Merge "Declare dynamic properties"

[lhc/web/wiklou.git] / includes / specials / SpecialChangeEmail.php

diff --git a/includes/specials/SpecialChangeEmail.php b/includes/specials/SpecialChangeEmail.php
index 8d5cf85..7331cd7 100644 (file)
--- a/includes/specials/SpecialChangeEmail.php
+++ b/includes/specials/SpecialChangeEmail.php
@@ -23,6 +23,7 @@
 
 use MediaWiki\Auth\AuthManager;
 use MediaWiki\Logger\LoggerFactory;
+use MediaWiki\MediaWikiServices;
 
 /**
  * Let users change their email address.
@@ -55,14 +56,16 @@ class SpecialChangeEmail extends FormSpecialPage {
         * @param string $par
         */
        function execute( $par ) {
-               $this->checkLoginSecurityLevel();
-
                $out = $this->getOutput();
                $out->disallowUserJs();
 
                parent::execute( $par );
        }
 
+       protected function getLoginSecurityLevel() {
+               return $this->getName();
+       }
+
        protected function checkExecutePermissions( User $user ) {
                if ( !AuthManager::singleton()->allowsPropertyChange( 'emailaddress' ) ) {
                        throw new ErrorPageError( 'changeemail', 'cannotchangeemail' );
@@ -72,7 +75,10 @@ class SpecialChangeEmail extends FormSpecialPage {
 
                // This could also let someone check the current email address, so
                // require both permissions.
-               if ( !$this->getUser()->isAllowed( 'viewmyprivateinfo' ) ) {
+               if ( !MediaWikiServices::getInstance()
+                               ->getPermissionManager()
+                               ->userHasRight( $this->getUser(), 'viewmyprivateinfo' )
+               ) {
                        throw new PermissionsError( 'viewmyprivateinfo' );
                }
 
@@ -160,6 +166,12 @@ class SpecialChangeEmail extends FormSpecialPage {
                        return Status::newFatal( 'changeemail-nochange' );
                }
 
+               // To prevent spam, rate limit adding a new address, but do
+               // not rate limit removing an address.
+               if ( $newaddr !== '' && $user->pingLimiter( 'changeemail' ) ) {
+                       return Status::newFatal( 'actionthrottledtext' );
+               }
+
                $oldaddr = $user->getEmail();
                $status = $user->setEmailWithConfirmation( $newaddr );
                if ( !$status->isGood() ) {