(bug 38633) Don't block non-existent users via the API

Change-Id: I49232e177b23e11d04f64ac0d939073fa9418d64

diff --git a/includes/api/ApiBlock.php b/includes/api/ApiBlock.php
index 813e4d4..4779067 100644 (file)
--- a/includes/api/ApiBlock.php
+++ b/includes/api/ApiBlock.php
@@ -55,6 +55,7 @@ class ApiBlock extends ApiBase {
                if ( !$user->isAllowed( 'block' ) ) {
                        $this->dieUsageMsg( 'cantblock' );
                }
+
                # bug 15810: blocked admins should have limited access here
                if ( $user->isBlocked() ) {
                        $status = SpecialBlock::checkUnblockSelf( $params['user'], $user );
@@ -62,6 +63,13 @@ class ApiBlock extends ApiBase {
                                $this->dieUsageMsg( array( $status ) );
                        }
                }
+
+               $target = User::newFromName( $params['user'] );
+               // Bug 38633 - if the target is a user (not an IP address), but it doesn't exist or is unusable, error.
+               if ( $target instanceof User && ( $target->isAnon() /* doesn't exist */ || !User::isUsableName( $target->getName() ) ) ) {
+                       $this->dieUsageMsg( array( 'nosuchuser', $params['user'] ) );
+               }
+
                if ( $params['hidename'] && !$user->isAllowed( 'hideuser' ) ) {
                        $this->dieUsageMsg( 'canthide' );
                }