $msgKey = $permissionManager->quickUserCan( 'undelete',
+                                                               $user, $title ) ? 'undelete' : 'viewdeleted';
                                                        $content_navigation['actions']['undelete'] = [
                                                                'class' => $this->getTitle()->isSpecial( 'Undelete' ) ? 'selected' : false,
                                                                'text' => wfMessageFallback( "$skname-action-$msgKey", "{$msgKey}_short" )
@@ -1068,9 +1072,9 @@ class SkinTemplate extends Skin {
                                        }
                                }
 
-                               if ( $title->quickUserCan( 'protect', $user ) && $title->getRestrictionTypes() &&
-                                       MediaWikiServices::getInstance()->getPermissionManager()
-                                               ->getNamespaceRestrictionLevels( $title->getNamespace(), $user ) !== [ '' ]
+                               if ( $permissionManager->quickUserCan( 'protect', $user, $title ) &&
+                                        $title->getRestrictionTypes() &&
+                                        $permissionManager->getNamespaceRestrictionLevels( $title->getNamespace(), $user ) !== [ '' ]
                                ) {
                                        $mode = $title->isProtected() ? 'unprotect' : 'protect';
                                        $content_navigation['actions'][$mode] = [
@@ -1082,9 +1086,8 @@ class SkinTemplate extends Skin {
                                }
 
                                // Checks if the user is logged in
-                               if ( $this->loggedin && MediaWikiServices::getInstance()
-                                               ->getPermissionManager()
-                                               ->userHasAllRights( $user, 'viewmywatchlist', 'editmywatchlist' )
+                               if ( $this->loggedin && $permissionManager->userHasAllRights( $user,
+                                               'viewmywatchlist', 'editmywatchlist' )
                                ) {
                                        /**
                                         * The following actions use messages which, if made particular to
@@ -1341,7 +1344,10 @@ class SkinTemplate extends Skin {
                                'href' => self::makeSpecialUrlSubpage( 'Log', $rootUser )
                        ];
 
-                       if ( $this->getUser()->isAllowed( 'block' ) ) {
+                       if ( MediawikiServices::getInstance()
+                                       ->getPermissionManager()
+                                       ->userHasRight( $this->getUser(), 'block' )
+                       ) {
                                $nav_urls['blockip'] = [
                                        'text' => $this->msg( 'blockip', $rootUser )->text(),
                                        'href' => self::makeSpecialUrlSubpage( 'Block', $rootUser )