r65898 MediaWiki - Code Review archive

Repository:MediaWiki
Revision:r65897‎ | r65898 | r65899 >
Date:14:48, 4 May 2010
Author:btongminh
Status:ok (Comments)
Tags:
Comment:
Fix for r65818: the proper permission is 'createpage', not 'create'. Skip checking 'createpage' in isAllowed, because a user could have permission to reupload but not to upload.
Modified paths:
  • /trunk/phase3/includes/upload/UploadBase.php (modified) (history)

Diff [purge]

Index: trunk/phase3/includes/upload/UploadBase.php
@@ -83,7 +83,7 @@
8484 * @return array
8585 */
8686 public static function getRequiredPermissions() {
87 - return array( 'upload', 'create', 'edit' );
 87+ return array( 'upload', 'edit' );
8888 }
8989 /**
9090 * Returns true if the user can use this upload module or else a string
@@ -396,7 +396,11 @@
397397 }
398398 $permErrors = $nt->getUserPermissionsErrors( 'edit', $user );
399399 $permErrorsUpload = $nt->getUserPermissionsErrors( 'upload', $user );
400 - $permErrorsCreate = ( $nt->exists() ? array() : $nt->getUserPermissionsErrors( 'create', $user ) );
 400+ if ( $nt->exists() ) {
 401+ $permErrorsCreate = $nt->getUserPermissionsErrors( 'createpage', $user );
 402+ } else {
 403+ $permErrorsCreate = array();
 404+ }
401405 if( $permErrors || $permErrorsUpload || $permErrorsCreate ) {
402406 $permErrors = array_merge( $permErrors, wfArrayDiff2( $permErrorsUpload, $permErrors ) );
403407 $permErrors = array_merge( $permErrors, wfArrayDiff2( $permErrorsCreate, $permErrors ) );

Follow-up revisions

RevisionCommit summaryAuthorDate
r84573Followup r65898, fix inverse logic for title existence...reedy22:22, 22 March 2011
r90737(bug 28466) Make titleblack list consider 'createpage' action to be same as '...bawolff21:25, 24 June 2011
r96601Partial revert of r65898 (bug 27700). Callers should check 'create' and Title...aaron19:28, 8 September 2011

Past revisions this follows-up on

RevisionCommit summaryAuthorDate
r65818(bug 18408) All required permissions for uploading (upload, edit, create) are...btongminh20:34, 2 May 2010

Comments

#Comment by Mormegil (talk | contribs)   21:31, 21 March 2011

I can’t help myself: the condition is now reversed! If the title already exists, there is no point checking the createpage permission, and vice versa. (See bugzilla:28169.)

Status & tagging log