At the moment the action=userrights modules makes nothing, when the user is not allow to change any userrights or one of the specified userrights. It is better to get a api error in this case.
Thanks.
You can call UserrightsPage::userCanChangeRights to check if the user can change any userrights.
Version: 1.20.x
Severity: normal
| Title | Reference | Author | Source Branch | Dest Branch | |
|---|---|---|---|---|---|
| ldap: escape cn values when searching | toolforge-repos/gitlab-account-approval!13 | bd808 | work/bd808/escape-ldap-search-input | main |
Currently, UserrightsPage (Special:UserRights) includes a userCanChangeRights function. A similar functionality is needed in the api. I suggest adding a function, either to User or UserGroupManager[1] to see if a user can change rights for a specified target user, to avoid publication. Since userCanChangeRights is used by SkinTemplate, SpecialContributions, and MediaWiki-extensions-CleanChanges I think it makes more sense to move it out of the special page file. Thoughts?
[1] Doesn't exist yet, see https://gerrit.wikimedia.org/r/#/c/mediawiki/core/+/545690/