Merge "Escape return path extra params to php mail()"

[lhc/web/wiklou.git] / includes / api / ApiBlock.php

diff --git a/includes/api/ApiBlock.php b/includes/api/ApiBlock.php
index e4c9d0a..3774f09 100644 (file)
--- a/includes/api/ApiBlock.php
+++ b/includes/api/ApiBlock.php
@@ -41,41 +41,50 @@ class ApiBlock extends ApiBase {
        public function execute() {
                global $wgContLang;
 
+               $this->checkUserRightsAny( 'block' );
+
                $user = $this->getUser();
                $params = $this->extractRequestParams();
 
-               if ( !$user->isAllowed( 'block' ) ) {
-                       $this->dieUsageMsg( 'cantblock' );
-               }
+               $this->requireOnlyOneParameter( $params, 'user', 'userid' );
 
                # bug 15810: blocked admins should have limited access here
                if ( $user->isBlocked() ) {
                        $status = SpecialBlock::checkUnblockSelf( $params['user'], $user );
                        if ( $status !== true ) {
-                               $msg = $this->parseMsg( $status );
-                               $this->dieUsage(
-                                       $msg['info'],
-                                       $msg['code'],
-                                       0,
+                               $this->dieWithError(
+                                       $status,
+                                       null,
                                        [ 'blockinfo' => ApiQueryUserInfo::getBlockInfo( $user->getBlock() ) ]
                                );
                        }
                }
 
-               $target = User::newFromName( $params['user'] );
-               // Bug 38633 - if the target is a user (not an IP address), but it
-               // doesn't exist or is unusable, error.
-               if ( $target instanceof User &&
-                       ( $target->isAnon() /* doesn't exist */ || !User::isUsableName( $target->getName() ) )
-               ) {
-                       $this->dieUsageMsg( [ 'nosuchuser', $params['user'] ] );
+               if ( $params['userid'] !== null ) {
+                       $username = User::whoIs( $params['userid'] );
+
+                       if ( $username === false ) {
+                               $this->dieWithError( [ 'apierror-nosuchuserid', $params['userid'] ], 'nosuchuserid' );
+                       } else {
+                               $params['user'] = $username;
+                       }
+               } else {
+                       $target = User::newFromName( $params['user'] );
+
+                       // Bug 38633 - if the target is a user (not an IP address), but it
+                       // doesn't exist or is unusable, error.
+                       if ( $target instanceof User &&
+                               ( $target->isAnon() /* doesn't exist */ || !User::isUsableName( $target->getName() ) )
+                       ) {
+                               $this->dieWithError( [ 'nosuchusershort', $params['user'] ], 'nosuchuser' );
+                       }
                }
 
                if ( $params['hidename'] && !$user->isAllowed( 'hideuser' ) ) {
-                       $this->dieUsageMsg( 'canthide' );
+                       $this->dieWithError( 'apierror-canthide' );
                }
                if ( $params['noemail'] && !SpecialBlock::canBlockEmail( $user ) ) {
-                       $this->dieUsageMsg( 'cantblock-email' );
+                       $this->dieWithError( 'apierror-cantblock-email' );
                }
 
                $data = [
@@ -100,8 +109,7 @@ class ApiBlock extends ApiBase {
 
                $retval = SpecialBlock::processForm( $data, $this->getContext() );
                if ( $retval !== true ) {
-                       // We don't care about multiple errors, just report one of them
-                       $this->dieUsageMsg( $retval );
+                       $this->dieStatus( $this->errorArrayToStatus( $retval ) );
                }
 
                list( $target, /*...*/ ) = SpecialBlock::getTargetAndType( $params['user'] );
@@ -142,7 +150,9 @@ class ApiBlock extends ApiBase {
                return [
                        'user' => [
                                ApiBase::PARAM_TYPE => 'user',
-                               ApiBase::PARAM_REQUIRED => true
+                       ],
+                       'userid' => [
+                               ApiBase::PARAM_TYPE => 'integer',
                        ],
                        'expiry' => 'never',
                        'reason' => '',