Fix 403 handling and add login links to prevent nginx 404 fallthrough

.gitignore

@@ -0,0 +1,15 @@
+# Composer dependencies
+/vendor/
+/composer.lock
+
+# IDE files
+.vscode/
+.idea/
+
+# Temporary files
+*.tmp
+*.log
+
+# OS files
+.DS_Store
+Thumbs.db

composer.json

@@ -0,0 +1,5 @@
+{
+    "require-dev": {
+        "phpunit/phpunit": "^9.0"
+    }
+}

i18n/de.json

@@ -3,5 +3,5 @@
         "authors": [ "MyWikis LLC" ]
     },
     "crawlerprotection-accessdenied-title": "Zugriff verweigert",
-    "crawlerprotection-accessdenied-text": "Anmeldung erforderlich, um diese Aktion auzuführen oder Spezialseite anzusehen."
+    "crawlerprotection-accessdenied-text": "Anmeldung erforderlich, um diese Aktion auzuführen oder Spezialseite anzusehen. Bitte [[Special:UserLogin|melden Sie sich an]], um fortzufahren."
 }

i18n/en.json

@@ -3,5 +3,5 @@
         "authors": [ "MyWikis LLC" ]
     },
     "crawlerprotection-accessdenied-title": "Access denied",
-    "crawlerprotection-accessdenied-text": "You must be logged in to perform this action or view this special page."
+    "crawlerprotection-accessdenied-text": "You must be logged in to perform this action or view this special page. Please [[Special:UserLogin|log in]] to continue."
 }

includes/Hooks.php

@@ -113,14 +113,17 @@ public function onSpecialPageBeforeExecute( $special, $subPage ) {
 	 * @return void
 	 */
 	protected function denyAccess( OutputPage $output ): void {
+		$output->clearHTML();
 		$output->setStatusCode( 403 );
-		$output->addWikiTextAsInterface( wfMessage( 'crawlerprotection-accessdenied-text' )->plain() );
-
+
 		if ( version_compare( MW_VERSION, '1.41', '<' ) ) {
 			$output->setPageTitle( wfMessage( 'crawlerprotection-accessdenied-title' ) );
 		} else {
 			// @phan-suppress-next-line PhanUndeclaredMethod Exists in 1.41+
 			$output->setPageTitleMsg( wfMessage( 'crawlerprotection-accessdenied-title' ) );
 		}
+
+		$output->addWikiTextAsInterface( wfMessage( 'crawlerprotection-accessdenied-text' )->plain() );
+		$output->returnToMain();
 	}
 }

tests/phpunit/unit/HooksTest.php

@@ -133,4 +133,21 @@ public function testNonRevisionTypeAlwaysAllowed() {
 		$result = $runner->onMediaWikiPerformAction( $output, $article, $title, $user, $request, $wiki );
 		$this->assertTrue( $result );
 	}
+
+	/**
+	 * @covers ::denyAccess
+	 */
+	public function testDenyAccessSetsCorrectStatusAndContent() {
+		$output = $this->createMock( self::$outputPageClassName );
+		$output->expects( $this->once() )->method( 'clearHTML' );
+		$output->expects( $this->once() )->method( 'setStatusCode' )->with( 403 );
+		$output->expects( $this->once() )->method( 'addWikiTextAsInterface' );
+		$output->expects( $this->once() )->method( 'returnToMain' );
+
+		$hooks = new Hooks();
+		$reflection = new \ReflectionClass( $hooks );
+		$method = $reflection->getMethod( 'denyAccess' );
+		$method->setAccessible( true );
+		$method->invoke( $hooks, $output );
+	}
 }