Page MenuHomePhabricator

Comments should use Title::userCan to determine a user's blocked status
Closed, ResolvedPublic

Description

While using the Comments extension on a wikifarm, I notice that there was an issue where a globally blocked IP was leaving comments. This is easily resolved by applying a local block, but it shouldn't be necessary.

Upon investigation, I discovered the extension uses User::isBlocked to decide whether or not to show the reply form. However, User::isBlocked does not report on if the user/IP is currently under a global block. One could use User::isBlockedGlobally in addition to the current check, but the documentation for that function comes with a warning to use something else instead.

Instead, I'd suggest changing the conditional on the line linked above to be:

if ( $this->title->userCan( 'comment', $this->getUser() == false ) && ( $this->allow == '' || $pos !== false ) ) {

I would also recommend similar logic in getVoteLink in Comments.php.

A possible outcome of this change is that it could now be possible to limit the action comment using means other than blocking a user or removing the comment user right (eg by applying comment protection using $wgRestrictionTypes).

Event Timeline

Restricted Application added a subscriber: Aklapper. · View Herald Transcript

Change 651586 had a related patch set uploaded (by Paladox; owner: Paladox):
[mediawiki/extensions/Comments@master] Check for if the user is globally blocked

https://gerrit.wikimedia.org/r/651586

Change 651586 merged by jenkins-bot:

[mediawiki/extensions/Comments@master] Check for if the user is globally blocked

https://gerrit.wikimedia.org/r/651586

Change 699511 had a related patch set uploaded (by Paladox; author: Paladox):

[mediawiki/extensions/Comments@REL1_36] Check for if the user is globally blocked

https://gerrit.wikimedia.org/r/699511

Change 699511 merged by jenkins-bot:

[mediawiki/extensions/Comments@REL1_36] Check for if the user is globally blocked

https://gerrit.wikimedia.org/r/699511

Paladox claimed this task.