Avoid unstubbing $wgUser before the end of Setup.php in User::getBlockedStatus()

Autocreation needs to check if the current IP is blocked from account
creation.

There are two ways we could go here: treat $wgUser as logged-out, or
assume it will eventually be the user name specified by the session.
This patch chooses the former, by the logic that at this early point in
the setup process we don't have a logged-in user determined yet so no
username can really be considered to match the logged-in user.

Bug: T124367
Change-Id: I631bec85291b57f07c378cf6554a8f06cf3fb00c

diff --git a/includes/user/User.php b/includes/user/User.php
index 8e3b2ec..3635f5c 100644 (file)
--- a/includes/user/User.php
+++ b/includes/user/User.php
@@ -1535,10 +1535,16 @@ class User implements IDBAccessObject {
                # We only need to worry about passing the IP address to the Block generator if the
                # user is not immune to autoblocks/hardblocks, and they are the current user so we
                # know which IP address they're actually coming from
-               if ( !$this->isAllowed( 'ipblock-exempt' ) && $this->equals( $wgUser ) ) {
-                       $ip = $this->getRequest()->getIP();
-               } else {
-                       $ip = null;
+               $ip = null;
+               if ( !$this->isAllowed( 'ipblock-exempt' ) ) {
+                       // $wgUser->getName() only works after the end of Setup.php. Until
+                       // then, assume it's a logged-out user.
+                       $globalUserName = $wgUser->isSafeToLoad()
+                               ? $wgUser->getName()
+                               : IP::sanitizeIP( $wgUser->getRequest()->getIP() );
+                       if ( $this->getName() === $globalUserName ) {
+                               $ip = $this->getRequest()->getIP();
+                       }
                }
 
                // User/IP blocking