mirror of
https://gerrit.wikimedia.org/r/mediawiki/extensions/AbuseFilter.git
synced 2024-12-19 17:10:58 +00:00
c469fb4b76
There are lots of cases where we can inject a User object without additional efforts. Now $wgUser is only used inside AFComputedVariable, which is a little bit harder to handle because some instances of that class are serialized in the DB, and thus we cannot easily change the constructor until T213006 is resolved. This partly copies what Ia474f02dfeee8c7d067ee7e555c08cbfef08f6a6 tried to do, but adopting a different approach for various can*() methods: they're now static methods in the AbuseFilter class, so future callers don't need to instantiate an AbuseFilterView class. This also allows to re-use those methods in an API module for editing filters (T213037). Bug: T213037 Bug: T159299 Change-Id: I22743557e162fd23b3b4e52951a649d8c21109c8
111 lines
2.8 KiB
PHP
111 lines
2.8 KiB
PHP
<?php
|
|
/**
|
|
* This program is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License as published by
|
|
* the Free Software Foundation; either version 2 of the License, or
|
|
* (at your option) any later version.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License along
|
|
* with this program; if not, write to the Free Software Foundation, Inc.,
|
|
* 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
|
|
* http://www.gnu.org/copyleft/gpl.html
|
|
*/
|
|
|
|
/**
|
|
* API module to allow accessing private details (the user's IP) from AbuseLog entries
|
|
*
|
|
* @ingroup API
|
|
* @ingroup Extensions
|
|
*/
|
|
class ApiAbuseLogPrivateDetails extends ApiBase {
|
|
/**
|
|
* @inheritDoc
|
|
*/
|
|
public function mustBePosted() {
|
|
return true;
|
|
}
|
|
|
|
/**
|
|
* @inheritDoc
|
|
*/
|
|
public function isWriteMode() {
|
|
return true;
|
|
}
|
|
|
|
/**
|
|
* @inheritDoc
|
|
*/
|
|
public function needsToken() {
|
|
return 'csrf';
|
|
}
|
|
|
|
/**
|
|
* @inheritDoc
|
|
*/
|
|
public function execute() {
|
|
$user = $this->getUser();
|
|
|
|
if ( !SpecialAbuseLog::canSeePrivateDetails( $user ) ) {
|
|
$this->dieWithError( 'abusefilter-log-cannot-see-private-details' );
|
|
}
|
|
$params = $this->extractRequestParams();
|
|
|
|
if ( !SpecialAbuseLog::checkPrivateDetailsAccessReason( $params['reason'] ) ) {
|
|
// Double check, in case we add some extra validation
|
|
$this->dieWithError( 'abusefilter-noreason' );
|
|
}
|
|
$status = SpecialAbuseLog::getPrivateDetailsRow( $user, $params['logid'] );
|
|
if ( !$status->isGood() ) {
|
|
$this->dieWithError( $status->getErrors()[0] );
|
|
}
|
|
$row = $status->getValue();
|
|
// Log accessing private details
|
|
if ( $this->getConfig()->get( 'AbuseFilterLogPrivateDetailsAccess' ) ) {
|
|
SpecialAbuseLog::addPrivateDetailsAccessLogEntry(
|
|
$params['logid'],
|
|
$params['reason'],
|
|
$user
|
|
);
|
|
}
|
|
|
|
$result = [
|
|
'log-id' => $params['logid'],
|
|
'user' => $row->afl_user_text,
|
|
'filter-id' => $row->af_id,
|
|
'filter-description' => $row->af_public_comments,
|
|
'ip-address' => $row->afl_ip !== '' ? $row->afl_ip : null
|
|
];
|
|
$this->getResult()->addValue( null, $this->getModuleName(), $result );
|
|
}
|
|
|
|
/**
|
|
* @inheritDoc
|
|
*/
|
|
public function getAllowedParams() {
|
|
return [
|
|
'logid' => [
|
|
ApiBase::PARAM_TYPE => 'integer'
|
|
],
|
|
'reason' => [
|
|
ApiBase::PARAM_TYPE => 'string',
|
|
ApiBase::PARAM_REQUIRED => $this->getConfig()->get( 'AbuseFilterPrivateDetailsForceReason' ),
|
|
]
|
|
];
|
|
}
|
|
|
|
/**
|
|
* @inheritDoc
|
|
*/
|
|
protected function getExamplesMessages() {
|
|
return [
|
|
'action=abuselogprivatedetails&logid=1&reason=example&token=ABC123'
|
|
=> 'apihelp-abuselogprivatedetails-example-1'
|
|
];
|
|
}
|
|
}
|