From d2cfd25e0ff076db177d9c35ecd34bb4d18cd256 Mon Sep 17 00:00:00 2001
From: AntiCompositeNumber <anticompositenumber@gmail.com>
Date: Sun, 6 Mar 2022 17:03:05 -0500
Subject: [PATCH] SECURITY: Check for blocks before performing write actions

Adds missing block checks to Special:PageTranslation,
Special:ManageMessageGroups (untested), and ApiAggregateGroups.

Bug: T302479
Change-Id: I69a855750b25c75cf897cb0be26443d3987a3d85
---
 api/ApiAggregateGroups.php                    |  4 ++++
 .../PageTranslationSpecialPage.php            | 19 +++++++++++++++++++
 .../ManageGroupsSpecialPage.php               | 11 +++++++++++
 3 files changed, 34 insertions(+)

diff --git a/api/ApiAggregateGroups.php b/api/ApiAggregateGroups.php
index 581fb70c1..5e32a01b7 100644
--- a/api/ApiAggregateGroups.php
+++ b/api/ApiAggregateGroups.php
@@ -22,6 +22,10 @@ class ApiAggregateGroups extends ApiBase {
 
 	public function execute() {
 		$this->checkUserRightsAny( self::$right );
+		$block = $this->getUser()->getBlock();
+		if ( $block && $block->isSitewide() ) {
+			$this->dieBlocked( $block );
+		}
 
 		$params = $this->extractRequestParams();
 		$action = $params['do'];
diff --git a/src/PageTranslation/PageTranslationSpecialPage.php b/src/PageTranslation/PageTranslationSpecialPage.php
index 8a3ed46bd..27848f35a 100644
--- a/src/PageTranslation/PageTranslationSpecialPage.php
+++ b/src/PageTranslation/PageTranslationSpecialPage.php
@@ -11,6 +11,7 @@ use MediaWiki\Cache\LinkBatchFactory;
 use MediaWiki\Extension\Translate\Utilities\LanguagesMultiselectWidget;
 use MediaWiki\Languages\LanguageFactory;
 use MediaWiki\Languages\LanguageNameUtils;
+use MediaWiki\MediaWikiServices;
 use MediaWiki\Revision\RevisionRecord;
 use MediaWiki\User\UserIdentity;
 use MessageGroups;
@@ -32,6 +33,7 @@ use TranslatablePage;
 use TranslateMetadata;
 use TranslateUtils;
 use TranslationsUpdateJob;
+use UserBlockedError;
 use WebRequest;
 use Wikimedia\Rdbms\IResultWrapper;
 use WikiPage;
@@ -131,6 +133,23 @@ class PageTranslationSpecialPage extends SpecialPage {
 			return;
 		}
 
+		// Check for blocks
+		$permissionManager = MediaWikiServices::getInstance()->getPermissionManager();
+		if ( $permissionManager->isBlockedFrom( $user, $title, !$request->wasPosted() ) ) {
+			$block = $user->getBlock();
+			if ( $block ) {
+				throw new UserBlockedError(
+					$block,
+					$user,
+					$this->getLanguage(),
+					$request->getIP()
+				);
+			}
+
+			throw new PermissionsError( 'pagetranslation', [ 'badaccess-group0' ] );
+
+		}
+
 		// Check token for all POST actions here
 		if ( $request->wasPosted() && !$user->matchEditToken( $request->getText( 'token' ) ) ) {
 			throw new PermissionsError( 'pagetranslation' );
diff --git a/src/Synchronization/ManageGroupsSpecialPage.php b/src/Synchronization/ManageGroupsSpecialPage.php
index 8ecb77ea4..0e6d90208 100644
--- a/src/Synchronization/ManageGroupsSpecialPage.php
+++ b/src/Synchronization/ManageGroupsSpecialPage.php
@@ -32,6 +32,7 @@ use SpecialPage;
 use TextContent;
 use Title;
 use TranslateUtils;
+use UserBlockedError;
 use WebRequest;
 use Xml;
 
@@ -139,6 +140,16 @@ class ManageGroupsSpecialPage extends SpecialPage {
 			return;
 		}
 
+		$block = $user->getBlock();
+		if ( $block && $block->isSitewide() ) {
+			throw new UserBlockedError(
+				$block,
+				$user,
+				$this->getLanguage(),
+				$req->getIP()
+			);
+		}
+
 		$token = $req->getVal( 'token' );
 		if ( !$this->hasRight || !$user->matchEditToken( $token ) ) {
 			throw new PermissionsError( self::RIGHT );
-- 
2.35.1