From beedb3aa1c9e73de7df3913a36f2165a05b9ee3a Mon Sep 17 00:00:00 2001
From: Reedy <reedy@wikimedia.org>
Date: Thu, 15 Apr 2021 12:59:01 +0100
Subject: [PATCH] SECURITY: Prevent blocked users from purging pages

CVE-2021-35197

Bug: T280226
Change-Id: Id783618e885998cddf45a4cfc7b2c19fd0c7e9f5
---

diff --git a/includes/actions/PurgeAction.php b/includes/actions/PurgeAction.php
index c9f1820..44ebe17 100644
--- a/includes/actions/PurgeAction.php
+++ b/includes/actions/PurgeAction.php
@@ -33,10 +33,6 @@
 		return 'purge';
 	}
 
-	public function requiresUnblock() {
-		return false;
-	}
-
 	public function getDescription() {
 		return '';
 	}
diff --git a/includes/api/ApiPurge.php b/includes/api/ApiPurge.php
index bb1f3d3..e5a6722 100644
--- a/includes/api/ApiPurge.php
+++ b/includes/api/ApiPurge.php
@@ -31,6 +31,14 @@
 	 * Purges the cache of a page
 	 */
 	public function execute() {
+		$user = $this->getUser();
+
+		// Fail early if the user is sitewide blocked.
+		$block = $user->getBlock();
+		if ( $block && $block->isSitewide() ) {
+			$this->dieBlocked( $block );
+		}
+
 		$params = $this->extractRequestParams();
 
 		$continuationManager = new ApiContinuationManager( $this, [], [] );
@@ -42,7 +50,6 @@
 		$pageSet->execute();
 
 		$result = $pageSet->getInvalidTitlesAndRevisions();
-		$user = $this->getUser();
 
 		foreach ( $pageSet->getGoodTitles() as $title ) {
 			$r = [];