From c3e2fe8274c92deccea5de661802d8cafbc97714 Mon Sep 17 00:00:00 2001
From: AntiCompositeNumber <anticompositenumber@gmail.com>
Date: Sun, 6 Mar 2022 17:03:05 -0500
Subject: [PATCH] SECURITY: Check for blocks before performing write actions

Adds missing block checks to Special:PageTranslation,
Special:ManageMessageGroups (untested), ApiAggregateGroups, and
ManageGroupSynchronizationCacheActionApi (untested).

Bug: T302479
Change-Id: I69a855750b25c75cf897cb0be26443d3987a3d85
---
 api/ApiAggregateGroups.php                    |  4 ++++
 .../PageTranslationSpecialPage.php            | 19 +++++++++++++++++++
 ...nageGroupSynchronizationCacheActionApi.php |  4 ++++
 .../ManageGroupsSpecialPage.php               | 11 +++++++++++
 4 files changed, 38 insertions(+)

diff --git a/api/ApiAggregateGroups.php b/api/ApiAggregateGroups.php
index a0730344f..84986536a 100644
--- a/api/ApiAggregateGroups.php
+++ b/api/ApiAggregateGroups.php
@@ -23,6 +23,10 @@ class ApiAggregateGroups extends ApiBase {
 
 	public function execute() {
 		$this->checkUserRightsAny( self::$right );
+		$block = $this->getUser()->getBlock();
+		if ( $block && $block->isSitewide() ) {
+			$this->dieBlocked( $block );
+		}
 
 		$params = $this->extractRequestParams();
 		$action = $params['do'];
diff --git a/src/PageTranslation/PageTranslationSpecialPage.php b/src/PageTranslation/PageTranslationSpecialPage.php
index ebcc5c2a5..468ec8b92 100644
--- a/src/PageTranslation/PageTranslationSpecialPage.php
+++ b/src/PageTranslation/PageTranslationSpecialPage.php
@@ -12,6 +12,7 @@ use MediaWiki\Extension\Translate\Utilities\LanguagesMultiselectWidget;
 use MediaWiki\Extension\TranslationNotifications\SpecialNotifyTranslators;
 use MediaWiki\Languages\LanguageFactory;
 use MediaWiki\Languages\LanguageNameUtils;
+use MediaWiki\MediaWikiServices;
 use MediaWiki\Revision\RevisionRecord;
 use MediaWiki\User\UserIdentity;
 use Message;
@@ -34,6 +35,7 @@ use TranslatablePage;
 use TranslateMetadata;
 use TranslateUtils;
 use TranslationsUpdateJob;
+use UserBlockedError;
 use WebRequest;
 use Wikimedia\Rdbms\IResultWrapper;
 use WikiPage;
@@ -133,6 +135,23 @@ class PageTranslationSpecialPage extends SpecialPage {
 			return;
 		}
 
+		// Check for blocks
+		$permissionManager = MediaWikiServices::getInstance()->getPermissionManager();
+		if ( $permissionManager->isBlockedFrom( $user, $title, !$request->wasPosted() ) ) {
+			$block = $user->getBlock();
+			if ( $block ) {
+				throw new UserBlockedError(
+					$block,
+					$user,
+					$this->getLanguage(),
+					$request->getIP()
+				);
+			}
+
+			throw new PermissionsError( 'pagetranslation', [ 'badaccess-group0' ] );
+
+		}
+
 		// Check token for all POST actions here
 		if ( $request->wasPosted() && !$user->matchEditToken( $request->getText( 'token' ) ) ) {
 			throw new PermissionsError( 'pagetranslation' );
diff --git a/src/Synchronization/ManageGroupSynchronizationCacheActionApi.php b/src/Synchronization/ManageGroupSynchronizationCacheActionApi.php
index 43d1bb0f5..e263dffcd 100644
--- a/src/Synchronization/ManageGroupSynchronizationCacheActionApi.php
+++ b/src/Synchronization/ManageGroupSynchronizationCacheActionApi.php
@@ -35,6 +35,10 @@ class ManageGroupSynchronizationCacheActionApi extends ApiBase {
 
 	public function execute() {
 		$this->checkUserRightsAny( self::RIGHT );
+		$block = $this->getUser()->getBlock();
+		if ( $block && $block->isSitewide() ) {
+			$this->dieBlocked( $block );
+		}
 
 		$params = $this->extractRequestParams();
 		$operation = $params['operation'];
diff --git a/src/Synchronization/ManageGroupsSpecialPage.php b/src/Synchronization/ManageGroupsSpecialPage.php
index f494cb353..b22b884d8 100644
--- a/src/Synchronization/ManageGroupsSpecialPage.php
+++ b/src/Synchronization/ManageGroupsSpecialPage.php
@@ -32,6 +32,7 @@ use SpecialPage;
 use TextContent;
 use Title;
 use TranslateUtils;
+use UserBlockedError;
 use WebRequest;
 use Xml;
 
@@ -139,6 +140,16 @@ class ManageGroupsSpecialPage extends SpecialPage {
 			return;
 		}
 
+		$block = $user->getBlock();
+		if ( $block && $block->isSitewide() ) {
+			throw new UserBlockedError(
+				$block,
+				$user,
+				$this->getLanguage(),
+				$req->getIP()
+			);
+		}
+
 		$token = $req->getVal( 'token' );
 		if ( !$this->hasRight || !$user->matchEditToken( $token ) ) {
 			throw new PermissionsError( self::RIGHT );
-- 
2.36.1