mdaniels5757 / waca

config.inc.php

Indentation +52 added lines, -52 removed lines

@@ -183,56 +183,56 @@
 // Initialise the site configuration object
 global $siteConfiguration;
 $siteConfiguration->setBaseUrl($baseurl)
-    ->setFilePath(__DIR__)
-    ->setDebuggingTraceEnabled($enableErrorTrace)
-    ->setDebuggingCssBreakpointsEnabled($enableCssBreakpoints)
-    ->setForceIdentification($forceIdentification)
-    ->setIdentificationCacheExpiry($identificationCacheExpiry)
-    ->setMetaWikimediaWebServiceEndpoint($metaWikimediaWebServiceEndpoint)
-    ->setEnforceOAuth($enforceOAuth)
-    ->setEmailConfirmationEnabled($enableEmailConfirm == 1)
-    ->setEmailConfirmationExpiryDays($emailConfirmationExpiryDays)
-    ->setMiserModeLimit($requestLimitShowOnly)
-    ->setSquidList($squidIpList)
-    ->setUseStrictTransportSecurity($strictTransportSecurityExpiry)
-    ->setUserAgent($toolUserAgent)
-    ->setCurlDisableVerifyPeer($curlDisableSSLVerifyPeer)
-    ->setUseOAuthSignup($useOauthSignup)
-    ->setOAuthConsumerToken($oauthConsumerToken)
-    ->setOAuthLegacyConsumerTokens($oauthLegacyTokens)
-    ->setOAuthConsumerSecret($oauthSecretToken)
-    ->setOauthMediaWikiCanonicalServer($oauthMediaWikiCanonicalServer)
-    ->setDataClearInterval($dataclear_interval)
-    ->setXffTrustedHostsFile($xff_trusted_hosts_file)
-    ->setIrcNotificationsEnabled($ircBotNotificationsEnabled == 1)
-    ->setIrcNotificationsInstance($whichami)
-    ->setTitleBlacklistEnabled($enableTitleblacklist == 1)
-    ->setTorExitPaths(array_merge(gethostbynamel('en.wikipedia.org'), gethostbynamel('accounts.wmflabs.org')))
-    ->setCreationBotUsername($creationBotUsername)
-    ->setCreationBotPassword($creationBotPassword)
-    ->setCurlCookieJar($curlCookieJar)
-    ->setYubicoApiId($yubicoApiId)
-    ->setYubicoApiKey($yubicoApiKey)
-    ->setTotpEncryptionKey($totpEncryptionKey)
-    ->setRegistrationAllowed($allowRegistration)
-    ->setCspReportUri($cspReportUri)
-    ->setResourceCacheEpoch($resourceCacheEpoch)
-    ->setLocationProviderApiKey($locationProviderApiKey)
-    ->setCommonEmailDomains($commonEmailDomains)
-    ->setBanMaxIpRange($banMaxIpRange)
-    ->setBanMaxIpBlockRange($banMaxIpBlockRange)
-    ->setJobQueueBatchSize($jobQueueBatchSize)
-    ->setAmqpConfiguration($amqpConfiguration)
-    ->setEmailSender($emailSender)
-    ->setIdentificationNoticeboardPage($identificationNoticeboardPage)
-    ->setIdentificationNoticeboardWebserviceEndpoint($identificationNoticeboardApi)
-    ->setAcceptClientHints($acceptClientHints)
-    ->setOffline(['offline' => $dontUseDb == 1, 'reason' => $dontUseDbReason, 'culprit' => $dontUseDbCulprit])
-    ->setDatabaseConfig([
-        'datasource' => 'mysql:host=' . $toolserver_host . ';dbname=' . $toolserver_database,
-        'username' => $toolserver_username,
-        'password' => $toolserver_password,
-    ])
-    ->setCookiePath($cookiepath)
-    ->setCookieSessionName($sessionname)
+	->setFilePath(__DIR__)
+	->setDebuggingTraceEnabled($enableErrorTrace)
+	->setDebuggingCssBreakpointsEnabled($enableCssBreakpoints)
+	->setForceIdentification($forceIdentification)
+	->setIdentificationCacheExpiry($identificationCacheExpiry)
+	->setMetaWikimediaWebServiceEndpoint($metaWikimediaWebServiceEndpoint)
+	->setEnforceOAuth($enforceOAuth)
+	->setEmailConfirmationEnabled($enableEmailConfirm == 1)
+	->setEmailConfirmationExpiryDays($emailConfirmationExpiryDays)
+	->setMiserModeLimit($requestLimitShowOnly)
+	->setSquidList($squidIpList)
+	->setUseStrictTransportSecurity($strictTransportSecurityExpiry)
+	->setUserAgent($toolUserAgent)
+	->setCurlDisableVerifyPeer($curlDisableSSLVerifyPeer)
+	->setUseOAuthSignup($useOauthSignup)
+	->setOAuthConsumerToken($oauthConsumerToken)
+	->setOAuthLegacyConsumerTokens($oauthLegacyTokens)
+	->setOAuthConsumerSecret($oauthSecretToken)
+	->setOauthMediaWikiCanonicalServer($oauthMediaWikiCanonicalServer)
+	->setDataClearInterval($dataclear_interval)
+	->setXffTrustedHostsFile($xff_trusted_hosts_file)
+	->setIrcNotificationsEnabled($ircBotNotificationsEnabled == 1)
+	->setIrcNotificationsInstance($whichami)
+	->setTitleBlacklistEnabled($enableTitleblacklist == 1)
+	->setTorExitPaths(array_merge(gethostbynamel('en.wikipedia.org'), gethostbynamel('accounts.wmflabs.org')))
+	->setCreationBotUsername($creationBotUsername)
+	->setCreationBotPassword($creationBotPassword)
+	->setCurlCookieJar($curlCookieJar)
+	->setYubicoApiId($yubicoApiId)
+	->setYubicoApiKey($yubicoApiKey)
+	->setTotpEncryptionKey($totpEncryptionKey)
+	->setRegistrationAllowed($allowRegistration)
+	->setCspReportUri($cspReportUri)
+	->setResourceCacheEpoch($resourceCacheEpoch)
+	->setLocationProviderApiKey($locationProviderApiKey)
+	->setCommonEmailDomains($commonEmailDomains)
+	->setBanMaxIpRange($banMaxIpRange)
+	->setBanMaxIpBlockRange($banMaxIpBlockRange)
+	->setJobQueueBatchSize($jobQueueBatchSize)
+	->setAmqpConfiguration($amqpConfiguration)
+	->setEmailSender($emailSender)
+	->setIdentificationNoticeboardPage($identificationNoticeboardPage)
+	->setIdentificationNoticeboardWebserviceEndpoint($identificationNoticeboardApi)
+	->setAcceptClientHints($acceptClientHints)
+	->setOffline(['offline' => $dontUseDb == 1, 'reason' => $dontUseDbReason, 'culprit' => $dontUseDbCulprit])
+	->setDatabaseConfig([
+		'datasource' => 'mysql:host=' . $toolserver_host . ';dbname=' . $toolserver_database,
+		'username' => $toolserver_username,
+		'password' => $toolserver_password,
+	])
+	->setCookiePath($cookiepath)
+	->setCookieSessionName($sessionname)
 ;

includes/Exceptions/AccessDeniedException.php

Indentation +90 added lines, -90 removed lines

@@ -27,94 +27,94 @@
  */
 class AccessDeniedException extends ReadableException
 {
-    use NavigationMenuAccessControl;
-
-    /** @var SecurityManager */
-    private $securityManager;
-    /** @var DomainAccessManager */
-    private $domainAccessManager;
-
-    /**
-     * AccessDeniedException constructor.
-     *
-     * @param SecurityManager     $securityManager
-     * @param DomainAccessManager $domainAccessManager
-     */
-    public function __construct(SecurityManager $securityManager, DomainAccessManager $domainAccessManager)
-    {
-        $this->securityManager = $securityManager;
-        $this->domainAccessManager = $domainAccessManager;
-    }
-
-    public function getReadableError()
-    {
-        if (!headers_sent()) {
-            header("HTTP/1.1 403 Forbidden");
-        }
-
-        $this->setUpSmarty();
-
-        // uck. We should still be able to access the database in this situation though.
-        $database = PdoDatabase::getDatabaseConnection($this->getSiteConfiguration());
-        $currentUser = User::getCurrent($database);
-        $this->assign('skin', PreferenceManager::getForCurrent($database)->getPreference(PreferenceManager::PREF_SKIN));
-        $this->assign('currentUser', $currentUser);
-        $this->assign('currentDomain', Domain::getCurrent($database));
-
-        if ($this->securityManager !== null) {
-            $this->setupNavMenuAccess($currentUser);
-        }
-
-        if ($currentUser->isDeclined()) {
-            $this->assign('htmlTitle', 'Account Declined');
-            $this->assign('declineReason', $this->getLogEntry('Declined', $currentUser, $database));
-
-            return $this->fetchTemplate("exception/account-declined.tpl");
-        }
-
-        if ($currentUser->isSuspended()) {
-            $this->assign('htmlTitle', 'Account Suspended');
-            $this->assign('suspendReason', $this->getLogEntry('Suspended', $currentUser, $database));
-
-            return $this->fetchTemplate("exception/account-suspended.tpl");
-        }
-
-        if ($currentUser->isNewUser()) {
-            $this->assign('htmlTitle', 'Account Pending');
-
-            return $this->fetchTemplate("exception/account-new.tpl");
-        }
-
-        return $this->fetchTemplate("exception/access-denied.tpl");
-    }
-
-    /**
-     * @param string      $action
-     * @param User        $user
-     * @param PdoDatabase $database
-     *
-     * @return null|string
-     */
-    private function getLogEntry($action, User $user, PdoDatabase $database)
-    {
-        /** @var Log[] $logs */
-        $logs = LogSearchHelper::get($database, null)
-            ->byAction($action)
-            ->byObjectType('User')
-            ->byObjectId($user->getId())
-            ->limit(1)
-            ->fetch();
-
-        return $logs[0]->getComment();
-    }
-
-    protected function getSecurityManager(): SecurityManager
-    {
-        return $this->securityManager;
-    }
-
-    public function getDomainAccessManager(): DomainAccessManager
-    {
-        return $this->domainAccessManager;
-    }
+	use NavigationMenuAccessControl;
+
+	/** @var SecurityManager */
+	private $securityManager;
+	/** @var DomainAccessManager */
+	private $domainAccessManager;
+
+	/**
+	 * AccessDeniedException constructor.
+	 *
+	 * @param SecurityManager     $securityManager
+	 * @param DomainAccessManager $domainAccessManager
+	 */
+	public function __construct(SecurityManager $securityManager, DomainAccessManager $domainAccessManager)
+	{
+		$this->securityManager = $securityManager;
+		$this->domainAccessManager = $domainAccessManager;
+	}
+
+	public function getReadableError()
+	{
+		if (!headers_sent()) {
+			header("HTTP/1.1 403 Forbidden");
+		}
+
+		$this->setUpSmarty();
+
+		// uck. We should still be able to access the database in this situation though.
+		$database = PdoDatabase::getDatabaseConnection($this->getSiteConfiguration());
+		$currentUser = User::getCurrent($database);
+		$this->assign('skin', PreferenceManager::getForCurrent($database)->getPreference(PreferenceManager::PREF_SKIN));
+		$this->assign('currentUser', $currentUser);
+		$this->assign('currentDomain', Domain::getCurrent($database));
+
+		if ($this->securityManager !== null) {
+			$this->setupNavMenuAccess($currentUser);
+		}
+
+		if ($currentUser->isDeclined()) {
+			$this->assign('htmlTitle', 'Account Declined');
+			$this->assign('declineReason', $this->getLogEntry('Declined', $currentUser, $database));
+
+			return $this->fetchTemplate("exception/account-declined.tpl");
+		}
+
+		if ($currentUser->isSuspended()) {
+			$this->assign('htmlTitle', 'Account Suspended');
+			$this->assign('suspendReason', $this->getLogEntry('Suspended', $currentUser, $database));
+
+			return $this->fetchTemplate("exception/account-suspended.tpl");
+		}
+
+		if ($currentUser->isNewUser()) {
+			$this->assign('htmlTitle', 'Account Pending');
+
+			return $this->fetchTemplate("exception/account-new.tpl");
+		}
+
+		return $this->fetchTemplate("exception/access-denied.tpl");
+	}
+
+	/**
+	 * @param string      $action
+	 * @param User        $user
+	 * @param PdoDatabase $database
+	 *
+	 * @return null|string
+	 */
+	private function getLogEntry($action, User $user, PdoDatabase $database)
+	{
+		/** @var Log[] $logs */
+		$logs = LogSearchHelper::get($database, null)
+			->byAction($action)
+			->byObjectType('User')
+			->byObjectId($user->getId())
+			->limit(1)
+			->fetch();
+
+		return $logs[0]->getComment();
+	}
+
+	protected function getSecurityManager(): SecurityManager
+	{
+		return $this->securityManager;
+	}
+
+	public function getDomainAccessManager(): DomainAccessManager
+	{
+		return $this->domainAccessManager;
+	}
 }
\ No newline at end of file

includes/Exceptions/NotIdentifiedException.php

Indentation +45 added lines, -45 removed lines

@@ -18,58 +18,58 @@
 
 class NotIdentifiedException extends ReadableException
 {
-    use NavigationMenuAccessControl;
+	use NavigationMenuAccessControl;
 
-    /** @var SecurityManager */
-    private $securityManager;
-    /** @var DomainAccessManager */
-    private $domainAccessManager;
+	/** @var SecurityManager */
+	private $securityManager;
+	/** @var DomainAccessManager */
+	private $domainAccessManager;
 
-    /**
-     * NotIdentifiedException constructor.
-     *
-     * @param SecurityManager     $securityManager
-     * @param DomainAccessManager $domainAccessManager
-     */
-    public function __construct(SecurityManager $securityManager, DomainAccessManager $domainAccessManager)
-    {
-        $this->securityManager = $securityManager;
-        $this->domainAccessManager = $domainAccessManager;
-    }
+	/**
+	 * NotIdentifiedException constructor.
+	 *
+	 * @param SecurityManager     $securityManager
+	 * @param DomainAccessManager $domainAccessManager
+	 */
+	public function __construct(SecurityManager $securityManager, DomainAccessManager $domainAccessManager)
+	{
+		$this->securityManager = $securityManager;
+		$this->domainAccessManager = $domainAccessManager;
+	}
 
-    /**
-     * Returns a readable HTML error message that's displayable to the user using templates.
-     * @return string
-     */
-    public function getReadableError()
-    {
-        if (!headers_sent()) {
-            header("HTTP/1.1 403 Forbidden");
-        }
+	/**
+	 * Returns a readable HTML error message that's displayable to the user using templates.
+	 * @return string
+	 */
+	public function getReadableError()
+	{
+		if (!headers_sent()) {
+			header("HTTP/1.1 403 Forbidden");
+		}
 
-        $this->setUpSmarty();
+		$this->setUpSmarty();
 
-        // uck. We should still be able to access the database in this situation though.
-        $database = PdoDatabase::getDatabaseConnection($this->getSiteConfiguration());
-        $currentUser = User::getCurrent($database);
-        $this->assign('skin', PreferenceManager::getForCurrent($database)->getPreference(PreferenceManager::PREF_SKIN));
-        $this->assign('currentUser', $currentUser);
-        $this->assign('currentDomain', Domain::getCurrent($database));
+		// uck. We should still be able to access the database in this situation though.
+		$database = PdoDatabase::getDatabaseConnection($this->getSiteConfiguration());
+		$currentUser = User::getCurrent($database);
+		$this->assign('skin', PreferenceManager::getForCurrent($database)->getPreference(PreferenceManager::PREF_SKIN));
+		$this->assign('currentUser', $currentUser);
+		$this->assign('currentDomain', Domain::getCurrent($database));
 
-        if ($this->securityManager !== null) {
-            $this->setupNavMenuAccess($currentUser);
-        }
+		if ($this->securityManager !== null) {
+			$this->setupNavMenuAccess($currentUser);
+		}
 
-        return $this->fetchTemplate("exception/not-identified.tpl");
-    }
+		return $this->fetchTemplate("exception/not-identified.tpl");
+	}
 
-    protected function getSecurityManager(): SecurityManager
-    {
-        return $this->securityManager;
-    }
+	protected function getSecurityManager(): SecurityManager
+	{
+		return $this->securityManager;
+	}
 
-    public function getDomainAccessManager(): DomainAccessManager
-    {
-        return $this->domainAccessManager;
-    }
+	public function getDomainAccessManager(): DomainAccessManager
+	{
+		return $this->domainAccessManager;
+	}
 }
\ No newline at end of file

includes/Pages/PageBan.php

Indentation +657 added lines, -657 removed lines

@@ -26,663 +26,663 @@
 
 class PageBan extends InternalPageBase
 {
-    /**
-     * Main function for this page, when no specific actions are called.
-     */
-    protected function main(): void
-    {
-        $this->assignCSRFToken();
-        $this->setHtmlTitle('Bans');
-
-        $database = $this->getDatabase();
-        $currentDomain = Domain::getCurrent($database);
-        $bans = Ban::getActiveBans($database, $currentDomain->getId());
-
-        $this->setupBanList($bans);
-
-        $this->assign('isFiltered', false);
-        $this->setTemplate('bans/main.tpl');
-    }
-
-    protected function show(): void
-    {
-        $this->assignCSRFToken();
-        $this->setHtmlTitle('Bans');
-
-        $rawIdList = WebRequest::getString('id');
-        if ($rawIdList === null) {
-            $this->redirect('bans');
-
-            return;
-        }
-
-        $idList = explode(',', $rawIdList);
-
-        $database = $this->getDatabase();
-        $currentDomain = Domain::getCurrent($database);
-        $bans = Ban::getByIdList($idList, $database, $currentDomain->getId());
-
-        $this->setupBanList($bans);
-        $this->assign('isFiltered', true);
-        $this->setTemplate('bans/main.tpl');
-    }
-
-    /**
-     * Entry point for the ban set action
-     * @throws SmartyException
-     * @throws Exception
-     */
-    protected function set(): void
-    {
-        $this->setHtmlTitle('Bans');
-
-        // dual-mode action
-        if (WebRequest::wasPosted()) {
-            try {
-                $this->handlePostMethodForSetBan();
-            }
-            catch (ApplicationLogicException $ex) {
-                SessionAlert::error($ex->getMessage());
-                $this->redirect("bans", "set");
-            }
-        }
-        else {
-            $this->handleGetMethodForSetBan();
-
-            $user = User::getCurrent($this->getDatabase());
-            $banType = WebRequest::getString('type');
-            $banRequest = WebRequest::getInt('request');
-
-            // if the parameters are null, skip loading a request.
-            if ($banType !== null && $banRequest !== null && $banRequest !== 0) {
-                $this->preloadFormForRequest($banRequest, $banType, $user);
-            }
-        }
-    }
-
-    protected function replace(): void
-    {
-        $this->setHtmlTitle('Bans');
-
-        $database = $this->getDatabase();
-        $domain = Domain::getCurrent($database);
-
-        // dual-mode action
-        if (WebRequest::wasPosted()) {
-            try {
-                $originalBanId = WebRequest::postInt('replaceBanId');
-                $originalBanUpdateVersion = WebRequest::postInt('replaceBanUpdateVersion');
-
-                $originalBan = Ban::getActiveId($originalBanId, $database, $domain->getId());
-
-                if ($originalBan === false) {
-                    throw new ApplicationLogicException("The specified ban is not currently active, or doesn't exist.");
-                }
-
-                // Discard original ban; we're replacing it.
-                $originalBan->setUpdateVersion($originalBanUpdateVersion);
-                $originalBan->setActive(false);
-                $originalBan->save();
-
-                Logger::banReplaced($database, $originalBan);
-
-                // Proceed as normal to save the new ban.
-                $this->handlePostMethodForSetBan();
-            }
-            catch (ApplicationLogicException $ex) {
-                $database->rollback();
-                SessionAlert::error($ex->getMessage());
-                $this->redirect("bans", "set");
-            }
-        }
-        else {
-            $this->handleGetMethodForSetBan();
-
-            $user = User::getCurrent($database);
-            $originalBanId = WebRequest::getString('id');
-
-            $originalBan = Ban::getActiveId($originalBanId, $database, $domain->getId());
-
-            if ($originalBan === false) {
-                throw new ApplicationLogicException("The specified ban is not currently active, or doesn't exist.");
-            }
-
-            if ($originalBan->getName() !== null) {
-                if (!$this->barrierTest('name', $user, 'BanType')) {
-                    SessionAlert::error("You are not allowed to set this type of ban.");
-                    $this->redirect("bans", "set");
-                    return;
-                }
-
-                $this->assign('banName', $originalBan->getName());
-            }
-
-            if ($originalBan->getEmail() !== null) {
-                if (!$this->barrierTest('email', $user, 'BanType')) {
-                    SessionAlert::error("You are not allowed to set this type of ban.");
-                    $this->redirect("bans", "set");
-                    return;
-                }
-
-                $this->assign('banEmail', $originalBan->getEmail());
-            }
-
-            if ($originalBan->getUseragent() !== null) {
-                if (!$this->barrierTest('useragent', $user, 'BanType')) {
-                    SessionAlert::error("You are not allowed to set this type of ban.");
-                    $this->redirect("bans", "set");
-                    return;
-                }
-
-                $this->assign('banUseragent', $originalBan->getUseragent());
-            }
-
-            if ($originalBan->getIp() !== null) {
-                if (!$this->barrierTest('ip', $user, 'BanType')) {
-                    SessionAlert::error("You are not allowed to set this type of ban.");
-                    $this->redirect("bans", "set");
-                    return;
-                }
-
-                $this->assign('banIP', $originalBan->getIp() . '/' . $originalBan->getIpMask());
-            }
-
-            $banIsGlobal = $originalBan->getDomain() === null;
-            if ($banIsGlobal) {
-                if (!$this->barrierTest('global', $user, 'BanType')) {
-                    SessionAlert::error("You are not allowed to set this type of ban.");
-                    $this->redirect("bans", "set");
-                    return;
-                }
-            }
-
-            if (!$this->barrierTest($originalBan->getVisibility(), $user, 'BanVisibility')) {
-                SessionAlert::error("You are not allowed to set this type of ban.");
-                $this->redirect("bans", "set");
-                return;
-            }
-
-            $this->assign('banGlobal', $banIsGlobal);
-            $this->assign('banVisibility', $originalBan->getVisibility());
-
-            if ($originalBan->getDuration() !== null) {
-                $this->assign('banDuration', date('c', $originalBan->getDuration()));
-            }
-
-            $this->assign('banReason', $originalBan->getReason());
-            $this->assign('banAction', $originalBan->getAction());
-            $this->assign('banQueue', $originalBan->getTargetQueue());
-
-            $this->assign('replaceBanId', $originalBan->getId());
-            $this->assign('replaceBanUpdateVersion', $originalBan->getUpdateVersion());
-        }
-    }
-
-    /**
-     * Entry point for the ban remove action
-     *
-     * @throws AccessDeniedException
-     * @throws ApplicationLogicException
-     * @throws SmartyException
-     */
-    protected function remove(): void
-    {
-        $this->setHtmlTitle('Bans');
-
-        $ban = $this->getBanForUnban();
-
-        $banHelper = new BanHelper($this->getDatabase(), $this->getXffTrustProvider(), $this->getSecurityManager());
-        if (!$banHelper->canUnban($ban)) {
-            // triggered when a user tries to unban a ban they can't see the entirety of.
-            // there's no UI way to get to this, so a raw exception is fine.
-            throw new AccessDeniedException($this->getSecurityManager(), $this->getDomainAccessManager());
-        }
-
-        // dual mode
-        if (WebRequest::wasPosted()) {
-            $this->validateCSRFToken();
-            $unbanReason = WebRequest::postString('unbanreason');
-
-            if ($unbanReason === null || trim($unbanReason) === "") {
-                SessionAlert::error('No unban reason specified');
-                $this->redirect("bans", "remove", array('id' => $ban->getId()));
-            }
-
-            // set optimistic locking from delete form page load
-            $updateVersion = WebRequest::postInt('updateversion');
-            $ban->setUpdateVersion($updateVersion);
-
-            $database = $this->getDatabase();
-            $ban->setActive(false);
-            $ban->save();
-
-            Logger::unbanned($database, $ban, $unbanReason);
-
-            SessionAlert::quick('Disabled ban.');
-            $this->getNotificationHelper()->unbanned($ban, $unbanReason);
-
-            $this->redirect('bans');
-        }
-        else {
-            $this->assignCSRFToken();
-            $this->assign('ban', $ban);
-            $this->setTemplate('bans/unban.tpl');
-        }
-    }
-
-    /**
-     * Retrieves the requested ban duration from the WebRequest
-     *
-     * @throws ApplicationLogicException
-     */
-    private function getBanDuration(): ?int
-    {
-        $duration = WebRequest::postString('duration');
-        if ($duration === "other") {
-            $duration = strtotime(WebRequest::postString('otherduration'));
-
-            if (!$duration) {
-                throw new ApplicationLogicException('Invalid ban time');
-            }
-            elseif (time() > $duration) {
-                throw new ApplicationLogicException('Ban time has already expired!');
-            }
-
-            return $duration;
-        }
-        elseif ($duration === "-1") {
-            return null;
-        }
-        else {
-            return WebRequest::postInt('duration') + time();
-        }
-    }
-
-    /**
-     * Handles the POST method on the set action
-     *
-     * @throws ApplicationLogicException
-     * @throws Exception
-     */
-    private function handlePostMethodForSetBan()
-    {
-        $this->validateCSRFToken();
-        $database = $this->getDatabase();
-        $user = User::getCurrent($database);
-        $currentDomain = Domain::getCurrent($database);
-
-        // Checks whether there is a reason entered for ban.
-        $reason = WebRequest::postString('banreason');
-        if ($reason === null || trim($reason) === "") {
-            throw new ApplicationLogicException('You must specify a ban reason');
-        }
-
-        // ban targets
-        list($targetName, $targetIp, $targetEmail, $targetUseragent) = $this->getRawBanTargets($user);
-
-        $visibility = $this->getBanVisibility();
-
-        // Validate ban duration
-        $duration = $this->getBanDuration();
-
-        $action = WebRequest::postString('banAction') ?? Ban::ACTION_NONE;
-
-        $global = WebRequest::postBoolean('banGlobal');
-        if (!$this->barrierTest('global', $user, 'BanType')) {
-            $global = false;
-        }
-
-        if ($action === Ban::ACTION_DEFER && $global) {
-            throw new ApplicationLogicException("Cannot set a global ban in defer-to-queue mode.");
-        }
-
-        // handle CIDR ranges
-        $targetMask = null;
-        if ($targetIp !== null) {
-            list($targetIp, $targetMask) = $this->splitCidrRange($targetIp);
-            $this->validateIpBan($targetIp, $targetMask, $user, $action);
-        }
-
-        $banHelper = new BanHelper($this->getDatabase(), $this->getXffTrustProvider(), $this->getSecurityManager());
-
-        $bansByTarget = $banHelper->getBansByTarget(
-            $targetName,
-            $targetEmail,
-            $targetIp,
-            $targetMask,
-            $targetUseragent,
-            $currentDomain->getId());
-
-        if (count($bansByTarget) > 0) {
-            throw new ApplicationLogicException('This target is already banned!');
-        }
-
-        $ban = new Ban();
-        $ban->setDatabase($database);
-        $ban->setActive(true);
-
-        $ban->setName($targetName);
-        $ban->setIp($targetIp, $targetMask);
-        $ban->setEmail($targetEmail);
-        $ban->setUseragent($targetUseragent);
-
-        $ban->setUser($user->getId());
-        $ban->setReason($reason);
-        $ban->setDuration($duration);
-        $ban->setVisibility($visibility);
-
-        $ban->setDomain($global ? null : $currentDomain->getId());
-
-        $ban->setAction($action);
-        if ($ban->getAction() === Ban::ACTION_DEFER) {
-            //FIXME: domains
-            $queue = RequestQueue::getByApiName($database, WebRequest::postString('banActionTarget'), 1);
-            if ($queue === false) {
-                throw new ApplicationLogicException("Unknown target queue");
-            }
-
-            if (!$queue->isEnabled()) {
-                throw new ApplicationLogicException("Target queue is not enabled");
-            }
-
-            $ban->setTargetQueue($queue->getId());
-        }
-
-        $ban->save();
-
-        Logger::banned($database, $ban, $reason);
-
-        $this->getNotificationHelper()->banned($ban);
-        SessionAlert::quick('Ban has been set.');
-
-        $this->redirect('bans');
-    }
-
-    /**
-     * Handles the GET method on the set action
-     * @throws Exception
-     */
-    private function handleGetMethodForSetBan()
-    {
-        $this->setTemplate('bans/banform.tpl');
-        $this->assignCSRFToken();
-
-        $this->assign('maxIpRange', $this->getSiteConfiguration()->getBanMaxIpRange());
-        $this->assign('maxIpBlockRange', $this->getSiteConfiguration()->getBanMaxIpBlockRange());
-
-        $this->assign('banVisibility', 'user');
-        $this->assign('banGlobal', false);
-        $this->assign('banQueue', false);
-        $this->assign('banAction', Ban::ACTION_BLOCK);
-        $this->assign('banDuration', '');
-        $this->assign('banReason', '');
-
-        $this->assign('banEmail', '');
-        $this->assign('banIP', '');
-        $this->assign('banName', '');
-        $this->assign('banUseragent', '');
-
-        $this->assign('replaceBanId', null);
-
-
-
-        $database = $this->getDatabase();
-
-        $user = User::getCurrent($database);
-        $this->setupSecurity($user);
-
-        $queues = RequestQueue::getEnabledQueues($database);
-
-        $this->assign('requestQueues', $queues);
-    }
-
-    /**
-     * Finds the Ban object referenced in the WebRequest if it is valid
-     *
-     * @return Ban
-     * @throws ApplicationLogicException
-     */
-    private function getBanForUnban(): Ban
-    {
-        $banId = WebRequest::getInt('id');
-        if ($banId === null || $banId === 0) {
-            throw new ApplicationLogicException("The ban ID appears to be missing. This is probably a bug.");
-        }
-
-        $database = $this->getDatabase();
-        $this->setupSecurity(User::getCurrent($database));
-        $currentDomain = Domain::getCurrent($database);
-        $ban = Ban::getActiveId($banId, $database, $currentDomain->getId());
-
-        if ($ban === false) {
-            throw new ApplicationLogicException("The specified ban is not currently active, or doesn't exist.");
-        }
-
-        return $ban;
-    }
-
-    /**
-     * Sets up Smarty variables for access control
-     */
-    private function setupSecurity(User $user): void
-    {
-        $this->assign('canSeeIpBan', $this->barrierTest('ip', $user, 'BanType'));
-        $this->assign('canSeeNameBan', $this->barrierTest('name', $user, 'BanType'));
-        $this->assign('canSeeEmailBan', $this->barrierTest('email', $user, 'BanType'));
-        $this->assign('canSeeUseragentBan', $this->barrierTest('useragent', $user, 'BanType'));
-
-        $this->assign('canGlobalBan', $this->barrierTest('global', $user, 'BanType'));
-
-        $this->assign('canSeeUserVisibility', $this->barrierTest('user', $user, 'BanVisibility'));
-        $this->assign('canSeeAdminVisibility', $this->barrierTest('admin', $user, 'BanVisibility'));
-        $this->assign('canSeeCheckuserVisibility', $this->barrierTest('checkuser', $user, 'BanVisibility'));
-    }
-
-    /**
-     * Validates that the provided IP is acceptable for a ban of this type
-     *
-     * @param string $targetIp   IP address
-     * @param int    $targetMask CIDR prefix length
-     * @param User   $user       User performing the ban
-     * @param string $action     Ban action to take
-     *
-     * @throws ApplicationLogicException
-     */
-    private function validateIpBan(string $targetIp, int $targetMask, User $user, string $action): void
-    {
-        // validate this is an IP
-        if (!filter_var($targetIp, FILTER_VALIDATE_IP)) {
-            throw new ApplicationLogicException("Not a valid IP address");
-        }
-
-        $canLargeIpBan = $this->barrierTest('ip-largerange', $user, 'BanType');
-        $maxIpBlockRange = $this->getSiteConfiguration()->getBanMaxIpBlockRange();
-        $maxIpRange = $this->getSiteConfiguration()->getBanMaxIpRange();
-
-        // validate CIDR ranges
-        if (filter_var($targetIp, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6)) {
-            if ($targetMask < 0 || $targetMask > 128) {
-                throw new ApplicationLogicException("CIDR mask out of range for IPv6");
-            }
-
-            // prevent setting the ban if:
-            //  * the user isn't allowed to set large bans, AND
-            //  * the ban is a drop or a block (preventing human review of the request), AND
-            //  * the mask is too wide-reaching
-            if (!$canLargeIpBan && ($action == Ban::ACTION_BLOCK || $action == Ban::ACTION_DROP) && $targetMask < $maxIpBlockRange[6]) {
-                throw new ApplicationLogicException("The requested IP range for this ban is too wide for the block/drop action.");
-            }
-
-            if (!$canLargeIpBan && $targetMask < $maxIpRange[6]) {
-                throw new ApplicationLogicException("The requested IP range for this ban is too wide.");
-            }
-        }
-
-        if (filter_var($targetIp, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4)) {
-            if ($targetMask < 0 || $targetMask > 32) {
-                throw new ApplicationLogicException("CIDR mask out of range for IPv4");
-            }
-
-            if (!$canLargeIpBan && ($action == Ban::ACTION_BLOCK || $action == Ban::ACTION_DROP) && $targetMask < $maxIpBlockRange[4]) {
-                throw new ApplicationLogicException("The IP range for this ban is too wide for the block/drop action.");
-            }
-
-            if (!$canLargeIpBan && $targetMask < $maxIpRange[4]) {
-                throw new ApplicationLogicException("The requested IP range for this ban is too wide.");
-            }
-        }
-
-        $squidIpList = $this->getSiteConfiguration()->getSquidList();
-        if (in_array($targetIp, $squidIpList)) {
-            throw new ApplicationLogicException("This IP address is on the protected list of proxies, and cannot be banned.");
-        }
-    }
-
-    /**
-     * Configures a ban list template for display
-     *
-     * @param Ban[] $bans
-     */
-    private function setupBanList(array $bans): void
-    {
-        $userIds = array_map(fn(Ban $entry) => $entry->getUser(), $bans);
-        $userList = UserSearchHelper::get($this->getDatabase())->inIds($userIds)->fetchMap('username');
-
-        $domainIds = array_filter(array_unique(array_map(fn(Ban $entry) => $entry->getDomain(), $bans)));
-        $domains = [];
-        foreach ($domainIds as $d) {
-            if ($d === null) {
-                continue;
-            }
-            $domains[$d] = Domain::getById($d, $this->getDatabase());
-        }
-
-        $this->assign('domains', $domains);
-
-        $user = User::getCurrent($this->getDatabase());
-        $this->assign('canSet', $this->barrierTest('set', $user));
-        $this->assign('canRemove', $this->barrierTest('remove', $user));
-
-        $this->setupSecurity($user);
-
-        $this->assign('usernames', $userList);
-        $this->assign('activebans', $bans);
-
-        $banHelper = new BanHelper($this->getDatabase(), $this->getXffTrustProvider(), $this->getSecurityManager());
-        $this->assign('banHelper', $banHelper);
-    }
-
-    /**
-     * Converts a plain IP or CIDR mask into an IP and a CIDR suffix
-     *
-     * @param string $targetIp IP or CIDR range
-     *
-     * @return array
-     */
-    private function splitCidrRange(string $targetIp): array
-    {
-        if (strpos($targetIp, '/') !== false) {
-            $ipParts = explode('/', $targetIp, 2);
-            $targetIp = $ipParts[0];
-            $targetMask = (int)$ipParts[1];
-        }
-        else {
-            // Default the CIDR range based on the IP type
-            $targetMask = filter_var($targetIp, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6) ? 128 : 32;
-        }
-
-        return array($targetIp, $targetMask);
+	/**
+	 * Main function for this page, when no specific actions are called.
+	 */
+	protected function main(): void
+	{
+		$this->assignCSRFToken();
+		$this->setHtmlTitle('Bans');
+
+		$database = $this->getDatabase();
+		$currentDomain = Domain::getCurrent($database);
+		$bans = Ban::getActiveBans($database, $currentDomain->getId());
+
+		$this->setupBanList($bans);
+
+		$this->assign('isFiltered', false);
+		$this->setTemplate('bans/main.tpl');
+	}
+
+	protected function show(): void
+	{
+		$this->assignCSRFToken();
+		$this->setHtmlTitle('Bans');
+
+		$rawIdList = WebRequest::getString('id');
+		if ($rawIdList === null) {
+			$this->redirect('bans');
+
+			return;
+		}
+
+		$idList = explode(',', $rawIdList);
+
+		$database = $this->getDatabase();
+		$currentDomain = Domain::getCurrent($database);
+		$bans = Ban::getByIdList($idList, $database, $currentDomain->getId());
+
+		$this->setupBanList($bans);
+		$this->assign('isFiltered', true);
+		$this->setTemplate('bans/main.tpl');
+	}
+
+	/**
+	 * Entry point for the ban set action
+	 * @throws SmartyException
+	 * @throws Exception
+	 */
+	protected function set(): void
+	{
+		$this->setHtmlTitle('Bans');
+
+		// dual-mode action
+		if (WebRequest::wasPosted()) {
+			try {
+				$this->handlePostMethodForSetBan();
+			}
+			catch (ApplicationLogicException $ex) {
+				SessionAlert::error($ex->getMessage());
+				$this->redirect("bans", "set");
+			}
+		}
+		else {
+			$this->handleGetMethodForSetBan();
+
+			$user = User::getCurrent($this->getDatabase());
+			$banType = WebRequest::getString('type');
+			$banRequest = WebRequest::getInt('request');
+
+			// if the parameters are null, skip loading a request.
+			if ($banType !== null && $banRequest !== null && $banRequest !== 0) {
+				$this->preloadFormForRequest($banRequest, $banType, $user);
+			}
+		}
+	}
+
+	protected function replace(): void
+	{
+		$this->setHtmlTitle('Bans');
+
+		$database = $this->getDatabase();
+		$domain = Domain::getCurrent($database);
+
+		// dual-mode action
+		if (WebRequest::wasPosted()) {
+			try {
+				$originalBanId = WebRequest::postInt('replaceBanId');
+				$originalBanUpdateVersion = WebRequest::postInt('replaceBanUpdateVersion');
+
+				$originalBan = Ban::getActiveId($originalBanId, $database, $domain->getId());
+
+				if ($originalBan === false) {
+					throw new ApplicationLogicException("The specified ban is not currently active, or doesn't exist.");
+				}
+
+				// Discard original ban; we're replacing it.
+				$originalBan->setUpdateVersion($originalBanUpdateVersion);
+				$originalBan->setActive(false);
+				$originalBan->save();
+
+				Logger::banReplaced($database, $originalBan);
+
+				// Proceed as normal to save the new ban.
+				$this->handlePostMethodForSetBan();
+			}
+			catch (ApplicationLogicException $ex) {
+				$database->rollback();
+				SessionAlert::error($ex->getMessage());
+				$this->redirect("bans", "set");
+			}
+		}
+		else {
+			$this->handleGetMethodForSetBan();
+
+			$user = User::getCurrent($database);
+			$originalBanId = WebRequest::getString('id');
+
+			$originalBan = Ban::getActiveId($originalBanId, $database, $domain->getId());
+
+			if ($originalBan === false) {
+				throw new ApplicationLogicException("The specified ban is not currently active, or doesn't exist.");
+			}
+
+			if ($originalBan->getName() !== null) {
+				if (!$this->barrierTest('name', $user, 'BanType')) {
+					SessionAlert::error("You are not allowed to set this type of ban.");
+					$this->redirect("bans", "set");
+					return;
+				}
+
+				$this->assign('banName', $originalBan->getName());
+			}
+
+			if ($originalBan->getEmail() !== null) {
+				if (!$this->barrierTest('email', $user, 'BanType')) {
+					SessionAlert::error("You are not allowed to set this type of ban.");
+					$this->redirect("bans", "set");
+					return;
+				}
+
+				$this->assign('banEmail', $originalBan->getEmail());
+			}
+
+			if ($originalBan->getUseragent() !== null) {
+				if (!$this->barrierTest('useragent', $user, 'BanType')) {
+					SessionAlert::error("You are not allowed to set this type of ban.");
+					$this->redirect("bans", "set");
+					return;
+				}
+
+				$this->assign('banUseragent', $originalBan->getUseragent());
+			}
+
+			if ($originalBan->getIp() !== null) {
+				if (!$this->barrierTest('ip', $user, 'BanType')) {
+					SessionAlert::error("You are not allowed to set this type of ban.");
+					$this->redirect("bans", "set");
+					return;
+				}
+
+				$this->assign('banIP', $originalBan->getIp() . '/' . $originalBan->getIpMask());
+			}
+
+			$banIsGlobal = $originalBan->getDomain() === null;
+			if ($banIsGlobal) {
+				if (!$this->barrierTest('global', $user, 'BanType')) {
+					SessionAlert::error("You are not allowed to set this type of ban.");
+					$this->redirect("bans", "set");
+					return;
+				}
+			}
+
+			if (!$this->barrierTest($originalBan->getVisibility(), $user, 'BanVisibility')) {
+				SessionAlert::error("You are not allowed to set this type of ban.");
+				$this->redirect("bans", "set");
+				return;
+			}
+
+			$this->assign('banGlobal', $banIsGlobal);
+			$this->assign('banVisibility', $originalBan->getVisibility());
+
+			if ($originalBan->getDuration() !== null) {
+				$this->assign('banDuration', date('c', $originalBan->getDuration()));
+			}
+
+			$this->assign('banReason', $originalBan->getReason());
+			$this->assign('banAction', $originalBan->getAction());
+			$this->assign('banQueue', $originalBan->getTargetQueue());
+
+			$this->assign('replaceBanId', $originalBan->getId());
+			$this->assign('replaceBanUpdateVersion', $originalBan->getUpdateVersion());
+		}
+	}
+
+	/**
+	 * Entry point for the ban remove action
+	 *
+	 * @throws AccessDeniedException
+	 * @throws ApplicationLogicException
+	 * @throws SmartyException
+	 */
+	protected function remove(): void
+	{
+		$this->setHtmlTitle('Bans');
+
+		$ban = $this->getBanForUnban();
+
+		$banHelper = new BanHelper($this->getDatabase(), $this->getXffTrustProvider(), $this->getSecurityManager());
+		if (!$banHelper->canUnban($ban)) {
+			// triggered when a user tries to unban a ban they can't see the entirety of.
+			// there's no UI way to get to this, so a raw exception is fine.
+			throw new AccessDeniedException($this->getSecurityManager(), $this->getDomainAccessManager());
+		}
+
+		// dual mode
+		if (WebRequest::wasPosted()) {
+			$this->validateCSRFToken();
+			$unbanReason = WebRequest::postString('unbanreason');
+
+			if ($unbanReason === null || trim($unbanReason) === "") {
+				SessionAlert::error('No unban reason specified');
+				$this->redirect("bans", "remove", array('id' => $ban->getId()));
+			}
+
+			// set optimistic locking from delete form page load
+			$updateVersion = WebRequest::postInt('updateversion');
+			$ban->setUpdateVersion($updateVersion);
+
+			$database = $this->getDatabase();
+			$ban->setActive(false);
+			$ban->save();
+
+			Logger::unbanned($database, $ban, $unbanReason);
+
+			SessionAlert::quick('Disabled ban.');
+			$this->getNotificationHelper()->unbanned($ban, $unbanReason);
+
+			$this->redirect('bans');
+		}
+		else {
+			$this->assignCSRFToken();
+			$this->assign('ban', $ban);
+			$this->setTemplate('bans/unban.tpl');
+		}
+	}
+
+	/**
+	 * Retrieves the requested ban duration from the WebRequest
+	 *
+	 * @throws ApplicationLogicException
+	 */
+	private function getBanDuration(): ?int
+	{
+		$duration = WebRequest::postString('duration');
+		if ($duration === "other") {
+			$duration = strtotime(WebRequest::postString('otherduration'));
+
+			if (!$duration) {
+				throw new ApplicationLogicException('Invalid ban time');
+			}
+			elseif (time() > $duration) {
+				throw new ApplicationLogicException('Ban time has already expired!');
+			}
+
+			return $duration;
+		}
+		elseif ($duration === "-1") {
+			return null;
+		}
+		else {
+			return WebRequest::postInt('duration') + time();
+		}
+	}
+
+	/**
+	 * Handles the POST method on the set action
+	 *
+	 * @throws ApplicationLogicException
+	 * @throws Exception
+	 */
+	private function handlePostMethodForSetBan()
+	{
+		$this->validateCSRFToken();
+		$database = $this->getDatabase();
+		$user = User::getCurrent($database);
+		$currentDomain = Domain::getCurrent($database);
+
+		// Checks whether there is a reason entered for ban.
+		$reason = WebRequest::postString('banreason');
+		if ($reason === null || trim($reason) === "") {
+			throw new ApplicationLogicException('You must specify a ban reason');
+		}
+
+		// ban targets
+		list($targetName, $targetIp, $targetEmail, $targetUseragent) = $this->getRawBanTargets($user);
+
+		$visibility = $this->getBanVisibility();
+
+		// Validate ban duration
+		$duration = $this->getBanDuration();
+
+		$action = WebRequest::postString('banAction') ?? Ban::ACTION_NONE;
+
+		$global = WebRequest::postBoolean('banGlobal');
+		if (!$this->barrierTest('global', $user, 'BanType')) {
+			$global = false;
+		}
+
+		if ($action === Ban::ACTION_DEFER && $global) {
+			throw new ApplicationLogicException("Cannot set a global ban in defer-to-queue mode.");
+		}
+
+		// handle CIDR ranges
+		$targetMask = null;
+		if ($targetIp !== null) {
+			list($targetIp, $targetMask) = $this->splitCidrRange($targetIp);
+			$this->validateIpBan($targetIp, $targetMask, $user, $action);
+		}
+
+		$banHelper = new BanHelper($this->getDatabase(), $this->getXffTrustProvider(), $this->getSecurityManager());
+
+		$bansByTarget = $banHelper->getBansByTarget(
+			$targetName,
+			$targetEmail,
+			$targetIp,
+			$targetMask,
+			$targetUseragent,
+			$currentDomain->getId());
+
+		if (count($bansByTarget) > 0) {
+			throw new ApplicationLogicException('This target is already banned!');
+		}
+
+		$ban = new Ban();
+		$ban->setDatabase($database);
+		$ban->setActive(true);
+
+		$ban->setName($targetName);
+		$ban->setIp($targetIp, $targetMask);
+		$ban->setEmail($targetEmail);
+		$ban->setUseragent($targetUseragent);
+
+		$ban->setUser($user->getId());
+		$ban->setReason($reason);
+		$ban->setDuration($duration);
+		$ban->setVisibility($visibility);
+
+		$ban->setDomain($global ? null : $currentDomain->getId());
+
+		$ban->setAction($action);
+		if ($ban->getAction() === Ban::ACTION_DEFER) {
+			//FIXME: domains
+			$queue = RequestQueue::getByApiName($database, WebRequest::postString('banActionTarget'), 1);
+			if ($queue === false) {
+				throw new ApplicationLogicException("Unknown target queue");
+			}
+
+			if (!$queue->isEnabled()) {
+				throw new ApplicationLogicException("Target queue is not enabled");
+			}
+
+			$ban->setTargetQueue($queue->getId());
+		}
+
+		$ban->save();
+
+		Logger::banned($database, $ban, $reason);
+
+		$this->getNotificationHelper()->banned($ban);
+		SessionAlert::quick('Ban has been set.');
+
+		$this->redirect('bans');
+	}
+
+	/**
+	 * Handles the GET method on the set action
+	 * @throws Exception
+	 */
+	private function handleGetMethodForSetBan()
+	{
+		$this->setTemplate('bans/banform.tpl');
+		$this->assignCSRFToken();
+
+		$this->assign('maxIpRange', $this->getSiteConfiguration()->getBanMaxIpRange());
+		$this->assign('maxIpBlockRange', $this->getSiteConfiguration()->getBanMaxIpBlockRange());
+
+		$this->assign('banVisibility', 'user');
+		$this->assign('banGlobal', false);
+		$this->assign('banQueue', false);
+		$this->assign('banAction', Ban::ACTION_BLOCK);
+		$this->assign('banDuration', '');
+		$this->assign('banReason', '');
+
+		$this->assign('banEmail', '');
+		$this->assign('banIP', '');
+		$this->assign('banName', '');
+		$this->assign('banUseragent', '');
+
+		$this->assign('replaceBanId', null);
+
+
+
+		$database = $this->getDatabase();
+
+		$user = User::getCurrent($database);
+		$this->setupSecurity($user);
+
+		$queues = RequestQueue::getEnabledQueues($database);
+
+		$this->assign('requestQueues', $queues);
+	}
+
+	/**
+	 * Finds the Ban object referenced in the WebRequest if it is valid
+	 *
+	 * @return Ban
+	 * @throws ApplicationLogicException
+	 */
+	private function getBanForUnban(): Ban
+	{
+		$banId = WebRequest::getInt('id');
+		if ($banId === null || $banId === 0) {
+			throw new ApplicationLogicException("The ban ID appears to be missing. This is probably a bug.");
+		}
+
+		$database = $this->getDatabase();
+		$this->setupSecurity(User::getCurrent($database));
+		$currentDomain = Domain::getCurrent($database);
+		$ban = Ban::getActiveId($banId, $database, $currentDomain->getId());
+
+		if ($ban === false) {
+			throw new ApplicationLogicException("The specified ban is not currently active, or doesn't exist.");
+		}
+
+		return $ban;
+	}
+
+	/**
+	 * Sets up Smarty variables for access control
+	 */
+	private function setupSecurity(User $user): void
+	{
+		$this->assign('canSeeIpBan', $this->barrierTest('ip', $user, 'BanType'));
+		$this->assign('canSeeNameBan', $this->barrierTest('name', $user, 'BanType'));
+		$this->assign('canSeeEmailBan', $this->barrierTest('email', $user, 'BanType'));
+		$this->assign('canSeeUseragentBan', $this->barrierTest('useragent', $user, 'BanType'));
+
+		$this->assign('canGlobalBan', $this->barrierTest('global', $user, 'BanType'));
+
+		$this->assign('canSeeUserVisibility', $this->barrierTest('user', $user, 'BanVisibility'));
+		$this->assign('canSeeAdminVisibility', $this->barrierTest('admin', $user, 'BanVisibility'));
+		$this->assign('canSeeCheckuserVisibility', $this->barrierTest('checkuser', $user, 'BanVisibility'));
+	}
+
+	/**
+	 * Validates that the provided IP is acceptable for a ban of this type
+	 *
+	 * @param string $targetIp   IP address
+	 * @param int    $targetMask CIDR prefix length
+	 * @param User   $user       User performing the ban
+	 * @param string $action     Ban action to take
+	 *
+	 * @throws ApplicationLogicException
+	 */
+	private function validateIpBan(string $targetIp, int $targetMask, User $user, string $action): void
+	{
+		// validate this is an IP
+		if (!filter_var($targetIp, FILTER_VALIDATE_IP)) {
+			throw new ApplicationLogicException("Not a valid IP address");
+		}
+
+		$canLargeIpBan = $this->barrierTest('ip-largerange', $user, 'BanType');
+		$maxIpBlockRange = $this->getSiteConfiguration()->getBanMaxIpBlockRange();
+		$maxIpRange = $this->getSiteConfiguration()->getBanMaxIpRange();
+
+		// validate CIDR ranges
+		if (filter_var($targetIp, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6)) {
+			if ($targetMask < 0 || $targetMask > 128) {
+				throw new ApplicationLogicException("CIDR mask out of range for IPv6");
+			}
+
+			// prevent setting the ban if:
+			//  * the user isn't allowed to set large bans, AND
+			//  * the ban is a drop or a block (preventing human review of the request), AND
+			//  * the mask is too wide-reaching
+			if (!$canLargeIpBan && ($action == Ban::ACTION_BLOCK || $action == Ban::ACTION_DROP) && $targetMask < $maxIpBlockRange[6]) {
+				throw new ApplicationLogicException("The requested IP range for this ban is too wide for the block/drop action.");
+			}
+
+			if (!$canLargeIpBan && $targetMask < $maxIpRange[6]) {
+				throw new ApplicationLogicException("The requested IP range for this ban is too wide.");
+			}
+		}
+
+		if (filter_var($targetIp, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4)) {
+			if ($targetMask < 0 || $targetMask > 32) {
+				throw new ApplicationLogicException("CIDR mask out of range for IPv4");
+			}
+
+			if (!$canLargeIpBan && ($action == Ban::ACTION_BLOCK || $action == Ban::ACTION_DROP) && $targetMask < $maxIpBlockRange[4]) {
+				throw new ApplicationLogicException("The IP range for this ban is too wide for the block/drop action.");
+			}
+
+			if (!$canLargeIpBan && $targetMask < $maxIpRange[4]) {
+				throw new ApplicationLogicException("The requested IP range for this ban is too wide.");
+			}
+		}
+
+		$squidIpList = $this->getSiteConfiguration()->getSquidList();
+		if (in_array($targetIp, $squidIpList)) {
+			throw new ApplicationLogicException("This IP address is on the protected list of proxies, and cannot be banned.");
+		}
+	}
+
+	/**
+	 * Configures a ban list template for display
+	 *
+	 * @param Ban[] $bans
+	 */
+	private function setupBanList(array $bans): void
+	{
+		$userIds = array_map(fn(Ban $entry) => $entry->getUser(), $bans);
+		$userList = UserSearchHelper::get($this->getDatabase())->inIds($userIds)->fetchMap('username');
+
+		$domainIds = array_filter(array_unique(array_map(fn(Ban $entry) => $entry->getDomain(), $bans)));
+		$domains = [];
+		foreach ($domainIds as $d) {
+			if ($d === null) {
+				continue;
+			}
+			$domains[$d] = Domain::getById($d, $this->getDatabase());
+		}
+
+		$this->assign('domains', $domains);
+
+		$user = User::getCurrent($this->getDatabase());
+		$this->assign('canSet', $this->barrierTest('set', $user));
+		$this->assign('canRemove', $this->barrierTest('remove', $user));
+
+		$this->setupSecurity($user);
+
+		$this->assign('usernames', $userList);
+		$this->assign('activebans', $bans);
+
+		$banHelper = new BanHelper($this->getDatabase(), $this->getXffTrustProvider(), $this->getSecurityManager());
+		$this->assign('banHelper', $banHelper);
+	}
+
+	/**
+	 * Converts a plain IP or CIDR mask into an IP and a CIDR suffix
+	 *
+	 * @param string $targetIp IP or CIDR range
+	 *
+	 * @return array
+	 */
+	private function splitCidrRange(string $targetIp): array
+	{
+		if (strpos($targetIp, '/') !== false) {
+			$ipParts = explode('/', $targetIp, 2);
+			$targetIp = $ipParts[0];
+			$targetMask = (int)$ipParts[1];
+		}
+		else {
+			// Default the CIDR range based on the IP type
+			$targetMask = filter_var($targetIp, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6) ? 128 : 32;
+		}
+
+		return array($targetIp, $targetMask);
 }
 
-    /**
-     * Returns the validated ban visibility from WebRequest
-     *
-     * @throws ApplicationLogicException
-     */
-    private function getBanVisibility(): string
-    {
-        $visibility = WebRequest::postString('banVisibility');
-        if ($visibility !== 'user' && $visibility !== 'admin' && $visibility !== 'checkuser') {
-            throw new ApplicationLogicException('Invalid ban visibility');
-        }
-
-        return $visibility;
-    }
-
-    /**
-     * Returns array of [username, ip, email, ua] as ban targets from WebRequest,
-     * filtered for whether the user is allowed to set bans including those types.
-     *
-     * @return string[]
-     * @throws ApplicationLogicException
-     */
-    private function getRawBanTargets(User $user): array
-    {
-        $targetName = WebRequest::postString('banName');
-        $targetIp = WebRequest::postString('banIP');
-        $targetEmail = WebRequest::postString('banEmail');
-        $targetUseragent = WebRequest::postString('banUseragent');
-
-        // check the user is allowed to use provided targets
-        if (!$this->barrierTest('name', $user, 'BanType')) {
-            $targetName = null;
-        }
-        if (!$this->barrierTest('ip', $user, 'BanType')) {
-            $targetIp = null;
-        }
-        if (!$this->barrierTest('email', $user, 'BanType')) {
-            $targetEmail = null;
-        }
-        if (!$this->barrierTest('useragent', $user, 'BanType')) {
-            $targetUseragent = null;
-        }
-
-        // Checks whether there is a target entered to ban.
-        if ($targetName === null && $targetIp === null && $targetEmail === null && $targetUseragent === null) {
-            throw new ApplicationLogicException('You must specify a target to be banned');
-        }
-
-        return array($targetName, $targetIp, $targetEmail, $targetUseragent);
-    }
-
-    private function preloadFormForRequest(int $banRequest, string $banType, User $user): void
-    {
-        $database = $this->getDatabase();
-
-        // Attempt to resolve the correct target
-        /** @var Request|false $request */
-        $request = Request::getById($banRequest, $database);
-        if ($request === false) {
-            $this->assign('bantarget', '');
-
-            return;
-        }
-
-        switch ($banType) {
-            case 'EMail':
-                if ($this->barrierTest('email', $user, 'BanType')) {
-                    $this->assign('banEmail', $request->getEmail());
-                }
-                break;
-            case 'IP':
-                if ($this->barrierTest('ip', $user, 'BanType')) {
-                    $trustedIp = $this->getXffTrustProvider()->getTrustedClientIp(
-                        $request->getIp(),
-                        $request->getForwardedIp());
-
-                    $this->assign('banIP', $trustedIp);
-                }
-                break;
-            case 'Name':
-                if ($this->barrierTest('name', $user, 'BanType')) {
-                    $this->assign('banName', $request->getName());
-                }
-                break;
-            case 'UA':
-                if ($this->barrierTest('useragent', $user, 'BanType')) {
-                    $this->assign('banUseragent', $request->getEmail());
-                }
-                break;
-        }
-    }
+	/**
+	 * Returns the validated ban visibility from WebRequest
+	 *
+	 * @throws ApplicationLogicException
+	 */
+	private function getBanVisibility(): string
+	{
+		$visibility = WebRequest::postString('banVisibility');
+		if ($visibility !== 'user' && $visibility !== 'admin' && $visibility !== 'checkuser') {
+			throw new ApplicationLogicException('Invalid ban visibility');
+		}
+
+		return $visibility;
+	}
+
+	/**
+	 * Returns array of [username, ip, email, ua] as ban targets from WebRequest,
+	 * filtered for whether the user is allowed to set bans including those types.
+	 *
+	 * @return string[]
+	 * @throws ApplicationLogicException
+	 */
+	private function getRawBanTargets(User $user): array
+	{
+		$targetName = WebRequest::postString('banName');
+		$targetIp = WebRequest::postString('banIP');
+		$targetEmail = WebRequest::postString('banEmail');
+		$targetUseragent = WebRequest::postString('banUseragent');
+
+		// check the user is allowed to use provided targets
+		if (!$this->barrierTest('name', $user, 'BanType')) {
+			$targetName = null;
+		}
+		if (!$this->barrierTest('ip', $user, 'BanType')) {
+			$targetIp = null;
+		}
+		if (!$this->barrierTest('email', $user, 'BanType')) {
+			$targetEmail = null;
+		}
+		if (!$this->barrierTest('useragent', $user, 'BanType')) {
+			$targetUseragent = null;
+		}
+
+		// Checks whether there is a target entered to ban.
+		if ($targetName === null && $targetIp === null && $targetEmail === null && $targetUseragent === null) {
+			throw new ApplicationLogicException('You must specify a target to be banned');
+		}
+
+		return array($targetName, $targetIp, $targetEmail, $targetUseragent);
+	}
+
+	private function preloadFormForRequest(int $banRequest, string $banType, User $user): void
+	{
+		$database = $this->getDatabase();
+
+		// Attempt to resolve the correct target
+		/** @var Request|false $request */
+		$request = Request::getById($banRequest, $database);
+		if ($request === false) {
+			$this->assign('bantarget', '');
+
+			return;
+		}
+
+		switch ($banType) {
+			case 'EMail':
+				if ($this->barrierTest('email', $user, 'BanType')) {
+					$this->assign('banEmail', $request->getEmail());
+				}
+				break;
+			case 'IP':
+				if ($this->barrierTest('ip', $user, 'BanType')) {
+					$trustedIp = $this->getXffTrustProvider()->getTrustedClientIp(
+						$request->getIp(),
+						$request->getForwardedIp());
+
+					$this->assign('banIP', $trustedIp);
+				}
+				break;
+			case 'Name':
+				if ($this->barrierTest('name', $user, 'BanType')) {
+					$this->assign('banName', $request->getName());
+				}
+				break;
+			case 'UA':
+				if ($this->barrierTest('useragent', $user, 'BanType')) {
+					$this->assign('banUseragent', $request->getEmail());
+				}
+				break;
+		}
+	}
 }

includes/Pages/Statistics/StatsUsers.php

Indentation +94 added lines, -94 removed lines

@@ -24,13 +24,13 @@ 
 
 class StatsUsers extends InternalPageBase
 {
-    public function main()
-    {
-        $this->setHtmlTitle('Users :: Statistics');
+	public function main()
+	{
+		$this->setHtmlTitle('Users :: Statistics');
 
-        $database = $this->getDatabase();
+		$database = $this->getDatabase();
 
-        $query = <<<SQL
+		$query = <<<SQL
 SELECT
     u.id
     , u.username
@@ -46,34 +46,34 @@ 
 WHERE u.status = 'Active'
 SQL;
 
-        $users = $database->query($query)->fetchAll(PDO::FETCH_ASSOC);
-        $this->assign('users', $users);
+		$users = $database->query($query)->fetchAll(PDO::FETCH_ASSOC);
+		$this->assign('users', $users);
 
-        $this->assign('statsPageTitle', 'Account Creation Tool users');
-        $this->setTemplate("statistics/users.tpl");
-    }
+		$this->assign('statsPageTitle', 'Account Creation Tool users');
+		$this->setTemplate("statistics/users.tpl");
+	}
 
-    /**
-     * Entry point for the detail action.
-     *
-     * @throws ApplicationLogicException
-     */
-    protected function detail()
-    {
-        $userId = WebRequest::getInt('user');
-        if ($userId === null) {
-            throw new ApplicationLogicException("User not found");
-        }
+	/**
+	 * Entry point for the detail action.
+	 *
+	 * @throws ApplicationLogicException
+	 */
+	protected function detail()
+	{
+		$userId = WebRequest::getInt('user');
+		if ($userId === null) {
+			throw new ApplicationLogicException("User not found");
+		}
 
-        $database = $this->getDatabase();
+		$database = $this->getDatabase();
 
-        $user = User::getById($userId, $database);
-        if ($user == false) {
-            throw new ApplicationLogicException('User not found');
-        }
+		$user = User::getById($userId, $database);
+		if ($user == false) {
+			throw new ApplicationLogicException('User not found');
+		}
 
 
-        $activitySummary = $database->prepare(<<<SQL
+		$activitySummary = $database->prepare(<<<SQL
 SELECT COALESCE(closes.mail_desc, log.action) AS action, COUNT(*) AS count
 FROM log
 INNER JOIN user ON log.user = user.id
@@ -81,14 +81,14 @@ 
 WHERE user.username = :username
 GROUP BY action;
 SQL
-        );
-        $activitySummary->execute(array(":username" => $user->getUsername()));
-        $activitySummaryData = $activitySummary->fetchAll(PDO::FETCH_ASSOC);
+		);
+		$activitySummary->execute(array(":username" => $user->getUsername()));
+		$activitySummaryData = $activitySummary->fetchAll(PDO::FETCH_ASSOC);
 
-        $this->assign("user", $user);
-        $this->assign("activity", $activitySummaryData);
+		$this->assign("user", $user);
+		$this->assign("activity", $activitySummaryData);
 
-        $usersCreatedQuery = $database->prepare(<<<SQL
+		$usersCreatedQuery = $database->prepare(<<<SQL
 SELECT log.timestamp time, request.name name, request.id id
 FROM log
 INNER JOIN request ON (request.id = log.objectid AND log.objecttype = 'Request')
@@ -99,12 +99,12 @@ 
     AND (emailtemplate.defaultaction = :created OR log.action = 'Closed custom-y')
 ORDER BY log.timestamp;
 SQL
-        );
-        $usersCreatedQuery->execute(array(":username" => $user->getUsername(), ':created' => EmailTemplate::ACTION_CREATED));
-        $usersCreated = $usersCreatedQuery->fetchAll(PDO::FETCH_ASSOC);
-        $this->assign("created", $usersCreated);
+		);
+		$usersCreatedQuery->execute(array(":username" => $user->getUsername(), ':created' => EmailTemplate::ACTION_CREATED));
+		$usersCreated = $usersCreatedQuery->fetchAll(PDO::FETCH_ASSOC);
+		$this->assign("created", $usersCreated);
 
-        $usersNotCreatedQuery = $database->prepare(<<<SQL
+		$usersNotCreatedQuery = $database->prepare(<<<SQL
 SELECT log.timestamp time, request.name name, request.id id
 FROM log
 JOIN request ON request.id = log.objectid AND log.objecttype = 'Request'
@@ -115,60 +115,60 @@ 
     AND (emailtemplate.defaultaction = :created OR log.action = 'Closed custom-n' OR log.action = 'Closed 0')
 ORDER BY log.timestamp;
 SQL
-        );
-        $usersNotCreatedQuery->execute(array(":username" => $user->getUsername(), ':created' => EmailTemplate::ACTION_NOT_CREATED));
-        $usersNotCreated = $usersNotCreatedQuery->fetchAll(PDO::FETCH_ASSOC);
-        $this->assign("notcreated", $usersNotCreated);
-
-        /** @var Log[] $logs */
-        $logs = LogSearchHelper::get($database, Domain::getCurrent($database)->getId())
-            ->byObjectType('User')
-            ->byObjectId($user->getId())
-            ->getRecordCount($logCount)
-            ->fetch();
-
-        if ($logCount === 0) {
-            $this->assign('accountlog', array());
-        }
-        else {
-            list($users, $logData) = LogHelper::prepareLogsForTemplate($logs, $database, $this->getSiteConfiguration());
-
-            $this->assign("accountlog", $logData);
-            $this->assign("users", $users);
-        }
-
-        $currentUser = User::getCurrent($database);
-        $this->assign('canApprove', $this->barrierTest('approve', $currentUser, PageUserManagement::class));
-        $this->assign('canDecline', $this->barrierTest('decline', $currentUser, PageUserManagement::class));
-        $this->assign('canRename', $this->barrierTest('rename', $currentUser, PageUserManagement::class));
-        $this->assign('canEditUser', $this->barrierTest('editUser', $currentUser, PageUserManagement::class));
-        $this->assign('canSuspend', $this->barrierTest('suspend', $currentUser, PageUserManagement::class));
-        $this->assign('canEditRoles', $this->barrierTest('editRoles', $currentUser, PageUserManagement::class));
-
-        $oauth = new OAuthUserHelper($user, $database, $this->getOAuthProtocolHelper(), $this->getSiteConfiguration());
-        $this->assign('oauth', $oauth);
-
-        if ($user->getForceIdentified() === null) {
-            $idVerifier = new IdentificationVerifier($this->getHttpHelper(), $this->getSiteConfiguration(), $this->getDatabase());
-            $this->assign('identificationStatus', $idVerifier->isUserIdentified($user->getOnWikiName()) ? 'detected' : 'missing');
-        }
-        else {
-            $this->assign('identificationStatus', $user->getForceIdentified() == 1 ? 'forced-on' : 'forced-off');
-        }
-
-        if ($oauth->isFullyLinked()) {
-            $this->assign('identity', $oauth->getIdentity(true));
-            $this->assign('identityExpired', $oauth->identityExpired());
-        }
-
-        $this->assign('statsPageTitle', 'Account Creation Tool users');
-
-        // FIXME: domains!
-        /** @var Domain $domain */
-        $domain = Domain::getById(1, $this->getDatabase());
-        $this->assign('mediawikiScriptPath', $domain->getWikiArticlePath());
-
-        $this->setHtmlTitle('{$user->getUsername()|escape} :: Users :: Statistics');
-        $this->setTemplate("statistics/userdetail.tpl");
-    }
+		);
+		$usersNotCreatedQuery->execute(array(":username" => $user->getUsername(), ':created' => EmailTemplate::ACTION_NOT_CREATED));
+		$usersNotCreated = $usersNotCreatedQuery->fetchAll(PDO::FETCH_ASSOC);
+		$this->assign("notcreated", $usersNotCreated);
+
+		/** @var Log[] $logs */
+		$logs = LogSearchHelper::get($database, Domain::getCurrent($database)->getId())
+			->byObjectType('User')
+			->byObjectId($user->getId())
+			->getRecordCount($logCount)
+			->fetch();
+
+		if ($logCount === 0) {
+			$this->assign('accountlog', array());
+		}
+		else {
+			list($users, $logData) = LogHelper::prepareLogsForTemplate($logs, $database, $this->getSiteConfiguration());
+
+			$this->assign("accountlog", $logData);
+			$this->assign("users", $users);
+		}
+
+		$currentUser = User::getCurrent($database);
+		$this->assign('canApprove', $this->barrierTest('approve', $currentUser, PageUserManagement::class));
+		$this->assign('canDecline', $this->barrierTest('decline', $currentUser, PageUserManagement::class));
+		$this->assign('canRename', $this->barrierTest('rename', $currentUser, PageUserManagement::class));
+		$this->assign('canEditUser', $this->barrierTest('editUser', $currentUser, PageUserManagement::class));
+		$this->assign('canSuspend', $this->barrierTest('suspend', $currentUser, PageUserManagement::class));
+		$this->assign('canEditRoles', $this->barrierTest('editRoles', $currentUser, PageUserManagement::class));
+
+		$oauth = new OAuthUserHelper($user, $database, $this->getOAuthProtocolHelper(), $this->getSiteConfiguration());
+		$this->assign('oauth', $oauth);
+
+		if ($user->getForceIdentified() === null) {
+			$idVerifier = new IdentificationVerifier($this->getHttpHelper(), $this->getSiteConfiguration(), $this->getDatabase());
+			$this->assign('identificationStatus', $idVerifier->isUserIdentified($user->getOnWikiName()) ? 'detected' : 'missing');
+		}
+		else {
+			$this->assign('identificationStatus', $user->getForceIdentified() == 1 ? 'forced-on' : 'forced-off');
+		}
+
+		if ($oauth->isFullyLinked()) {
+			$this->assign('identity', $oauth->getIdentity(true));
+			$this->assign('identityExpired', $oauth->identityExpired());
+		}
+
+		$this->assign('statsPageTitle', 'Account Creation Tool users');
+
+		// FIXME: domains!
+		/** @var Domain $domain */
+		$domain = Domain::getById(1, $this->getDatabase());
+		$this->assign('mediawikiScriptPath', $domain->getWikiArticlePath());
+
+		$this->setHtmlTitle('{$user->getUsername()|escape} :: Users :: Statistics');
+		$this->setTemplate("statistics/userdetail.tpl");
+	}
 }

includes/Pages/PageUserManagement.php

Indentation +634 added lines, -634 removed lines

@@ -29,638 +29,638 @@
  */
 class PageUserManagement extends InternalPageBase
 {
-    // FIXME: domains
-    /** @var string */
-    private $adminMailingList = 'enwiki-acc-admins@googlegroups.com';
-
-    /**
-     * Main function for this page, when no specific actions are called.
-     */
-    protected function main()
-    {
-        $this->setHtmlTitle('User Management');
-
-        $database = $this->getDatabase();
-        $currentUser = User::getCurrent($database);
-
-        $userSearchRequest = WebRequest::getString('usersearch');
-        if ($userSearchRequest !== null) {
-            $searchedUser = User::getByUsername($userSearchRequest, $database);
-            if ($searchedUser !== false) {
-                $this->redirect('statistics/users', 'detail', ['user' => $searchedUser->getId()]);
-                return;
-            }
-        }
-
-        // A bit hacky, but it's better than my last solution of creating an object for each user and passing that to
-        // the template. I still don't have a particularly good way of handling this.
-        OAuthUserHelper::prepareTokenCountStatement($database);
-
-        if (WebRequest::getBoolean("showAll")) {
-            $this->assign("showAll", true);
-
-            $suspendedUsers = UserSearchHelper::get($database)->byStatus(User::STATUS_SUSPENDED)->fetch();
-            $this->assign("suspendedUsers", $suspendedUsers);
-
-            $declinedUsers = UserSearchHelper::get($database)->byStatus(User::STATUS_DECLINED)->fetch();
-            $this->assign("declinedUsers", $declinedUsers);
-
-            UserSearchHelper::get($database)->getRoleMap($roleMap);
-        }
-        else {
-            $this->assign("showAll", false);
-            $this->assign("suspendedUsers", array());
-            $this->assign("declinedUsers", array());
-
-            UserSearchHelper::get($database)->statusIn(array('New', 'Active'))->getRoleMap($roleMap);
-        }
-
-        $newUsers = UserSearchHelper::get($database)->byStatus(User::STATUS_NEW)->fetch();
-        $normalUsers = UserSearchHelper::get($database)->byStatus(User::STATUS_ACTIVE)->byRole('user')->fetch();
-        $adminUsers = UserSearchHelper::get($database)->byStatus(User::STATUS_ACTIVE)->byRole('admin')->fetch();
-        $checkUsers = UserSearchHelper::get($database)->byStatus(User::STATUS_ACTIVE)->byRole('checkuser')->fetch();
-        $toolRoots = UserSearchHelper::get($database)->byStatus(User::STATUS_ACTIVE)->byRole('toolRoot')->fetch();
-        $this->assign('newUsers', $newUsers);
-        $this->assign('normalUsers', $normalUsers);
-        $this->assign('adminUsers', $adminUsers);
-        $this->assign('checkUsers', $checkUsers);
-        $this->assign('toolRoots', $toolRoots);
-
-        $this->assign('roles', $roleMap);
-
-        $this->addJs("/api.php?action=users&all=true&targetVariable=typeaheaddata");
-
-        $this->assign('canApprove', $this->barrierTest('approve', $currentUser));
-        $this->assign('canDecline', $this->barrierTest('decline', $currentUser));
-        $this->assign('canRename', $this->barrierTest('rename', $currentUser));
-        $this->assign('canEditUser', $this->barrierTest('editUser', $currentUser));
-        $this->assign('canSuspend', $this->barrierTest('suspend', $currentUser));
-        $this->assign('canEditRoles', $this->barrierTest('editRoles', $currentUser));
-
-        // FIXME: domains!
-        /** @var Domain $domain */
-        $domain = Domain::getById(1, $this->getDatabase());
-        $this->assign('mediawikiScriptPath', $domain->getWikiArticlePath());
-
-        $this->setTemplate("usermanagement/main.tpl");
-    }
-
-    #region Access control
-
-    /**
-     * Action target for editing the roles assigned to a user
-     *
-     * @throws ApplicationLogicException
-     * @throws SmartyException
-     * @throws OptimisticLockFailedException
-     * @throws Exception
-     */
-    protected function editRoles(): void
-    {
-        $this->setHtmlTitle('User Management');
-        $database = $this->getDatabase();
-        $domain = Domain::getCurrent($database);
-        $userId = WebRequest::getInt('user');
-
-        /** @var User|false $user */
-        $user = User::getById($userId, $database);
-
-        if ($user === false || $user->isCommunityUser()) {
-            throw new ApplicationLogicException('Sorry, the user you are trying to edit could not be found.');
-        }
-
-        $roleData = $this->getRoleData(UserRole::getForUser($user->getId(), $database, $domain->getId()));
-
-        // Dual-mode action
-        if (WebRequest::wasPosted()) {
-            $this->validateCSRFToken();
-
-            $reason = WebRequest::postString('reason');
-            if ($reason === false || trim($reason) === '') {
-                throw new ApplicationLogicException('No reason specified for roles change');
-            }
-
-            /** @var UserRole[] $delete */
-            $delete = array();
-            /** @var string[] $add */
-            $add = array();
-
-            /** @var UserRole[] $globalDelete */
-            $globalDelete = array();
-            /** @var string[] $globalAdd */
-            $globalAdd = array();
-
-            foreach ($roleData as $name => $r) {
-                if ($r['allowEdit'] !== 1) {
-                    // not allowed, to touch this, so ignore it
-                    continue;
-                }
-
-                $newValue = WebRequest::postBoolean('role-' . $name) ? 1 : 0;
-                if ($newValue !== $r['active']) {
-                    if ($newValue === 0) {
-                        if ($r['globalOnly']) {
-                            $globalDelete[] = $r['object'];
-                        }
-                        else {
-                            $delete[] = $r['object'];
-                        }
-                    }
-
-                    if ($newValue === 1) {
-                        if ($r['globalOnly']) {
-                            $globalAdd[] = $name;
-                        }
-                        else {
-                            $add[] = $name;
-                        }
-                    }
-                }
-            }
-
-            // Check there's something to do
-            if ((count($add) + count($delete) + count($globalAdd) + count($globalDelete)) === 0) {
-                $this->redirect('statistics/users', 'detail', array('user' => $user->getId()));
-                SessionAlert::warning('No changes made to roles.');
-
-                return;
-            }
-
-            $removed = array();
-            $globalRemoved = array();
-
-            foreach ($delete as $d) {
-                $removed[] = $d->getRole();
-                $d->delete();
-            }
-
-            foreach ($globalDelete as $d) {
-                $globalRemoved[] = $d->getRole();
-                $d->delete();
-            }
-
-            foreach ($add as $x) {
-                $a = new UserRole();
-                $a->setUser($user->getId());
-                $a->setRole($x);
-                $a->setDomain($domain->getId());
-                $a->setDatabase($database);
-                $a->save();
-            }
-
-            foreach ($globalAdd as $x) {
-                $a = new UserRole();
-                $a->setUser($user->getId());
-                $a->setRole($x);
-                $a->setDomain(null);
-                $a->setDatabase($database);
-                $a->save();
-            }
-
-            if ((count($add) + count($delete)) > 0) {
-                Logger::userRolesEdited($database, $user, $reason, $add, $removed, $domain->getId());
-            }
-
-            if ((count($globalAdd) + count($globalDelete)) > 0) {
-                Logger::userGlobalRolesEdited($database, $user, $reason, $globalAdd, $globalRemoved);
-            }
-
-            // dummy save for optimistic locking. If this fails, the entire txn will roll back.
-            $user->setUpdateVersion(WebRequest::postInt('updateversion'));
-            $user->save();
-
-            $this->getNotificationHelper()->userRolesEdited($user, $reason);
-            SessionAlert::quick('Roles changed for user ' . htmlentities($user->getUsername(), ENT_COMPAT, 'UTF-8'));
-
-            $this->redirect('statistics/users', 'detail', array('user' => $user->getId()));
-        }
-        else {
-            $this->assignCSRFToken();
-            $this->setTemplate('usermanagement/roleedit.tpl');
-            $this->assign('user', $user);
-            $this->assign('roleData', $roleData);
-        }
-    }
-
-    /**
-     * Action target for suspending users
-     *
-     * @throws ApplicationLogicException
-     */
-    protected function suspend()
-    {
-        $this->setHtmlTitle('User Management');
-
-        $database = $this->getDatabase();
-
-        $userId = WebRequest::getInt('user');
-
-        /** @var User $user */
-        $user = User::getById($userId, $database);
-
-        if ($user === false || $user->isCommunityUser()) {
-            throw new ApplicationLogicException('Sorry, the user you are trying to suspend could not be found.');
-        }
-
-        if ($user->isSuspended()) {
-            throw new ApplicationLogicException('Sorry, the user you are trying to suspend is already suspended.');
-        }
-
-        // Dual-mode action
-        if (WebRequest::wasPosted()) {
-            $this->validateCSRFToken();
-            $reason = WebRequest::postString('reason');
-
-            if ($reason === null || trim($reason) === "") {
-                throw new ApplicationLogicException('No reason provided');
-            }
-
-            $user->setStatus(User::STATUS_SUSPENDED);
-            $user->setUpdateVersion(WebRequest::postInt('updateversion'));
-            $user->save();
-            Logger::suspendedUser($database, $user, $reason);
-
-            $this->getNotificationHelper()->userSuspended($user, $reason);
-            SessionAlert::quick('Suspended user ' . htmlentities($user->getUsername(), ENT_COMPAT, 'UTF-8'));
-
-            // send email
-            $this->sendStatusChangeEmail(
-                'Your WP:ACC account has been suspended',
-                'usermanagement/emails/suspended.tpl',
-                $reason,
-                $user,
-                User::getCurrent($database)->getUsername()
-            );
-
-            $this->redirect('userManagement');
-
-            return;
-        }
-        else {
-            $this->assignCSRFToken();
-            $this->setTemplate('usermanagement/changelevel-reason.tpl');
-            $this->assign('user', $user);
-            $this->assign('status', 'Suspended');
-            $this->assign("showReason", true);
-
-            if (WebRequest::getString('preload')) {
-                $this->assign('preload', WebRequest::getString('preload'));
-            }
-        }
-    }
-
-    /**
-     * Entry point for the decline action
-     *
-     * @throws ApplicationLogicException
-     */
-    protected function decline()
-    {
-        $this->setHtmlTitle('User Management');
-
-        $database = $this->getDatabase();
-
-        $userId = WebRequest::getInt('user');
-        $user = User::getById($userId, $database);
-
-        if ($user === false || $user->isCommunityUser()) {
-            throw new ApplicationLogicException('Sorry, the user you are trying to decline could not be found.');
-        }
-
-        if (!$user->isNewUser()) {
-            throw new ApplicationLogicException('Sorry, the user you are trying to decline is not new.');
-        }
-
-        // Dual-mode action
-        if (WebRequest::wasPosted()) {
-            $this->validateCSRFToken();
-            $reason = WebRequest::postString('reason');
-
-            if ($reason === null || trim($reason) === "") {
-                throw new ApplicationLogicException('No reason provided');
-            }
-
-            $user->setStatus(User::STATUS_DECLINED);
-            $user->setUpdateVersion(WebRequest::postInt('updateversion'));
-            $user->save();
-            Logger::declinedUser($database, $user, $reason);
-
-            $this->getNotificationHelper()->userDeclined($user, $reason);
-            SessionAlert::quick('Declined user ' . htmlentities($user->getUsername(), ENT_COMPAT, 'UTF-8'));
-
-            // send email
-            $this->sendStatusChangeEmail(
-                'Your WP:ACC account has been declined',
-                'usermanagement/emails/declined.tpl',
-                $reason,
-                $user,
-                User::getCurrent($database)->getUsername()
-            );
-
-            $this->redirect('userManagement');
-
-            return;
-        }
-        else {
-            $this->assignCSRFToken();
-            $this->setTemplate('usermanagement/changelevel-reason.tpl');
-            $this->assign('user', $user);
-            $this->assign('status', 'Declined');
-            $this->assign("showReason", true);
-        }
-    }
-
-    /**
-     * Entry point for the approve action
-     *
-     * @throws ApplicationLogicException
-     */
-    protected function approve()
-    {
-        $this->setHtmlTitle('User Management');
-
-        $database = $this->getDatabase();
-
-        $userId = WebRequest::getInt('user');
-        $user = User::getById($userId, $database);
-
-        if ($user === false || $user->isCommunityUser()) {
-            throw new ApplicationLogicException('Sorry, the user you are trying to approve could not be found.');
-        }
-
-        if ($user->isActive()) {
-            throw new ApplicationLogicException('Sorry, the user you are trying to approve is already an active user.');
-        }
-
-        // Dual-mode action
-        if (WebRequest::wasPosted()) {
-            $this->validateCSRFToken();
-            $user->setStatus(User::STATUS_ACTIVE);
-            $user->setUpdateVersion(WebRequest::postInt('updateversion'));
-            $user->save();
-            Logger::approvedUser($database, $user);
-
-            $this->getNotificationHelper()->userApproved($user);
-            SessionAlert::quick('Approved user ' . htmlentities($user->getUsername(), ENT_COMPAT, 'UTF-8'));
-
-            // send email
-            $this->sendStatusChangeEmail(
-                'Your WP:ACC account has been approved',
-                'usermanagement/emails/approved.tpl',
-                null,
-                $user,
-                User::getCurrent($database)->getUsername()
-            );
-
-            $this->redirect("userManagement");
-
-            return;
-        }
-        else {
-            $this->assignCSRFToken();
-            $this->setTemplate("usermanagement/changelevel-reason.tpl");
-            $this->assign("user", $user);
-            $this->assign("status", "Active");
-            $this->assign("showReason", false);
-        }
-    }
-
-    #endregion
-
-    #region Renaming / Editing
-
-    /**
-     * Entry point for the rename action
-     *
-     * @throws ApplicationLogicException
-     */
-    protected function rename()
-    {
-        $this->setHtmlTitle('User Management');
-
-        $database = $this->getDatabase();
-
-        $userId = WebRequest::getInt('user');
-        $user = User::getById($userId, $database);
-
-        if ($user === false || $user->isCommunityUser()) {
-            throw new ApplicationLogicException('Sorry, the user you are trying to rename could not be found.');
-        }
-
-        // Dual-mode action
-        if (WebRequest::wasPosted()) {
-            $this->validateCSRFToken();
-            $newUsername = WebRequest::postString('newname');
-
-            if ($newUsername === null || trim($newUsername) === "") {
-                throw new ApplicationLogicException('The new username cannot be empty');
-            }
-
-            if (User::getByUsername($newUsername, $database) != false) {
-                throw new ApplicationLogicException('The new username already exists');
-            }
-
-            $oldUsername = $user->getUsername();
-            $user->setUsername($newUsername);
-            $user->setUpdateVersion(WebRequest::postInt('updateversion'));
-
-            $user->save();
-
-            $logEntryData = serialize(array(
-                'old' => $oldUsername,
-                'new' => $newUsername,
-            ));
-
-            Logger::renamedUser($database, $user, $logEntryData);
-
-            SessionAlert::quick("Changed User "
-                . htmlentities($oldUsername, ENT_COMPAT, 'UTF-8')
-                . " name to "
-                . htmlentities($newUsername, ENT_COMPAT, 'UTF-8'));
-
-            $this->getNotificationHelper()->userRenamed($user, $oldUsername);
-
-            // send an email to the user.
-            $this->assign('targetUsername', $user->getUsername());
-            $this->assign('toolAdmin', User::getCurrent($database)->getUsername());
-            $this->assign('oldUsername', $oldUsername);
-            $this->assign('mailingList', $this->adminMailingList);
-
-            // FIXME: domains!
-            /** @var Domain $domain */
-            $domain = Domain::getById(1, $database);
-            $this->getEmailHelper()->sendMail(
-                $this->adminMailingList,
-                $user->getEmail(),
-                'Your username on WP:ACC has been changed',
-                $this->fetchTemplate('usermanagement/emails/renamed.tpl')
-            );
-
-            $this->redirect("userManagement");
-
-            return;
-        }
-        else {
-            $this->assignCSRFToken();
-            $this->setTemplate('usermanagement/renameuser.tpl');
-            $this->assign('user', $user);
-        }
-    }
-
-    /**
-     * Entry point for the edit action
-     *
-     * @throws ApplicationLogicException
-     */
-    protected function editUser()
-    {
-        $this->setHtmlTitle('User Management');
-
-        $database = $this->getDatabase();
-
-        $userId = WebRequest::getInt('user');
-        $user = User::getById($userId, $database);
-        $oauth = new OAuthUserHelper($user, $database, $this->getOAuthProtocolHelper(), $this->getSiteConfiguration());
-
-        if ($user === false || $user->isCommunityUser()) {
-            throw new ApplicationLogicException('Sorry, the user you are trying to edit could not be found.');
-        }
-
-        // FIXME: domains
-        $prefs = new PreferenceManager($database, $user->getId(), 1);
-
-        // Dual-mode action
-        if (WebRequest::wasPosted()) {
-            $this->validateCSRFToken();
-            $newEmail = WebRequest::postEmail('user_email');
-            $newOnWikiName = WebRequest::postString('user_onwikiname');
-
-            if ($newEmail === null) {
-                throw new ApplicationLogicException('Invalid email address');
-            }
-
-            if ($this->validateUnusedEmail($newEmail, $userId)) {
-                throw new ApplicationLogicException('The specified email address is already in use.');
-            }
-
-            if (!($oauth->isFullyLinked() || $oauth->isPartiallyLinked())) {
-                if (trim($newOnWikiName) == "") {
-                    throw new ApplicationLogicException('New on-wiki username cannot be blank');
-                }
-
-                $user->setOnWikiName($newOnWikiName);
-            }
-
-            $user->setEmail($newEmail);
-
-            $prefs->setLocalPreference(PreferenceManager::PREF_CREATION_MODE, WebRequest::postInt('creationmode'));
-
-            $user->setUpdateVersion(WebRequest::postInt('updateversion'));
-
-            $user->save();
-
-            Logger::userPreferencesChange($database, $user);
-            $this->getNotificationHelper()->userPrefChange($user);
-            SessionAlert::quick('Changes to user\'s preferences have been saved');
-
-            $this->redirect("userManagement");
-
-            return;
-        }
-        else {
-            $this->assignCSRFToken();
-            $oauth = new OAuthUserHelper($user, $database, $this->getOAuthProtocolHelper(),
-                $this->getSiteConfiguration());
-            $this->setTemplate('usermanagement/edituser.tpl');
-            $this->assign('user', $user);
-            $this->assign('oauth', $oauth);
-
-            $this->assign('preferredCreationMode', (int)$prefs->getPreference(PreferenceManager::PREF_CREATION_MODE));
-            $this->assign('emailSignature', $prefs->getPreference(PreferenceManager::PREF_EMAIL_SIGNATURE));
-
-            $this->assign('canManualCreate',
-                $this->barrierTest(PreferenceManager::CREATION_MANUAL, $user, 'RequestCreation'));
-            $this->assign('canOauthCreate',
-                $this->barrierTest(PreferenceManager::CREATION_OAUTH, $user, 'RequestCreation'));
-            $this->assign('canBotCreate',
-                $this->barrierTest(PreferenceManager::CREATION_BOT, $user, 'RequestCreation'));
-        }
-    }
-
-    #endregion
-
-    private function validateUnusedEmail(string $email, int $userId) : bool {
-        $query = 'SELECT COUNT(id) FROM user WHERE email = :email AND id <> :uid';
-        $statement = $this->getDatabase()->prepare($query);
-        $statement->execute(array(':email' => $email, ':uid' => $userId));
-        $inUse = $statement->fetchColumn() > 0;
-        $statement->closeCursor();
-
-        return $inUse;
-    }
-
-    /**
-     * Sends a status change email to the user.
-     *
-     * @param string      $subject           The subject of the email
-     * @param string      $template          The smarty template to use
-     * @param string|null $reason            The reason for performing the status change
-     * @param User        $user              The user affected
-     * @param string      $toolAdminUsername The tool admin's username who is making the edit
-     */
-    private function sendStatusChangeEmail($subject, $template, $reason, $user, $toolAdminUsername)
-    {
-        $this->assign('targetUsername', $user->getUsername());
-        $this->assign('toolAdmin', $toolAdminUsername);
-        $this->assign('actionReason', $reason);
-        $this->assign('mailingList', $this->adminMailingList);
-
-        // FIXME: domains!
-        /** @var Domain $domain */
-        $domain = Domain::getById(1, $this->getDatabase());
-        $this->getEmailHelper()->sendMail(
-            $this->adminMailingList,
-            $user->getEmail(),
-            $subject,
-            $this->fetchTemplate($template)
-        );
-    }
-
-    /**
-     * @param UserRole[] $activeRoles
-     *
-     * @return array
-     */
-    private function getRoleData($activeRoles)
-    {
-        $availableRoles = $this->getSecurityManager()->getRoleConfiguration()->getAvailableRoles();
-
-        $currentUser = User::getCurrent($this->getDatabase());
-        $this->getSecurityManager()->getActiveRoles($currentUser, $userRoles, $inactiveRoles);
-
-        $initialValue = array('active' => 0, 'allowEdit' => 0, 'description' => '???', 'object' => null);
-
-        $roleData = array();
-        foreach ($availableRoles as $role => $data) {
-            $intersection = array_intersect($data['editableBy'], $userRoles);
-
-            $roleData[$role] = $initialValue;
-            $roleData[$role]['allowEdit'] = count($intersection) > 0 ? 1 : 0;
-            $roleData[$role]['description'] = $data['description'];
-            $roleData[$role]['globalOnly'] = $data['globalOnly'];
-        }
-
-        foreach ($activeRoles as $role) {
-            if (!isset($roleData[$role->getRole()])) {
-                // This value is no longer available in the configuration, allow changing (aka removing) it.
-                $roleData[$role->getRole()] = $initialValue;
-                $roleData[$role->getRole()]['allowEdit'] = 1;
-            }
-
-            $roleData[$role->getRole()]['object'] = $role;
-            $roleData[$role->getRole()]['active'] = 1;
-        }
-
-        return $roleData;
-    }
+	// FIXME: domains
+	/** @var string */
+	private $adminMailingList = 'enwiki-acc-admins@googlegroups.com';
+
+	/**
+	 * Main function for this page, when no specific actions are called.
+	 */
+	protected function main()
+	{
+		$this->setHtmlTitle('User Management');
+
+		$database = $this->getDatabase();
+		$currentUser = User::getCurrent($database);
+
+		$userSearchRequest = WebRequest::getString('usersearch');
+		if ($userSearchRequest !== null) {
+			$searchedUser = User::getByUsername($userSearchRequest, $database);
+			if ($searchedUser !== false) {
+				$this->redirect('statistics/users', 'detail', ['user' => $searchedUser->getId()]);
+				return;
+			}
+		}
+
+		// A bit hacky, but it's better than my last solution of creating an object for each user and passing that to
+		// the template. I still don't have a particularly good way of handling this.
+		OAuthUserHelper::prepareTokenCountStatement($database);
+
+		if (WebRequest::getBoolean("showAll")) {
+			$this->assign("showAll", true);
+
+			$suspendedUsers = UserSearchHelper::get($database)->byStatus(User::STATUS_SUSPENDED)->fetch();
+			$this->assign("suspendedUsers", $suspendedUsers);
+
+			$declinedUsers = UserSearchHelper::get($database)->byStatus(User::STATUS_DECLINED)->fetch();
+			$this->assign("declinedUsers", $declinedUsers);
+
+			UserSearchHelper::get($database)->getRoleMap($roleMap);
+		}
+		else {
+			$this->assign("showAll", false);
+			$this->assign("suspendedUsers", array());
+			$this->assign("declinedUsers", array());
+
+			UserSearchHelper::get($database)->statusIn(array('New', 'Active'))->getRoleMap($roleMap);
+		}
+
+		$newUsers = UserSearchHelper::get($database)->byStatus(User::STATUS_NEW)->fetch();
+		$normalUsers = UserSearchHelper::get($database)->byStatus(User::STATUS_ACTIVE)->byRole('user')->fetch();
+		$adminUsers = UserSearchHelper::get($database)->byStatus(User::STATUS_ACTIVE)->byRole('admin')->fetch();
+		$checkUsers = UserSearchHelper::get($database)->byStatus(User::STATUS_ACTIVE)->byRole('checkuser')->fetch();
+		$toolRoots = UserSearchHelper::get($database)->byStatus(User::STATUS_ACTIVE)->byRole('toolRoot')->fetch();
+		$this->assign('newUsers', $newUsers);
+		$this->assign('normalUsers', $normalUsers);
+		$this->assign('adminUsers', $adminUsers);
+		$this->assign('checkUsers', $checkUsers);
+		$this->assign('toolRoots', $toolRoots);
+
+		$this->assign('roles', $roleMap);
+
+		$this->addJs("/api.php?action=users&all=true&targetVariable=typeaheaddata");
+
+		$this->assign('canApprove', $this->barrierTest('approve', $currentUser));
+		$this->assign('canDecline', $this->barrierTest('decline', $currentUser));
+		$this->assign('canRename', $this->barrierTest('rename', $currentUser));
+		$this->assign('canEditUser', $this->barrierTest('editUser', $currentUser));
+		$this->assign('canSuspend', $this->barrierTest('suspend', $currentUser));
+		$this->assign('canEditRoles', $this->barrierTest('editRoles', $currentUser));
+
+		// FIXME: domains!
+		/** @var Domain $domain */
+		$domain = Domain::getById(1, $this->getDatabase());
+		$this->assign('mediawikiScriptPath', $domain->getWikiArticlePath());
+
+		$this->setTemplate("usermanagement/main.tpl");
+	}
+
+	#region Access control
+
+	/**
+	 * Action target for editing the roles assigned to a user
+	 *
+	 * @throws ApplicationLogicException
+	 * @throws SmartyException
+	 * @throws OptimisticLockFailedException
+	 * @throws Exception
+	 */
+	protected function editRoles(): void
+	{
+		$this->setHtmlTitle('User Management');
+		$database = $this->getDatabase();
+		$domain = Domain::getCurrent($database);
+		$userId = WebRequest::getInt('user');
+
+		/** @var User|false $user */
+		$user = User::getById($userId, $database);
+
+		if ($user === false || $user->isCommunityUser()) {
+			throw new ApplicationLogicException('Sorry, the user you are trying to edit could not be found.');
+		}
+
+		$roleData = $this->getRoleData(UserRole::getForUser($user->getId(), $database, $domain->getId()));
+
+		// Dual-mode action
+		if (WebRequest::wasPosted()) {
+			$this->validateCSRFToken();
+
+			$reason = WebRequest::postString('reason');
+			if ($reason === false || trim($reason) === '') {
+				throw new ApplicationLogicException('No reason specified for roles change');
+			}
+
+			/** @var UserRole[] $delete */
+			$delete = array();
+			/** @var string[] $add */
+			$add = array();
+
+			/** @var UserRole[] $globalDelete */
+			$globalDelete = array();
+			/** @var string[] $globalAdd */
+			$globalAdd = array();
+
+			foreach ($roleData as $name => $r) {
+				if ($r['allowEdit'] !== 1) {
+					// not allowed, to touch this, so ignore it
+					continue;
+				}
+
+				$newValue = WebRequest::postBoolean('role-' . $name) ? 1 : 0;
+				if ($newValue !== $r['active']) {
+					if ($newValue === 0) {
+						if ($r['globalOnly']) {
+							$globalDelete[] = $r['object'];
+						}
+						else {
+							$delete[] = $r['object'];
+						}
+					}
+
+					if ($newValue === 1) {
+						if ($r['globalOnly']) {
+							$globalAdd[] = $name;
+						}
+						else {
+							$add[] = $name;
+						}
+					}
+				}
+			}
+
+			// Check there's something to do
+			if ((count($add) + count($delete) + count($globalAdd) + count($globalDelete)) === 0) {
+				$this->redirect('statistics/users', 'detail', array('user' => $user->getId()));
+				SessionAlert::warning('No changes made to roles.');
+
+				return;
+			}
+
+			$removed = array();
+			$globalRemoved = array();
+
+			foreach ($delete as $d) {
+				$removed[] = $d->getRole();
+				$d->delete();
+			}
+
+			foreach ($globalDelete as $d) {
+				$globalRemoved[] = $d->getRole();
+				$d->delete();
+			}
+
+			foreach ($add as $x) {
+				$a = new UserRole();
+				$a->setUser($user->getId());
+				$a->setRole($x);
+				$a->setDomain($domain->getId());
+				$a->setDatabase($database);
+				$a->save();
+			}
+
+			foreach ($globalAdd as $x) {
+				$a = new UserRole();
+				$a->setUser($user->getId());
+				$a->setRole($x);
+				$a->setDomain(null);
+				$a->setDatabase($database);
+				$a->save();
+			}
+
+			if ((count($add) + count($delete)) > 0) {
+				Logger::userRolesEdited($database, $user, $reason, $add, $removed, $domain->getId());
+			}
+
+			if ((count($globalAdd) + count($globalDelete)) > 0) {
+				Logger::userGlobalRolesEdited($database, $user, $reason, $globalAdd, $globalRemoved);
+			}
+
+			// dummy save for optimistic locking. If this fails, the entire txn will roll back.
+			$user->setUpdateVersion(WebRequest::postInt('updateversion'));
+			$user->save();
+
+			$this->getNotificationHelper()->userRolesEdited($user, $reason);
+			SessionAlert::quick('Roles changed for user ' . htmlentities($user->getUsername(), ENT_COMPAT, 'UTF-8'));
+
+			$this->redirect('statistics/users', 'detail', array('user' => $user->getId()));
+		}
+		else {
+			$this->assignCSRFToken();
+			$this->setTemplate('usermanagement/roleedit.tpl');
+			$this->assign('user', $user);
+			$this->assign('roleData', $roleData);
+		}
+	}
+
+	/**
+	 * Action target for suspending users
+	 *
+	 * @throws ApplicationLogicException
+	 */
+	protected function suspend()
+	{
+		$this->setHtmlTitle('User Management');
+
+		$database = $this->getDatabase();
+
+		$userId = WebRequest::getInt('user');
+
+		/** @var User $user */
+		$user = User::getById($userId, $database);
+
+		if ($user === false || $user->isCommunityUser()) {
+			throw new ApplicationLogicException('Sorry, the user you are trying to suspend could not be found.');
+		}
+
+		if ($user->isSuspended()) {
+			throw new ApplicationLogicException('Sorry, the user you are trying to suspend is already suspended.');
+		}
+
+		// Dual-mode action
+		if (WebRequest::wasPosted()) {
+			$this->validateCSRFToken();
+			$reason = WebRequest::postString('reason');
+
+			if ($reason === null || trim($reason) === "") {
+				throw new ApplicationLogicException('No reason provided');
+			}
+
+			$user->setStatus(User::STATUS_SUSPENDED);
+			$user->setUpdateVersion(WebRequest::postInt('updateversion'));
+			$user->save();
+			Logger::suspendedUser($database, $user, $reason);
+
+			$this->getNotificationHelper()->userSuspended($user, $reason);
+			SessionAlert::quick('Suspended user ' . htmlentities($user->getUsername(), ENT_COMPAT, 'UTF-8'));
+
+			// send email
+			$this->sendStatusChangeEmail(
+				'Your WP:ACC account has been suspended',
+				'usermanagement/emails/suspended.tpl',
+				$reason,
+				$user,
+				User::getCurrent($database)->getUsername()
+			);
+
+			$this->redirect('userManagement');
+
+			return;
+		}
+		else {
+			$this->assignCSRFToken();
+			$this->setTemplate('usermanagement/changelevel-reason.tpl');
+			$this->assign('user', $user);
+			$this->assign('status', 'Suspended');
+			$this->assign("showReason", true);
+
+			if (WebRequest::getString('preload')) {
+				$this->assign('preload', WebRequest::getString('preload'));
+			}
+		}
+	}
+
+	/**
+	 * Entry point for the decline action
+	 *
+	 * @throws ApplicationLogicException
+	 */
+	protected function decline()
+	{
+		$this->setHtmlTitle('User Management');
+
+		$database = $this->getDatabase();
+
+		$userId = WebRequest::getInt('user');
+		$user = User::getById($userId, $database);
+
+		if ($user === false || $user->isCommunityUser()) {
+			throw new ApplicationLogicException('Sorry, the user you are trying to decline could not be found.');
+		}
+
+		if (!$user->isNewUser()) {
+			throw new ApplicationLogicException('Sorry, the user you are trying to decline is not new.');
+		}
+
+		// Dual-mode action
+		if (WebRequest::wasPosted()) {
+			$this->validateCSRFToken();
+			$reason = WebRequest::postString('reason');
+
+			if ($reason === null || trim($reason) === "") {
+				throw new ApplicationLogicException('No reason provided');
+			}
+
+			$user->setStatus(User::STATUS_DECLINED);
+			$user->setUpdateVersion(WebRequest::postInt('updateversion'));
+			$user->save();
+			Logger::declinedUser($database, $user, $reason);
+
+			$this->getNotificationHelper()->userDeclined($user, $reason);
+			SessionAlert::quick('Declined user ' . htmlentities($user->getUsername(), ENT_COMPAT, 'UTF-8'));
+
+			// send email
+			$this->sendStatusChangeEmail(
+				'Your WP:ACC account has been declined',
+				'usermanagement/emails/declined.tpl',
+				$reason,
+				$user,
+				User::getCurrent($database)->getUsername()
+			);
+
+			$this->redirect('userManagement');
+
+			return;
+		}
+		else {
+			$this->assignCSRFToken();
+			$this->setTemplate('usermanagement/changelevel-reason.tpl');
+			$this->assign('user', $user);
+			$this->assign('status', 'Declined');
+			$this->assign("showReason", true);
+		}
+	}
+
+	/**
+	 * Entry point for the approve action
+	 *
+	 * @throws ApplicationLogicException
+	 */
+	protected function approve()
+	{
+		$this->setHtmlTitle('User Management');
+
+		$database = $this->getDatabase();
+
+		$userId = WebRequest::getInt('user');
+		$user = User::getById($userId, $database);
+
+		if ($user === false || $user->isCommunityUser()) {
+			throw new ApplicationLogicException('Sorry, the user you are trying to approve could not be found.');
+		}
+
+		if ($user->isActive()) {
+			throw new ApplicationLogicException('Sorry, the user you are trying to approve is already an active user.');
+		}
+
+		// Dual-mode action
+		if (WebRequest::wasPosted()) {
+			$this->validateCSRFToken();
+			$user->setStatus(User::STATUS_ACTIVE);
+			$user->setUpdateVersion(WebRequest::postInt('updateversion'));
+			$user->save();
+			Logger::approvedUser($database, $user);
+
+			$this->getNotificationHelper()->userApproved($user);
+			SessionAlert::quick('Approved user ' . htmlentities($user->getUsername(), ENT_COMPAT, 'UTF-8'));
+
+			// send email
+			$this->sendStatusChangeEmail(
+				'Your WP:ACC account has been approved',
+				'usermanagement/emails/approved.tpl',
+				null,
+				$user,
+				User::getCurrent($database)->getUsername()
+			);
+
+			$this->redirect("userManagement");
+
+			return;
+		}
+		else {
+			$this->assignCSRFToken();
+			$this->setTemplate("usermanagement/changelevel-reason.tpl");
+			$this->assign("user", $user);
+			$this->assign("status", "Active");
+			$this->assign("showReason", false);
+		}
+	}
+
+	#endregion
+
+	#region Renaming / Editing
+
+	/**
+	 * Entry point for the rename action
+	 *
+	 * @throws ApplicationLogicException
+	 */
+	protected function rename()
+	{
+		$this->setHtmlTitle('User Management');
+
+		$database = $this->getDatabase();
+
+		$userId = WebRequest::getInt('user');
+		$user = User::getById($userId, $database);
+
+		if ($user === false || $user->isCommunityUser()) {
+			throw new ApplicationLogicException('Sorry, the user you are trying to rename could not be found.');
+		}
+
+		// Dual-mode action
+		if (WebRequest::wasPosted()) {
+			$this->validateCSRFToken();
+			$newUsername = WebRequest::postString('newname');
+
+			if ($newUsername === null || trim($newUsername) === "") {
+				throw new ApplicationLogicException('The new username cannot be empty');
+			}
+
+			if (User::getByUsername($newUsername, $database) != false) {
+				throw new ApplicationLogicException('The new username already exists');
+			}
+
+			$oldUsername = $user->getUsername();
+			$user->setUsername($newUsername);
+			$user->setUpdateVersion(WebRequest::postInt('updateversion'));
+
+			$user->save();
+
+			$logEntryData = serialize(array(
+				'old' => $oldUsername,
+				'new' => $newUsername,
+			));
+
+			Logger::renamedUser($database, $user, $logEntryData);
+
+			SessionAlert::quick("Changed User "
+				. htmlentities($oldUsername, ENT_COMPAT, 'UTF-8')
+				. " name to "
+				. htmlentities($newUsername, ENT_COMPAT, 'UTF-8'));
+
+			$this->getNotificationHelper()->userRenamed($user, $oldUsername);
+
+			// send an email to the user.
+			$this->assign('targetUsername', $user->getUsername());
+			$this->assign('toolAdmin', User::getCurrent($database)->getUsername());
+			$this->assign('oldUsername', $oldUsername);
+			$this->assign('mailingList', $this->adminMailingList);
+
+			// FIXME: domains!
+			/** @var Domain $domain */
+			$domain = Domain::getById(1, $database);
+			$this->getEmailHelper()->sendMail(
+				$this->adminMailingList,
+				$user->getEmail(),
+				'Your username on WP:ACC has been changed',
+				$this->fetchTemplate('usermanagement/emails/renamed.tpl')
+			);
+
+			$this->redirect("userManagement");
+
+			return;
+		}
+		else {
+			$this->assignCSRFToken();
+			$this->setTemplate('usermanagement/renameuser.tpl');
+			$this->assign('user', $user);
+		}
+	}
+
+	/**
+	 * Entry point for the edit action
+	 *
+	 * @throws ApplicationLogicException
+	 */
+	protected function editUser()
+	{
+		$this->setHtmlTitle('User Management');
+
+		$database = $this->getDatabase();
+
+		$userId = WebRequest::getInt('user');
+		$user = User::getById($userId, $database);
+		$oauth = new OAuthUserHelper($user, $database, $this->getOAuthProtocolHelper(), $this->getSiteConfiguration());
+
+		if ($user === false || $user->isCommunityUser()) {
+			throw new ApplicationLogicException('Sorry, the user you are trying to edit could not be found.');
+		}
+
+		// FIXME: domains
+		$prefs = new PreferenceManager($database, $user->getId(), 1);
+
+		// Dual-mode action
+		if (WebRequest::wasPosted()) {
+			$this->validateCSRFToken();
+			$newEmail = WebRequest::postEmail('user_email');
+			$newOnWikiName = WebRequest::postString('user_onwikiname');
+
+			if ($newEmail === null) {
+				throw new ApplicationLogicException('Invalid email address');
+			}
+
+			if ($this->validateUnusedEmail($newEmail, $userId)) {
+				throw new ApplicationLogicException('The specified email address is already in use.');
+			}
+
+			if (!($oauth->isFullyLinked() || $oauth->isPartiallyLinked())) {
+				if (trim($newOnWikiName) == "") {
+					throw new ApplicationLogicException('New on-wiki username cannot be blank');
+				}
+
+				$user->setOnWikiName($newOnWikiName);
+			}
+
+			$user->setEmail($newEmail);
+
+			$prefs->setLocalPreference(PreferenceManager::PREF_CREATION_MODE, WebRequest::postInt('creationmode'));
+
+			$user->setUpdateVersion(WebRequest::postInt('updateversion'));
+
+			$user->save();
+
+			Logger::userPreferencesChange($database, $user);
+			$this->getNotificationHelper()->userPrefChange($user);
+			SessionAlert::quick('Changes to user\'s preferences have been saved');
+
+			$this->redirect("userManagement");
+
+			return;
+		}
+		else {
+			$this->assignCSRFToken();
+			$oauth = new OAuthUserHelper($user, $database, $this->getOAuthProtocolHelper(),
+				$this->getSiteConfiguration());
+			$this->setTemplate('usermanagement/edituser.tpl');
+			$this->assign('user', $user);
+			$this->assign('oauth', $oauth);
+
+			$this->assign('preferredCreationMode', (int)$prefs->getPreference(PreferenceManager::PREF_CREATION_MODE));
+			$this->assign('emailSignature', $prefs->getPreference(PreferenceManager::PREF_EMAIL_SIGNATURE));
+
+			$this->assign('canManualCreate',
+				$this->barrierTest(PreferenceManager::CREATION_MANUAL, $user, 'RequestCreation'));
+			$this->assign('canOauthCreate',
+				$this->barrierTest(PreferenceManager::CREATION_OAUTH, $user, 'RequestCreation'));
+			$this->assign('canBotCreate',
+				$this->barrierTest(PreferenceManager::CREATION_BOT, $user, 'RequestCreation'));
+		}
+	}
+
+	#endregion
+
+	private function validateUnusedEmail(string $email, int $userId) : bool {
+		$query = 'SELECT COUNT(id) FROM user WHERE email = :email AND id <> :uid';
+		$statement = $this->getDatabase()->prepare($query);
+		$statement->execute(array(':email' => $email, ':uid' => $userId));
+		$inUse = $statement->fetchColumn() > 0;
+		$statement->closeCursor();
+
+		return $inUse;
+	}
+
+	/**
+	 * Sends a status change email to the user.
+	 *
+	 * @param string      $subject           The subject of the email
+	 * @param string      $template          The smarty template to use
+	 * @param string|null $reason            The reason for performing the status change
+	 * @param User        $user              The user affected
+	 * @param string      $toolAdminUsername The tool admin's username who is making the edit
+	 */
+	private function sendStatusChangeEmail($subject, $template, $reason, $user, $toolAdminUsername)
+	{
+		$this->assign('targetUsername', $user->getUsername());
+		$this->assign('toolAdmin', $toolAdminUsername);
+		$this->assign('actionReason', $reason);
+		$this->assign('mailingList', $this->adminMailingList);
+
+		// FIXME: domains!
+		/** @var Domain $domain */
+		$domain = Domain::getById(1, $this->getDatabase());
+		$this->getEmailHelper()->sendMail(
+			$this->adminMailingList,
+			$user->getEmail(),
+			$subject,
+			$this->fetchTemplate($template)
+		);
+	}
+
+	/**
+	 * @param UserRole[] $activeRoles
+	 *
+	 * @return array
+	 */
+	private function getRoleData($activeRoles)
+	{
+		$availableRoles = $this->getSecurityManager()->getRoleConfiguration()->getAvailableRoles();
+
+		$currentUser = User::getCurrent($this->getDatabase());
+		$this->getSecurityManager()->getActiveRoles($currentUser, $userRoles, $inactiveRoles);
+
+		$initialValue = array('active' => 0, 'allowEdit' => 0, 'description' => '???', 'object' => null);
+
+		$roleData = array();
+		foreach ($availableRoles as $role => $data) {
+			$intersection = array_intersect($data['editableBy'], $userRoles);
+
+			$roleData[$role] = $initialValue;
+			$roleData[$role]['allowEdit'] = count($intersection) > 0 ? 1 : 0;
+			$roleData[$role]['description'] = $data['description'];
+			$roleData[$role]['globalOnly'] = $data['globalOnly'];
+		}
+
+		foreach ($activeRoles as $role) {
+			if (!isset($roleData[$role->getRole()])) {
+				// This value is no longer available in the configuration, allow changing (aka removing) it.
+				$roleData[$role->getRole()] = $initialValue;
+				$roleData[$role->getRole()]['allowEdit'] = 1;
+			}
+
+			$roleData[$role->getRole()]['object'] = $role;
+			$roleData[$role->getRole()]['active'] = 1;
+		}
+
+		return $roleData;
+	}
 }

includes/Router/RequestRouter.php

Indentation +474 added lines, -474 removed lines

@@ -70,478 +70,478 @@
  */
 class RequestRouter implements IRequestRouter
 {
-    /**
-     * This is the core routing table for the application. The basic idea is:
-     *
-     *      array(
-     *          "foo" =>
-     *              array(
-     *                  "class"   => PageFoo::class,
-     *                  "actions" => array("bar", "other")
-     *              ),
-     * );
-     *
-     * Things to note:
-     *     - If no page is requested, we go to PageMain. PageMain can't have actions defined.
-     *
-     *     - If a page is defined and requested, but no action is requested, go to that page's main() method
-     *     - If a page is defined and requested, and an action is defined and requested, go to that action's method.
-     *     - If a page is defined and requested, and an action NOT defined and requested, go to Page404 and it's main()
-     *       method.
-     *     - If a page is NOT defined and requested, go to Page404 and it's main() method.
-     *
-     *     - Query parameters are ignored.
-     *
-     * The key point here is request routing with validation that this is allowed, before we start hitting the
-     * filesystem through the AutoLoader, and opening random files. Also, so that we validate the action requested
-     * before we start calling random methods through the web UI.
-     *
-     * Examples:
-     * /internal.php                => returns instance of PageMain, routed to main()
-     * /internal.php?query          => returns instance of PageMain, routed to main()
-     * /internal.php/foo            => returns instance of PageFoo, routed to main()
-     * /internal.php/foo?query      => returns instance of PageFoo, routed to main()
-     * /internal.php/foo/bar        => returns instance of PageFoo, routed to bar()
-     * /internal.php/foo/bar?query  => returns instance of PageFoo, routed to bar()
-     * /internal.php/foo/baz        => returns instance of Page404, routed to main()
-     * /internal.php/foo/baz?query  => returns instance of Page404, routed to main()
-     * /internal.php/bar            => returns instance of Page404, routed to main()
-     * /internal.php/bar?query      => returns instance of Page404, routed to main()
-     * /internal.php/bar/baz        => returns instance of Page404, routed to main()
-     * /internal.php/bar/baz?query  => returns instance of Page404, routed to main()
-     *
-     * Take care when changing this - a lot of places rely on the array key for redirects and other links. If you need
-     * to change the key, then you'll likely have to update a lot of files.
-     *
-     * @var array
-     */
-    private $routeMap = array(
-
-        //////////////////////////////////////////////////////////////////////////////////////////////////
-        // Login and registration
-        'logout'                      =>
-            array(
-                'class'   => PageLogout::class,
-                'actions' => array(),
-            ),
-        'login'                       =>
-            array(
-                'class'   => PagePasswordLogin::class,
-                'actions' => array(),
-            ),
-        'login/otp'                   =>
-            array(
-                'class'   => PageOtpLogin::class,
-                'actions' => array(),
-            ),
-        'forgotPassword'              =>
-            array(
-                'class'   => PageForgotPassword::class,
-                'actions' => array('reset'),
-            ),
-        'register'                    =>
-            array(
-                'class'   => PageRegisterOption::class,
-                'actions' => array(),
-            ),
-        'register/standard'           =>
-            array(
-                'class'   => PageRegisterStandard::class,
-                'actions' => array('done'),
-            ),
-        'domainSwitch'                =>
-            array(
-                'class'   => PageDomainSwitch::class,
-                'actions' => array(),
-            ),
-
-        //////////////////////////////////////////////////////////////////////////////////////////////////
-        // Discovery
-        'search'                      =>
-            array(
-                'class'   => PageSearch::class,
-                'actions' => array(),
-            ),
-        'logs'                        =>
-            array(
-                'class'   => PageLog::class,
-                'actions' => array(),
-            ),
-
-        //////////////////////////////////////////////////////////////////////////////////////////////////
-        // Administration
-        'bans'                        =>
-            array(
-                'class'   => PageBan::class,
-                'actions' => array('set', 'remove', 'show', 'replace'),
-            ),
-        'userManagement'              =>
-            array(
-                'class'   => PageUserManagement::class,
-                'actions' => array(
-                    'approve',
-                    'decline',
-                    'rename',
-                    'editUser',
-                    'suspend',
-                    'editRoles',
-                ),
-            ),
-        'siteNotice'                  =>
-            array(
-                'class'   => PageSiteNotice::class,
-                'actions' => array(),
-            ),
-        'emailManagement'             =>
-            array(
-                'class'   => PageEmailManagement::class,
-                'actions' => array('create', 'edit', 'view'),
-            ),
-        'queueManagement'             =>
-            array(
-                'class'   => PageQueueManagement::class,
-                'actions' => array('create', 'edit'),
-            ),
-        'requestFormManagement'       =>
-            array(
-                'class'   => PageRequestFormManagement::class,
-                'actions' => array('create', 'edit', 'view', 'preview'),
-            ),
-        'jobQueue'                    =>
-            array(
-                'class'   => PageJobQueue::class,
-                'actions' => array('acknowledge', 'requeue', 'view', 'all', 'cancel'),
-            ),
-        'domainManagement'            =>
-            array(
-                'class'   => PageDomainManagement::class,
-                'actions' => array('create', 'edit'),
-            ),
-        'flaggedComments'             =>
-            array(
-                'class'   => PageListFlaggedComments::class,
-                'actions' => array(),
-            ),
-
-        //////////////////////////////////////////////////////////////////////////////////////////////////
-        // Personal preferences
-        'preferences'                 =>
-            array(
-                'class'   => PagePreferences::class,
-                'actions' => array(
-                    'refreshOAuth'
-                ),
-            ),
-        'changePassword'              =>
-            array(
-                'class'   => PageChangePassword::class,
-                'actions' => array(),
-            ),
-        'multiFactor'                 =>
-            array(
-                'class'   => PageMultiFactor::class,
-                'actions' => array(
-                    'scratch',
-                    'enableYubikeyOtp',
-                    'disableYubikeyOtp',
-                    'enableTotp',
-                    'disableTotp',
-                ),
-            ),
-        'oauth'                       =>
-            array(
-                'class'   => PageOAuth::class,
-                'actions' => array('detach', 'attach'),
-            ),
-        'oauth/callback'              =>
-            array(
-                'class'   => PageOAuthCallback::class,
-                'actions' => array('authorise', 'create'),
-            ),
-
-        //////////////////////////////////////////////////////////////////////////////////////////////////
-        // Welcomer configuration
-        'welcomeTemplates'            =>
-            array(
-                'class'   => PageWelcomeTemplateManagement::class,
-                'actions' => array('select', 'edit', 'delete', 'add', 'view'),
-            ),
-
-        //////////////////////////////////////////////////////////////////////////////////////////////////
-        // Statistics
-        'statistics'                  =>
-            array(
-                'class'   => StatsMain::class,
-                'actions' => array(),
-            ),
-        'statistics/fastCloses'       =>
-            array(
-                'class'   => StatsFastCloses::class,
-                'actions' => array(),
-            ),
-        'statistics/inactiveUsers'    =>
-            array(
-                'class'   => StatsInactiveUsers::class,
-                'actions' => array(),
-            ),
-        'statistics/monthlyStats'     =>
-            array(
-                'class'   => StatsMonthlyStats::class,
-                'actions' => array(),
-            ),
-        'statistics/reservedRequests' =>
-            array(
-                'class'   => StatsReservedRequests::class,
-                'actions' => array(),
-            ),
-        'statistics/templateStats'    =>
-            array(
-                'class'   => StatsTemplateStats::class,
-                'actions' => array(),
-            ),
-        'statistics/topCreators'      =>
-            array(
-                'class'   => StatsTopCreators::class,
-                'actions' => array(),
-            ),
-        'statistics/users'            =>
-            array(
-                'class'   => StatsUsers::class,
-                'actions' => array('detail'),
-            ),
-
-        //////////////////////////////////////////////////////////////////////////////////////////////////
-        // Zoom page
-        'viewRequest'                 =>
-            array(
-                'class'   => PageViewRequest::class,
-                'actions' => array(),
-            ),
-        'viewRequest/confirm'         =>
-            array(
-                'class'   => PageManuallyConfirm::class,
-                'actions' => array(),
-            ),
-        'viewRequest/reserve'         =>
-            array(
-                'class'   => PageReservation::class,
-                'actions' => array(),
-            ),
-        'viewRequest/breakReserve'    =>
-            array(
-                'class'   => PageBreakReservation::class,
-                'actions' => array(),
-            ),
-        'viewRequest/defer'           =>
-            array(
-                'class'   => PageDeferRequest::class,
-                'actions' => array(),
-            ),
-        'viewRequest/comment'         =>
-            array(
-                'class'   => PageComment::class,
-                'actions' => array(),
-            ),
-        'viewRequest/sendToUser'      =>
-            array(
-                'class'   => PageSendToUser::class,
-                'actions' => array(),
-            ),
-        'viewRequest/close'           =>
-            array(
-                'class'   => PageCloseRequest::class,
-                'actions' => array(),
-            ),
-        'viewRequest/create'          =>
-            array(
-                'class'   => PageCreateRequest::class,
-                'actions' => array(),
-            ),
-        'viewRequest/drop'            =>
-            array(
-                'class'   => PageDropRequest::class,
-                'actions' => array(),
-            ),
-        'viewRequest/custom'          =>
-            array(
-                'class'   => PageCustomClose::class,
-                'actions' => array(),
-            ),
-        'editComment'                 =>
-            array(
-                'class'   => PageEditComment::class,
-                'actions' => array(),
-            ),
-        'flagComment'                 =>
-            array(
-                'class'   => PageFlagComment::class,
-                'actions' => array(),
-            ),
-
-        //////////////////////////////////////////////////////////////////////////////////////////////////
-        // Misc stuff
-        'team'                        =>
-            array(
-                'class'   => PageTeam::class,
-                'actions' => array(),
-            ),
-        'requestList'                 =>
-            array(
-                'class'   => PageExpandedRequestList::class,
-                'actions' => array(),
-            ),
-        'xffdemo'                     =>
-            array(
-                'class'   => PageXffDemo::class,
-                'actions' => array(),
-            ),
-        'errorLog'                    =>
-            array(
-                'class'   => PageErrorLogViewer::class,
-                'actions' => array('remove', 'view'),
-            ),
-    );
-
-    /**
-     * @return IRoutedTask
-     * @throws Exception
-     */
-    final public function route()
-    {
-        $pathInfo = WebRequest::pathInfo();
-
-        list($pageClass, $action) = $this->getRouteFromPath($pathInfo);
-
-        /** @var IRoutedTask $page */
-        $page = new $pageClass();
-
-        // Dynamic creation, so we've got to be careful here. We can't use built-in language type protection, so
-        // let's use our own.
-        if (!($page instanceof IRoutedTask)) {
-            throw new Exception('Expected a page, but this is not a page.');
-        }
-
-        // OK, I'm happy at this point that we know we're running a page, and we know it's probably what we want if it
-        // inherits PageBase and has been created from the routing map.
-        $page->setRoute($action);
-
-        return $page;
-    }
-
-    /**
-     * @param $pathInfo
-     *
-     * @return array
-     */
-    public function getRouteFromPath($pathInfo)
-    {
-        if (count($pathInfo) === 0) {
-            // No pathInfo, so no page to load. Load the main page.
-            return $this->getDefaultRoute();
-        }
-        elseif (count($pathInfo) === 1) {
-            // Exactly one path info segment, it's got to be a page.
-            $classSegment = $pathInfo[0];
-
-            return $this->routeSinglePathSegment($classSegment);
-        }
-
-        // OK, we have two or more segments now.
-        if (count($pathInfo) > 2) {
-            // Let's handle more than two, and collapse it down into two.
-            $requestedAction = array_pop($pathInfo);
-            $classSegment = implode('/', $pathInfo);
-        }
-        else {
-            // Two path info segments.
-            $classSegment = $pathInfo[0];
-            $requestedAction = $pathInfo[1];
-        }
-
-        $routeMap = $this->routePathSegments($classSegment, $requestedAction);
-
-        if ($routeMap[0] === Page404::class) {
-            $routeMap = $this->routeSinglePathSegment($classSegment . '/' . $requestedAction);
-        }
-
-        return $routeMap;
-    }
-
-    /**
-     * @param $classSegment
-     *
-     * @return array
-     */
-    final protected function routeSinglePathSegment($classSegment)
-    {
-        $routeMap = $this->getRouteMap();
-        if (array_key_exists($classSegment, $routeMap)) {
-            // Route exists, but we don't have an action in path info, so default to main.
-            $pageClass = $routeMap[$classSegment]['class'];
-            $action = 'main';
-
-            return array($pageClass, $action);
-        }
-        else {
-            // Doesn't exist in map. Fall back to 404
-            $pageClass = Page404::class;
-            $action = "main";
-
-            return array($pageClass, $action);
-        }
-    }
-
-    /**
-     * @param $classSegment
-     * @param $requestedAction
-     *
-     * @return array
-     */
-    final protected function routePathSegments($classSegment, $requestedAction)
-    {
-        $routeMap = $this->getRouteMap();
-        if (array_key_exists($classSegment, $routeMap)) {
-            // Route exists, but we don't have an action in path info, so default to main.
-
-            if (isset($routeMap[$classSegment]['actions'])
-                && array_search($requestedAction, $routeMap[$classSegment]['actions']) !== false
-            ) {
-                // Action exists in allowed action list. Allow both the page and the action
-                $pageClass = $routeMap[$classSegment]['class'];
-                $action = $requestedAction;
-
-                return array($pageClass, $action);
-            }
-            else {
-                // Valid page, invalid action. 404 our way out.
-                $pageClass = Page404::class;
-                $action = 'main';
-
-                return array($pageClass, $action);
-            }
-        }
-        else {
-            // Class doesn't exist in map. Fall back to 404
-            $pageClass = Page404::class;
-            $action = 'main';
-
-            return array($pageClass, $action);
-        }
-    }
-
-    /**
-     * @return array
-     */
-    protected function getRouteMap()
-    {
-        return $this->routeMap;
-    }
-
-    /**
-     * @return array
-     */
-    protected function getDefaultRoute()
-    {
-        return array(PageMain::class, "main");
-    }
+	/**
+	 * This is the core routing table for the application. The basic idea is:
+	 *
+	 *      array(
+	 *          "foo" =>
+	 *              array(
+	 *                  "class"   => PageFoo::class,
+	 *                  "actions" => array("bar", "other")
+	 *              ),
+	 * );
+	 *
+	 * Things to note:
+	 *     - If no page is requested, we go to PageMain. PageMain can't have actions defined.
+	 *
+	 *     - If a page is defined and requested, but no action is requested, go to that page's main() method
+	 *     - If a page is defined and requested, and an action is defined and requested, go to that action's method.
+	 *     - If a page is defined and requested, and an action NOT defined and requested, go to Page404 and it's main()
+	 *       method.
+	 *     - If a page is NOT defined and requested, go to Page404 and it's main() method.
+	 *
+	 *     - Query parameters are ignored.
+	 *
+	 * The key point here is request routing with validation that this is allowed, before we start hitting the
+	 * filesystem through the AutoLoader, and opening random files. Also, so that we validate the action requested
+	 * before we start calling random methods through the web UI.
+	 *
+	 * Examples:
+	 * /internal.php                => returns instance of PageMain, routed to main()
+	 * /internal.php?query          => returns instance of PageMain, routed to main()
+	 * /internal.php/foo            => returns instance of PageFoo, routed to main()
+	 * /internal.php/foo?query      => returns instance of PageFoo, routed to main()
+	 * /internal.php/foo/bar        => returns instance of PageFoo, routed to bar()
+	 * /internal.php/foo/bar?query  => returns instance of PageFoo, routed to bar()
+	 * /internal.php/foo/baz        => returns instance of Page404, routed to main()
+	 * /internal.php/foo/baz?query  => returns instance of Page404, routed to main()
+	 * /internal.php/bar            => returns instance of Page404, routed to main()
+	 * /internal.php/bar?query      => returns instance of Page404, routed to main()
+	 * /internal.php/bar/baz        => returns instance of Page404, routed to main()
+	 * /internal.php/bar/baz?query  => returns instance of Page404, routed to main()
+	 *
+	 * Take care when changing this - a lot of places rely on the array key for redirects and other links. If you need
+	 * to change the key, then you'll likely have to update a lot of files.
+	 *
+	 * @var array
+	 */
+	private $routeMap = array(
+
+		//////////////////////////////////////////////////////////////////////////////////////////////////
+		// Login and registration
+		'logout'                      =>
+			array(
+				'class'   => PageLogout::class,
+				'actions' => array(),
+			),
+		'login'                       =>
+			array(
+				'class'   => PagePasswordLogin::class,
+				'actions' => array(),
+			),
+		'login/otp'                   =>
+			array(
+				'class'   => PageOtpLogin::class,
+				'actions' => array(),
+			),
+		'forgotPassword'              =>
+			array(
+				'class'   => PageForgotPassword::class,
+				'actions' => array('reset'),
+			),
+		'register'                    =>
+			array(
+				'class'   => PageRegisterOption::class,
+				'actions' => array(),
+			),
+		'register/standard'           =>
+			array(
+				'class'   => PageRegisterStandard::class,
+				'actions' => array('done'),
+			),
+		'domainSwitch'                =>
+			array(
+				'class'   => PageDomainSwitch::class,
+				'actions' => array(),
+			),
+
+		//////////////////////////////////////////////////////////////////////////////////////////////////
+		// Discovery
+		'search'                      =>
+			array(
+				'class'   => PageSearch::class,
+				'actions' => array(),
+			),
+		'logs'                        =>
+			array(
+				'class'   => PageLog::class,
+				'actions' => array(),
+			),
+
+		//////////////////////////////////////////////////////////////////////////////////////////////////
+		// Administration
+		'bans'                        =>
+			array(
+				'class'   => PageBan::class,
+				'actions' => array('set', 'remove', 'show', 'replace'),
+			),
+		'userManagement'              =>
+			array(
+				'class'   => PageUserManagement::class,
+				'actions' => array(
+					'approve',
+					'decline',
+					'rename',
+					'editUser',
+					'suspend',
+					'editRoles',
+				),
+			),
+		'siteNotice'                  =>
+			array(
+				'class'   => PageSiteNotice::class,
+				'actions' => array(),
+			),
+		'emailManagement'             =>
+			array(
+				'class'   => PageEmailManagement::class,
+				'actions' => array('create', 'edit', 'view'),
+			),
+		'queueManagement'             =>
+			array(
+				'class'   => PageQueueManagement::class,
+				'actions' => array('create', 'edit'),
+			),
+		'requestFormManagement'       =>
+			array(
+				'class'   => PageRequestFormManagement::class,
+				'actions' => array('create', 'edit', 'view', 'preview'),
+			),
+		'jobQueue'                    =>
+			array(
+				'class'   => PageJobQueue::class,
+				'actions' => array('acknowledge', 'requeue', 'view', 'all', 'cancel'),
+			),
+		'domainManagement'            =>
+			array(
+				'class'   => PageDomainManagement::class,
+				'actions' => array('create', 'edit'),
+			),
+		'flaggedComments'             =>
+			array(
+				'class'   => PageListFlaggedComments::class,
+				'actions' => array(),
+			),
+
+		//////////////////////////////////////////////////////////////////////////////////////////////////
+		// Personal preferences
+		'preferences'                 =>
+			array(
+				'class'   => PagePreferences::class,
+				'actions' => array(
+					'refreshOAuth'
+				),
+			),
+		'changePassword'              =>
+			array(
+				'class'   => PageChangePassword::class,
+				'actions' => array(),
+			),
+		'multiFactor'                 =>
+			array(
+				'class'   => PageMultiFactor::class,
+				'actions' => array(
+					'scratch',
+					'enableYubikeyOtp',
+					'disableYubikeyOtp',
+					'enableTotp',
+					'disableTotp',
+				),
+			),
+		'oauth'                       =>
+			array(
+				'class'   => PageOAuth::class,
+				'actions' => array('detach', 'attach'),
+			),
+		'oauth/callback'              =>
+			array(
+				'class'   => PageOAuthCallback::class,
+				'actions' => array('authorise', 'create'),
+			),
+
+		//////////////////////////////////////////////////////////////////////////////////////////////////
+		// Welcomer configuration
+		'welcomeTemplates'            =>
+			array(
+				'class'   => PageWelcomeTemplateManagement::class,
+				'actions' => array('select', 'edit', 'delete', 'add', 'view'),
+			),
+
+		//////////////////////////////////////////////////////////////////////////////////////////////////
+		// Statistics
+		'statistics'                  =>
+			array(
+				'class'   => StatsMain::class,
+				'actions' => array(),
+			),
+		'statistics/fastCloses'       =>
+			array(
+				'class'   => StatsFastCloses::class,
+				'actions' => array(),
+			),
+		'statistics/inactiveUsers'    =>
+			array(
+				'class'   => StatsInactiveUsers::class,
+				'actions' => array(),
+			),
+		'statistics/monthlyStats'     =>
+			array(
+				'class'   => StatsMonthlyStats::class,
+				'actions' => array(),
+			),
+		'statistics/reservedRequests' =>
+			array(
+				'class'   => StatsReservedRequests::class,
+				'actions' => array(),
+			),
+		'statistics/templateStats'    =>
+			array(
+				'class'   => StatsTemplateStats::class,
+				'actions' => array(),
+			),
+		'statistics/topCreators'      =>
+			array(
+				'class'   => StatsTopCreators::class,
+				'actions' => array(),
+			),
+		'statistics/users'            =>
+			array(
+				'class'   => StatsUsers::class,
+				'actions' => array('detail'),
+			),
+
+		//////////////////////////////////////////////////////////////////////////////////////////////////
+		// Zoom page
+		'viewRequest'                 =>
+			array(
+				'class'   => PageViewRequest::class,
+				'actions' => array(),
+			),
+		'viewRequest/confirm'         =>
+			array(
+				'class'   => PageManuallyConfirm::class,
+				'actions' => array(),
+			),
+		'viewRequest/reserve'         =>
+			array(
+				'class'   => PageReservation::class,
+				'actions' => array(),
+			),
+		'viewRequest/breakReserve'    =>
+			array(
+				'class'   => PageBreakReservation::class,
+				'actions' => array(),
+			),
+		'viewRequest/defer'           =>
+			array(
+				'class'   => PageDeferRequest::class,
+				'actions' => array(),
+			),
+		'viewRequest/comment'         =>
+			array(
+				'class'   => PageComment::class,
+				'actions' => array(),
+			),
+		'viewRequest/sendToUser'      =>
+			array(
+				'class'   => PageSendToUser::class,
+				'actions' => array(),
+			),
+		'viewRequest/close'           =>
+			array(
+				'class'   => PageCloseRequest::class,
+				'actions' => array(),
+			),
+		'viewRequest/create'          =>
+			array(
+				'class'   => PageCreateRequest::class,
+				'actions' => array(),
+			),
+		'viewRequest/drop'            =>
+			array(
+				'class'   => PageDropRequest::class,
+				'actions' => array(),
+			),
+		'viewRequest/custom'          =>
+			array(
+				'class'   => PageCustomClose::class,
+				'actions' => array(),
+			),
+		'editComment'                 =>
+			array(
+				'class'   => PageEditComment::class,
+				'actions' => array(),
+			),
+		'flagComment'                 =>
+			array(
+				'class'   => PageFlagComment::class,
+				'actions' => array(),
+			),
+
+		//////////////////////////////////////////////////////////////////////////////////////////////////
+		// Misc stuff
+		'team'                        =>
+			array(
+				'class'   => PageTeam::class,
+				'actions' => array(),
+			),
+		'requestList'                 =>
+			array(
+				'class'   => PageExpandedRequestList::class,
+				'actions' => array(),
+			),
+		'xffdemo'                     =>
+			array(
+				'class'   => PageXffDemo::class,
+				'actions' => array(),
+			),
+		'errorLog'                    =>
+			array(
+				'class'   => PageErrorLogViewer::class,
+				'actions' => array('remove', 'view'),
+			),
+	);
+
+	/**
+	 * @return IRoutedTask
+	 * @throws Exception
+	 */
+	final public function route()
+	{
+		$pathInfo = WebRequest::pathInfo();
+
+		list($pageClass, $action) = $this->getRouteFromPath($pathInfo);
+
+		/** @var IRoutedTask $page */
+		$page = new $pageClass();
+
+		// Dynamic creation, so we've got to be careful here. We can't use built-in language type protection, so
+		// let's use our own.
+		if (!($page instanceof IRoutedTask)) {
+			throw new Exception('Expected a page, but this is not a page.');
+		}
+
+		// OK, I'm happy at this point that we know we're running a page, and we know it's probably what we want if it
+		// inherits PageBase and has been created from the routing map.
+		$page->setRoute($action);
+
+		return $page;
+	}
+
+	/**
+	 * @param $pathInfo
+	 *
+	 * @return array
+	 */
+	public function getRouteFromPath($pathInfo)
+	{
+		if (count($pathInfo) === 0) {
+			// No pathInfo, so no page to load. Load the main page.
+			return $this->getDefaultRoute();
+		}
+		elseif (count($pathInfo) === 1) {
+			// Exactly one path info segment, it's got to be a page.
+			$classSegment = $pathInfo[0];
+
+			return $this->routeSinglePathSegment($classSegment);
+		}
+
+		// OK, we have two or more segments now.
+		if (count($pathInfo) > 2) {
+			// Let's handle more than two, and collapse it down into two.
+			$requestedAction = array_pop($pathInfo);
+			$classSegment = implode('/', $pathInfo);
+		}
+		else {
+			// Two path info segments.
+			$classSegment = $pathInfo[0];
+			$requestedAction = $pathInfo[1];
+		}
+
+		$routeMap = $this->routePathSegments($classSegment, $requestedAction);
+
+		if ($routeMap[0] === Page404::class) {
+			$routeMap = $this->routeSinglePathSegment($classSegment . '/' . $requestedAction);
+		}
+
+		return $routeMap;
+	}
+
+	/**
+	 * @param $classSegment
+	 *
+	 * @return array
+	 */
+	final protected function routeSinglePathSegment($classSegment)
+	{
+		$routeMap = $this->getRouteMap();
+		if (array_key_exists($classSegment, $routeMap)) {
+			// Route exists, but we don't have an action in path info, so default to main.
+			$pageClass = $routeMap[$classSegment]['class'];
+			$action = 'main';
+
+			return array($pageClass, $action);
+		}
+		else {
+			// Doesn't exist in map. Fall back to 404
+			$pageClass = Page404::class;
+			$action = "main";
+
+			return array($pageClass, $action);
+		}
+	}
+
+	/**
+	 * @param $classSegment
+	 * @param $requestedAction
+	 *
+	 * @return array
+	 */
+	final protected function routePathSegments($classSegment, $requestedAction)
+	{
+		$routeMap = $this->getRouteMap();
+		if (array_key_exists($classSegment, $routeMap)) {
+			// Route exists, but we don't have an action in path info, so default to main.
+
+			if (isset($routeMap[$classSegment]['actions'])
+				&& array_search($requestedAction, $routeMap[$classSegment]['actions']) !== false
+			) {
+				// Action exists in allowed action list. Allow both the page and the action
+				$pageClass = $routeMap[$classSegment]['class'];
+				$action = $requestedAction;
+
+				return array($pageClass, $action);
+			}
+			else {
+				// Valid page, invalid action. 404 our way out.
+				$pageClass = Page404::class;
+				$action = 'main';
+
+				return array($pageClass, $action);
+			}
+		}
+		else {
+			// Class doesn't exist in map. Fall back to 404
+			$pageClass = Page404::class;
+			$action = 'main';
+
+			return array($pageClass, $action);
+		}
+	}
+
+	/**
+	 * @return array
+	 */
+	protected function getRouteMap()
+	{
+		return $this->routeMap;
+	}
+
+	/**
+	 * @return array
+	 */
+	protected function getDefaultRoute()
+	{
+		return array(PageMain::class, "main");
+	}
 }

includes/ApplicationBase.php

Indentation +158 added lines, -158 removed lines

@@ -24,162 +24,162 @@
 
 abstract class ApplicationBase
 {
-    private $configuration;
-
-    public function __construct(SiteConfiguration $configuration)
-    {
-        $this->configuration = $configuration;
-    }
-
-    /**
-     * Application entry point.
-     *
-     * Sets up the environment and runs the application, performing any global cleanup operations when done.
-     */
-    public function run()
-    {
-        try {
-            if ($this->setupEnvironment()) {
-                $this->main();
-            }
-        }
-        catch (Exception $ex) {
-            print $ex->getMessage();
-        }
-        finally {
-            $this->cleanupEnvironment();
-        }
-    }
-
-    /**
-     * Environment setup
-     *
-     * This method initialises the tool environment. If the tool cannot be initialised correctly, it will return false
-     * and shut down prematurely.
-     *
-     * @return bool
-     * @throws EnvironmentException
-     */
-    protected function setupEnvironment()
-    {
-        foreach ([
-            'mbstring', // unicode and stuff
-            'pdo',
-            'pdo_mysql', // new database module
-            'session',
-            'date',
-            'pcre', // core stuff
-            'curl', // mediawiki api access etc
-            'openssl', // token generation
-        ] as $x) {
-            if (!extension_loaded($x)) {
-                throw new EnvironmentException("PHP extension `$x` is required.");
-            }
-        }
-
-        ini_set('user_agent', $this->getConfiguration()->getUserAgent());
-
-        $this->setupDatabase();
-
-        return true;
-    }
-
-    /**
-     * Checks the database is connectable and at the correct version
-     *
-     * @throws EnvironmentException
-     * @throws Exception
-     */
-    private function setupDatabase(): void
-    {
-        // check the schema version
-        $database = PdoDatabase::getDatabaseConnection($this->getConfiguration());
-
-        $actualVersion = (int)$database->query('SELECT version FROM schemaversion')->fetchColumn();
-        if ($actualVersion !== $this->getConfiguration()->getSchemaVersion()) {
-            throw new EnvironmentException('Database schema is wrong version! Please either update configuration or database.');
-        }
-    }
-
-    /**
-     * @return SiteConfiguration
-     */
-    public function getConfiguration()
-    {
-        return $this->configuration;
-    }
-
-    /**
-     * Main application logic
-     * @return void
-     */
-    abstract protected function main();
-
-    /**
-     * Any cleanup tasks should go here
-     *
-     * Note that we need to be very careful here, as exceptions may have been thrown and handled.
-     * This should *only* be for cleaning up, no logic should go here.
-     *
-     * @return void
-     */
-    abstract protected function cleanupEnvironment();
-
-    /**
-     * @param ITask             $page
-     * @param SiteConfiguration $siteConfiguration
-     * @param PdoDatabase       $database
-     *
-     * @return void
-     */
-    protected function setupHelpers(
-        ITask $page,
-        SiteConfiguration $siteConfiguration,
-        PdoDatabase $database
-    ) {
-        $page->setSiteConfiguration($siteConfiguration);
-
-        // setup the global database object
-        $page->setDatabase($database);
-
-        // set up helpers and inject them into the page.
-        $httpHelper = new HttpHelper($siteConfiguration);
-
-        $page->setEmailHelper(
-            new EmailHelper($siteConfiguration->getEmailSender(), $siteConfiguration->getIrcNotificationsInstance())
-        );
-
-        $page->setHttpHelper($httpHelper);
-
-        if ($siteConfiguration->getLocationProviderApiKey() === null) {
-            $page->setLocationProvider(new FakeLocationProvider());
-        }
-        else {
-            $page->setLocationProvider(
-                new IpLocationProvider(
-                    $database,
-                    $siteConfiguration->getLocationProviderApiKey(),
-                    $httpHelper
-                ));
-        }
-
-        $page->setXffTrustProvider(new XffTrustProvider($siteConfiguration->getSquidList(), $database));
-
-        $page->setRdnsProvider(new CachedRDnsLookupProvider($database));
-
-        $page->setAntiSpoofProvider(new CachedApiAntispoofProvider($database, $httpHelper));
-
-        $page->setOAuthProtocolHelper(new OAuthProtocolHelper(
-            $siteConfiguration->getOAuthConsumerToken(),
-            $siteConfiguration->getOAuthConsumerSecret(),
-            $database,
-            $siteConfiguration->getUserAgent()
-        ));
-
-        $page->setNotificationHelper(new IrcNotificationHelper(
-            $siteConfiguration,
-            $database));
-
-        $page->setTorExitProvider(new TorExitProvider($database));
-    }
+	private $configuration;
+
+	public function __construct(SiteConfiguration $configuration)
+	{
+		$this->configuration = $configuration;
+	}
+
+	/**
+	 * Application entry point.
+	 *
+	 * Sets up the environment and runs the application, performing any global cleanup operations when done.
+	 */
+	public function run()
+	{
+		try {
+			if ($this->setupEnvironment()) {
+				$this->main();
+			}
+		}
+		catch (Exception $ex) {
+			print $ex->getMessage();
+		}
+		finally {
+			$this->cleanupEnvironment();
+		}
+	}
+
+	/**
+	 * Environment setup
+	 *
+	 * This method initialises the tool environment. If the tool cannot be initialised correctly, it will return false
+	 * and shut down prematurely.
+	 *
+	 * @return bool
+	 * @throws EnvironmentException
+	 */
+	protected function setupEnvironment()
+	{
+		foreach ([
+			'mbstring', // unicode and stuff
+			'pdo',
+			'pdo_mysql', // new database module
+			'session',
+			'date',
+			'pcre', // core stuff
+			'curl', // mediawiki api access etc
+			'openssl', // token generation
+		] as $x) {
+			if (!extension_loaded($x)) {
+				throw new EnvironmentException("PHP extension `$x` is required.");
+			}
+		}
+
+		ini_set('user_agent', $this->getConfiguration()->getUserAgent());
+
+		$this->setupDatabase();
+
+		return true;
+	}
+
+	/**
+	 * Checks the database is connectable and at the correct version
+	 *
+	 * @throws EnvironmentException
+	 * @throws Exception
+	 */
+	private function setupDatabase(): void
+	{
+		// check the schema version
+		$database = PdoDatabase::getDatabaseConnection($this->getConfiguration());
+
+		$actualVersion = (int)$database->query('SELECT version FROM schemaversion')->fetchColumn();
+		if ($actualVersion !== $this->getConfiguration()->getSchemaVersion()) {
+			throw new EnvironmentException('Database schema is wrong version! Please either update configuration or database.');
+		}
+	}
+
+	/**
+	 * @return SiteConfiguration
+	 */
+	public function getConfiguration()
+	{
+		return $this->configuration;
+	}
+
+	/**
+	 * Main application logic
+	 * @return void
+	 */
+	abstract protected function main();
+
+	/**
+	 * Any cleanup tasks should go here
+	 *
+	 * Note that we need to be very careful here, as exceptions may have been thrown and handled.
+	 * This should *only* be for cleaning up, no logic should go here.
+	 *
+	 * @return void
+	 */
+	abstract protected function cleanupEnvironment();
+
+	/**
+	 * @param ITask             $page
+	 * @param SiteConfiguration $siteConfiguration
+	 * @param PdoDatabase       $database
+	 *
+	 * @return void
+	 */
+	protected function setupHelpers(
+		ITask $page,
+		SiteConfiguration $siteConfiguration,
+		PdoDatabase $database
+	) {
+		$page->setSiteConfiguration($siteConfiguration);
+
+		// setup the global database object
+		$page->setDatabase($database);
+
+		// set up helpers and inject them into the page.
+		$httpHelper = new HttpHelper($siteConfiguration);
+
+		$page->setEmailHelper(
+			new EmailHelper($siteConfiguration->getEmailSender(), $siteConfiguration->getIrcNotificationsInstance())
+		);
+
+		$page->setHttpHelper($httpHelper);
+
+		if ($siteConfiguration->getLocationProviderApiKey() === null) {
+			$page->setLocationProvider(new FakeLocationProvider());
+		}
+		else {
+			$page->setLocationProvider(
+				new IpLocationProvider(
+					$database,
+					$siteConfiguration->getLocationProviderApiKey(),
+					$httpHelper
+				));
+		}
+
+		$page->setXffTrustProvider(new XffTrustProvider($siteConfiguration->getSquidList(), $database));
+
+		$page->setRdnsProvider(new CachedRDnsLookupProvider($database));
+
+		$page->setAntiSpoofProvider(new CachedApiAntispoofProvider($database, $httpHelper));
+
+		$page->setOAuthProtocolHelper(new OAuthProtocolHelper(
+			$siteConfiguration->getOAuthConsumerToken(),
+			$siteConfiguration->getOAuthConsumerSecret(),
+			$database,
+			$siteConfiguration->getUserAgent()
+		));
+
+		$page->setNotificationHelper(new IrcNotificationHelper(
+			$siteConfiguration,
+			$database));
+
+		$page->setTorExitProvider(new TorExitProvider($database));
+	}
 }

includes/WebStart.php

Indentation +204 added lines, -204 removed lines

@@ -33,208 +33,208 @@
  */
 class WebStart extends ApplicationBase
 {
-    /**
-     * @var IRequestRouter $requestRouter The request router to use. Note that different entry points have different
-     *                                    routers and hence different URL mappings
-     */
-    private $requestRouter;
-    /**
-     * @var bool $isPublic Determines whether to use public interface objects or internal interface objects
-     */
-    private bool $isPublic = false;
-
-    /**
-     * WebStart constructor.
-     *
-     * @param SiteConfiguration $configuration The site configuration
-     * @param IRequestRouter    $router        The request router to use
-     */
-    public function __construct(SiteConfiguration $configuration, IRequestRouter $router)
-    {
-        parent::__construct($configuration);
-
-        $this->requestRouter = $router;
-    }
-
-    /**
-     * @param ITask             $page
-     * @param SiteConfiguration $siteConfiguration
-     * @param PdoDatabase       $database
-     *
-     * @return void
-     */
-    protected function setupHelpers(
-        ITask $page,
-        SiteConfiguration $siteConfiguration,
-        PdoDatabase $database
-    ) {
-        parent::setupHelpers($page, $siteConfiguration, $database);
-
-        if ($page instanceof PageBase) {
-            $page->setTokenManager(new TokenManager());
-            $page->setCspManager(new ContentSecurityPolicyManager($siteConfiguration));
-
-            if ($page instanceof InternalPageBase) {
-                $page->setTypeAheadHelper(new TypeAheadHelper());
-
-                $identificationVerifier = new IdentificationVerifier($page->getHttpHelper(), $siteConfiguration, $database);
-                $page->setSecurityManager(new SecurityManager($identificationVerifier, new RoleConfiguration()));
-
-                if ($siteConfiguration->getTitleBlacklistEnabled()) {
-                    $page->setBlacklistHelper(new BlacklistHelper($page->getHttpHelper(), $database, $siteConfiguration));
-                }
-                else {
-                    $page->setBlacklistHelper(new FakeBlacklistHelper());
-                }
-
-                $page->setDomainAccessManager(new DomainAccessManager($page->getSecurityManager()));
-            }
-        }
-    }
-
-    /**
-     * Application entry point.
-     *
-     * Sets up the environment and runs the application, performing any global cleanup operations when done.
-     */
-    public function run()
-    {
-        try {
-            if ($this->setupEnvironment()) {
-                $this->main();
-            }
-        }
-        catch (EnvironmentException $ex) {
-            ob_end_clean();
-            print Offline::getOfflineMessage($this->isPublic(), $this->getConfiguration(), $ex->getMessage());
-        }
-            /** @noinspection PhpRedundantCatchClauseInspection */
-        catch (ReadableException $ex) {
-            ob_end_clean();
-            print $ex->getReadableError();
-        }
-        finally {
-            $this->cleanupEnvironment();
-        }
-    }
-
-    /**
-     * Environment setup
-     *
-     * This method initialises the tool environment. If the tool cannot be initialised correctly, it will return false
-     * and shut down prematurely.
-     *
-     * @return bool
-     * @throws EnvironmentException
-     */
-    protected function setupEnvironment()
-    {
-        // initialise global exception handler
-        set_exception_handler(array(ExceptionHandler::class, 'exceptionHandler'));
-        set_error_handler(array(ExceptionHandler::class, 'errorHandler'), E_RECOVERABLE_ERROR);
-
-        // start output buffering if necessary
-        if (ob_get_level() === 0) {
-            ob_start();
-        }
-
-        // initialise super-global providers
-        WebRequest::setGlobalStateProvider(new GlobalStateProvider());
-
-        if (Offline::isOffline($this->getConfiguration())) {
-            print Offline::getOfflineMessage($this->isPublic(), $this->getConfiguration());
-            ob_end_flush();
-
-            return false;
-        }
-
-        // Call parent setup
-        if (!parent::setupEnvironment()) {
-            return false;
-        }
-
-        // Start up sessions
-        ini_set('session.cookie_path', $this->getConfiguration()->getCookiePath());
-        ini_set('session.name', $this->getConfiguration()->getCookieSessionName());
-        Session::start();
-
-        // Check the user is allowed to be logged in still. This must be before we call any user-loading functions and
-        // get the current user cached.
-        // I'm not sure if this function call being here is particularly a good thing, but it's part of starting up a
-        // session I suppose.
-        $this->checkForceLogout();
-
-        // environment initialised!
-        return true;
-    }
-
-    /**
-     * Main application logic
-     */
-    protected function main()
-    {
-        // Get the right route for the request
-        $page = $this->requestRouter->route();
-
-        $siteConfiguration = $this->getConfiguration();
-        $database = PdoDatabase::getDatabaseConnection($this->getConfiguration());
-
-        $this->setupHelpers($page, $siteConfiguration, $database);
-
-        // run the route code for the request.
-        $page->execute();
-    }
-
-    /**
-     * Any cleanup tasks should go here
-     *
-     * Note that we need to be very careful here, as exceptions may have been thrown and handled.
-     * This should *only* be for cleaning up, no logic should go here.
-     */
-    protected function cleanupEnvironment()
-    {
-        // Clean up anything we splurged after sending the page.
-        if (ob_get_level() > 0) {
-            for ($i = ob_get_level(); $i > 0; $i--) {
-                ob_end_clean();
-            }
-        }
-    }
-
-    private function checkForceLogout()
-    {
-        $database = PdoDatabase::getDatabaseConnection($this->getConfiguration());
-
-        $sessionUserId = WebRequest::getSessionUserId();
-        iF ($sessionUserId === null) {
-            return;
-        }
-
-        // Note, User::getCurrent() caches it's result, which we *really* don't want to trigger.
-        $currentUser = User::getById($sessionUserId, $database);
-
-        if ($currentUser === false) {
-            // Umm... this user has a session cookie with a userId set, but no user exists...
-            Session::restart();
-
-            $currentUser = User::getCurrent($database);
-        }
-
-        if ($currentUser->getForceLogout()) {
-            Session::restart();
-
-            $currentUser->setForceLogout(false);
-            $currentUser->save();
-        }
-    }
-
-    public function isPublic(): bool
-    {
-        return $this->isPublic;
-    }
-
-    public function setPublic(bool $isPublic): void
-    {
-        $this->isPublic = $isPublic;
-    }
+	/**
+	 * @var IRequestRouter $requestRouter The request router to use. Note that different entry points have different
+	 *                                    routers and hence different URL mappings
+	 */
+	private $requestRouter;
+	/**
+	 * @var bool $isPublic Determines whether to use public interface objects or internal interface objects
+	 */
+	private bool $isPublic = false;
+
+	/**
+	 * WebStart constructor.
+	 *
+	 * @param SiteConfiguration $configuration The site configuration
+	 * @param IRequestRouter    $router        The request router to use
+	 */
+	public function __construct(SiteConfiguration $configuration, IRequestRouter $router)
+	{
+		parent::__construct($configuration);
+
+		$this->requestRouter = $router;
+	}
+
+	/**
+	 * @param ITask             $page
+	 * @param SiteConfiguration $siteConfiguration
+	 * @param PdoDatabase       $database
+	 *
+	 * @return void
+	 */
+	protected function setupHelpers(
+		ITask $page,
+		SiteConfiguration $siteConfiguration,
+		PdoDatabase $database
+	) {
+		parent::setupHelpers($page, $siteConfiguration, $database);
+
+		if ($page instanceof PageBase) {
+			$page->setTokenManager(new TokenManager());
+			$page->setCspManager(new ContentSecurityPolicyManager($siteConfiguration));
+
+			if ($page instanceof InternalPageBase) {
+				$page->setTypeAheadHelper(new TypeAheadHelper());
+
+				$identificationVerifier = new IdentificationVerifier($page->getHttpHelper(), $siteConfiguration, $database);
+				$page->setSecurityManager(new SecurityManager($identificationVerifier, new RoleConfiguration()));
+
+				if ($siteConfiguration->getTitleBlacklistEnabled()) {
+					$page->setBlacklistHelper(new BlacklistHelper($page->getHttpHelper(), $database, $siteConfiguration));
+				}
+				else {
+					$page->setBlacklistHelper(new FakeBlacklistHelper());
+				}
+
+				$page->setDomainAccessManager(new DomainAccessManager($page->getSecurityManager()));
+			}
+		}
+	}
+
+	/**
+	 * Application entry point.
+	 *
+	 * Sets up the environment and runs the application, performing any global cleanup operations when done.
+	 */
+	public function run()
+	{
+		try {
+			if ($this->setupEnvironment()) {
+				$this->main();
+			}
+		}
+		catch (EnvironmentException $ex) {
+			ob_end_clean();
+			print Offline::getOfflineMessage($this->isPublic(), $this->getConfiguration(), $ex->getMessage());
+		}
+			/** @noinspection PhpRedundantCatchClauseInspection */
+		catch (ReadableException $ex) {
+			ob_end_clean();
+			print $ex->getReadableError();
+		}
+		finally {
+			$this->cleanupEnvironment();
+		}
+	}
+
+	/**
+	 * Environment setup
+	 *
+	 * This method initialises the tool environment. If the tool cannot be initialised correctly, it will return false
+	 * and shut down prematurely.
+	 *
+	 * @return bool
+	 * @throws EnvironmentException
+	 */
+	protected function setupEnvironment()
+	{
+		// initialise global exception handler
+		set_exception_handler(array(ExceptionHandler::class, 'exceptionHandler'));
+		set_error_handler(array(ExceptionHandler::class, 'errorHandler'), E_RECOVERABLE_ERROR);
+
+		// start output buffering if necessary
+		if (ob_get_level() === 0) {
+			ob_start();
+		}
+
+		// initialise super-global providers
+		WebRequest::setGlobalStateProvider(new GlobalStateProvider());
+
+		if (Offline::isOffline($this->getConfiguration())) {
+			print Offline::getOfflineMessage($this->isPublic(), $this->getConfiguration());
+			ob_end_flush();
+
+			return false;
+		}
+
+		// Call parent setup
+		if (!parent::setupEnvironment()) {
+			return false;
+		}
+
+		// Start up sessions
+		ini_set('session.cookie_path', $this->getConfiguration()->getCookiePath());
+		ini_set('session.name', $this->getConfiguration()->getCookieSessionName());
+		Session::start();
+
+		// Check the user is allowed to be logged in still. This must be before we call any user-loading functions and
+		// get the current user cached.
+		// I'm not sure if this function call being here is particularly a good thing, but it's part of starting up a
+		// session I suppose.
+		$this->checkForceLogout();
+
+		// environment initialised!
+		return true;
+	}
+
+	/**
+	 * Main application logic
+	 */
+	protected function main()
+	{
+		// Get the right route for the request
+		$page = $this->requestRouter->route();
+
+		$siteConfiguration = $this->getConfiguration();
+		$database = PdoDatabase::getDatabaseConnection($this->getConfiguration());
+
+		$this->setupHelpers($page, $siteConfiguration, $database);
+
+		// run the route code for the request.
+		$page->execute();
+	}
+
+	/**
+	 * Any cleanup tasks should go here
+	 *
+	 * Note that we need to be very careful here, as exceptions may have been thrown and handled.
+	 * This should *only* be for cleaning up, no logic should go here.
+	 */
+	protected function cleanupEnvironment()
+	{
+		// Clean up anything we splurged after sending the page.
+		if (ob_get_level() > 0) {
+			for ($i = ob_get_level(); $i > 0; $i--) {
+				ob_end_clean();
+			}
+		}
+	}
+
+	private function checkForceLogout()
+	{
+		$database = PdoDatabase::getDatabaseConnection($this->getConfiguration());
+
+		$sessionUserId = WebRequest::getSessionUserId();
+		iF ($sessionUserId === null) {
+			return;
+		}
+
+		// Note, User::getCurrent() caches it's result, which we *really* don't want to trigger.
+		$currentUser = User::getById($sessionUserId, $database);
+
+		if ($currentUser === false) {
+			// Umm... this user has a session cookie with a userId set, but no user exists...
+			Session::restart();
+
+			$currentUser = User::getCurrent($database);
+		}
+
+		if ($currentUser->getForceLogout()) {
+			Session::restart();
+
+			$currentUser->setForceLogout(false);
+			$currentUser->save();
+		}
+	}
+
+	public function isPublic(): bool
+	{
+		return $this->isPublic;
+	}
+
+	public function setPublic(bool $isPublic): void
+	{
+		$this->isPublic = $isPublic;
+	}
 }