Merge "Rename autonym for 'no' from 'norsk bokmål' to 'norsk'"

[lhc/web/wiklou.git] / includes / user / PasswordReset.php

diff --git a/includes/user/PasswordReset.php b/includes/user/PasswordReset.php
index 4ee256c..dd16fb7 100644 (file)
--- a/includes/user/PasswordReset.php
+++ b/includes/user/PasswordReset.php
@@ -100,9 +100,10 @@ class PasswordReset implements LoggerAwareInterface {
                        } elseif ( !$user->isAllowed( 'editmyprivateinfo' ) ) {
                                // Maybe not all users have permission to change private data
                                $status = StatusValue::newFatal( 'badaccess' );
-                       } elseif ( $user->isBlocked() ) {
+                       } elseif ( $this->isBlocked( $user ) ) {
                                // Maybe the user is blocked (check this here rather than relying on the parent
-                               // method as we have a more specific error message to use here
+                               // method as we have a more specific error message to use here and we want to
+                               // ignore some types of blocks)
                                $status = StatusValue::newFatal( 'blocked-mailpassword' );
                        }
 
@@ -250,6 +251,37 @@ class PasswordReset implements LoggerAwareInterface {
                return StatusValue::newGood( $passwords );
        }
 
+       /**
+        * Check whether the user is blocked.
+        * Ignores certain types of system blocks that are only meant to force users to log in.
+        * @param User $user
+        * @return bool
+        * @since 1.30
+        */
+       protected function isBlocked( User $user ) {
+               $block = $user->getBlock() ?: $user->getGlobalBlock();
+               if ( !$block ) {
+                       return false;
+               }
+               $type = $block->getSystemBlockType();
+               if ( in_array( $type, [ null, 'global-block' ], true ) ) {
+                       // Normal block. Maybe it was meant for someone else and the user just needs to log in;
+                       // or maybe it was issued specifically to prevent some IP from messing with password
+                       // reset? Go out on a limb and use the registration allowed flag to decide.
+                       return $block->prevents( 'createaccount' );
+               } elseif ( $type === 'proxy' ) {
+                       // we disallow actions through proxy even if the user is logged in
+                       // so it makes sense to disallow password resets as well
+                       return true;
+               } elseif ( in_array( $type, [ 'dnsbl', 'wgSoftBlockRanges' ], true ) ) {
+                       // these are just meant to force login so let's not prevent that
+                       return false;
+               } else {
+                       // some extension - we'll have to guess
+                       return true;
+               }
+       }
+
        /**
         * @param string $email
         * @return User[]