r61694 MediaWiki - Code Review archive

Repository:MediaWiki
Revision:r61693‎ | r61694 | r61695 >
Date:23:29, 29 January 2010
Author:demon
Status:ok (Comments)
Tags:
Comment:
Add new global $wgBlockDisablesLogin to prevent logging in by blocked users, obsoletes new Lockout extension
Modified paths:
  • /trunk/phase3/RELEASE-NOTES (modified) (history)
  • /trunk/phase3/includes/DefaultSettings.php (modified) (history)
  • /trunk/phase3/includes/specials/SpecialUserlogin.php (modified) (history)

Diff [purge]

Index: trunk/phase3/includes/DefaultSettings.php
@@ -1343,6 +1343,7 @@
13441344 'IPv4' => 16, # Blocks larger than a /16 (64k addresses) will not be allowed
13451345 'IPv6' => 64, # 2^64 = ~1.8x10^19 addresses
13461346 );
 1347+$wgBlockDisablesLogin = false; # If true, blocked users will not be allowed to login
13471348
13481349 # Pages anonymous user may see as an array, e.g.:
13491350 # array ( "Main Page", "Wikipedia:Help");
Index: trunk/phase3/includes/specials/SpecialUserlogin.php
@@ -417,6 +417,12 @@
418418 return self::THROTTLED;
419419 }
420420 }
 421+ // If we've enabled it, make it so that a blocked user cannot login
 422+ global $wgBlockDisablesLogin;
 423+ $u = User::newFromName( $this->mName );
 424+ if( $wgBlockDisablesLogin && !is_null( $u ) && $u->isBlocked() ) {
 425+ return self::USER_BLOCKED;
 426+ }
421427
422428 // Load $wgUser now, and check to see if we're logging in as the same
423429 // name. This is necessary because loading $wgUser (say by calling
@@ -433,7 +439,6 @@
434440
435441 # TODO: Allow some magic here for invalid external names, e.g., let the
436442 # user choose a different wiki name.
437 - $u = User::newFromName( $this->mName );
438443 if( is_null( $u ) || !User::isUsableName( $u->getName() ) ) {
439444 return self::ILLEGAL;
440445 }
Index: trunk/phase3/RELEASE-NOTES
@@ -98,6 +98,8 @@
9999 memcached servers.
100100 * New configuration variables $wgDebugTimestamps and $wgDebugPrintHttpHeaders
101101 for controlling debug output.
 102+* New $wgBlockDisablesLogin when set to true disallows blocked users from
 103+ logging in.
102104
103105 === New features in 1.16 ===
104106

Follow-up revisions

RevisionCommit summaryAuthorDate
r61704Followup r61694, expand comment based on [[Extension:Lockout]] and also deny ...demon01:28, 30 January 2010
r61788Cleanup r61694, move blocked check to after password check, global auth check...demon14:51, 1 February 2010

Comments

#Comment by Platonides (talk | contribs)   00:52, 30 January 2010

The note from Extension:Lockout should be added to DefaultSettings

#Comment by Duesentrieb (talk | contribs)   13:08, 30 January 2010

This only implements half the functionality of Extension:Lockout: it prevents login of blocked users, but it doesn't terminate the current session. I.e. a blocked user will remain logged in until their session expires.

#Comment by Duesentrieb (talk | contribs)   13:11, 30 January 2010

setting to "fixme" as per the above (i hope this conforms to the local customs)

#Comment by 😂 (talk | contribs)   14:29, 30 January 2010

See r61704, I already addressed both these issues.

#Comment by Duesentrieb (talk | contribs)   14:39, 30 January 2010

ah, ok, thanks :)

Status & tagging log