| Index: branches/REL1_16/phase3/includes/specials/SpecialImport.php |
| — | — | @@ -45,7 +45,7 @@ |
| 46 | 46 | * Execute |
| 47 | 47 | */ |
| 48 | 48 | function execute( $par ) { |
| 49 | | - global $wgRequest; |
| | 49 | + global $wgRequest, $wgUser, $wgOut; |
| 50 | 50 | |
| 51 | 51 | $this->setHeaders(); |
| 52 | 52 | $this->outputHeader(); |
| — | — | @@ -56,6 +56,21 @@ |
| 57 | 57 | return; |
| 58 | 58 | } |
| 59 | 59 | |
| | 60 | + if( !$wgUser->isAllowed( 'import' ) && !$wgUser->isAllowed( 'importupload' ) ) |
| | 61 | + return $wgOut->permissionRequired( 'import' ); |
| | 62 | + |
| | 63 | + # TODO: allow Title::getUserPermissionsErrors() to take an array |
| | 64 | + # FIXME: Title::checkSpecialsAndNSPermissions() has a very wierd expectation of what |
| | 65 | + # getUserPermissionsErrors() might actually be used for, hence the 'ns-specialprotected' |
| | 66 | + $errors = wfMergeErrorArrays( |
| | 67 | + $this->getTitle()->getUserPermissionsErrors( 'import', $wgUser, true, array( 'ns-specialprotected' ) ), |
| | 68 | + $this->getTitle()->getUserPermissionsErrors( 'importupload', $wgUser, true, array( 'ns-specialprotected' ) ) |
| | 69 | + ); |
| | 70 | + if( $errors ){ |
| | 71 | + $wgOut->showPermissionsErrorPage( $errors ); |
| | 72 | + return; |
| | 73 | + } |
| | 74 | + |
| 60 | 75 | if ( $wgRequest->wasPosted() && $wgRequest->getVal( 'action' ) == 'submit' ) { |
| 61 | 76 | $this->doImport(); |
| 62 | 77 | } |
| — | — | @@ -133,8 +148,6 @@ |
| 134 | 149 | |
| 135 | 150 | private function showForm() { |
| 136 | 151 | global $wgUser, $wgOut, $wgRequest, $wgImportSources, $wgExportMaxLinkDepth; |
| 137 | | - if( !$wgUser->isAllowed( 'import' ) && !$wgUser->isAllowed( 'importupload' ) ) |
| 138 | | - return $wgOut->permissionRequired( 'import' ); |
| 139 | 152 | |
| 140 | 153 | $action = $this->getTitle()->getLocalUrl( array( 'action' => 'submit' ) ); |
| 141 | 154 | |
| Index: branches/REL1_16/phase3/RELEASE-NOTES |
| — | — | @@ -44,6 +44,11 @@ |
| 45 | 45 | you have the DBA extension for PHP installed, this will improve performance |
| 46 | 46 | further. |
| 47 | 47 | |
| | 48 | +== Changes since 1.16.2 == |
| | 49 | +* (bug 15641) Fixed permissions checks in Special:Import which allowed users |
| | 50 | + without the 'import' permission to import pages from the configured import |
| | 51 | + sources. |
| | 52 | + |
| 48 | 53 | == Changes since 1.16.1 == |
| 49 | 54 | |
| 50 | 55 | * (bug 26642) Fixed incorrect translated namespace due to a regression in the |
| Property changes on: branches/REL1_16/phase3/RELEASE-NOTES |
| ___________________________________________________________________ |
| Added: svn:mergeinfo |
| 51 | 56 | Merged /trunk/phase3/RELEASE-NOTES:r85006 |