r83709 MediaWiki - Code Review archive

Repository:MediaWiki
Revision:r83708‎ | r83709 | r83710 >
Date:18:59, 11 March 2011
Author:nikerabbit
Status:ok
Tags:
Comment:
Don't expose actions to users who are not allowed to do them
Modified paths:
  • /trunk/extensions/Translate/specials/SpecialManageGroups.php (modified) (history)

Diff [purge]

Index: trunk/extensions/Translate/specials/SpecialManageGroups.php
@@ -270,13 +270,16 @@
271271 }
272272
273273 $act = array();
274 - $defaction = $fuzzy ? 'conflict' : 'import';
275274
276 - foreach ( $actions as $action ) {
277 - $label = wfMsg( "translate-manage-action-$action" );
278 - $name = MessageWebImporter::escapeNameForPHP( "action-$type-$key" );
279 - $id = Sanitizer::escapeId( "action-$key-$action" );
280 - $act[] = Xml::radioLabel( $label, $name, $action, $id, $action === $defaction );
 275+ if ( $this->user->isAllowed( 'translate-manage' ) ) {
 276+ $defaction = $fuzzy ? 'conflict' : 'import';
 277+
 278+ foreach ( $actions as $action ) {
 279+ $label = wfMsg( "translate-manage-action-$action" );
 280+ $name = MessageWebImporter::escapeNameForPHP( "action-$type-$key" );
 281+ $id = Sanitizer::escapeId( "action-$key-$action" );
 282+ $act[] = Xml::radioLabel( $label, $name, $action, $id, $action === $defaction );
 283+ }
281284 }
282285
283286 $name = wfMsg( 'translate-manage-import-diff',
@@ -331,8 +334,10 @@
332335 }
333336 $this->out->addHTML( Html::hidden( 'language', $code ) );
334337 $this->out->addHTML( implode( "\n", $changed ) );
335 - $this->out->addHTML( Xml::submitButton( wfMsg( 'translate-manage-submit' ) ) );
336 - } else {
 338+ if ( $this->user->isAllowed( 'translate-manage' ) ) {
 339+ $this->out->addHTML( Xml::submitButton( wfMsg( 'translate-manage-submit' ) ) );
 340+ }
 341+ } elseif( $this->user->isAllowed( 'translate-manage' ) ) {
337342 $cache->create(); // Update timestamp
338343 $this->out->addWikiMsg( 'translate-manage-nochanges' );
339344 }
@@ -395,17 +400,21 @@
396401 'action' => $this->getTitle()->getFullURL( array( 'group' => $group->getId() ) ),
397402 );
398403
399 - $this->out->addHTML(
400 - Xml::openElement( 'form', $formParams ) .
401 - Html::hidden( 'title', $this->getTitle()->getPrefixedText() ) .
402 - Html::hidden( 'token', $this->user->editToken() ) .
403 - Html::hidden( 'group', $group->getId() ) .
404 - Html::hidden( 'codes', implode( ',', $codes ) ) .
405 - Html::hidden( 'rebuildall', 1 ) .
406 - Xml::submitButton( wfMsg( 'translate-manage-import-rebuild-all' ) ) .
407 - Xml::closeElement( 'form' )
408 - );
 404+ if ( $this->user->isAllowed( 'translate-manage' ) ) {
409405
 406+ $this->out->addHTML(
 407+ Xml::openElement( 'form', $formParams ) .
 408+ Html::hidden( 'title', $this->getTitle()->getPrefixedText() ) .
 409+ Html::hidden( 'token', $this->user->editToken() ) .
 410+ Html::hidden( 'group', $group->getId() ) .
 411+ Html::hidden( 'codes', implode( ',', $codes ) ) .
 412+ Html::hidden( 'rebuildall', 1 ) .
 413+ Xml::submitButton( wfMsg( 'translate-manage-import-rebuild-all' ) ) .
 414+ Xml::closeElement( 'form' )
 415+ );
 416+
 417+ }
 418+
410419 $this->out->addHTML(
411420 '<ul><li>' . implode( "</li>\n<li>", $modified ) . '</li></ul>'
412421 );

Status & tagging log