From afab4c1c2b29891d7951d812993702d11a7aaf42 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gerg=C5=91=20Tisza?= <gtisza@wikimedia.org>
Date: Tue, 2 Jun 2015 21:36:50 +0000
Subject: [PATCH] [SECURITY] Launch a separate user suppression job for each
 wiki

Needed to handle cache invalidations.

Requires Ia8deed7bde36d5905771a2f1cedbf96238e48d26.

Bug: T90300
Change-Id: I6a48d267debd9f8dfbd78879496af14316e024d1
---
 CentralAuth.php              |  6 ------
 includes/CentralAuthUser.php | 40 +++++++++++++++++-----------------------
 includes/SuppressUserJob.php | 16 ++++++++++++----
 3 files changed, 29 insertions(+), 33 deletions(-)

diff --git a/CentralAuth.php b/CentralAuth.php
index da05b50..8eff5fc 100644
--- a/CentralAuth.php
+++ b/CentralAuth.php
@@ -213,12 +213,6 @@ $wgCentralAuthLockedCanEdit = array();
 $wgDisableUnmergedEditing = false;
 
 /**
- * Size of wikis handled in one suppress user job.
- * Keep in mind that one wiki requires ~10 queries.
- */
-$wgCentralAuthWikisPerSuppressJob = 10;
-
-/**
  * Like $wgReadOnly, used to set extension to database read only mode
  * @var bool
  */
diff --git a/includes/CentralAuthUser.php b/includes/CentralAuthUser.php
index d9e3f3f..3a2fba5 100644
--- a/includes/CentralAuthUser.php
+++ b/includes/CentralAuthUser.php
@@ -1482,35 +1482,29 @@ class CentralAuthUser extends AuthPluginUser {
 	}
 
 	/**
+	 * Creates a job for each attached wiki to call doLocalSuppression.
+	 *
 	 * @param $suppress Bool
 	 * @param $by String
 	 * @param $reason String
 	 */
 	protected function doCrosswikiSuppression( $suppress, $by, $reason ) {
-		global $wgCentralAuthWikisPerSuppressJob;
 		$this->loadAttached();
-		if ( count( $this->mAttachedArray ) <= $wgCentralAuthWikisPerSuppressJob ) {
-			foreach ( $this->mAttachedArray as $wiki ) {
-				$this->doLocalSuppression( $suppress, $wiki, $by, $reason );
-			}
-		} else {
-			$jobParams = array(
-				'username' => $this->getName(),
-				'suppress' => $suppress,
-				'by' => $by,
-				'reason' => $reason,
-			);
-			$jobs = array();
-			$chunks = array_chunk( $this->mAttachedArray, $wgCentralAuthWikisPerSuppressJob );
-			foreach ( $chunks as $wikis ) {
-				$jobParams['wikis'] = $wikis;
-				$jobs[] = Job::factory(
-					'crosswikiSuppressUser',
-					Title::makeTitleSafe( NS_USER, $this->getName() ),
-					$jobParams );
-			}
-			JobQueueGroup::singleton()->push( $jobs );
-		}
+		$jobParams = array(
+			'username' => $this->getName(),
+			'suppress' => $suppress,
+			'by' => $by,
+			'reason' => $reason,
+		);
+		$jobs = array();
+		foreach ( $this->mAttachedArray as $wiki ) {
+			$jobParams['wiki'] = $wiki;
+			$jobs[] = Job::factory(
+				'crosswikiSuppressUser',
+				Title::makeTitleSafe( NS_USER, $this->getName() ),
+				$jobParams );
+		}
+		JobQueueGroup::singleton( $wiki )->push( $jobs );
 	}
 
 	/**
diff --git a/includes/SuppressUserJob.php b/includes/SuppressUserJob.php
index 3559dea..e7234d1 100644
--- a/includes/SuppressUserJob.php
+++ b/includes/SuppressUserJob.php
@@ -1,9 +1,8 @@
 <?php
 
 /**
- * A job to do crosswiki suppression in batches, rather than
- * in one request. Size of batch is changed by changing
- * $wgCentralAuthWikisPerSuppressJob.
+ * A job to do crosswiki suppression. One job will be fired on each wiki where the user has an
+ * attached account.
  */
 class CentralAuthSuppressUserJob extends Job {
 	/**
@@ -24,7 +23,13 @@ class CentralAuthSuppressUserJob extends Job {
 	public function run() {
 		$username = $this->params['username'];
 		$by = $this->params['by'];
-		$wikis = $this->params['wikis'];
+		// FIXME temporary code to handle version mismatch due to heterogenous deploy
+		$local = isset( $this->params['wiki'] ); // job is running locally
+		if ( $local ) {
+			$wikis = array( $this->params['wiki'] );
+		} else {
+			$wikis = $this->params['wikis'];
+		}
 		$suppress = $this->params['suppress'];
 		$reason = $this->params['reason'];
 		$user = new CentralAuthUser( $username );
@@ -34,6 +39,9 @@ class CentralAuthSuppressUserJob extends Job {
 
 		foreach ( $wikis as $wiki ) {
 			$user->doLocalSuppression( $suppress, $wiki, $by, $reason );
+			if ( $local ) {
+				RevisionDeleteUser::invalidateCache( $username );
+			}
 			wfDebugLog( 'suppressjob', ( $suppress ? 'S' : 'Uns' ) . "uppressed {$username} at {$wiki} by {$by} via job queue." );
 		}
 		return true;
-- 
1.9.1