| Index: trunk/extensions/ArticleFeedbackv5/api/ApiFlagFeedbackArticleFeedbackv5.php |
| — | — | @@ -45,6 +45,9 @@ |
| 46 | 46 | $direction = isset( $params['direction'] ) ? $params['direction'] : 'increase'; |
| 47 | 47 | $where = array( 'af_id' => $feedbackId ); |
| 48 | 48 | |
| | 49 | + // woah, we were not checking for permissions (that could have been script kiddy bad) |
| | 50 | + global $wgUser; |
| | 51 | + |
| 49 | 52 | // we use ONE db connection that talks to master |
| 50 | 53 | $dbw = wfGetDB( DB_MASTER ); |
| 51 | 54 | $dbw->begin(); |
| — | — | @@ -56,7 +59,7 @@ |
| 57 | 60 | // no-op, because this is already broken |
| 58 | 61 | $error = 'articlefeedbackv5-invalid-feedback-id'; |
| 59 | 62 | |
| 60 | | - } elseif ( 'delete' == $flag ) { |
| | 63 | + } elseif ( 'delete' == $flag && $wgUser->isAllowed( 'aftv5-delete-feedback' )) { |
| 61 | 64 | |
| 62 | 65 | // deleting means to "mark as oversighted" and "delete" it |
| 63 | 66 | // oversighting also auto-hides the item |
| — | — | @@ -96,7 +99,7 @@ |
| 97 | 100 | $filters['notdeleted'] = 1; |
| 98 | 101 | } |
| 99 | 102 | |
| 100 | | - } elseif ( 'hide' == $flag ) { |
| | 103 | + } elseif ( 'hide' == $flag && $wgUser->isAllowed( 'aftv5-hide-feedback' )) { |
| 101 | 104 | |
| 102 | 105 | // increase means "hide this" |
| 103 | 106 | if( $direction == 'increase' ) { |
| — | — | @@ -118,7 +121,7 @@ |
| 119 | 122 | $filters = $this->changeFilterCounts( $record, $filters, 'show' ); |
| 120 | 123 | } |
| 121 | 124 | |
| 122 | | - } elseif( 'resetoversight' === $flag) { |
| | 125 | + } elseif( 'resetoversight' === $flag && $wgUser->isAllowed( 'aftv5-delete-feedback' )) { |
| 123 | 126 | |
| 124 | 127 | $activity = 'decline'; |
| 125 | 128 | // oversight request count becomes 0 |
| — | — | @@ -193,7 +196,7 @@ |
| 194 | 197 | } |
| 195 | 198 | |
| 196 | 199 | // NOTE: this is actually request/unrequest oversight and works similar to abuse |
| 197 | | - } elseif( 'oversight' === $flag) { |
| | 200 | + } elseif( 'oversight' === $flag && $wgUser->isAllowed( 'aftv5-hide-feedback' )) { |
| 198 | 201 | |
| 199 | 202 | if($direction == 'increase') { |
| 200 | 203 | $activity = 'request'; |