- Patch #228594 by catch et al: removed access rule functionality from core.

  The access rules capability of user module has been stripped down to a
  simple method for blocking IP addresses. E-mail and username restrictions
  are now available in a contributed module. IP address range blocking is
  no longer supported and should be done at the server level.

  This patch is partly motiviated by the fact that at the usability testing,
  it frequently came up that users went to "access rules" when trying to
  configure their site settings.

5 files changed, 4 insertions, 318 deletions

diff --git a/modules/user/user-rtl.css b/modules/user/user-rtl.css
index ea0278ba3..219b0cf7c 100644
--- a/modules/user/user-rtl.css
+++ b/modules/user/user-rtl.css
@@ -4,11 +4,6 @@
   padding-left: 0;
   padding-right: 1.5em;
 }
-#access-rules .access-type, #access-rules .rule-type {
-  margin-right: 0;
-  margin-left: 1em;
-  float: right;
-}
 #user-admin-buttons {
   float: right;
   margin-left: 0;
diff --git a/modules/user/user.admin.inc b/modules/user/user.admin.inc
index 3e554151e..8174878a4 100644
--- a/modules/user/user.admin.inc
+++ b/modules/user/user.admin.inc
@@ -712,206 +712,6 @@ function user_admin_role_submit($form, &$form_state) {
 }
 
 /**
- * Menu callback: list all access rules
- */
-function user_admin_access_check() {
-  $output = drupal_get_form('user_admin_check_user');
-  $output .= drupal_get_form('user_admin_check_mail');
-  $output .= drupal_get_form('user_admin_check_host');
-  return $output;
-}
-
-/**
- * Menu callback: add an access rule
- */
-function user_admin_access_add($mask = NULL, $type = NULL) {
-  if ($edit = $_POST) {
-    if (!$edit['mask']) {
-      form_set_error('mask', t('You must enter a mask.'));
-    }
-    else {
-      db_query("INSERT INTO {access} (mask, type, status) VALUES ('%s', '%s', %d)", $edit['mask'], $edit['type'], $edit['status']);
-      $aid = db_last_insert_id('access', 'aid');
-      drupal_set_message(t('The access rule has been added.'));
-      drupal_goto('admin/user/rules');
-    }
-  }
-  else {
-    $edit['mask'] = $mask;
-    $edit['type'] = $type;
-  }
-  return drupal_get_form('user_admin_access_add_form', $edit, t('Add rule'));
-}
-
-/**
- * Menu callback: edit an access rule
- */
-function user_admin_access_edit($aid = 0) {
-  if ($edit = $_POST) {
-    if (!$edit['mask']) {
-      form_set_error('mask', t('You must enter a mask.'));
-    }
-    else {
-      db_query("UPDATE {access} SET mask = '%s', type = '%s', status = '%s' WHERE aid = %d", $edit['mask'], $edit['type'], $edit['status'], $aid);
-      drupal_set_message(t('The access rule has been saved.'));
-      drupal_goto('admin/user/rules');
-    }
-  }
-  else {
-    $edit = db_fetch_array(db_query('SELECT aid, type, status, mask FROM {access} WHERE aid = %d', $aid));
-  }
-  return drupal_get_form('user_admin_access_edit_form', $edit, t('Save rule'));
-}
-
-/**
- * Form builder; Configure access rules.
- *
- * @ingroup forms
- */
-function user_admin_access_form(&$form_state, $edit, $submit) {
-  $form['status'] = array(
-    '#type' => 'radios',
-    '#title' => t('Access type'),
-    '#default_value' => isset($edit['status']) ? $edit['status'] : 0,
-    '#options' => array('1' => t('Allow'), '0' => t('Deny')),
-  );
-  $type_options = array('user' => t('Username'), 'mail' => t('E-mail'), 'host' => t('Host'));
-  $form['type'] = array(
-    '#type' => 'radios',
-    '#title' => t('Rule type'),
-    '#default_value' => (isset($type_options[$edit['type']]) ? $edit['type'] : 'user'),
-    '#options' => $type_options,
-  );
-  $form['mask'] = array(
-    '#type' => 'textfield',
-    '#title' => t('Mask'),
-    '#size' => 30,
-    '#maxlength' => 64,
-    '#default_value' => $edit['mask'],
-    '#description' => '%: '. t('Matches any number of characters, even zero characters') .'.<br />_: '. t('Matches exactly one character.'),
-    '#required' => TRUE,
-  );
-  $form['submit'] = array('#type' => 'submit', '#value' => $submit);
-
-  return $form;
-}
-
-function user_admin_access_check_validate($form, &$form_state) {
-  if (empty($form_state['values']['test'])) {
-    form_set_error($form_state['values']['type'], t('No value entered. Please enter a test string and try again.'));
-  }
-}
-
-function user_admin_check_user() {
-  $form['user'] = array('#type' => 'fieldset', '#title' => t('Username'));
-  $form['user']['test'] = array('#type' => 'textfield', '#title' => '', '#description' => t('Enter a username to check if it will be denied or allowed.'), '#size' => 30, '#maxlength' => USERNAME_MAX_LENGTH);
-  $form['user']['type'] = array('#type' => 'hidden', '#value' => 'user');
-  $form['user']['submit'] = array('#type' => 'submit', '#value' => t('Check username'));
-  $form['#submit'][] = 'user_admin_access_check_submit';
-  $form['#validate'][] = 'user_admin_access_check_validate';
-  $form['#theme'] = 'user_admin_access_check';
-  return $form;
-}
-
-function user_admin_check_mail() {
-  $form['mail'] = array('#type' => 'fieldset', '#title' => t('E-mail'));
-  $form['mail']['test'] = array('#type' => 'textfield', '#title' => '', '#description' => t('Enter an e-mail address to check if it will be denied or allowed.'), '#size' => 30, '#maxlength' => EMAIL_MAX_LENGTH);
-  $form['mail']['type'] = array('#type' => 'hidden', '#value' => 'mail');
-  $form['mail']['submit'] = array('#type' => 'submit', '#value' => t('Check e-mail'));
-  $form['#submit'][] = 'user_admin_access_check_submit';
-  $form['#validate'][] = 'user_admin_access_check_validate';
-  $form['#theme'] = 'user_admin_access_check';
-  return $form;
-}
-
-function user_admin_check_host() {
-  $form['host'] = array('#type' => 'fieldset', '#title' => t('Hostname'));
-  $form['host']['test'] = array('#type' => 'textfield', '#title' => '', '#description' => t('Enter a hostname or IP address to check if it will be denied or allowed.'), '#size' => 30, '#maxlength' => 64);
-  $form['host']['type'] = array('#type' => 'hidden', '#value' => 'host');
-  $form['host']['submit'] = array('#type' => 'submit', '#value' => t('Check hostname'));
-  $form['#submit'][] = 'user_admin_access_check_submit';
-  $form['#validate'][] = 'user_admin_access_check_validate';
-  $form['#theme'] = 'user_admin_access_check';
-  return $form;
-}
-
-function user_admin_access_check_submit($form, &$form_state) {
-  switch ($form_state['values']['type']) {
-    case 'user':
-      if (drupal_is_denied('user', $form_state['values']['test'])) {
-        drupal_set_message(t('The username %name is not allowed.', array('%name' => $form_state['values']['test'])));
-      }
-      else {
-        drupal_set_message(t('The username %name is allowed.', array('%name' => $form_state['values']['test'])));
-      }
-      break;
-    case 'mail':
-      if (drupal_is_denied('mail', $form_state['values']['test'])) {
-        drupal_set_message(t('The e-mail address %mail is not allowed.', array('%mail' => $form_state['values']['test'])));
-      }
-      else {
-        drupal_set_message(t('The e-mail address %mail is allowed.', array('%mail' => $form_state['values']['test'])));
-      }
-      break;
-    case 'host':
-      if (drupal_is_denied('host', $form_state['values']['test'])) {
-        drupal_set_message(t('The hostname %host is not allowed.', array('%host' => $form_state['values']['test'])));
-      }
-      else {
-        drupal_set_message(t('The hostname %host is allowed.', array('%host' => $form_state['values']['test'])));
-      }
-      break;
-    default:
-      break;
-  }
-}
-
-/**
- * Menu callback: delete an access rule
- *
- * @ingroup forms
- * @see user_admin_access_delete_confirm_submit()
- */
-function user_admin_access_delete_confirm($form_state, $aid = 0) {
-  $access_types = array('user' => t('username'), 'mail' => t('e-mail'), 'host' => t('host'));
-  $edit = db_fetch_object(db_query('SELECT aid, type, status, mask FROM {access} WHERE aid = %d', $aid));
-
-  $form = array();
-  $form['aid'] = array('#type' => 'hidden', '#value' => $aid);
-  $output = confirm_form($form,
-                  t('Are you sure you want to delete the @type rule for %rule?', array('@type' => $access_types[$edit->type], '%rule' => $edit->mask)),
-                  'admin/user/rules',
-                  t('This action cannot be undone.'),
-                  t('Delete'),
-                  t('Cancel'));
-  return $output;
-}
-
-function user_admin_access_delete_confirm_submit($form, &$form_state) {
-  db_query('DELETE FROM {access} WHERE aid = %d', $form_state['values']['aid']);
-  drupal_set_message(t('The access rule has been deleted.'));
-  $form_state['redirect'] = 'admin/user/rules';
-  return;
-}
-
-/**
- * Menu callback: list all access rules
- */
-function user_admin_access() {
-  $header = array(array('data' => t('Access type'), 'field' => 'status'), array('data' => t('Rule type'), 'field' => 'type'), array('data' => t('Mask'), 'field' => 'mask'), array('data' => t('Operations'), 'colspan' => 2));
-  $result = db_query("SELECT aid, type, status, mask FROM {access}". tablesort_sql($header));
-  $access_types = array('user' => t('username'), 'mail' => t('e-mail'), 'host' => t('host'));
-  $rows = array();
-  while ($rule = db_fetch_object($result)) {
-    $rows[] = array($rule->status ? t('allow') : t('deny'), $access_types[$rule->type], $rule->mask, l(t('edit'), 'admin/user/rules/edit/'. $rule->aid), l(t('delete'), 'admin/user/rules/delete/'. $rule->aid));
-  }
-  if (empty($rows)) {
-    $rows[] = array(array('data' => '<em>'. t('There are currently no access rules.') .'</em>', 'colspan' => 5));
-  }
-  return theme('table', $header, $rows);
-}
-
-/**
  * Theme user administration overview.
  *
  * @ingroup themeable
diff --git a/modules/user/user.css b/modules/user/user.css
index 977badd70..446049828 100644
--- a/modules/user/user.css
+++ b/modules/user/user.css
@@ -9,16 +9,6 @@
 #permissions tr.odd .form-item, tr.even .form-item {
   white-space: normal;
 }
-#access-rules .access-type, #access-rules .rule-type {
-  margin-right: 1em; /* LTR */
-  float: left; /* LTR */
-}
-#access-rules .access-type .form-item, #access-rules .rule-type .form-item {
-  margin-top: 0;
-}
-#access-rules .mask {
-  clear: both;
-}
 #user-login-form {
   text-align: center;
 }
diff --git a/modules/user/user.install b/modules/user/user.install
index ac9527e16..5f63f05ea 100644
--- a/modules/user/user.install
+++ b/modules/user/user.install
@@ -5,39 +5,6 @@
  * Implementation of hook_schema().
  */
 function user_schema() {
-  $schema['access'] = array(
-    'description' => t('Stores site access rules.'),
-    'fields' => array(
-      'aid' => array(
-        'type' => 'serial',
-        'not null' => TRUE,
-        'description' => t('Primary Key: Unique access ID.'),
-      ),
-      'mask' => array(
-        'type' => 'varchar',
-        'length' => 255,
-        'not null' => TRUE,
-        'default' => '',
-        'description' => t('Text mask used for filtering access.'),
-      ),
-      'type' => array(
-        'type' => 'varchar',
-        'length' => 255,
-        'not null' => TRUE,
-        'default' => '',
-        'description' => t('Type of access rule: name, mail or host.'),
-      ),
-      'status' => array(
-        'type' => 'int',
-        'not null' => TRUE,
-        'default' => 0,
-        'size' => 'tiny',
-        'description' => t('Whether rule is to allow(1) or deny(0) access.'),
-      ),
-    ),
-    'primary key' => array('aid'),
-  );
-
   $schema['authmap'] = array(
     'description' => t('Stores distributed authentication mapping.'),
     'fields' => array(
diff --git a/modules/user/user.module b/modules/user/user.module
index 9f4910146..8e9d9a186 100644
--- a/modules/user/user.module
+++ b/modules/user/user.module
@@ -92,7 +92,7 @@ function user_external_load($authname) {
  * Perform standard Drupal login operations for a user object.
  *
  * The user object must already be authenticated. This function verifies
- * that the user account is not blocked/denied and then performs the login,
+ * that the user account is not blocked and then performs the login,
  * updates the login timestamp in the database, invokes hook_user('login'),
  * and regenerates the session.
  *
@@ -113,7 +113,7 @@ function user_external_login($account, $edit = array()) {
     $state['values']['name'] = $account->name;
   }
 
-  // Check if user is blocked or denied by access rules.
+  // Check if user is blocked.
   user_login_name_validate($form, $state, (array)$account);
   if (form_get_errors()) {
     // Invalid login.
@@ -952,43 +952,6 @@ function user_menu() {
     'type' => MENU_CALLBACK,
     'file' => 'user.admin.inc',
   );
-  $items['admin/user/rules'] = array(
-    'title' => 'Access rules',
-    'description' => 'List and create rules to disallow usernames, e-mail addresses, and IP addresses.',
-    'page callback' => 'user_admin_access',
-    'access arguments' => array('administer permissions'),
-    'file' => 'user.admin.inc',
-  );
-  $items['admin/user/rules/list'] = array(
-    'title' => 'List',
-    'type' => MENU_DEFAULT_LOCAL_TASK,
-    'weight' => -10,
-  );
-  $items['admin/user/rules/add'] = array(
-    'title' => 'Add rule',
-    'page callback' => 'user_admin_access_add',
-    'type' => MENU_LOCAL_TASK,
-    'file' => 'user.admin.inc',
-  );
-  $items['admin/user/rules/check'] = array(
-    'title' => 'Check rules',
-    'page callback' => 'user_admin_access_check',
-    'type' => MENU_LOCAL_TASK,
-    'file' => 'user.admin.inc',
-  );
-  $items['admin/user/rules/edit'] = array(
-    'title' => 'Edit rule',
-    'page callback' => 'user_admin_access_edit',
-    'type' => MENU_CALLBACK,
-    'file' => 'user.admin.inc',
-  );
-  $items['admin/user/rules/delete'] = array(
-    'title' => 'Delete rule',
-    'page callback' => 'drupal_get_form',
-    'page arguments' => array('user_admin_access_delete_confirm'),
-    'type' => MENU_CALLBACK,
-    'file' => 'user.admin.inc',
-  );
 
   $items['logout'] = array(
     'title' => 'Log out',
@@ -1219,7 +1182,7 @@ function user_login(&$form_state, $msg = '') {
 }
 
 /**
- * Set up a series for validators which check for blocked/denied users,
+ * Set up a series for validators which check for blocked users,
  * then authenticate against local database, then return an error if
  * authentication fails. Distributed authentication modules are welcome
  * to use hook_form_alter() to change this series in order to
@@ -1240,8 +1203,7 @@ function user_login_default_validators() {
 }
 
 /**
- * A FAPI validate handler. Sets an error if supplied username has been blocked
- * or denied access.
+ * A FAPI validate handler. Sets an error if supplied username has been blocked.
  */
 function user_login_name_validate($form, &$form_state) {
   if (isset($form_state['values']['name'])) {
@@ -1249,10 +1211,6 @@ function user_login_name_validate($form, &$form_state) {
       // blocked in user administration
       form_set_error('name', t('The username %name has not been activated or is blocked.', array('%name' => $form_state['values']['name'])));
     }
-    else if (drupal_is_denied('user', $form_state['values']['name'])) {
-      // denied by access controls
-      form_set_error('name', t('The name %name is a reserved username.', array('%name' => $form_state['values']['name'])));
-    }
   }
 }
 
@@ -1504,9 +1462,6 @@ function _user_edit_validate($uid, &$edit) {
     else if (db_result(db_query("SELECT COUNT(*) FROM {users} WHERE uid != %d AND LOWER(name) = LOWER('%s')", $uid, $edit['name'])) > 0) {
       form_set_error('name', t('The name %name is already taken.', array('%name' => $edit['name'])));
     }
-    else if (drupal_is_denied('user', $edit['name'])) {
-      form_set_error('name', t('The name %name has been denied access.', array('%name' => $edit['name'])));
-    }
   }
 
   // Validate the e-mail address:
@@ -1516,9 +1471,6 @@ function _user_edit_validate($uid, &$edit) {
   else if (db_result(db_query("SELECT COUNT(*) FROM {users} WHERE uid != %d AND LOWER(mail) = LOWER('%s')", $uid, $edit['mail'])) > 0) {
     form_set_error('mail', t('The e-mail address %email is already registered. <a href="@password">Have you forgotten your password?</a>', array('%email' => $edit['mail'], '@password' => url('user/password'))));
   }
-  else if (drupal_is_denied('mail', $edit['mail'])) {
-    form_set_error('mail', t('The e-mail address %email has been denied access.', array('%email' => $edit['mail'])));
-  }
 }
 
 function _user_edit_submit($uid, &$edit) {
@@ -1853,8 +1805,6 @@ function user_help($path, $arg) {
     case 'admin/user/user/create':
     case 'admin/user/user/account/create':
       return '<p>'. t("This web page allows administrators to register new users. Users' e-mail addresses and usernames must be unique.") .'</p>';
-    case 'admin/user/rules':
-      return '<p>'. t('Set up username and e-mail address access rules for new <em>and</em> existing accounts (currently logged in accounts will not be logged out). If a username or e-mail address for an account matches any deny rule, but not an allow rule, then the account will not be allowed to be created or to log in. A host rule is effective for every page view, not just registrations.') .'</p>';
     case 'admin/user/permissions':
       return '<p>'. t('Permissions let you control what users can do on your site. Each user role (defined on the <a href="@role">user roles page</a>) has its own set of permissions. For example, you could give users classified as "Administrators" permission to "administer nodes" but deny this power to ordinary, "authenticated" users. You can use permissions to reveal new features to privileged users (those with subscriptions, for example). Permissions also allow trusted users to share the administrative burden of running a busy site.', array('@role' => url('admin/user/roles'))) .'</p>';
     case 'admin/user/roles':
@@ -2181,12 +2131,6 @@ function user_action_info() {
       'configurable' => FALSE,
       'hooks' => array(),
     ),
-    'user_block_ip_action' => array(
-      'description' => t('Ban IP address of current user'),
-      'type' => 'user',
-      'configurable' => FALSE,
-      'hooks' => array(),
-    ),
   );
 }
 
@@ -2211,16 +2155,6 @@ function user_block_user_action(&$object, $context = array()) {
 }
 
 /**
- * Implementation of a Drupal action.
- * Adds an access rule that blocks the user's IP address.
- */
-function user_block_ip_action() {
-  $ip = ip_address();
-  db_query("INSERT INTO {access} (mask, type, status) VALUES ('%s', '%s', %d)", $ip, 'host', 0);
-  watchdog('action', 'Banned IP address %ip', array('%ip' => $ip));
-}
-
-/**
  * Submit handler for the user registration form.
  *
  * This function is shared by the installation form and the normal registration form,