includes/utils/MWRestrictions.php

   1 <?php
   2 /**
   3  * A class to check request restrictions expressed as a JSON object
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License as published by
   7  * the Free Software Foundation; either version 2 of the License, or
   8  * (at your option) any later version.
   9  *
  10  * This program is distributed in the hope that it will be useful,
  11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  13  * GNU General Public License for more details.
  14  *
  15  * You should have received a copy of the GNU General Public License along
  16  * with this program; if not, write to the Free Software Foundation, Inc.,
  17  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  18  * http://www.gnu.org/copyleft/gpl.html
  19  */
  20
  21 use MediaWiki\Request\WebRequest;
  22 use MediaWiki\Status\Status;
  23 use Wikimedia\IPSet;
  24 use Wikimedia\IPUtils;
  25
  26 /**
  27  * A class to check request restrictions expressed as a JSON object
  28  */
  29 class MWRestrictions {
  30
  31         private $ipAddresses = [ '0.0.0.0/0', '::/0' ];
  32
  33         /**
  34          * @param array|null $restrictions
  35          * @throws InvalidArgumentException
  36          */
  37         protected function __construct( array $restrictions = null ) {
  38                 if ( $restrictions !== null ) {
  39                         $this->loadFromArray( $restrictions );
  40                 }
  41         }
  42
  43         /**
  44          * @return MWRestrictions
  45          */
  46         public static function newDefault() {
  47                 return new self();
  48         }
  49
  50         /**
  51          * @param array $restrictions
  52          * @return MWRestrictions
  53          * @throws InvalidArgumentException
  54          */
  55         public static function newFromArray( array $restrictions ) {
  56                 return new self( $restrictions );
  57         }
  58
  59         /**
  60          * @param string $json JSON representation of the restrictions
  61          * @return MWRestrictions
  62          * @throws InvalidArgumentException
  63          */
  64         public static function newFromJson( $json ) {
  65                 $restrictions = FormatJson::decode( $json, true );
  66                 if ( !is_array( $restrictions ) ) {
  67                         throw new InvalidArgumentException( 'Invalid restrictions JSON' );
  68                 }
  69                 return new self( $restrictions );
  70         }
  71
  72         private function loadFromArray( array $restrictions ) {
  73                 static $validKeys = [ 'IPAddresses' ];
  74                 static $neededKeys = [ 'IPAddresses' ];
  75
  76                 $keys = array_keys( $restrictions );
  77                 $invalidKeys = array_diff( $keys, $validKeys );
  78                 if ( $invalidKeys ) {
  79                         throw new InvalidArgumentException(
  80                                 'Array contains invalid keys: ' . implode( ', ', $invalidKeys )
  81                         );
  82                 }
  83                 $missingKeys = array_diff( $neededKeys, $keys );
  84                 if ( $missingKeys ) {
  85                         throw new InvalidArgumentException(
  86                                 'Array is missing required keys: ' . implode( ', ', $missingKeys )
  87                         );
  88                 }
  89
  90                 if ( !is_array( $restrictions['IPAddresses'] ) ) {
  91                         throw new InvalidArgumentException( 'IPAddresses is not an array' );
  92                 }
  93                 foreach ( $restrictions['IPAddresses'] as $ip ) {
  94                         if ( !IPUtils::isIPAddress( $ip ) ) {
  95                                 throw new InvalidArgumentException( "Invalid IP address: $ip" );
  96                         }
  97                 }
  98                 $this->ipAddresses = $restrictions['IPAddresses'];
  99         }
 100
 101         /**
 102          * Return the restrictions as an array
 103          * @return array
 104          */
 105         public function toArray() {
 106                 return [
 107                         'IPAddresses' => $this->ipAddresses,
 108                 ];
 109         }
 110
 111         /**
 112          * Return the restrictions as a JSON string
 113          * @param bool|string $pretty Pretty-print the JSON output, see FormatJson::encode
 114          * @return string
 115          */
 116         public function toJson( $pretty = false ) {
 117                 return FormatJson::encode( $this->toArray(), $pretty, FormatJson::ALL_OK );
 118         }
 119
 120         public function __toString() {
 121                 return $this->toJson();
 122         }
 123
 124         /**
 125          * Test against the passed WebRequest
 126          * @param WebRequest $request
 127          * @return Status
 128          */
 129         public function check( WebRequest $request ) {
 130                 $ok = [
 131                         'ip' => $this->checkIP( $request->getIP() ),
 132                 ];
 133                 $status = Status::newGood();
 134                 $status->setResult( $ok === array_filter( $ok ), $ok );
 135                 return $status;
 136         }
 137
 138         /**
 139          * Test if an IP address is allowed by the restrictions
 140          * @param string $ip
 141          * @return bool
 142          */
 143         public function checkIP( $ip ) {
 144                 $set = new IPSet( $this->ipAddresses );
 145                 return $set->match( $ip );
 146         }
 147 }