1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
|
<?php
use MediaWiki\Block\AbstractBlock;
use MediaWiki\Block\BlockPermissionChecker;
use MediaWiki\Block\BlockUtils;
use MediaWiki\Block\DatabaseBlock;
use MediaWiki\Config\ServiceOptions;
use MediaWiki\MainConfigNames;
use MediaWiki\Permissions\Authority;
use MediaWiki\Tests\Unit\Permissions\MockAuthorityTrait;
use MediaWiki\User\UserIdentity;
use MediaWiki\User\UserIdentityValue;
use PHPUnit\Framework\MockObject\MockObject;
/**
* @group Blocking
* @coversDefaultClass \MediaWiki\Block\BlockPermissionChecker
* @author DannyS712
*/
class BlockPermissionCheckerTest extends MediaWikiUnitTestCase {
use MockAuthorityTrait;
/**
* @param bool $enableUserEmail
* @param array $targetAndType
* @param Authority $performer
* @return BlockPermissionChecker
*/
private function getBlockPermissionChecker(
bool $enableUserEmail,
array $targetAndType,
Authority $performer
) {
$options = new ServiceOptions(
BlockPermissionChecker::CONSTRUCTOR_OPTIONS,
[ MainConfigNames::EnableUserEmail => $enableUserEmail ]
);
// We don't care about how BlockUtils::parseBlockTarget actually works, just
// override with whatever. Only used for a single call in the constructor
// for getting target and type
$blockUtils = $this->createNoOpMock( BlockUtils::class, [ 'parseBlockTarget' ] );
$blockUtils->expects( $this->once() )
->method( 'parseBlockTarget' )
->willReturn( $targetAndType );
return new BlockPermissionChecker(
$options,
$blockUtils,
'foo', // input to BlockUtils::parseBlockTarget, not used
$performer
);
}
/**
* @param bool $isSitewide
* @param string $byName
* @return DatabaseBlock|MockObject
*/
private function getBlock( bool $isSitewide, string $byName ) {
// Mock DatabaseBlock instead of AbstractBlock because its easier
$block = $this->createNoOpMock(
DatabaseBlock::class,
[ 'isSitewide', 'getBlocker' ]
);
$block->method( 'isSitewide' )->willReturn( $isSitewide );
$block->method( 'getBlocker' )->willReturn( new UserIdentityValue( 7, $byName ) );
return $block;
}
public static function provideCheckBasePermissions() {
// $rights, $checkHideuser, $expect
yield 'need block' => [ [], false, 'badaccess-group0' ];
yield 'block enough for not hiding' => [ [ 'block' ], false, true ];
yield 'need hideuser' => [ [ 'block' ], true, 'unblock-hideuser' ];
yield 'can hideuser' => [ [ 'block', 'hideuser' ], true, true ];
}
/**
* @covers ::checkBasePermissions
* @dataProvider provideCheckBasePermissions
*/
public function testCheckBasePermissions( $rights, $checkHideuser, $expect ) {
$performer = $this->mockRegisteredAuthorityWithPermissions( $rights );
$blockPermissionChecker = $this->getBlockPermissionChecker(
true, // $enableUserEmail, irrelevant
[ null, null ], // $targetAndType, irrelevant
$performer
);
$this->assertSame(
$expect,
$blockPermissionChecker->checkBasePermissions( $checkHideuser )
);
}
/**
* @covers ::checkBlockPermissions
*/
public function testNotBlockedPerformer() {
// checkBlockPermissions has an early return true if the performer has no block
$blockPermissionChecker = $this->getBlockPermissionChecker(
true, // $enableUserEmail, irrelevant
[ null, null ], // $targetAndType, irrelevant
$this->mockRegisteredAuthorityWithoutPermissions( [] )
);
$this->assertTrue(
$blockPermissionChecker->checkBlockPermissions()
);
}
/**
* @covers ::checkBlockPermissions
*/
public function testPartialBlockedPerformer() {
// checkBlockPermissions has an early return true if the performer is not sitewide blocked
$blocker = new UserIdentityValue( 1, 'blocker', UserIdentity::LOCAL );
$performer = $this->mockUserAuthorityWithBlock( $blocker, $this->getBlock( false, '' ) );
$blockPermissionChecker = $this->getBlockPermissionChecker(
true, // $enableUserEmail, irrelevant
[ null, null ], // $targetAndType, irrelevant
$performer
);
$this->assertTrue(
$blockPermissionChecker->checkBlockPermissions()
);
}
public static function provideCheckBlockPermissions() {
// Blocked admin changing own block
yield 'Self blocked' => [ 'blocker', 1, 'blocker', false, true ];
yield 'unblockself' => [ 'another admin', 1, 'blocker', true, true ];
yield 'ipbnounblockself' => [ 'another admin', 1, 'blocker', false, 'ipbnounblockself' ];
// Blocked admins can always block the admin who blocked them
yield 'Block my blocker' => [ 'another admin', 2, 'another admin', false, true ];
// Blocked admin blocking a third party
yield 'Block someone else' => [ 'another admin', 3, 'someone else', false, 'ipbblocked' ];
}
/**
* @covers ::checkBlockPermissions
* @dataProvider provideCheckBlockPermissions
*/
public function testCheckBlockPermissions(
string $blockedBy,
int $targetUserId,
string $targetUserName,
bool $unblockSelf,
$expect
) {
// cases for the target being a UserIdentity
// performing user has id 1 and the name 'blocker'
$block = $this->getBlock(
true, // sitewide
$blockedBy
);
$rights = $unblockSelf ? [ 'unblockself' ] : [];
$blocker = new UserIdentityValue( 1, 'blocker', UserIdentity::LOCAL );
$performer = $this->mockUserAuthorityWithBlock( $blocker, $block, $rights );
$target = new UserIdentityValue( $targetUserId, $targetUserName );
$blockPermissionChecker = $this->getBlockPermissionChecker(
true, // $enableUserEmail, irrelevant
[ $target, AbstractBlock::TYPE_USER ], // $targetAndType, irrelevant
$performer
);
$this->assertSame(
$expect,
$blockPermissionChecker->checkBlockPermissions()
);
}
public static function provideCheckEmailPermissions() {
// $enableEmail, $rights, $expect
yield 'Email not enabled, without permissions' => [ false, [], false ];
yield 'Email not enabled, with permissions' => [ false, [ 'blockemail' ], false ];
yield 'Email enabled, without permissions' => [ true, [], false ];
yield 'Email enabled, with permissions' => [ true, [ 'blockemail' ], true ];
}
/**
* @covers ::checkEmailPermissions
* @dataProvider provideCheckEmailPermissions
*/
public function testCheckEmailPermissionOkay( $enableEmail, $rights, $expect ) {
$performer = $this->mockRegisteredAuthorityWithPermissions( $rights );
$blockPermissionChecker = $this->getBlockPermissionChecker(
$enableEmail,
[ null, null ], // $targetAndType, irrelevant
$performer
);
$this->assertSame( $expect, $blockPermissionChecker->checkEmailPermissions() );
}
}
|
