Page MenuHomePhabricator

Special:SpecialPages - userCanExecute should accept multiple possible options
Open, Needs TriagePublic

Description

Steps to reproduce:

  • Add an account to a user group that contains importupload but not import rights
  • Visit Special:SpecialPages

Expected result:
Since users with importupload but not import rights can use Special:Import, it is listed

Actual result:
Since SpecialImport::mRestriction is based solely on import rights, the special page isn't shown

Proposed solution:
Change SpecialPage::__construct and SpecialPage::mRestriction to accept either a string of a single right needed, or an array of possible rights needed

Backwards compatibility:
providing a string or no restriction continues to work as before
overriding userCanExecute continues to work as before

This would also be helpful for T226926 and T92795 by making it easier for a special page to require that the user have "one of" some rights

Event Timeline

Restricted Application added a project: User-DannyS712. · View Herald TranscriptDec 21 2019, 9:19 AM
Restricted Application added a subscriber: Aklapper. · View Herald Transcript

When changing the string to array it is not possible to declare if all or any of the rights are needed. It seems better to override the function and calling userHasAnyRight with both rights

When changing the string to array it is not possible to declare if all or any of the rights are needed. It seems better to override the function and calling userHasAnyRight with both rights

To clarify, are you saying that (in this case for SpecialImport) rather than specifying a restriction, specify no restriction (via mRestriction) and instead validate by overriding userHasRight?

DannyS712 moved this task from Unsorted to Next on the User-DannyS712 board.Dec 22 2019, 4:28 AM

It is only a possible way to implement this

You have to specify mRestriction to make the permission error looks good (The restriction is used in displayRestrictionError)