mdaniels5757 / waca

includes/Fragments/NavigationMenuAccessControl.php

Indentation +92 added lines, -92 removed lines

@@ -37,108 +37,108 @@
 
 trait NavigationMenuAccessControl
 {
-    protected abstract function assign($name, $value);
+	protected abstract function assign($name, $value);
 
-    protected abstract function getSecurityManager(): ISecurityManager;
+	protected abstract function getSecurityManager(): ISecurityManager;
 
-    public abstract function getDomainAccessManager(): IDomainAccessManager;
+	public abstract function getDomainAccessManager(): IDomainAccessManager;
 
-    /**
-     * @param $currentUser
-     */
-    protected function setupNavMenuAccess($currentUser)
-    {
-        $this->assign('nav__canRequests', $this->getSecurityManager()
-                ->allows(PageMain::class, RoleConfigurationBase::MAIN, $currentUser) === ISecurityManager::ALLOWED);
+	/**
+	 * @param $currentUser
+	 */
+	protected function setupNavMenuAccess($currentUser)
+	{
+		$this->assign('nav__canRequests', $this->getSecurityManager()
+				->allows(PageMain::class, RoleConfigurationBase::MAIN, $currentUser) === ISecurityManager::ALLOWED);
 
-        $this->assign('nav__canLogs', $this->getSecurityManager()
-                ->allows(PageLog::class, RoleConfigurationBase::MAIN, $currentUser) === ISecurityManager::ALLOWED);
-        $this->assign('nav__canUsers', $this->getSecurityManager()
-                ->allows(StatsUsers::class, RoleConfigurationBase::MAIN, $currentUser) === ISecurityManager::ALLOWED);
-        $this->assign('nav__canSearch', $this->getSecurityManager()
-                ->allows(PageSearch::class, RoleConfigurationBase::MAIN, $currentUser) === ISecurityManager::ALLOWED);
-        $this->assign('nav__canStats', $this->getSecurityManager()
-                ->allows(StatsMain::class, RoleConfigurationBase::MAIN, $currentUser) === ISecurityManager::ALLOWED);
+		$this->assign('nav__canLogs', $this->getSecurityManager()
+				->allows(PageLog::class, RoleConfigurationBase::MAIN, $currentUser) === ISecurityManager::ALLOWED);
+		$this->assign('nav__canUsers', $this->getSecurityManager()
+				->allows(StatsUsers::class, RoleConfigurationBase::MAIN, $currentUser) === ISecurityManager::ALLOWED);
+		$this->assign('nav__canSearch', $this->getSecurityManager()
+				->allows(PageSearch::class, RoleConfigurationBase::MAIN, $currentUser) === ISecurityManager::ALLOWED);
+		$this->assign('nav__canStats', $this->getSecurityManager()
+				->allows(StatsMain::class, RoleConfigurationBase::MAIN, $currentUser) === ISecurityManager::ALLOWED);
 
-        $this->assign('nav__canBan', $this->getSecurityManager()
-                ->allows(PageBan::class, RoleConfigurationBase::MAIN, $currentUser) === ISecurityManager::ALLOWED);
-        $this->assign('nav__canEmailMgmt', $this->getSecurityManager()
-                ->allows(PageEmailManagement::class, RoleConfigurationBase::MAIN,
-                    $currentUser) === ISecurityManager::ALLOWED);
-        $this->assign('nav__canWelcomeMgmt', $this->getSecurityManager()
-                ->allows(PageWelcomeTemplateManagement::class, RoleConfigurationBase::MAIN,
-                    $currentUser) === ISecurityManager::ALLOWED);
-        $this->assign('nav__canSiteNoticeMgmt', $this->getSecurityManager()
-                ->allows(PageSiteNotice::class, RoleConfigurationBase::MAIN, $currentUser) === ISecurityManager::ALLOWED);
-        $this->assign('nav__canUserMgmt', $this->getSecurityManager()
-                ->allows(PageUserManagement::class, RoleConfigurationBase::MAIN,
-                    $currentUser) === ISecurityManager::ALLOWED);
-        $this->assign('nav__canJobQueue', $this->getSecurityManager()
-                ->allows(PageJobQueue::class, RoleConfigurationBase::MAIN,
-                    $currentUser) === ISecurityManager::ALLOWED);
-        $this->assign('nav__canDomainMgmt', $this->getSecurityManager()
-                ->allows(PageDomainManagement::class, RoleConfigurationBase::MAIN,
-                    $currentUser) === ISecurityManager::ALLOWED);
-        $this->assign('nav__canFlaggedComments', $this->getSecurityManager()
-                ->allows(PageListFlaggedComments::class, RoleConfigurationBase::MAIN,
-                    $currentUser) === ISecurityManager::ALLOWED);
-        $this->assign('nav__canQueueMgmt', $this->getSecurityManager()
-                ->allows(PageQueueManagement::class, RoleConfigurationBase::MAIN,
-                    $currentUser) === ISecurityManager::ALLOWED);
-        $this->assign('nav__canFormMgmt', $this->getSecurityManager()
-                ->allows(PageRequestFormManagement::class, RoleConfigurationBase::MAIN,
-                    $currentUser) === ISecurityManager::ALLOWED);
-        $this->assign('nav__canErrorLog', $this->getSecurityManager()
-                ->allows(PageErrorLogViewer::class, RoleConfigurationBase::MAIN, $currentUser) === ISecurityManager::ALLOWED);
+		$this->assign('nav__canBan', $this->getSecurityManager()
+				->allows(PageBan::class, RoleConfigurationBase::MAIN, $currentUser) === ISecurityManager::ALLOWED);
+		$this->assign('nav__canEmailMgmt', $this->getSecurityManager()
+				->allows(PageEmailManagement::class, RoleConfigurationBase::MAIN,
+					$currentUser) === ISecurityManager::ALLOWED);
+		$this->assign('nav__canWelcomeMgmt', $this->getSecurityManager()
+				->allows(PageWelcomeTemplateManagement::class, RoleConfigurationBase::MAIN,
+					$currentUser) === ISecurityManager::ALLOWED);
+		$this->assign('nav__canSiteNoticeMgmt', $this->getSecurityManager()
+				->allows(PageSiteNotice::class, RoleConfigurationBase::MAIN, $currentUser) === ISecurityManager::ALLOWED);
+		$this->assign('nav__canUserMgmt', $this->getSecurityManager()
+				->allows(PageUserManagement::class, RoleConfigurationBase::MAIN,
+					$currentUser) === ISecurityManager::ALLOWED);
+		$this->assign('nav__canJobQueue', $this->getSecurityManager()
+				->allows(PageJobQueue::class, RoleConfigurationBase::MAIN,
+					$currentUser) === ISecurityManager::ALLOWED);
+		$this->assign('nav__canDomainMgmt', $this->getSecurityManager()
+				->allows(PageDomainManagement::class, RoleConfigurationBase::MAIN,
+					$currentUser) === ISecurityManager::ALLOWED);
+		$this->assign('nav__canFlaggedComments', $this->getSecurityManager()
+				->allows(PageListFlaggedComments::class, RoleConfigurationBase::MAIN,
+					$currentUser) === ISecurityManager::ALLOWED);
+		$this->assign('nav__canQueueMgmt', $this->getSecurityManager()
+				->allows(PageQueueManagement::class, RoleConfigurationBase::MAIN,
+					$currentUser) === ISecurityManager::ALLOWED);
+		$this->assign('nav__canFormMgmt', $this->getSecurityManager()
+				->allows(PageRequestFormManagement::class, RoleConfigurationBase::MAIN,
+					$currentUser) === ISecurityManager::ALLOWED);
+		$this->assign('nav__canErrorLog', $this->getSecurityManager()
+				->allows(PageErrorLogViewer::class, RoleConfigurationBase::MAIN, $currentUser) === ISecurityManager::ALLOWED);
 
-        $this->assign('nav__canViewRequest', $this->getSecurityManager()
-                ->allows(PageViewRequest::class, RoleConfigurationBase::MAIN, $currentUser) === ISecurityManager::ALLOWED);
+		$this->assign('nav__canViewRequest', $this->getSecurityManager()
+				->allows(PageViewRequest::class, RoleConfigurationBase::MAIN, $currentUser) === ISecurityManager::ALLOWED);
 
-        $this->assign('nav__domainList', []);
-        if ($this->getDomainAccessManager() !== null) {
-            $this->assign('nav__domainList', $this->getDomainAccessManager()->getAllowedDomains($currentUser));
-        }
-    }
+		$this->assign('nav__domainList', []);
+		if ($this->getDomainAccessManager() !== null) {
+			$this->assign('nav__domainList', $this->getDomainAccessManager()->getAllowedDomains($currentUser));
+		}
+	}
 
-    /**
-     * Sets up the badges to draw attention to issues on various admin pages.
-     *
-     * This function checks to see if a user can access the pages, and if so checks the count of problem areas.
-     * If problem areas are found, a number greater than 0 will cause the badge to show up.
-     *
-     * @param User        $currentUser The current user
-     * @param PdoDatabase $database    Database instance
-     *
-     * @return void
-     */
-    public function setUpNavBarBadges(User $currentUser, PdoDatabase $database) {
-        // Set up some variables.
-        // A size of 0 causes nothing to show up on the page (checked on navigation-menu.tpl) so leaving it 0 here is fine.
-        $countOfFlagged = 0;
-        $countOfJobQueue = 0;
+	/**
+	 * Sets up the badges to draw attention to issues on various admin pages.
+	 *
+	 * This function checks to see if a user can access the pages, and if so checks the count of problem areas.
+	 * If problem areas are found, a number greater than 0 will cause the badge to show up.
+	 *
+	 * @param User        $currentUser The current user
+	 * @param PdoDatabase $database    Database instance
+	 *
+	 * @return void
+	 */
+	public function setUpNavBarBadges(User $currentUser, PdoDatabase $database) {
+		// Set up some variables.
+		// A size of 0 causes nothing to show up on the page (checked on navigation-menu.tpl) so leaving it 0 here is fine.
+		$countOfFlagged = 0;
+		$countOfJobQueue = 0;
 
-        // Count of flagged comments:
-        if($this->barrierTest(RoleConfigurationBase::MAIN, $currentUser, PageListFlaggedComments::class)) {
-            // We want all flagged comments that haven't been acknowledged if we can visit the page.
-            $countOfFlagged = sizeof(Comment::getFlaggedComments($database, 1)); // FIXME: domains
-        }
+		// Count of flagged comments:
+		if($this->barrierTest(RoleConfigurationBase::MAIN, $currentUser, PageListFlaggedComments::class)) {
+			// We want all flagged comments that haven't been acknowledged if we can visit the page.
+			$countOfFlagged = sizeof(Comment::getFlaggedComments($database, 1)); // FIXME: domains
+		}
 
-        // Count of failed job queue changes:
-        if($this->barrierTest(RoleConfigurationBase::MAIN, $currentUser, PageJobQueue::class)) {
-            // We want all failed jobs that haven't been acknowledged if we can visit the page.
-            JobQueueSearchHelper::get($database, 1) // FIXME: domains
-                ->statusIn([JobQueue::STATUS_FAILED])
-                ->notAcknowledged()
-                ->getRecordCount($countOfJobQueue);
-        }
+		// Count of failed job queue changes:
+		if($this->barrierTest(RoleConfigurationBase::MAIN, $currentUser, PageJobQueue::class)) {
+			// We want all failed jobs that haven't been acknowledged if we can visit the page.
+			JobQueueSearchHelper::get($database, 1) // FIXME: domains
+				->statusIn([JobQueue::STATUS_FAILED])
+				->notAcknowledged()
+				->getRecordCount($countOfJobQueue);
+		}
 
-        // To generate the main badge, add both up.
-        // If we add more badges in the future, don't forget to add them here!
-        $countOfAll = $countOfFlagged + $countOfJobQueue;
+		// To generate the main badge, add both up.
+		// If we add more badges in the future, don't forget to add them here!
+		$countOfAll = $countOfFlagged + $countOfJobQueue;
 
-        // Set badge variables
-        $this->assign("nav__numFlaggedComments", $countOfFlagged);
-        $this->assign("nav__numJobQueueFailed", $countOfJobQueue);
-        $this->assign("nav__numAdmin", $countOfAll);
-    }
+		// Set badge variables
+		$this->assign("nav__numFlaggedComments", $countOfFlagged);
+		$this->assign("nav__numJobQueueFailed", $countOfJobQueue);
+		$this->assign("nav__numAdmin", $countOfAll);
+	}
 }

Spacing +2 added lines, -2 removed lines

@@ -118,13 +118,13 @@
         $countOfJobQueue = 0;
 
         // Count of flagged comments:
-        if($this->barrierTest(RoleConfigurationBase::MAIN, $currentUser, PageListFlaggedComments::class)) {
+        if ($this->barrierTest(RoleConfigurationBase::MAIN, $currentUser, PageListFlaggedComments::class)) {
             // We want all flagged comments that haven't been acknowledged if we can visit the page.
             $countOfFlagged = sizeof(Comment::getFlaggedComments($database, 1)); // FIXME: domains
         }
 
         // Count of failed job queue changes:
-        if($this->barrierTest(RoleConfigurationBase::MAIN, $currentUser, PageJobQueue::class)) {
+        if ($this->barrierTest(RoleConfigurationBase::MAIN, $currentUser, PageJobQueue::class)) {
             // We want all failed jobs that haven't been acknowledged if we can visit the page.
             JobQueueSearchHelper::get($database, 1) // FIXME: domains
                 ->statusIn([JobQueue::STATUS_FAILED])

includes/Fragments/LogEntryLookup.php

Indentation +14 added lines, -14 removed lines

@@ -16,20 +16,20 @@
 
 trait LogEntryLookup
 {
-    protected function getLogEntry(string $action, User $user, PdoDatabase $database): ?string
-    {
-        /** @var Log[] $logs */
-        $logs = LogSearchHelper::get($database, null)
-            ->byAction($action)
-            ->byObjectType('User')
-            ->byObjectId($user->getId())
-            ->limit(1)
-            ->fetch();
+	protected function getLogEntry(string $action, User $user, PdoDatabase $database): ?string
+	{
+		/** @var Log[] $logs */
+		$logs = LogSearchHelper::get($database, null)
+			->byAction($action)
+			->byObjectType('User')
+			->byObjectId($user->getId())
+			->limit(1)
+			->fetch();
 
-        if (count($logs) > 0) {
-            return $logs[0]->getComment();
-        }
+		if (count($logs) > 0) {
+			return $logs[0]->getComment();
+		}
 
-        return null;
-    }
+		return null;
+	}
 }
\ No newline at end of file

includes/Tasks/InternalPageBase.php

Indentation +228 added lines, -228 removed lines

@@ -24,232 +24,232 @@
 
 abstract class InternalPageBase extends PageBase
 {
-    use NavigationMenuAccessControl;
-
-    /** @var ITypeAheadHelper */
-    private $typeAheadHelper;
-    private ISecurityManager $securityManager;
-    /** @var IBlacklistHelper */
-    private $blacklistHelper;
-
-    private IDomainAccessManager $domainAccessManager;
-
-    /**
-     * @return ITypeAheadHelper
-     */
-    public function getTypeAheadHelper()
-    {
-        return $this->typeAheadHelper;
-    }
-
-    /**
-     * @param ITypeAheadHelper $typeAheadHelper
-     */
-    public function setTypeAheadHelper(ITypeAheadHelper $typeAheadHelper)
-    {
-        $this->typeAheadHelper = $typeAheadHelper;
-    }
-
-    /**
-     * Runs the page code
-     *
-     * @throws Exception
-     * @category Security-Critical
-     */
-    final public function execute()
-    {
-        if ($this->getRouteName() === null) {
-            throw new Exception("Request is unrouted.");
-        }
-
-        if ($this->getSiteConfiguration() === null) {
-            throw new Exception("Page has no configuration!");
-        }
-
-        $this->setupPage();
-
-        $this->touchUserLastActive();
-
-        $currentUser = User::getCurrent($this->getDatabase());
-
-        // Hey, this is also a security barrier, in addition to the below. Separated out for readability.
-        if (!$this->isProtectedPage()) {
-            // This page is /not/ a protected page, as such we can just run it.
-            $this->runPage();
-
-            return;
-        }
-
-        // Security barrier.
-        //
-        // This code essentially doesn't care if the user is logged in or not, as the security manager hides all that
-        // away for us
-        $securityResult = $this->getSecurityManager()->allows(get_called_class(), $this->getRouteName(), $currentUser);
-        if ($securityResult === ISecurityManager::ALLOWED) {
-            // We're allowed to run the page, so let's run it.
-            $this->runPage();
-        }
-        else {
-            $this->handleAccessDenied($securityResult);
-
-            // Send the headers
-            $this->sendResponseHeaders();
-        }
-    }
-
-    /**
-     * Performs final tasks needed before rendering the page.
-     */
-    final public function finalisePage()
-    {
-        parent::finalisePage();
-
-        $database = $this->getDatabase();
-        $currentUser = User::getCurrent($database);
-
-        // Load in the badges for the navbar
-        $this->setUpNavBarBadges($currentUser, $database);
-
-        if ($this->barrierTest('viewSiteNotice', User::getCurrent($database), 'GlobalInfo')) {
-            $siteNotice = SiteNotice::get($this->getDatabase());
-            $siteNoticeHash = sha1($siteNotice);
-
-            if (WebRequest::testSiteNoticeCookieValue($siteNoticeHash)) {
-                $this->assign('siteNoticeState', 'd-none');
-            }
-            else {
-                $this->assign('siteNoticeState', 'd-block');
-            }
-
-            $this->assign('siteNoticeText', $siteNotice);
-            $this->assign('siteNoticeVersion', $siteNoticeHash);
-        }
-
-        if ($this->barrierTest('viewOnlineUsers', User::getCurrent($database), 'GlobalInfo')) {
-            $sql = 'SELECT * FROM user WHERE lastactive > DATE_SUB(CURRENT_TIMESTAMP(), INTERVAL 5 MINUTE);';
-            $statement = $database->query($sql);
-            $activeUsers = $statement->fetchAll(PDO::FETCH_CLASS, User::class);
-            $this->assign('onlineusers', $activeUsers);
-        }
-
-        $this->setupNavMenuAccess($currentUser);
-    }
-
-    /**
-     * Configures whether the page respects roles or not. You probably want this to return true.
-     *
-     * Set to false for public pages. You probably want this to return true.
-     *
-     * This defaults to true unless you explicitly set it to false. Setting it to false means anybody can do anything
-     * on this page, so you probably want this to return true.
-     *
-     * @return bool
-     * @category Security-Critical
-     */
-    protected function isProtectedPage()
-    {
-        return true;
-    }
-
-    protected function handleAccessDenied($denyReason)
-    {
-        $currentUser = User::getCurrent($this->getDatabase());
-
-        // Not allowed to access this resource.
-        // Firstly, let's check if we're even logged in.
-        if ($currentUser->isCommunityUser()) {
-            // Not logged in, redirect to login page
-            WebRequest::setPostLoginRedirect();
-            $this->redirect("login");
-
-            return;
-        }
-        else {
-            // Decide whether this was a rights failure, or an identification failure.
-
-            if ($denyReason === ISecurityManager::ERROR_NOT_IDENTIFIED) {
-                // Not identified
-                throw new NotIdentifiedException($this->getSecurityManager(), $this->getDomainAccessManager());
-            }
-            elseif ($denyReason === ISecurityManager::ERROR_DENIED) {
-                // Nope, plain old access denied
-                throw new AccessDeniedException($this->getSecurityManager(), $this->getDomainAccessManager());
-            }
-            else {
-                throw new Exception('Unknown response from security manager.');
-            }
-        }
-    }
-
-    /**
-     * Tests the security barrier for a specified action.
-     *
-     * Don't use within templates
-     *
-     * @param string      $action
-     *
-     * @param User        $user
-     * @param null|string $pageName
-     *
-     * @return bool
-     * @category Security-Critical
-     */
-    final public function barrierTest($action, User $user, $pageName = null)
-    {
-        $page = get_called_class();
-        if ($pageName !== null) {
-            $page = $pageName;
-        }
-
-        $securityResult = $this->getSecurityManager()->allows($page, $action, $user);
-
-        return $securityResult === ISecurityManager::ALLOWED;
-    }
-
-    /**
-     * Updates the lastactive timestamp
-     */
-    private function touchUserLastActive()
-    {
-        if (WebRequest::getSessionUserId() !== null) {
-            $query = 'UPDATE user SET lastactive = CURRENT_TIMESTAMP() WHERE id = :id;';
-            $this->getDatabase()->prepare($query)->execute(array(":id" => WebRequest::getSessionUserId()));
-        }
-    }
-
-    public function getSecurityManager(): ISecurityManager
-    {
-        return $this->securityManager;
-    }
-
-    public function setSecurityManager(ISecurityManager $securityManager)
-    {
-        $this->securityManager = $securityManager;
-    }
-
-    /**
-     * @return IBlacklistHelper
-     */
-    public function getBlacklistHelper()
-    {
-        return $this->blacklistHelper;
-    }
-
-    /**
-     * @param IBlacklistHelper $blacklistHelper
-     */
-    public function setBlacklistHelper(IBlacklistHelper $blacklistHelper)
-    {
-        $this->blacklistHelper = $blacklistHelper;
-    }
-
-    public function getDomainAccessManager(): IDomainAccessManager
-    {
-        return $this->domainAccessManager;
-    }
-
-    public function setDomainAccessManager(IDomainAccessManager $domainAccessManager): void
-    {
-        $this->domainAccessManager = $domainAccessManager;
-    }
+	use NavigationMenuAccessControl;
+
+	/** @var ITypeAheadHelper */
+	private $typeAheadHelper;
+	private ISecurityManager $securityManager;
+	/** @var IBlacklistHelper */
+	private $blacklistHelper;
+
+	private IDomainAccessManager $domainAccessManager;
+
+	/**
+	 * @return ITypeAheadHelper
+	 */
+	public function getTypeAheadHelper()
+	{
+		return $this->typeAheadHelper;
+	}
+
+	/**
+	 * @param ITypeAheadHelper $typeAheadHelper
+	 */
+	public function setTypeAheadHelper(ITypeAheadHelper $typeAheadHelper)
+	{
+		$this->typeAheadHelper = $typeAheadHelper;
+	}
+
+	/**
+	 * Runs the page code
+	 *
+	 * @throws Exception
+	 * @category Security-Critical
+	 */
+	final public function execute()
+	{
+		if ($this->getRouteName() === null) {
+			throw new Exception("Request is unrouted.");
+		}
+
+		if ($this->getSiteConfiguration() === null) {
+			throw new Exception("Page has no configuration!");
+		}
+
+		$this->setupPage();
+
+		$this->touchUserLastActive();
+
+		$currentUser = User::getCurrent($this->getDatabase());
+
+		// Hey, this is also a security barrier, in addition to the below. Separated out for readability.
+		if (!$this->isProtectedPage()) {
+			// This page is /not/ a protected page, as such we can just run it.
+			$this->runPage();
+
+			return;
+		}
+
+		// Security barrier.
+		//
+		// This code essentially doesn't care if the user is logged in or not, as the security manager hides all that
+		// away for us
+		$securityResult = $this->getSecurityManager()->allows(get_called_class(), $this->getRouteName(), $currentUser);
+		if ($securityResult === ISecurityManager::ALLOWED) {
+			// We're allowed to run the page, so let's run it.
+			$this->runPage();
+		}
+		else {
+			$this->handleAccessDenied($securityResult);
+
+			// Send the headers
+			$this->sendResponseHeaders();
+		}
+	}
+
+	/**
+	 * Performs final tasks needed before rendering the page.
+	 */
+	final public function finalisePage()
+	{
+		parent::finalisePage();
+
+		$database = $this->getDatabase();
+		$currentUser = User::getCurrent($database);
+
+		// Load in the badges for the navbar
+		$this->setUpNavBarBadges($currentUser, $database);
+
+		if ($this->barrierTest('viewSiteNotice', User::getCurrent($database), 'GlobalInfo')) {
+			$siteNotice = SiteNotice::get($this->getDatabase());
+			$siteNoticeHash = sha1($siteNotice);
+
+			if (WebRequest::testSiteNoticeCookieValue($siteNoticeHash)) {
+				$this->assign('siteNoticeState', 'd-none');
+			}
+			else {
+				$this->assign('siteNoticeState', 'd-block');
+			}
+
+			$this->assign('siteNoticeText', $siteNotice);
+			$this->assign('siteNoticeVersion', $siteNoticeHash);
+		}
+
+		if ($this->barrierTest('viewOnlineUsers', User::getCurrent($database), 'GlobalInfo')) {
+			$sql = 'SELECT * FROM user WHERE lastactive > DATE_SUB(CURRENT_TIMESTAMP(), INTERVAL 5 MINUTE);';
+			$statement = $database->query($sql);
+			$activeUsers = $statement->fetchAll(PDO::FETCH_CLASS, User::class);
+			$this->assign('onlineusers', $activeUsers);
+		}
+
+		$this->setupNavMenuAccess($currentUser);
+	}
+
+	/**
+	 * Configures whether the page respects roles or not. You probably want this to return true.
+	 *
+	 * Set to false for public pages. You probably want this to return true.
+	 *
+	 * This defaults to true unless you explicitly set it to false. Setting it to false means anybody can do anything
+	 * on this page, so you probably want this to return true.
+	 *
+	 * @return bool
+	 * @category Security-Critical
+	 */
+	protected function isProtectedPage()
+	{
+		return true;
+	}
+
+	protected function handleAccessDenied($denyReason)
+	{
+		$currentUser = User::getCurrent($this->getDatabase());
+
+		// Not allowed to access this resource.
+		// Firstly, let's check if we're even logged in.
+		if ($currentUser->isCommunityUser()) {
+			// Not logged in, redirect to login page
+			WebRequest::setPostLoginRedirect();
+			$this->redirect("login");
+
+			return;
+		}
+		else {
+			// Decide whether this was a rights failure, or an identification failure.
+
+			if ($denyReason === ISecurityManager::ERROR_NOT_IDENTIFIED) {
+				// Not identified
+				throw new NotIdentifiedException($this->getSecurityManager(), $this->getDomainAccessManager());
+			}
+			elseif ($denyReason === ISecurityManager::ERROR_DENIED) {
+				// Nope, plain old access denied
+				throw new AccessDeniedException($this->getSecurityManager(), $this->getDomainAccessManager());
+			}
+			else {
+				throw new Exception('Unknown response from security manager.');
+			}
+		}
+	}
+
+	/**
+	 * Tests the security barrier for a specified action.
+	 *
+	 * Don't use within templates
+	 *
+	 * @param string      $action
+	 *
+	 * @param User        $user
+	 * @param null|string $pageName
+	 *
+	 * @return bool
+	 * @category Security-Critical
+	 */
+	final public function barrierTest($action, User $user, $pageName = null)
+	{
+		$page = get_called_class();
+		if ($pageName !== null) {
+			$page = $pageName;
+		}
+
+		$securityResult = $this->getSecurityManager()->allows($page, $action, $user);
+
+		return $securityResult === ISecurityManager::ALLOWED;
+	}
+
+	/**
+	 * Updates the lastactive timestamp
+	 */
+	private function touchUserLastActive()
+	{
+		if (WebRequest::getSessionUserId() !== null) {
+			$query = 'UPDATE user SET lastactive = CURRENT_TIMESTAMP() WHERE id = :id;';
+			$this->getDatabase()->prepare($query)->execute(array(":id" => WebRequest::getSessionUserId()));
+		}
+	}
+
+	public function getSecurityManager(): ISecurityManager
+	{
+		return $this->securityManager;
+	}
+
+	public function setSecurityManager(ISecurityManager $securityManager)
+	{
+		$this->securityManager = $securityManager;
+	}
+
+	/**
+	 * @return IBlacklistHelper
+	 */
+	public function getBlacklistHelper()
+	{
+		return $this->blacklistHelper;
+	}
+
+	/**
+	 * @param IBlacklistHelper $blacklistHelper
+	 */
+	public function setBlacklistHelper(IBlacklistHelper $blacklistHelper)
+	{
+		$this->blacklistHelper = $blacklistHelper;
+	}
+
+	public function getDomainAccessManager(): IDomainAccessManager
+	{
+		return $this->domainAccessManager;
+	}
+
+	public function setDomainAccessManager(IDomainAccessManager $domainAccessManager): void
+	{
+		$this->domainAccessManager = $domainAccessManager;
+	}
 }

Braces +5 added lines, -10 removed lines

@@ -88,8 +88,7 @@ 
         if ($securityResult === ISecurityManager::ALLOWED) {
             // We're allowed to run the page, so let's run it.
             $this->runPage();
-        }
-        else {
+        } else {
             $this->handleAccessDenied($securityResult);
 
             // Send the headers
@@ -116,8 +115,7 @@ 
 
             if (WebRequest::testSiteNoticeCookieValue($siteNoticeHash)) {
                 $this->assign('siteNoticeState', 'd-none');
-            }
-            else {
+            } else {
                 $this->assign('siteNoticeState', 'd-block');
             }
 
@@ -163,19 +161,16 @@ 
             $this->redirect("login");
 
             return;
-        }
-        else {
+        } else {
             // Decide whether this was a rights failure, or an identification failure.
 
             if ($denyReason === ISecurityManager::ERROR_NOT_IDENTIFIED) {
                 // Not identified
                 throw new NotIdentifiedException($this->getSecurityManager(), $this->getDomainAccessManager());
-            }
-            elseif ($denyReason === ISecurityManager::ERROR_DENIED) {
+            } elseif ($denyReason === ISecurityManager::ERROR_DENIED) {
                 // Nope, plain old access denied
                 throw new AccessDeniedException($this->getSecurityManager(), $this->getDomainAccessManager());
-            }
-            else {
+            } else {
                 throw new Exception('Unknown response from security manager.');
             }
         }

includes/Tasks/TextApiPageBase.php

Indentation +16 added lines, -16 removed lines

@@ -13,23 +13,23 @@
 
 abstract class TextApiPageBase extends ApiPageBase implements IRoutedTask
 {
-    final protected function main()
-    {
-        if (headers_sent()) {
-            throw new ApiException('Headers have already been sent - this indicates a bug in the application!');
-        }
+	final protected function main()
+	{
+		if (headers_sent()) {
+			throw new ApiException('Headers have already been sent - this indicates a bug in the application!');
+		}
 
-        try {
-            $responseData = $this->runApiPage();
-        }
-        catch (ApiException $ex) {
-            $responseData = $ex->getMessage();
-        }
+		try {
+			$responseData = $this->runApiPage();
+		}
+		catch (ApiException $ex) {
+			$responseData = $ex->getMessage();
+		}
 
-        header('Content-Type: text/plain');
+		header('Content-Type: text/plain');
 
-        ob_end_clean();
-        print($responseData);
-        ob_start();
-    }
+		ob_end_clean();
+		print($responseData);
+		ob_start();
+	}
 }

includes/API/Actions/CountAction.php

Indentation +92 added lines, -92 removed lines

@@ -22,47 +22,47 @@ 
  */
 class CountAction extends XmlApiPageBase implements IXmlApiAction
 {
-    /**
-     * The target user
-     * @var User $user
-     */
-    private $user;
+	/**
+	 * The target user
+	 * @var User $user
+	 */
+	private $user;
 
-    public function executeApiAction(DOMElement $apiDocument)
-    {
-        $username = WebRequest::getString('user');
-        if ($username === null) {
-            throw new ApiException("Please specify a username");
-        }
+	public function executeApiAction(DOMElement $apiDocument)
+	{
+		$username = WebRequest::getString('user');
+		if ($username === null) {
+			throw new ApiException("Please specify a username");
+		}
 
-        $userElement = $this->document->createElement("user");
-        $userElement->setAttribute("name", $username);
-        $apiDocument->appendChild($userElement);
+		$userElement = $this->document->createElement("user");
+		$userElement->setAttribute("name", $username);
+		$apiDocument->appendChild($userElement);
 
-        $user = User::getByUsername($username, $this->getDatabase());
+		$user = User::getByUsername($username, $this->getDatabase());
 
-        if ($user === false) {
-            $userElement->setAttribute("missing", "true");
+		if ($user === false) {
+			$userElement->setAttribute("missing", "true");
 
-            return $apiDocument;
-        }
+			return $apiDocument;
+		}
 
-        $this->user = $user;
+		$this->user = $user;
 
-        $userElement->setAttribute("level", $this->user->getStatus());
-        $userElement->setAttribute("created", $this->getAccountsCreated());
+		$userElement->setAttribute("level", $this->user->getStatus());
+		$userElement->setAttribute("created", $this->getAccountsCreated());
 
-        $userElement->setAttribute("today", $this->getToday());
+		$userElement->setAttribute("today", $this->getToday());
 
-        // Let the IRC bot handle the result of this.
-        $this->fetchAdminData($userElement);
+		// Let the IRC bot handle the result of this.
+		$this->fetchAdminData($userElement);
 
-        return $apiDocument;
-    }
+		return $apiDocument;
+	}
 
-    private function getAccountsCreated()
-    {
-        $query = <<<QUERY
+	private function getAccountsCreated()
+	{
+		$query = <<<QUERY
         SELECT COUNT(*) AS count
         FROM log
             LEFT JOIN emailtemplate ON concat('Closed ', emailtemplate.id) = log.action
@@ -73,17 +73,17 @@ 
             AND user.username = :username;
 QUERY;
 
-        $statement = $this->getDatabase()->prepare($query);
-        $statement->execute(array(":username" => $this->user->getUsername(), ":created" => EmailTemplate::ACTION_CREATED));
-        $result = $statement->fetchColumn();
-        $statement->closeCursor();
+		$statement = $this->getDatabase()->prepare($query);
+		$statement->execute(array(":username" => $this->user->getUsername(), ":created" => EmailTemplate::ACTION_CREATED));
+		$result = $statement->fetchColumn();
+		$statement->closeCursor();
 
-        return $result;
-    }
+		return $result;
+	}
 
-    private function getToday()
-    {
-        $query = <<<QUERY
+	private function getToday()
+	{
+		$query = <<<QUERY
         SELECT
             COUNT(*) AS count
         FROM log
@@ -95,75 +95,75 @@ 
             AND user.username = :username;
 QUERY;
 
-        $statement = $this->getDatabase()->prepare($query);
-        $statement->bindValue(":username", $this->user->getUsername());
-        $statement->bindValue(":date", date('Y-m-d') . "%");
-        $statement->bindValue(":created", EmailTemplate::ACTION_CREATED);
-        $statement->execute();
-        $today = $statement->fetchColumn();
-        $statement->closeCursor();
+		$statement = $this->getDatabase()->prepare($query);
+		$statement->bindValue(":username", $this->user->getUsername());
+		$statement->bindValue(":date", date('Y-m-d') . "%");
+		$statement->bindValue(":created", EmailTemplate::ACTION_CREATED);
+		$statement->execute();
+		$today = $statement->fetchColumn();
+		$statement->closeCursor();
 
-        return $today;
-    }
+		return $today;
+	}
 
-    private function fetchAdminData(DOMElement $userElement)
-    {
-        $query = "SELECT COUNT(*) AS count FROM log WHERE log.user = :userid AND log.action = :action;";
+	private function fetchAdminData(DOMElement $userElement)
+	{
+		$query = "SELECT COUNT(*) AS count FROM log WHERE log.user = :userid AND log.action = :action;";
 
-        $statement = $this->getDatabase()->prepare($query);
-        $statement->bindValue(":userid", $this->user->getId());
+		$statement = $this->getDatabase()->prepare($query);
+		$statement->bindValue(":userid", $this->user->getId());
         
-        // Each entry is in the form [ database string, attribute name ]
-        // and it happens to be that the attribute is just the lower case form of the database value
-        $actions = [
-            ['Promoted', 'promoted'],
-            ['Approved', 'approved'],
-            ['Demoted', 'demoted'],
-            ['Renamed', 'renamed'],
-            ['Edited', 'edited'],
-            ['Prefchange', 'prefchange'],
-            ['DeactivatedUser', 'deactivateduser'],
-        ];
-        foreach ($actions as $action) {
-            $dbValue = $action[0];
-            $attributeName = $action[1];
+		// Each entry is in the form [ database string, attribute name ]
+		// and it happens to be that the attribute is just the lower case form of the database value
+		$actions = [
+			['Promoted', 'promoted'],
+			['Approved', 'approved'],
+			['Demoted', 'demoted'],
+			['Renamed', 'renamed'],
+			['Edited', 'edited'],
+			['Prefchange', 'prefchange'],
+			['DeactivatedUser', 'deactivateduser'],
+		];
+		foreach ($actions as $action) {
+			$dbValue = $action[0];
+			$attributeName = $action[1];
             
-            $statement->bindValue(":action", $dbValue);
-            $statement->execute();
-            $attributeValue = $statement->fetchColumn();
-            $userElement->setAttribute($attributeName, $attributeValue);
-            $statement->closeCursor();
-        }
-
-        // Combine all three actions affecting Welcome templates into one count.
-        $combinedquery = $this->getDatabase()->prepare(<<<SQL
+			$statement->bindValue(":action", $dbValue);
+			$statement->execute();
+			$attributeValue = $statement->fetchColumn();
+			$userElement->setAttribute($attributeName, $attributeValue);
+			$statement->closeCursor();
+		}
+
+		// Combine all three actions affecting Welcome templates into one count.
+		$combinedquery = $this->getDatabase()->prepare(<<<SQL
             SELECT
                 COUNT(*) AS count
             FROM log
             WHERE log.user = :userid
                 AND log.action IN ('CreatedTemplate', 'EditedTemplate', 'DeletedTemplate');
 SQL
-        );
+		);
 
-        $combinedquery->bindValue(":userid", $this->user->getId());
-        $combinedquery->execute();
-        $dtc = $combinedquery->fetchColumn();
-        $userElement->setAttribute("welctempchange", $dtc);
-        $combinedquery->closeCursor();
+		$combinedquery->bindValue(":userid", $this->user->getId());
+		$combinedquery->execute();
+		$dtc = $combinedquery->fetchColumn();
+		$userElement->setAttribute("welctempchange", $dtc);
+		$combinedquery->closeCursor();
 
-        // Combine both actions affecting Email templates into one count.
-        $combinedquery = $this->getDatabase()->prepare(<<<SQL
+		// Combine both actions affecting Email templates into one count.
+		$combinedquery = $this->getDatabase()->prepare(<<<SQL
             SELECT COUNT(*) AS count
             FROM log
             WHERE log.user = :userid
                 AND log.action IN ('CreatedEmail', 'EditedEmail');
 SQL
-        );
-
-        $combinedquery->bindValue(":userid", $this->user->getId());
-        $combinedquery->execute();
-        $cec = $combinedquery->fetchColumn();
-        $userElement->setAttribute("emailtempchange", $cec);
-        $combinedquery->closeCursor();
-    }
+		);
+
+		$combinedquery->bindValue(":userid", $this->user->getId());
+		$combinedquery->execute();
+		$cec = $combinedquery->fetchColumn();
+		$userElement->setAttribute("emailtempchange", $cec);
+		$combinedquery->closeCursor();
+	}
 }

includes/Security/SecurityManager.php

Indentation +165 added lines, -165 removed lines

@@ -16,169 +16,169 @@
 
 final class SecurityManager implements ISecurityManager
 {
-    private IIdentificationVerifier $identificationVerifier;
-    private RoleConfigurationBase $roleConfiguration;
-
-    private array $cache = [];
-    private IUserAccessLoader $userAccessLoader;
-
-    public function __construct(
-        IIdentificationVerifier $identificationVerifier,
-        RoleConfigurationBase $roleConfiguration,
-        IUserAccessLoader $userAccessLoader
-    ) {
-        $this->identificationVerifier = $identificationVerifier;
-        $this->roleConfiguration = $roleConfiguration;
-        $this->userAccessLoader = $userAccessLoader;
-    }
-
-    /**
-     * Tests if a user is allowed to perform an action.
-     *
-     * This method should form a hard, deterministic security barrier, and only return true if it is absolutely sure
-     * that a user should have access to something.
-     *
-     * @category Security-Critical
-     */
-    public function allows(string $page, string $route, User $user): int
-    {
-        $this->getCachedActiveRoles($user, $activeRoles, $inactiveRoles);
-
-        $availableRights = $this->roleConfiguration->getResultantRole($activeRoles);
-        $testResult = $this->findResult($availableRights, $page, $route);
-
-        if ($testResult !== null) {
-            // We got a firm result here, so just return it.
-            return $testResult;
-        }
-
-        // No firm result yet, so continue testing the inactive roles so we can give a better error.
-        $inactiveRights = $this->roleConfiguration->getResultantRole($inactiveRoles);
-        $testResult = $this->findResult($inactiveRights, $page, $route);
-
-        if ($testResult === self::ALLOWED) {
-            // The user is allowed to access this, but their role is inactive.
-            return self::ERROR_NOT_IDENTIFIED;
-        }
-
-        // Other options from the secondary test are denied and inconclusive, which at this point defaults to denied.
-        return self::ERROR_DENIED;
-    }
-
-    public function getActiveRoles(User $user, ?array &$activeRoles, ?array &$inactiveRoles)
-    {
-        // Default to the community user here, because the main user is logged out
-        $identified = false;
-        $userRoles = array('public');
-
-        // if we're not the community user, get our real rights.
-        if (!$user->isCommunityUser()) {
-            // Check the user's status - only active users are allowed the effects of roles
-
-            $userRoles[] = 'loggedIn';
-
-            if ($user->isActive()) {
-                // All active users get +user
-                $userRoles[] = 'user';
-
-                $loadedRoles = $this->userAccessLoader->loadRolesForUser($user);
-
-                // NOTE: public is still in this array.
-                $userRoles = array_merge($userRoles, $loadedRoles);
-
-                $identified = $this->userIsIdentified($user);
-            }
-        }
-
-        $activeRoles = array();
-        $inactiveRoles = array();
-
-        foreach ($userRoles as $v) {
-            if ($this->roleConfiguration->roleNeedsIdentification($v)) {
-                if ($identified) {
-                    $activeRoles[] = $v;
-                }
-                else {
-                    $inactiveRoles[] = $v;
-                }
-            }
-            else {
-                $activeRoles[] = $v;
-            }
-        }
-    }
-
-    public function getCachedActiveRoles(User $user, ?array &$activeRoles, ?array &$inactiveRoles): void
-    {
-        if (!array_key_exists($user->getId(), $this->cache)) {
-            $this->getActiveRoles($user, $retrievedActiveRoles, $retrievedInactiveRoles);
-            $this->cache[$user->getId()] = ['active' => $retrievedActiveRoles, 'inactive' => $retrievedInactiveRoles];
-        }
-
-        $activeRoles = $this->cache[$user->getId()]['active'];
-        $inactiveRoles = $this->cache[$user->getId()]['inactive'];
-    }
-
-    public function getAvailableRoles(): array
-    {
-        return $this->roleConfiguration->getAvailableRoles();
-    }
-
-    /**
-     * Tests a role for an ACL decision on a specific page/route
-     *
-     * @param array  $pseudoRole The role (flattened) to check
-     * @param string $page       The page class to check
-     * @param string $route      The page route to check
-     *
-     * @return int|null
-     */
-    private function findResult($pseudoRole, $page, $route)
-    {
-        if (isset($pseudoRole[$page])) {
-            // check for deny on catch-all route
-            if (isset($pseudoRole[$page][RoleConfigurationBase::ALL])) {
-                if ($pseudoRole[$page][RoleConfigurationBase::ALL] === RoleConfigurationBase::ACCESS_DENY) {
-                    return self::ERROR_DENIED;
-                }
-            }
-
-            // check normal route
-            if (isset($pseudoRole[$page][$route])) {
-                if ($pseudoRole[$page][$route] === RoleConfigurationBase::ACCESS_DENY) {
-                    return self::ERROR_DENIED;
-                }
-
-                if ($pseudoRole[$page][$route] === RoleConfigurationBase::ACCESS_ALLOW) {
-                    return self::ALLOWED;
-                }
-            }
-
-            // check for allowed on catch-all route
-            if (isset($pseudoRole[$page][RoleConfigurationBase::ALL])) {
-                if ($pseudoRole[$page][RoleConfigurationBase::ALL] === RoleConfigurationBase::ACCESS_ALLOW) {
-                    return self::ALLOWED;
-                }
-            }
-        }
-
-        // return indeterminate result
-        return null;
-    }
-
-    private function userIsIdentified(User $user): bool
-    {
-        if ($user->getForceIdentified() === false) {
-            // User forced to be unidentified in the database.
-            return false;
-        }
-
-        if ($user->getForceIdentified() === true) {
-            // User forced to be identified in the database.
-            return true;
-        }
-
-        // User not forced to any particular identified status; consult IdentificationVerifier
-        return $this->identificationVerifier->isUserIdentified($user->getOnWikiName());
-    }
+	private IIdentificationVerifier $identificationVerifier;
+	private RoleConfigurationBase $roleConfiguration;
+
+	private array $cache = [];
+	private IUserAccessLoader $userAccessLoader;
+
+	public function __construct(
+		IIdentificationVerifier $identificationVerifier,
+		RoleConfigurationBase $roleConfiguration,
+		IUserAccessLoader $userAccessLoader
+	) {
+		$this->identificationVerifier = $identificationVerifier;
+		$this->roleConfiguration = $roleConfiguration;
+		$this->userAccessLoader = $userAccessLoader;
+	}
+
+	/**
+	 * Tests if a user is allowed to perform an action.
+	 *
+	 * This method should form a hard, deterministic security barrier, and only return true if it is absolutely sure
+	 * that a user should have access to something.
+	 *
+	 * @category Security-Critical
+	 */
+	public function allows(string $page, string $route, User $user): int
+	{
+		$this->getCachedActiveRoles($user, $activeRoles, $inactiveRoles);
+
+		$availableRights = $this->roleConfiguration->getResultantRole($activeRoles);
+		$testResult = $this->findResult($availableRights, $page, $route);
+
+		if ($testResult !== null) {
+			// We got a firm result here, so just return it.
+			return $testResult;
+		}
+
+		// No firm result yet, so continue testing the inactive roles so we can give a better error.
+		$inactiveRights = $this->roleConfiguration->getResultantRole($inactiveRoles);
+		$testResult = $this->findResult($inactiveRights, $page, $route);
+
+		if ($testResult === self::ALLOWED) {
+			// The user is allowed to access this, but their role is inactive.
+			return self::ERROR_NOT_IDENTIFIED;
+		}
+
+		// Other options from the secondary test are denied and inconclusive, which at this point defaults to denied.
+		return self::ERROR_DENIED;
+	}
+
+	public function getActiveRoles(User $user, ?array &$activeRoles, ?array &$inactiveRoles)
+	{
+		// Default to the community user here, because the main user is logged out
+		$identified = false;
+		$userRoles = array('public');
+
+		// if we're not the community user, get our real rights.
+		if (!$user->isCommunityUser()) {
+			// Check the user's status - only active users are allowed the effects of roles
+
+			$userRoles[] = 'loggedIn';
+
+			if ($user->isActive()) {
+				// All active users get +user
+				$userRoles[] = 'user';
+
+				$loadedRoles = $this->userAccessLoader->loadRolesForUser($user);
+
+				// NOTE: public is still in this array.
+				$userRoles = array_merge($userRoles, $loadedRoles);
+
+				$identified = $this->userIsIdentified($user);
+			}
+		}
+
+		$activeRoles = array();
+		$inactiveRoles = array();
+
+		foreach ($userRoles as $v) {
+			if ($this->roleConfiguration->roleNeedsIdentification($v)) {
+				if ($identified) {
+					$activeRoles[] = $v;
+				}
+				else {
+					$inactiveRoles[] = $v;
+				}
+			}
+			else {
+				$activeRoles[] = $v;
+			}
+		}
+	}
+
+	public function getCachedActiveRoles(User $user, ?array &$activeRoles, ?array &$inactiveRoles): void
+	{
+		if (!array_key_exists($user->getId(), $this->cache)) {
+			$this->getActiveRoles($user, $retrievedActiveRoles, $retrievedInactiveRoles);
+			$this->cache[$user->getId()] = ['active' => $retrievedActiveRoles, 'inactive' => $retrievedInactiveRoles];
+		}
+
+		$activeRoles = $this->cache[$user->getId()]['active'];
+		$inactiveRoles = $this->cache[$user->getId()]['inactive'];
+	}
+
+	public function getAvailableRoles(): array
+	{
+		return $this->roleConfiguration->getAvailableRoles();
+	}
+
+	/**
+	 * Tests a role for an ACL decision on a specific page/route
+	 *
+	 * @param array  $pseudoRole The role (flattened) to check
+	 * @param string $page       The page class to check
+	 * @param string $route      The page route to check
+	 *
+	 * @return int|null
+	 */
+	private function findResult($pseudoRole, $page, $route)
+	{
+		if (isset($pseudoRole[$page])) {
+			// check for deny on catch-all route
+			if (isset($pseudoRole[$page][RoleConfigurationBase::ALL])) {
+				if ($pseudoRole[$page][RoleConfigurationBase::ALL] === RoleConfigurationBase::ACCESS_DENY) {
+					return self::ERROR_DENIED;
+				}
+			}
+
+			// check normal route
+			if (isset($pseudoRole[$page][$route])) {
+				if ($pseudoRole[$page][$route] === RoleConfigurationBase::ACCESS_DENY) {
+					return self::ERROR_DENIED;
+				}
+
+				if ($pseudoRole[$page][$route] === RoleConfigurationBase::ACCESS_ALLOW) {
+					return self::ALLOWED;
+				}
+			}
+
+			// check for allowed on catch-all route
+			if (isset($pseudoRole[$page][RoleConfigurationBase::ALL])) {
+				if ($pseudoRole[$page][RoleConfigurationBase::ALL] === RoleConfigurationBase::ACCESS_ALLOW) {
+					return self::ALLOWED;
+				}
+			}
+		}
+
+		// return indeterminate result
+		return null;
+	}
+
+	private function userIsIdentified(User $user): bool
+	{
+		if ($user->getForceIdentified() === false) {
+			// User forced to be unidentified in the database.
+			return false;
+		}
+
+		if ($user->getForceIdentified() === true) {
+			// User forced to be identified in the database.
+			return true;
+		}
+
+		// User not forced to any particular identified status; consult IdentificationVerifier
+		return $this->identificationVerifier->isUserIdentified($user->getOnWikiName());
+	}
 }

includes/Security/ISecurityManager.php

Indentation +21 added lines, -21 removed lines

@@ -12,29 +12,29 @@
 
 interface ISecurityManager
 {
-    public const ALLOWED = 1;
-    public const ERROR_NOT_IDENTIFIED = 2;
-    public const ERROR_DENIED = 3;
+	public const ALLOWED = 1;
+	public const ERROR_NOT_IDENTIFIED = 2;
+	public const ERROR_DENIED = 3;
 
-    /**
-     * Tests if a user is allowed to perform an action.
-     *
-     * This method should form a hard, deterministic security barrier, and only return true if it is absolutely sure
-     * that a user should have access to something.
-     *
-     * @param string $page
-     * @param string $route
-     * @param User   $user
-     *
-     * @return int
-     *
-     * @category Security-Critical
-     */
-    public function allows(string $page, string $route, User $user): int;
+	/**
+	 * Tests if a user is allowed to perform an action.
+	 *
+	 * This method should form a hard, deterministic security barrier, and only return true if it is absolutely sure
+	 * that a user should have access to something.
+	 *
+	 * @param string $page
+	 * @param string $route
+	 * @param User   $user
+	 *
+	 * @return int
+	 *
+	 * @category Security-Critical
+	 */
+	public function allows(string $page, string $route, User $user): int;
 
-    public function getActiveRoles(User $user, ?array &$activeRoles, ?array &$inactiveRoles);
+	public function getActiveRoles(User $user, ?array &$activeRoles, ?array &$inactiveRoles);
 
-    public function getCachedActiveRoles(User $user, ?array &$activeRoles, ?array &$inactiveRoles): void;
+	public function getCachedActiveRoles(User $user, ?array &$activeRoles, ?array &$inactiveRoles): void;
 
-    public function getAvailableRoles(): array;
+	public function getAvailableRoles(): array;
 }
\ No newline at end of file

includes/Security/UserAccessLoader.php

Indentation +21 added lines, -21 removed lines

@@ -15,37 +15,37 @@
 
 final class UserAccessLoader implements IUserAccessLoader
 {
-    public function loadRolesForUser(User $user): array
-    {
-        $domain = Domain::getCurrent($user->getDatabase());
-        $userRoles = UserRole::getForUser($user->getId(), $user->getDatabase(), $domain->getId());
+	public function loadRolesForUser(User $user): array
+	{
+		$domain = Domain::getCurrent($user->getDatabase());
+		$userRoles = UserRole::getForUser($user->getId(), $user->getDatabase(), $domain->getId());
 
-        return array_map(fn(UserRole $r): string => $r->getRole(), $userRoles);
-    }
+		return array_map(fn(UserRole $r): string => $r->getRole(), $userRoles);
+	}
 
-    public function loadDomainsForUser(User $user): array
-    {
-        $database = $user->getDatabase();
+	public function loadDomainsForUser(User $user): array
+	{
+		$database = $user->getDatabase();
 
-        $statement = $database->prepare(<<<'SQL'
+		$statement = $database->prepare(<<<'SQL'
             SELECT d.* 
             FROM domain d
             INNER JOIN userdomain ud on d.id = ud.domain
             WHERE ud.user = :user
             AND d.enabled = 1
 SQL
-        );
-        $statement->execute([
-            ':user' => $user->getId()
-        ]);
+		);
+		$statement->execute([
+			':user' => $user->getId()
+		]);
 
-        $resultObjects = $statement->fetchAll(PDO::FETCH_CLASS, Domain::class);
+		$resultObjects = $statement->fetchAll(PDO::FETCH_CLASS, Domain::class);
 
-        /** @var Domain $t */
-        foreach ($resultObjects as $t) {
-            $t->setDatabase($database);
-        }
+		/** @var Domain $t */
+		foreach ($resultObjects as $t) {
+			$t->setDatabase($database);
+		}
 
-        return $resultObjects;
-    }
+		return $resultObjects;
+	}
 }
\ No newline at end of file

includes/Security/IDomainAccessManager.php

Indentation +8 added lines, -8 removed lines

@@ -13,14 +13,14 @@
 
 interface IDomainAccessManager
 {
-    public function switchToDefaultDomain(User $user): void;
+	public function switchToDefaultDomain(User $user): void;
 
-    public function switchDomain(User $user, Domain $newDomain): void;
+	public function switchDomain(User $user, Domain $newDomain): void;
 
-    /**
-     * @param User $user
-     *
-     * @return Domain[]
-     */
-    public function getAllowedDomains(User $user): array;
+	/**
+	 * @param User $user
+	 *
+	 * @return Domain[]
+	 */
+	public function getAllowedDomains(User $user): array;
 }
\ No newline at end of file