This was noticed from looking at the code, rather than from any real-life bug reports.
DatabaseBlock::insert can be passed a database, otherwise it will use wfGetDB with some defaults. However, it calls out to other methods without passing the database on, and those methods then call wfGetDB with their defaults:
- DatabaseBlock::purgeExpired
- BlockRestrictionStore::insert
- BlockRestrictionStore::deleteByBlockId
- DatabaseBlock::doRetroactiveAutoblock
Presumably all of these actions should be done using the same database that was passed to insert.
It's possible that no bugs have been noticed because this is currently an unusual use-case. However, bugs lie in wait for future callers.
Notes
CentralAuthUser::doLocalSuppression is an example that passes the database to insert:
- The block is always sitewide (so the calls to BlockRestrictionStore don't happen)
- The block is always autoblocking (presumably the autoblocks are not being inserted correctly?)
- Calling purgeExpired on the wrong database doesn't cause problems because insert manually purges expired blocks if it still finds a conflict.