Page MenuHomePhabricator
Files F3888227

T132653
No One
Actions

Authored By
phuedx
Apr 18 2016, 9:59 AM
Size
2 KB
Referenced Files
None
Subscribers
None

T132653
View Options

From 6756575f038ea95ecade6e546bf633601f256542 Mon Sep 17 00:00:00 2001
From: Sam Smith <git@samsmith.io>
Date: Mon, 18 Apr 2016 10:53:13 +0100
Subject: [PATCH] SECURITY: Don't list deleted edits without rights
If the current user doesn't have the appropriate rights, then don't list
deleted or suppressed edits in a user's contributions.
Bug: T132653
Change-Id: Ib5e56a93af771c11412023c789d65ef53b8415f8
---
includes/specials/SpecialMobileContributions.php | 20 +++++++++++++++++++-
1 file changed, 19 insertions(+), 1 deletion(-)
diff --git a/includes/specials/SpecialMobileContributions.php b/includes/specials/SpecialMobileContributions.php
index 01488ca..2a9b29f 100644
--- a/includes/specials/SpecialMobileContributions.php
+++ b/includes/specials/SpecialMobileContributions.php
@@ -168,6 +168,8 @@ class SpecialMobileContributions extends SpecialMobileHistory {
*/
protected function getQueryConditions() {
$conds = array();
+ $dbr = wfGetDB( DB_SLAVE, self::DB_REVISIONS_TABLE );
+
if ( $this->user ) {
if ( $this->user->getId() ) {
$conds['rev_user'] = $this->user->getId();
@@ -175,8 +177,24 @@ class SpecialMobileContributions extends SpecialMobileHistory {
$conds['rev_user_text'] = $this->user->getName();
}
}
+
+ $currentUser = $this->getContext()->getUser();
+
+ // T132653: Only list deleted/suppressed edits if the current user - not the
+ // target user (`$this->user`) – can view them.
+ //
+ // This code was taken from ContribsPager#getQueryInfo.
+ //
+ // FIXME: Make Special:MobileContributions use ContribsPager ASAP.
+ if ( $currentUser && $this->user ) {
+ if ( !$currentUser->isAllowed( 'deletedhistory' ) ) {
+ $conds[] = $dbr->bitAnd( 'rev_deleted', Revision::DELETED_USER ) . ' = 0';
+ } elseif ( !$currentUser->isAllowedAny( 'suppressrevision', 'viewsuppressed' ) ) {
+ $conds[] = $dbr->bitAnd( 'rev_deleted', Revision::SUPPRESSED_USER ) .
+ ' != ' . Revision::SUPPRESSED_USER;
+ }
+ }
if ( $this->offset ) {
- $dbr = wfGetDB( DB_SLAVE, self::DB_REVISIONS_TABLE );
$conds[] = 'rev_timestamp <= ' . $dbr->addQuotes( $this->offset );
}
return $conds;
--
2.6.4 (Apple Git-63)

File Metadata

Mime Type
text/x-diff
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
3664900
Default Alt Text
T132653 (2 KB)

Event Timeline

Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL