Page MenuHomePhabricator

"rcshowhidepatr" is shown even if the user is not authorized to patrol
Closed, InvalidPublic

Description

Author: rotemliss

Description:
Bug #5409 is fixed, but "rcshowhidepatr" is shown even if the user is not
authorized to patrol. (The exclamation mark and the change in "diff" are not
shown if the user is not authorized.)

These are the cases (when the user is sysop, of course):

Case 1:

  • $wgUseRCPatrol = true;
  • $wgGroupPermissions["sysop"]["patrol"] = true;

Results (normal):

  • rcshowhidepatr is shown.
  • The exclamation mark and the change in "diff" are shown.

Case 2:

  • $wgUseRCPatrol = false;
  • $wgGroupPermissions["sysop"]["patrol"] = true;

Results (normal):

  • rcshowhidepatr is not shown.
  • The exclamation mark and the change in "diff" are not shown.

Case 3:

  • $wgUseRCPatrol = true;
  • $wgGroupPermissions["sysop"]["patrol"] = false;

Results (not normal):

  • rcshowhidepatr is *shown*.
  • The exclamation mark and the change in "diff" are not shown.

Case 4:

  • $wgUseRCPatrol = false;
  • $wgGroupPermissions["sysop"]["patrol"] = false;

Results (normal):

  • rcshowhidepatr is not shown.
  • The exclamation mark and the change in "diff" are not shown.

The "rcshowhidepatr" is shown whenever $wgUseRCPatrol is true, and the system
doesn't check whether the user has the "patrol" permission or not. The function
"usePatrol()" of the recent changes list does check it.


Version: unspecified
Severity: normal

Details

Reference
bz5515

Event Timeline

bzimport raised the priority of this task from to Medium.Nov 21 2014, 9:11 PM
bzimport set Reference to bz5515.
bzimport added a subscriber: Unknown Object (MLST).

robchur wrote:

This is intended behaviour.

rotemliss wrote:

So we should also show the exclamation mark even for users without the "patrol"
permission (although we shouldn't change the "diff" link), for they will be able
to know what is patrolled and what is not patrolled.