Allow blocked sysops to view Special:Unblock

Previously, trying to visit [[Special:Unblock]] while blocked would give
an error, even if the user has the unblockself permission.  I moved the
permission check from execute() to right before the code that does the
actual unblocking.  This should probably be examined closely for
security, since I'm not familiar with this code, although the impact of
a bug would be small.  I tested some simple cases manually and they all
worked as expected:

* Unblocking self works (as before)
* Submitting the form fails unless you're trying to unblock yourself (as
  before)
* GETting the page with any parameters works (previously failed unless
  the target was your own username)

diff --git a/includes/specials/SpecialUnblock.php b/includes/specials/SpecialUnblock.php
index 8243582..65f9bb1 100644 (file)
--- a/includes/specials/SpecialUnblock.php
+++ b/includes/specials/SpecialUnblock.php
@@ -51,13 +51,6 @@ class SpecialUnblock extends SpecialPage {
                list( $this->target, $this->type ) = SpecialBlock::getTargetAndType( $par, $wgRequest );
                $this->block = Block::newFromTarget( $this->target );
 
-               # bug 15810: blocked admins should have limited access here.  This won't allow sysops
-               # to remove autoblocks on themselves, but they should have ipblock-exempt anyway
-               $status = SpecialBlock::checkUnblockSelf( $this->target );
-               if ( $status !== true ) {
-                       throw new ErrorPageError( 'badaccess', $status );
-               }
-
                $wgOut->setPageTitle( wfMsg( 'unblockip' ) );
                $wgOut->addModules( 'mediawiki.special' );
 
@@ -162,6 +155,14 @@ class SpecialUnblock extends SpecialPage {
                        return array( array( 'ipb_cant_unblock', $target ) );
                }
 
+               # bug 15810: blocked admins should have limited access here.  This
+               # won't allow sysops to remove autoblocks on themselves, but they
+               # should have ipblock-exempt anyway
+               $status = SpecialBlock::checkUnblockSelf( $target );
+               if ( $status !== true ) {
+                       throw new ErrorPageError( 'badaccess', $status );
+               }
+
                # If the specified IP is a single address, and the block is a range block, don't
                # unblock the whole range.
                list( $target, $type ) = SpecialBlock::getTargetAndType( $target );