Check if user is blocked during upload process

Further down, this was already somewhat being checked.
On L112, `verifyTitlePermissions` is called, which will fail
if the user is blocked. However:

* This was not being checked during stashed uploads
* Block just "happens" to be part of that check: the intent is
  actually to verify the file title. The error is treated as
  recoverable (the title can be changed), but it isn't (the
  user can't unblock himself in this process)

Bug: T111228
Change-Id: I9cbf250a0b92c3daa3a0843f2257cc049abd3923

diff --git a/includes/api/ApiUpload.php b/includes/api/ApiUpload.php
index 1571b27..0a79aa4 100644 (file)
--- a/includes/api/ApiUpload.php
+++ b/includes/api/ApiUpload.php
@@ -488,6 +488,16 @@ class ApiUpload extends ApiBase {
 
                        $this->dieUsageMsg( 'badaccess-groups' );
                }
+
+               // Check blocks
+               if ( $user->isBlocked() ) {
+                       $this->dieBlocked( $user->getBlock() );
+               }
+
+               // Global blocks
+               if ( $user->isBlockedGlobally() ) {
+                       $this->dieBlocked( $user->getGlobalBlock() );
+               }
        }
 
        /**

diff --git a/languages/i18n/en.json b/languages/i18n/en.json
index 4160dea..aacf623 100644 (file)
--- a/languages/i18n/en.json
+++ b/languages/i18n/en.json
@@ -3859,8 +3859,10 @@
        "feedback-useragent": "User agent:",
        "searchsuggest-search": "Search",
        "searchsuggest-containing": "containing...",
+       "api-error-autoblocked": "Your IP address has been blocked automatically, because it was used by a blocked user.",
        "api-error-badaccess-groups": "You are not permitted to upload files to this wiki.",
        "api-error-badtoken": "Internal error: Bad token.",
+       "api-error-blocked": "You have been blocked from editing.",
        "api-error-copyuploaddisabled": "Uploading by URL is disabled on this server.",
        "api-error-duplicate": "There {{PLURAL:$1|is another file|are some other files}} already on the site with the same content.",
        "api-error-duplicate-archive": "There {{PLURAL:$1|was another file|were some other files}} already on the site with the same content, but {{PLURAL:$1|it was|they were}} deleted.",

diff --git a/languages/i18n/qqq.json b/languages/i18n/qqq.json
index a3a56a5..ddf544b 100644 (file)
--- a/languages/i18n/qqq.json
+++ b/languages/i18n/qqq.json
@@ -4037,8 +4037,10 @@
        "feedback-useragent": "A label denoting the user agent in the feedback that is posted to the feedback page.\n{{Identical|User agent}}",
        "searchsuggest-search": "Greyed out default text in the simple search box in the Vector skin. (It disappears and lets the user enter the requested search terms when the search box receives focus.)\n\n{{Identical|Search}}",
        "searchsuggest-containing": "Label used in the special item of the search suggestions list which gives the user an option to perform a full text search for the term.",
+       "api-error-autoblocked": "API error message that can be used for client side localisation of API errors.",
        "api-error-badaccess-groups": "API error message that can be used for client side localisation of API errors.",
        "api-error-badtoken": "API error message that can be used for client side localisation of API errors.",
+       "api-error-blocked": "API error message that can be used for client side localisation of API errors.",
        "api-error-copyuploaddisabled": "API error message that can be used for client side localisation of API errors.",
        "api-error-duplicate": "API error message that can be used for client side localisation of API errors. Parameters:\n* $1 - a number of files",
        "api-error-duplicate-archive": "API error message that can be used for client side localisation of API errors. Parameters:\n* $1 - a number of files",

diff --git a/resources/Resources.php b/resources/Resources.php
index be13559..4334237 100644 (file)
--- a/resources/Resources.php
+++ b/resources/Resources.php
@@ -1213,6 +1213,8 @@ return [
                        'upload-form-label-usage-filename',
                        'api-error-unknownerror',
                        'api-error-unknown-warning',
+                       'api-error-autoblocked',
+                       'api-error-blocked',
                        'api-error-badaccess-groups',
                        'api-error-badtoken',
                        'api-error-copyuploaddisabled',

diff --git a/resources/src/mediawiki/api.js b/resources/src/mediawiki/api.js
index 1f21fc6..9cef1c4 100644 (file)
--- a/resources/src/mediawiki/api.js
+++ b/resources/src/mediawiki/api.js
@@ -433,6 +433,8 @@
                'fileexists-shared-forbidden',
                'invalidtitle',
                'notloggedin',
+               'autoblocked',
+               'blocked',
 
                // Stash-specific errors - expanded
                'stashfailed',