From be01dc451d4cd6513525bd9796b6c52c52b98ff7 Mon Sep 17 00:00:00 2001
From: Thiemo Kreuz <thiemo.kreuz@wikimedia.de>
Date: Tue, 15 Sep 2020 13:48:23 +0200
Subject: [PATCH] Block page titles which are marked as fully protected on the
 target wiki

Bug: T262628
Change-Id: Ib852a96afc4dca10516d0510e69c10f9892b351b
---
 src/Services/ImportPlanValidator.php | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git src/Services/ImportPlanValidator.php src/Services/ImportPlanValidator.php
index 8e45adc..51ae1ed 100644
--- src/Services/ImportPlanValidator.php
+++ src/Services/ImportPlanValidator.php
@@ -200,8 +200,19 @@ class ImportPlanValidator {
 	}
 
 	private function runPermissionTitleChecks( ImportPlan $importPlan, User $user ) {
-		$permErrors = MediaWikiServices::getInstance()->getPermissionManager()
-			->getPermissionErrors( 'upload', $user, $importPlan->getTitle() );
+		$title = $importPlan->getTitle();
+		$permissionManager = MediaWikiServices::getInstance()->getPermissionManager();
+
+		/**
+		 * We must check "create" as a fallback when "upload" is not recorded in the
+		 * page_restrictions table ({@see WikiPage::doUpdateRestrictions} skips "upload" for
+		 * non-existing pages). Checking "upload" after "create" was fine is probably pointless, but
+		 * {@see UploadBase::verifyTitlePermissions} does the same.
+		 */
+		$permErrors = $permissionManager->getPermissionErrors( 'create', $user, $title );
+		if ( !$permErrors ) {
+			$permErrors = $permissionManager->getPermissionErrors( 'upload', $user, $title );
+		}
 
 		if ( $permErrors !== [] ) {
 			throw new RecoverableTitleException( $permErrors[0], $importPlan );
-- 
2.17.1