From ca2d0d9e978b681928d22ef2ac1153b99d651035 Mon Sep 17 00:00:00 2001
From: =?utf8?q?Tim=20D=C3=BCsterhus?= <duesterhus@woltlab.com>
Date: Thu, 10 Jun 2021 15:33:30 +0200
Subject: [PATCH] Remove `BLACKLIST_IP_ADDRESSES`

see #3914
---
 com.woltlab.wcf/option.xml                    |  5 +---
 constants.php                                 |  1 -
 .../install/files/lib/system/WCF.class.php    | 30 +++----------------
 wcfsetup/install/files/options.inc.php        |  1 -
 wcfsetup/install/lang/de.xml                  |  4 +--
 wcfsetup/install/lang/en.xml                  |  4 +--
 6 files changed, 9 insertions(+), 36 deletions(-)

diff --git a/com.woltlab.wcf/option.xml b/com.woltlab.wcf/option.xml
index 1fa47391fc..1d74ee011c 100644
--- a/com.woltlab.wcf/option.xml
+++ b/com.woltlab.wcf/option.xml
@@ -714,10 +714,6 @@ block:wcf.acp.option.blacklist_sfs_action.block]]></selectoptions>
 			</option>
 			<!-- /security.blacklist.stopforumspam -->
 			<!-- security.blacklist.custom -->
-			<option name="blacklist_ip_addresses">
-				<categoryname>security.blacklist.custom</categoryname>
-				<optiontype>textarea</optiontype>
-			</option>
 			<option name="blacklist_user_agents">
 				<categoryname>security.blacklist.custom</categoryname>
 				<optiontype>textarea</optiontype>
@@ -1701,5 +1697,6 @@ DESC:wcf.global.sortOrder.descending</selectoptions>
 	</import>
 	<delete>
 		<option name="module_master_password"/>
+		<option name="blacklist_ip_addresses"/>
 	</delete>
 </data>
diff --git a/constants.php b/constants.php
index 86ace69315..46e686a2ee 100644
--- a/constants.php
+++ b/constants.php
@@ -76,7 +76,6 @@
 \define('USER_AUTHENTICATION_FAILURE_USER_CAPTCHA', 3);
 \define('USER_AUTHENTICATION_FAILURE_EXPIRATION', 30);
 \define('SIGNATURE_SECRET', '');
-\define('BLACKLIST_IP_ADDRESSES', '');
 \define('BLACKLIST_USER_AGENTS', '');
 \define('CAPTCHA_TYPE', 'com.woltlab.wcf.recaptcha');
 \define('REGISTER_USE_CAPTCHA', 1);
diff --git a/wcfsetup/install/files/lib/system/WCF.class.php b/wcfsetup/install/files/lib/system/WCF.class.php
index 27c9009486..5c061c2127 100644
--- a/wcfsetup/install/files/lib/system/WCF.class.php
+++ b/wcfsetup/install/files/lib/system/WCF.class.php
@@ -470,6 +470,10 @@ class WCF
         // The master password has been removed since 5.5.
         // https://github.com/WoltLab/WCF/issues/3913
         \define('MODULE_MASTER_PASSWORD', 0);
+
+        // The IP address blocklist was removed in 5.5.
+        // https://github.com/WoltLab/WCF/issues/3914
+        \define('BLACKLIST_IP_ADDRESSES', '');
     }
 
     /**
@@ -535,32 +539,6 @@ class WCF
     {
         $isAjax = isset($_SERVER['HTTP_X_REQUESTED_WITH']) && ($_SERVER['HTTP_X_REQUESTED_WITH'] == 'XMLHttpRequest');
 
-        if (\defined('BLACKLIST_IP_ADDRESSES') && BLACKLIST_IP_ADDRESSES != '') {
-            if (
-                !StringUtil::executeWordFilter(
-                    UserUtil::convertIPv6To4(UserUtil::getIpAddress()),
-                    BLACKLIST_IP_ADDRESSES
-                )
-            ) {
-                if ($isAjax) {
-                    throw new AJAXException(
-                        self::getLanguage()->getDynamicVariable('wcf.ajax.error.permissionDenied'),
-                        AJAXException::INSUFFICIENT_PERMISSIONS
-                    );
-                } else {
-                    throw new PermissionDeniedException();
-                }
-            } elseif (!StringUtil::executeWordFilter(UserUtil::getIpAddress(), BLACKLIST_IP_ADDRESSES)) {
-                if ($isAjax) {
-                    throw new AJAXException(
-                        self::getLanguage()->getDynamicVariable('wcf.ajax.error.permissionDenied'),
-                        AJAXException::INSUFFICIENT_PERMISSIONS
-                    );
-                } else {
-                    throw new PermissionDeniedException();
-                }
-            }
-        }
         if (\defined('BLACKLIST_USER_AGENTS') && BLACKLIST_USER_AGENTS != '') {
             if (!StringUtil::executeWordFilter(UserUtil::getUserAgent(), BLACKLIST_USER_AGENTS)) {
                 if ($isAjax) {
diff --git a/wcfsetup/install/files/options.inc.php b/wcfsetup/install/files/options.inc.php
index 35d82f0f1d..62041ec59b 100644
--- a/wcfsetup/install/files/options.inc.php
+++ b/wcfsetup/install/files/options.inc.php
@@ -24,7 +24,6 @@ if (\file_exists(WCF_DIR . 'cookiePrefix.txt')) {
 
 \define('HTTP_SEND_X_FRAME_OPTIONS', 0);
 
-\define('BLACKLIST_IP_ADDRESSES', '');
 \define('BLACKLIST_USER_AGENTS', '');
 
 \define('CACHE_SOURCE_TYPE', 'disk');
diff --git a/wcfsetup/install/lang/de.xml b/wcfsetup/install/lang/de.xml
index 93e0fec9f9..51400b1a1e 100644
--- a/wcfsetup/install/lang/de.xml
+++ b/wcfsetup/install/lang/de.xml
@@ -1257,8 +1257,6 @@ ACHTUNG: Die oben genannten Meldungen sind stark gekürzt. Sie können Details z
 		<item name="wcf.acp.notice.showOrder.description"><![CDATA[Legt die Reihenfolge fest, in der die Hinweise angezeigt werden.]]></item>
 	</category>
 	<category name="wcf.acp.option">
-		<item name="wcf.acp.option.blacklist_ip_addresses"><![CDATA[IP-Adresse ausschließen (Obsolet)]]></item>
-		<item name="wcf.acp.option.blacklist_ip_addresses.description"><![CDATA[Der Ausschluss einzelner IP-Adressen erfolgt zuverlässiger und leistungsfähiger auf Ebene des Webservers. Diese Option ist obsolet und wird mit einer zukünftigen Version entfernt.]]></item>
 		<item name="wcf.acp.option.blacklist_user_agents"><![CDATA[Browser-Kennung ausschließen (Obsolet)]]></item>
 		<item name="wcf.acp.option.blacklist_user_agents.description"><![CDATA[Browser-Kennungen können durch Angreifer leicht gefälscht werden und sind kein zuverlässiger Indikator für die Identität des Anfragestellers. Falls ein Ausschluss dennoch gewünscht ist, erfolgt ein Ausschluss von Browser-Kenunngen leistungsfähiger auf Ebene des Webservers. Diese Option ist obsolet und wird mit einer zukünftigen Version entfernt.]]></item>
 		<item name="wcf.acp.option.cache_source_memcached_host"><![CDATA[Memcached-Server]]></item>
@@ -5540,5 +5538,7 @@ Benachrichtigungen auf <a href="{link isHtmlEmail=true}{/link}">{PAGE_TITLE|lang
 	<item name="wcf.acp.masterPassword.enter.deprecated"/>
 	<item name="wcf.acp.option.module_master_password"/>
 	<item name="wcf.acp.option.module_master_password.description"/>
+	<item name="wcf.acp.option.blacklist_ip_addresses"/>
+	<item name="wcf.acp.option.blacklist_ip_addresses.description"/>
 </delete>
 </language>
diff --git a/wcfsetup/install/lang/en.xml b/wcfsetup/install/lang/en.xml
index 3d42467792..05c4b8cfa8 100644
--- a/wcfsetup/install/lang/en.xml
+++ b/wcfsetup/install/lang/en.xml
@@ -1235,8 +1235,6 @@ ATTENTION: The messages listed above are greatly shortened. You can view details
 		<item name="wcf.acp.notice.showOrder.description"><![CDATA[Choose display order of notices.]]></item>
 	</category>
 	<category name="wcf.acp.option">
-		<item name="wcf.acp.option.blacklist_ip_addresses"><![CDATA[Block by IP Address (Not Recommended)]]></item>
-		<item name="wcf.acp.option.blacklist_ip_addresses.description"><![CDATA[Blocking IP Addresses is more reliably and performant achieved at the web server level. Use of this blocklist is not recommended and this option will be removed in a future version.]]></item>
 		<item name="wcf.acp.option.blacklist_user_agents"><![CDATA[Block by User-Agent (Not Recommended)]]></item>
 		<item name="wcf.acp.option.blacklist_user_agents.description"><![CDATA[User-Agents are easily faked by an attacker and not a reliable indicator of the client’s identity. If a block based on the User-Agent is desired nonetheless, it is achieve more performant at the web server level. Use of this blocklist is not recommended and this option will be removed in a future version.]]></item>
 		<item name="wcf.acp.option.cache_source_memcached_host"><![CDATA[Memcached-Server]]></item>
@@ -5541,5 +5539,7 @@ your notifications on <a href="{link isHtmlEmail=true}{/link}">{PAGE_TITLE|langu
 	<item name="wcf.acp.masterPassword.enter.deprecated"/>
 	<item name="wcf.acp.option.module_master_password"/>
 	<item name="wcf.acp.option.module_master_password.description"/>
+	<item name="wcf.acp.option.blacklist_ip_addresses"/>
+	<item name="wcf.acp.option.blacklist_ip_addresses.description"/>
 </delete>
 </language>
-- 
2.20.1