Author: wwerawrko
Description:
If a user group is given the 'editprotected' right, and then a specific protection right is revoked, the revoking doesn't work.
For example:
$wgGroupPermissions['mygroup']['editprotected'] = true;
$wgRevokePermissions['mygroup']['mylevel'] = true;
I would expect that in this case, if a page was protected to the 'mylevel' level, then the 'mygroup' group would not be able to edit that page. The actual outcome is that revoking the 'mylevel' right has no affect.
In addition, if the 'mygroup' group also has the 'protect' permission, they can unprotect the page to a lower level.
For example:
$wgGroupPermissions['mygroup']['protect'] = true;
$wgGroupPermissions['mygroup']['editprotected'] = true;
$wgGroupPermissions['mygroup']['someotherlevel'] = true;
$wgRevokePermissions['mygroup']['mylevel'] = true;
I would expect that in this case, if a page was protected to the 'mylevel' level, then the 'mygroup' group would not be able to unprotect the page. The actual outcome is that they can unprotect it, and/or change the protection level to 'someotherlevel', which in my case is a lower level.
Version: unspecified
Severity: minor