Change Details

== Summary Currently the `revisions` API allows a user to search for revisions with a specified private tag even if the user cannot see said private tag == Steps to reproduce # Define a private tag that only users with a specific right can see (not given to anon users) # Add the private tag to an edit # Open `Special:ApiSandbox` while logged out # Use the `revisions` query API, with the tag filter set to the private tag you defined above # Run the API query ==== What happens The revision that has the private tag is shown. While the tags for that revision properly hide the tag (as addressed in T431667), the existence of the tag in the result still means you know the revision has the tag on the edit == Acceptance criteria * [ ] The `ApiQueryRevisions` class pretends the tag does not exist if the user cannot see it

== Summary Currently the `revisions` API allows a user to search for revisions with a specified private tag even if the user cannot see said private tag == Steps to reproduce # Define a private tag that only users with a specific right can see (not given to anon users) # Add the private tag to an edit # Open `Special:ApiSandbox` while logged out # Use the `revisions` query API, with the tag filter set to the private tag you defined above # Run the API query ==== What happens The revision that has the private tag is shown. While the tags for that revision properly hide the tag (as addressed in T431667), the existence of the tag in the result still means you know the revision has the tag on the edit == Acceptance criteria * [ ] The `ApiQueryRevisions` class pretends the tag does not exist if the user cannot see it * [ ] A search for other APIs that allow searching by tag is done and those APIs are fixed too

== Summary Currently the `revisions` API allows a user to search for revisions with a specified private tag even if the user cannot see said private tag == Steps to reproduce # Define a private tag that only users with a specific right can see (not given to anon users) # Add the private tag to an edit # Open `Special:ApiSandbox` while logged out # Use the `revisions` query API, with the tag filter set to the private tag you defined above # Run the API query ==== What happens The revision that has the private tag is shown. While the tags for that revision properly hide the tag (as addressed in T431667), the existence of the tag in the result still means you know the revision has the tag on the edit == Acceptance criteria * [ ] The `ApiQueryRevisions` class pretends the tag does not exist if the user cannot see it * [ ] A search for other APIs that allow searching by tag is done and those APIs are fixed too