From b4e826e87661ed57202fcb0ac8fe34f42191eb62 Mon Sep 17 00:00:00 2001
From: Abijeet <abijeetpatro@gmail.com>
Date: Mon, 6 Jun 2022 17:34:29 +0530
Subject: [PATCH] SECURITY: Check for blocks before performing write actions

Adds missing block checks to Special:PageTranslation,
Special:ManageMessageGroups, ApiAggregateGroups, when translating a page
and ManageGroupSynchronizationCacheActionApi.

Bug: T302479
Change-Id: Ic2060215ba629acb90dc7ddc5d0bb016933198b9
---
 api/ApiAggregateGroups.php                    |  4 ++++
 .../PageTranslationSpecialPage.php            | 19 +++++++++++++++++++
 ...nageGroupSynchronizationCacheActionApi.php |  4 ++++
 .../ManageGroupsSpecialPage.php               | 11 +++++++++++
 tag/PageTranslationHooks.php                  | 13 +++++++++++++
 5 files changed, 51 insertions(+)

diff --git a/api/ApiAggregateGroups.php b/api/ApiAggregateGroups.php
index a0730344f..84986536a 100644
--- a/api/ApiAggregateGroups.php
+++ b/api/ApiAggregateGroups.php
@@ -23,6 +23,10 @@ class ApiAggregateGroups extends ApiBase {
 
 	public function execute() {
 		$this->checkUserRightsAny( self::$right );
+		$block = $this->getUser()->getBlock();
+		if ( $block && $block->isSitewide() ) {
+			$this->dieBlocked( $block );
+		}
 
 		$params = $this->extractRequestParams();
 		$action = $params['do'];
diff --git a/src/PageTranslation/PageTranslationSpecialPage.php b/src/PageTranslation/PageTranslationSpecialPage.php
index 637beb059..beae78286 100644
--- a/src/PageTranslation/PageTranslationSpecialPage.php
+++ b/src/PageTranslation/PageTranslationSpecialPage.php
@@ -13,6 +13,7 @@ use MediaWiki\Extension\Translate\Utilities\LanguagesMultiselectWidget;
 use MediaWiki\Extension\TranslationNotifications\SpecialNotifyTranslators;
 use MediaWiki\Languages\LanguageFactory;
 use MediaWiki\Languages\LanguageNameUtils;
+use MediaWiki\MediaWikiServices;
 use MediaWiki\Revision\RevisionRecord;
 use MediaWiki\User\UserIdentity;
 use Message;
@@ -34,6 +35,7 @@ use TranslatablePage;
 use TranslateMetadata;
 use TranslateUtils;
 use TranslationsUpdateJob;
+use UserBlockedError;
 use WebRequest;
 use Wikimedia\Rdbms\IResultWrapper;
 use WikiPage;
@@ -133,6 +135,23 @@ class PageTranslationSpecialPage extends SpecialPage {
 			return;
 		}
 
+		// Check for blocks
+		$permissionManager = MediaWikiServices::getInstance()->getPermissionManager();
+		if ( $permissionManager->isBlockedFrom( $user, $title, !$request->wasPosted() ) ) {
+			$block = $user->getBlock();
+			if ( $block ) {
+				throw new UserBlockedError(
+					$block,
+					$user,
+					$this->getLanguage(),
+					$request->getIP()
+				);
+			}
+
+			throw new PermissionsError( 'pagetranslation', [ 'badaccess-group0' ] );
+
+		}
+
 		// Check token for all POST actions here
 		if ( $request->wasPosted() && !$user->matchEditToken( $request->getText( 'token' ) ) ) {
 			throw new PermissionsError( 'pagetranslation' );
diff --git a/src/Synchronization/ManageGroupSynchronizationCacheActionApi.php b/src/Synchronization/ManageGroupSynchronizationCacheActionApi.php
index 43d1bb0f5..e263dffcd 100644
--- a/src/Synchronization/ManageGroupSynchronizationCacheActionApi.php
+++ b/src/Synchronization/ManageGroupSynchronizationCacheActionApi.php
@@ -35,6 +35,10 @@ class ManageGroupSynchronizationCacheActionApi extends ApiBase {
 
 	public function execute() {
 		$this->checkUserRightsAny( self::RIGHT );
+		$block = $this->getUser()->getBlock();
+		if ( $block && $block->isSitewide() ) {
+			$this->dieBlocked( $block );
+		}
 
 		$params = $this->extractRequestParams();
 		$operation = $params['operation'];
diff --git a/src/Synchronization/ManageGroupsSpecialPage.php b/src/Synchronization/ManageGroupsSpecialPage.php
index f494cb353..b22b884d8 100644
--- a/src/Synchronization/ManageGroupsSpecialPage.php
+++ b/src/Synchronization/ManageGroupsSpecialPage.php
@@ -32,6 +32,7 @@ use SpecialPage;
 use TextContent;
 use Title;
 use TranslateUtils;
+use UserBlockedError;
 use WebRequest;
 use Xml;
 
@@ -139,6 +140,16 @@ class ManageGroupsSpecialPage extends SpecialPage {
 			return;
 		}
 
+		$block = $user->getBlock();
+		if ( $block && $block->isSitewide() ) {
+			throw new UserBlockedError(
+				$block,
+				$user,
+				$this->getLanguage(),
+				$req->getIP()
+			);
+		}
+
 		$token = $req->getVal( 'token' );
 		if ( !$this->hasRight || !$user->matchEditToken( $token ) ) {
 			throw new PermissionsError( self::RIGHT );
diff --git a/tag/PageTranslationHooks.php b/tag/PageTranslationHooks.php
index d637f9ea5..31a4a469c 100644
--- a/tag/PageTranslationHooks.php
+++ b/tag/PageTranslationHooks.php
@@ -914,6 +914,19 @@ class PageTranslationHooks {
 	) {
 		$handle = new MessageHandle( $title );
 
+		$permissionManager = MediaWikiServices::getInstance()->getPermissionManager();
+		$group = $handle->getGroup();
+		if ( $group instanceof WikiPageMessageGroup ) {
+			if ( $permissionManager->isBlockedFrom( $user, $group->getTitle() ) ) {
+				$block = $user->getBlock();
+				if ( $block ) {
+					$error = new UserBlockedError( $block, $user );
+					$result = $error->getMessageObject()->parse();
+					return false;
+				}
+			}
+		}
+
 		// Check only when someone tries to create translation units.
 		// Allow editing units that become orphaned in regular use, so that
 		// people can delete them or fix links or other issues in them.
-- 
2.36.1