+global\SpecialBlock::processForm()

Complexity

Conditions	38
Paths	7940

Size

Total Lines	214
Code Lines	111

Duplication

Lines	0
Ratio	0 %

Importance

Changes

0

<?php
	public static function processForm( array $data, IContextSource $context ) {
		global $wgBlockAllowsUTEdit, $wgHideUserContribLimit, $wgContLang;

		$performer = $context->getUser();

		// Handled by field validator callback
		// self::validateTargetField( $data['Target'] );

		# This might have been a hidden field or a checkbox, so interesting data
		# can come from it
		$data['Confirm'] = !in_array( $data['Confirm'], [ '', '0', null, false ], true );

		/** @var User $target */
		list( $target, $type ) = self::getTargetAndType( $data['Target'] );
		if ( $type == Block::TYPE_USER ) {
			$user = $target;
			$target = $user->getName();
			$userId = $user->getId();

			# Give admins a heads-up before they go and block themselves.  Much messier
			# to do this for IPs, but it's pretty unlikely they'd ever get the 'block'
			# permission anyway, although the code does allow for it.
			# Note: Important to use $target instead of $data['Target']
			# since both $data['PreviousTarget'] and $target are normalized
			# but $data['target'] gets overridden by (non-normalized) request variable
			# from previous request.
			if ( $target === $performer->getName() &&
				( $data['PreviousTarget'] !== $target || !$data['Confirm'] )
			) {
				return [ 'ipb-blockingself', 'ipb-confirmaction' ];
			}
		} elseif ( $type == Block::TYPE_RANGE ) {
			$userId = 0;
		} elseif ( $type == Block::TYPE_IP ) {
			$target = $target->getName();
			$userId = 0;
		} else {
			# This should have been caught in the form field validation
			return [ 'badipaddress' ];
		}

		$expiryTime = self::parseExpiryInput( $data['Expiry'] );

		if (
			// an expiry time is needed
			( strlen( $data['Expiry'] ) == 0 ) ||
			// can't be a larger string as 50 (it should be a time format in any way)
			( strlen( $data['Expiry'] ) > 50 ) ||
			// check, if the time could be parsed
			!$expiryTime

The expression $expiryTime of type false|string is loosely compared to false; this is ambiguous if the string can be empty. You might want to explicitly use === false instead.

		) {
			return [ 'ipb_expiry_invalid' ];
		}

		// an expiry time should be in the future, not in the
		// past (wouldn't make any sense) - bug T123069
		if ( $expiryTime < wfTimestampNow() ) {
			return [ 'ipb_expiry_old' ];
		}

		if ( !isset( $data['DisableEmail'] ) ) {
			$data['DisableEmail'] = false;
		}

		# If the user has done the form 'properly', they won't even have been given the
		# option to suppress-block unless they have the 'hideuser' permission
		if ( !isset( $data['HideUser'] ) ) {
			$data['HideUser'] = false;
		}

		if ( $data['HideUser'] ) {
			if ( !$performer->isAllowed( 'hideuser' ) ) {
				# this codepath is unreachable except by a malicious user spoofing forms,
				# or by race conditions (user has hideuser and block rights, loads block form,
				# and loses hideuser rights before submission); so need to fail completely
				# rather than just silently disable hiding
				return [ 'badaccess-group0' ];
			}

			# Recheck params here...
			if ( $type != Block::TYPE_USER ) {
				$data['HideUser'] = false; # IP users should not be hidden
			} elseif ( !wfIsInfinity( $data['Expiry'] ) ) {
				# Bad expiry.
				return [ 'ipb_expiry_temp' ];
			} elseif ( $wgHideUserContribLimit !== false
				&& $user->getEditCount() > $wgHideUserContribLimit

The variable $user does not seem to be defined for all execution paths leading up to this point.

			) {
				# Typically, the user should have a handful of edits.
				# Disallow hiding users with many edits for performance.
				return [ [ 'ipb_hide_invalid',
					Message::numParam( $wgHideUserContribLimit ) ] ];
			} elseif ( !$data['Confirm'] ) {
				return [ 'ipb-confirmhideuser', 'ipb-confirmaction' ];
			}
		}

		# Create block object.
		$block = new Block();
		$block->setTarget( $target );
		$block->setBlocker( $performer );
		# Truncate reason for whole multibyte characters
		$block->mReason = $wgContLang->truncate( $data['Reason'][0], 255 );
		$block->mExpiry = $expiryTime;
		$block->prevents( 'createaccount', $data['CreateAccount'] );
		$block->prevents( 'editownusertalk', ( !$wgBlockAllowsUTEdit || $data['DisableUTEdit'] ) );
		$block->prevents( 'sendemail', $data['DisableEmail'] );
		$block->isHardblock( $data['HardBlock'] );
		$block->isAutoblocking( $data['AutoBlock'] );
		$block->mHideName = $data['HideUser'];

		$reason = [ 'hookaborted' ];
		if ( !Hooks::run( 'BlockIp', [ &$block, &$performer, &$reason ] ) ) {
			return $reason;
		}

		# Try to insert block. Is there a conflicting block?
		$status = $block->insert();
		if ( !$status ) {
			# Indicates whether the user is confirming the block and is aware of
			# the conflict (did not change the block target in the meantime)
			$blockNotConfirmed = !$data['Confirm'] || ( array_key_exists( 'PreviousTarget', $data )
				&& $data['PreviousTarget'] !== $target );

			# Special case for API - bug 32434
			$reblockNotAllowed = ( array_key_exists( 'Reblock', $data ) && !$data['Reblock'] );

			# Show form unless the user is already aware of this...
			if ( $blockNotConfirmed || $reblockNotAllowed ) {
				return [ [ 'ipb_already_blocked', $block->getTarget() ] ];
				# Otherwise, try to update the block...
			} else {
				# This returns direct blocks before autoblocks/rangeblocks, since we should
				# be sure the user is blocked by now it should work for our purposes
				$currentBlock = Block::newFromTarget( $target );

It seems like $target can also be of type null; however, Block::newFromTarget() does only seem to accept string|object<User>|integer, maybe add an additional type check?

				if ( $block->equals( $currentBlock ) ) {

It seems like $currentBlock defined by \Block::newFromTarget($target) on line 750 can be null; however, Block::equals() does not accept null, maybe add an additional type check?

					return [ [ 'ipb_already_blocked', $block->getTarget() ] ];
				}

				# If the name was hidden and the blocking user cannot hide
				# names, then don't allow any block changes...
				if ( $currentBlock->mHideName && !$performer->isAllowed( 'hideuser' ) ) {
					return [ 'cant-see-hidden-user' ];
				}

				$currentBlock->isHardblock( $block->isHardblock() );
				$currentBlock->prevents( 'createaccount', $block->prevents( 'createaccount' ) );
				$currentBlock->mExpiry = $block->mExpiry;
				$currentBlock->isAutoblocking( $block->isAutoblocking() );
				$currentBlock->mHideName = $block->mHideName;
				$currentBlock->prevents( 'sendemail', $block->prevents( 'sendemail' ) );
				$currentBlock->prevents( 'editownusertalk', $block->prevents( 'editownusertalk' ) );
				$currentBlock->mReason = $block->mReason;

				$status = $currentBlock->update();

				$logaction = 'reblock';

				# Unset _deleted fields if requested
				if ( $currentBlock->mHideName && !$data['HideUser'] ) {
					RevisionDeleteUser::unsuppressUserName( $target, $userId );
				}

				# If hiding/unhiding a name, this should go in the private logs
				if ( (bool)$currentBlock->mHideName ) {
					$data['HideUser'] = true;
				}
			}
		} else {
			$logaction = 'block';
		}

		Hooks::run( 'BlockIpComplete', [ $block, $performer ] );

		# Set *_deleted fields if requested
		if ( $data['HideUser'] ) {
			RevisionDeleteUser::suppressUserName( $target, $userId );
		}

		# Can't watch a rangeblock
		if ( $type != Block::TYPE_RANGE && $data['Watch'] ) {
			WatchAction::doWatch(
				Title::makeTitle( NS_USER, $target ),

It seems like $target can also be of type null or object<User>; however, Title::makeTitle() does only seem to accept string, maybe add an additional type check?

				$performer,
				User::IGNORE_USER_RIGHTS
			);
		}

		# Block constructor sanitizes certain block options on insert
		$data['BlockEmail'] = $block->prevents( 'sendemail' );
		$data['AutoBlock'] = $block->isAutoblocking();

		# Prepare log parameters
		$logParams = [];
		$logParams['5::duration'] = $data['Expiry'];
		$logParams['6::flags'] = self::blockLogFlags( $data, $type );

		# Make log entry, if the name is hidden, put it in the suppression log
		$log_type = $data['HideUser'] ? 'suppress' : 'block';
		$logEntry = new ManualLogEntry( $log_type, $logaction );
		$logEntry->setTarget( Title::makeTitle( NS_USER, $target ) );

It seems like $target can also be of type null or object<User>; however, Title::makeTitle() does only seem to accept string, maybe add an additional type check?

		$logEntry->setComment( $data['Reason'][0] );
		$logEntry->setPerformer( $performer );
		$logEntry->setParameters( $logParams );
		# Relate log ID to block IDs (bug 25763)
		$blockIds = array_merge( [ $status['id'] ], $status['autoIds'] );
		$logEntry->setRelations( [ 'ipb_id' => $blockIds ] );
		$logId = $logEntry->insert();
		$logEntry->publish( $logId );

		# Report to the user
		return true;
	}