From 9420f22e9dd74bd1716a7a4cbbb187e1ad9637e5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bartosz=20Dziewo=C5=84ski?= <matma.rex@gmail.com>
Date: Wed, 14 Apr 2021 00:08:52 +0200
Subject: [PATCH] Don't allow query and cookie hacks to enable topic
 subscriptions

We can't allow it, because the required database tables may not exist
yet (T280082).

This is meant to be temporary until we complete DBA review and the
tables are created.

Bug: T280082
Change-Id: I8f947b779c6829763d3413931c6d354e6f7aee4d
---
 includes/Hooks/HookUtils.php | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/includes/Hooks/HookUtils.php b/includes/Hooks/HookUtils.php
index 09d8f0fec..02c166c39 100644
--- a/includes/Hooks/HookUtils.php
+++ b/includes/Hooks/HookUtils.php
@@ -228,19 +228,26 @@ class HookUtils {
 		}
 
 		// ?dtenable=1 overrides all user and title checks
-		if (
-			$output->getRequest()->getVal( 'dtenable' ) ||
+		$queryEnable = $output->getRequest()->getVal( 'dtenable' ) ||
 			// Extra hack for parses from API, where this parameter isn't passed to derivative requests
-			RequestContext::getMain()->getRequest()->getVal( 'dtenable' )
-		) {
+			RequestContext::getMain()->getRequest()->getVal( 'dtenable' );
+		// The cookie hack allows users to enable all features when they are not
+		// yet available on the wiki
+		$cookieEnable = $output->getRequest()->getCookie( 'discussiontools-tempenable' ) ?: false;
+
+		if ( $feature === self::TOPICSUBSCRIPTION ) {
+			// Can't be enabled via query/cookie, because the tables may not exist yet (T280082)
+			$queryEnable = false;
+			$cookieEnable = false;
+		}
+
+		if ( $queryEnable ) {
 			return true;
 		}
 
 		return static::isAvailableForTitle( $title ) && (
 			static::isFeatureEnabledForUser( $output->getUser(), $feature ) ||
-			// The cookie hack allows users to enable all features when they are not
-			// yet available on the wiki
-			$output->getRequest()->getCookie( 'discussiontools-tempenable' ) ?: false
+			$cookieEnable
 		);
 	}
 }