includes/auth/CheckBlocksSecondaryAuthenticationProvider.php

   1 <?php
   2 /**
   3  * This program is free software; you can redistribute it and/or modify
   4  * it under the terms of the GNU General Public License as published by
   5  * the Free Software Foundation; either version 2 of the License, or
   6  * (at your option) any later version.
   7  *
   8  * This program is distributed in the hope that it will be useful,
   9  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  10  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  11  * GNU General Public License for more details.
  12  *
  13  * You should have received a copy of the GNU General Public License along
  14  * with this program; if not, write to the Free Software Foundation, Inc.,
  15  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  16  * http://www.gnu.org/copyleft/gpl.html
  17  *
  18  * @file
  19  * @ingroup Auth
  20  */
  21
  22 namespace MediaWiki\Auth;
  23
  24 use MediaWiki\MainConfigNames;
  25 use MediaWiki\Message\Message;
  26
  27 /**
  28  * Check if the user is blocked, and prevent authentication if so.
  29  *
  30  * Not all scenarios are covered by this class, AuthManager does some block checks itself
  31  * via AuthManager::authorizeCreateAccount().
  32  *
  33  * @ingroup Auth
  34  * @since 1.27
  35  */
  36 class CheckBlocksSecondaryAuthenticationProvider extends AbstractSecondaryAuthenticationProvider {
  37
  38         /** @var bool */
  39         protected $blockDisablesLogin = null;
  40
  41         /**
  42          * @param array $params
  43          *  - blockDisablesLogin: (bool) Whether blocked accounts can log in,
  44          *    defaults to $wgBlockDisablesLogin
  45          */
  46         public function __construct( $params = [] ) {
  47                 if ( isset( $params['blockDisablesLogin'] ) ) {
  48                         $this->blockDisablesLogin = (bool)$params['blockDisablesLogin'];
  49                 }
  50         }
  51
  52         /** @inheritDoc */
  53         protected function postInitSetup() {
  54                 $this->blockDisablesLogin ??= $this->config->get( MainConfigNames::BlockDisablesLogin );
  55         }
  56
  57         /** @inheritDoc */
  58         public function getAuthenticationRequests( $action, array $options ) {
  59                 return [];
  60         }
  61
  62         /** @inheritDoc */
  63         public function beginSecondaryAuthentication( $user, array $reqs ) {
  64                 if ( !$this->blockDisablesLogin ) {
  65                         return AuthenticationResponse::newAbstain();
  66                 }
  67                 $block = $user->getBlock();
  68                 // Ignore IP blocks and partial blocks, $wgBlockDisablesLogin was meant for
  69                 // blocks banning specific users.
  70                 if ( $block && $block->isSitewide() && $block->isBlocking( $user ) ) {
  71                         return AuthenticationResponse::newFail(
  72                                 new Message( 'login-userblocked', [ $user->getName() ] )
  73                         );
  74                 } else {
  75                         return AuthenticationResponse::newPass();
  76                 }
  77         }
  78
  79         /** @inheritDoc */
  80         public function beginSecondaryAccountCreation( $user, $creator, array $reqs ) {
  81                 return AuthenticationResponse::newAbstain();
  82         }
  83
  84 }