T230402.patch
Rxy (rxy)
Actions

Authored By

	Rxy
	Aug 13 2019, 10:04 AM

Size

1 KB

Referenced Files

None

Subscribers

None

T230402.patch
View Options

	From 5e49f3a29f5fabf27cf54da9faf06bfa8ca8f876 Mon Sep 17 00:00:00 2001
	From: rxy <wikitech.rxy@rxy.jp>
	Date: Tue, 13 Aug 2019 18:30:38 +0900
	Subject: [PATCH] Add permission check for suppressed account

	Bug: T230402
	Change-Id: I6a13859be81e5c746bdf0993eb5416fecdac2306
	---
	includes/specials/SpecialRedirect.php \| 5 +++++
	1 file changed, 5 insertions(+)

	diff --git a/includes/specials/SpecialRedirect.php b/includes/specials/SpecialRedirect.php
	index c1409ffd6f..91f43c6cfb 100644
	--- a/includes/specials/SpecialRedirect.php
	+++ b/includes/specials/SpecialRedirect.php
	@@ -83,6 +83,11 @@ class SpecialRedirect extends FormSpecialPage {
	// Message: redirect-not-exists
	return Status::newFatal( $this->getMessagePrefix() . '-not-exists' );
	}
	+ if ( $user->isHidden() && !MediaWikiServices::getInstance()->getPermissionManager()
	+ ->userHasRight( $this->getUser(), 'hideuser' )
	+ ) {
	+ throw new PermissionsError( 'hideuser' );
	+ }
	$userpage = Title::makeTitle( NS_USER, $username );

	return Status::newGood( $userpage->getFullURL( '', false, PROTO_CURRENT ) );
	--
	2.11.0

Attached To	Mode
T239494: Requesting access to LogStash for rxy	Attached	Detach File
T230402: Exposed suppressed username via Special:Redirect	Attached	Detach File