Rearrange code in User::getBlockedStatus to avoid isAllowed calls

User::isAllowed() triggers session loading, which results in a loop
if it is called during session loading. Session providers need to
check block status when $wgBlockDisablesLogin is enabled, so try to
avoid isAllowed calls in that situation.

Bug: T218608
Change-Id: Iab24923c613d6aeed4b574f587fc4cee8f33077c

diff --git a/RELEASE-NOTES-1.31 b/RELEASE-NOTES-1.31
index 9795e8b..5eacf55 100644 (file)
--- a/RELEASE-NOTES-1.31
+++ b/RELEASE-NOTES-1.31
@@ -60,6 +60,8 @@ THIS IS NOT A RELEASE YET
 * (T215169) Fix for Database::update() with IGNORE option fails on PostgreSQL.
 * (T204423) Backport support for hyphenated DB names in JobQueueGroup.
 * (T199474) Fix typo in rebuildrecentchanges.php resulting in rogue flags.
+* (T218608) Fix an issue that prevents Extension:OAuth working when
+  $wgBlockDisablesLogin is true.
 
 == MediaWiki 1.31.1 ==
 

diff --git a/includes/user/User.php b/includes/user/User.php
index 86bb27b..464629a 100644 (file)
--- a/includes/user/User.php
+++ b/includes/user/User.php
@@ -1794,16 +1794,14 @@ class User implements IDBAccessObject, UserIdentity {
                # user is not immune to autoblocks/hardblocks, and they are the current user so we
                # know which IP address they're actually coming from
                $ip = null;
-               if ( !$this->isAllowed( 'ipblock-exempt' ) ) {
-                       $sessionUser = RequestContext::getMain()->getUser();
-                       // the session user is set up towards the end of Setup.php. Until then,
-                       // assume it's a logged-out user.
-                       $globalUserName = $sessionUser->isSafeToLoad()
-                               ? $sessionUser->getName()
-                               : IP::sanitizeIP( $sessionUser->getRequest()->getIP() );
-                       if ( $this->getName() === $globalUserName ) {
-                               $ip = $this->getRequest()->getIP();
-                       }
+               $sessionUser = RequestContext::getMain()->getUser();
+               // the session user is set up towards the end of Setup.php. Until then,
+               // assume it's a logged-out user.
+               $globalUserName = $sessionUser->isSafeToLoad()
+                       ? $sessionUser->getName()
+                       : IP::sanitizeIP( $sessionUser->getRequest()->getIP() );
+               if ( $this->getName() === $globalUserName && !$this->isAllowed( 'ipblock-exempt' ) ) {
+                       $ip = $this->getRequest()->getIP();
                }
 
                // User/IP blocking