Don't check anon permissions for maint scripts in autoCreateUser()

AuthManager::autoCreateUser() causes createAndPromote.php to give error
"Automatic account creation is not allowed." when
$wgGroupPermissions['*']['createaccount']=false is set. Anonymous user
checks should be skipped for maintenance scripts.

Change-Id: Ib61889a758e542abe991707d8b7853a25cfed8e9

diff --git a/includes/auth/AuthManager.php b/includes/auth/AuthManager.php
index 9686555..f9174a7 100644 (file)
--- a/includes/auth/AuthManager.php
+++ b/includes/auth/AuthManager.php
@@ -1635,7 +1635,9 @@ class AuthManager implements LoggerAwareInterface {
 
                // Is the IP user able to create accounts?
                $anon = new User;
-               if ( !$anon->isAllowedAny( 'createaccount', 'autocreateaccount' ) ) {
+               if ( $source !== self::AUTOCREATE_SOURCE_MAINT &&
+                       !$anon->isAllowedAny( 'createaccount', 'autocreateaccount' )
+               ) {
                        $this->logger->debug( __METHOD__ . ': IP lacks the ability to create or autocreate accounts', [
                                'username' => $username,
                                'ip' => $anon->getName(),

diff --git a/tests/phpunit/includes/auth/AuthManagerTest.php b/tests/phpunit/includes/auth/AuthManagerTest.php
index 564336e..e8981ec 100644 (file)
--- a/tests/phpunit/includes/auth/AuthManagerTest.php
+++ b/tests/phpunit/includes/auth/AuthManagerTest.php
@@ -2361,6 +2361,7 @@ class AuthManagerTest extends \MediaWikiTestCase {
                $workaroundPHPUnitBug = false;
 
                $username = self::usernameForCreation();
+               $expectedSource = AuthManager::AUTOCREATE_SOURCE_SESSION;
                $this->initializeManager();
 
                $this->setGroupPermissions( '*', 'createaccount', true );
@@ -2380,14 +2381,20 @@ class AuthManagerTest extends \MediaWikiTestCase {
                }
 
                $good = StatusValue::newGood();
+               $ok = StatusValue::newFatal( 'ok' );
                $callback = $this->callback( function ( $user ) use ( &$username, &$workaroundPHPUnitBug ) {
                        return $workaroundPHPUnitBug || $user->getName() === $username;
                } );
+               $callback2 = $this->callback(
+                       function ( $source ) use ( &$expectedSource, &$workaroundPHPUnitBug ) {
+                               return $workaroundPHPUnitBug || $source === $expectedSource;
+                       }
+               );
 
-               $mocks['pre']->expects( $this->exactly( 12 ) )->method( 'testUserForCreation' )
-                       ->with( $callback, $this->identicalTo( AuthManager::AUTOCREATE_SOURCE_SESSION ) )
+               $mocks['pre']->expects( $this->exactly( 13 ) )->method( 'testUserForCreation' )
+                       ->with( $callback, $callback2 )
                        ->will( $this->onConsecutiveCalls(
-                               StatusValue::newFatal( 'ok' ), StatusValue::newFatal( 'ok' ), // For testing permissions
+                               $ok, $ok, $ok, // For testing permissions
                                StatusValue::newFatal( 'fail-in-pre' ), $good, $good,
                                $good, // backoff test
                                $good, // addToDatabase fails test
@@ -2401,7 +2408,7 @@ class AuthManagerTest extends \MediaWikiTestCase {
                $mocks['primary']->expects( $this->any() )->method( 'testUserExists' )
                        ->will( $this->returnValue( true ) );
                $mocks['primary']->expects( $this->exactly( 9 ) )->method( 'testUserForCreation' )
-                       ->with( $callback, $this->identicalTo( AuthManager::AUTOCREATE_SOURCE_SESSION ) )
+                       ->with( $callback, $callback2 )
                        ->will( $this->onConsecutiveCalls(
                                StatusValue::newFatal( 'fail-in-primary' ), $good,
                                $good, // backoff test
@@ -2411,10 +2418,10 @@ class AuthManagerTest extends \MediaWikiTestCase {
                                $good, $good, $good
                        ) );
                $mocks['primary']->expects( $this->exactly( 3 ) )->method( 'autoCreatedAccount' )
-                       ->with( $callback, $this->identicalTo( AuthManager::AUTOCREATE_SOURCE_SESSION ) );
+                       ->with( $callback, $callback2 );
 
                $mocks['secondary']->expects( $this->exactly( 8 ) )->method( 'testUserForCreation' )
-                       ->with( $callback, $this->identicalTo( AuthManager::AUTOCREATE_SOURCE_SESSION ) )
+                       ->with( $callback, $callback2 )
                        ->will( $this->onConsecutiveCalls(
                                StatusValue::newFatal( 'fail-in-secondary' ),
                                $good, // backoff test
@@ -2424,7 +2431,7 @@ class AuthManagerTest extends \MediaWikiTestCase {
                                $good, $good, $good
                        ) );
                $mocks['secondary']->expects( $this->exactly( 3 ) )->method( 'autoCreatedAccount' )
-                       ->with( $callback, $this->identicalTo( AuthManager::AUTOCREATE_SOURCE_SESSION ) );
+                       ->with( $callback, $callback2 );
 
                $this->preauthMocks = [ $mocks['pre'] ];
                $this->primaryauthMocks = [ $mocks['primary'] ];
@@ -2564,8 +2571,20 @@ class AuthManagerTest extends \MediaWikiTestCase {
                        'authmanager-autocreate-noperm', $session->get( 'AuthManager::AutoCreateBlacklist' )
                );
 
+               // maintenance scripts always work
+               $expectedSource = AuthManager::AUTOCREATE_SOURCE_MAINT;
+               $this->setGroupPermissions( '*', 'createaccount', false );
+               $this->setGroupPermissions( '*', 'autocreateaccount', false );
+               $session->clear();
+               $user = \User::newFromName( $username );
+               $this->hook( 'LocalUserCreated', $this->never() );
+               $ret = $this->manager->autoCreateUser( $user, AuthManager::AUTOCREATE_SOURCE_MAINT, true );
+               $this->unhook( 'LocalUserCreated' );
+               $this->assertEquals( \Status::newFatal( 'ok' ), $ret );
+
                // Test that both permutations of permissions are allowed
                // (this hits the two "ok" entries in $mocks['pre'])
+               $expectedSource = AuthManager::AUTOCREATE_SOURCE_SESSION;
                $this->setGroupPermissions( '*', 'createaccount', false );
                $this->setGroupPermissions( '*', 'autocreateaccount', true );
                $session->clear();