**Steps to reproduce**
- create a test account on enwiki
- use an admin account to assign it to the following user group: New Page Patroller (patroller)
- log into the patroller account
- create an article
- refresh the page. note how the PageTriage toolbar pops up, but a bunch of icons such as "mark as reviewed" are missing. this is good. this means PageTriage's **front end** is correctly detecting that you are the author and you should not be able to mark your own article as reviewed.
- now go to Special:ApiSandbox and try to mark the page as reviewed using pagetriageaction. set the pageid and set reviewed=1.
- click "make request"
**What should happen**
- should get an error
**What actually happens**
- page is marked as reviewed. the **back end** is missing the needed permissions checking code.
**Why is this a big deal?**
- If undisclosed paid editors figure this out, and have access to an account with the patrol user group, they will be able to mark their own articles as reviewed, basically getting autopatrolled without applying for it. There are many cases of undisclosed paid editors spending months to infiltrate enwiki to obtain these kinds of perms. It is lucrative for them to have their articles skip the patrol process and get indexed on google immediately.
**The fix**
- Need to edit https://github.com/wikimedia/mediawiki-extensions-PageTriage/blob/master/includes/Api/ApiPageTriageAction.php to check if page author = editing user, and if true, reject the API request