r85099 MediaWiki - Code Review archive

Repository:MediaWiki
Revision:r85098‎ | r85099 | r85100 >
Date:23:09, 31 March 2011
Author:happy-melon
Status:ok
Tags:
Comment:
Fix for r85005: the getUserPermissionsErrors() calls were each returning a badaccess error when the user didn't have their particular permission, even if they had the other one, exclude these errors since they're already covered by the $user->isAllowedAny() check above. Also fix processForm() to check isAllowed('import') for transwiki; this wasn't being done which meant users with importupload but not import (an unlikely combination to be fair) could still spoof the form.
Modified paths:
  • /trunk/phase3/includes/specials/SpecialImport.php (modified) (history)

Diff [purge]

Index: trunk/phase3/includes/specials/SpecialImport.php
@@ -71,9 +71,16 @@
7272 # FIXME: Title::checkSpecialsAndNSPermissions() has a very wierd expectation of what
7373 # getUserPermissionsErrors() might actually be used for, hence the 'ns-specialprotected'
7474 $errors = wfMergeErrorArrays(
75 - $this->getTitle()->getUserPermissionsErrors( 'import', $wgUser, true, array( 'ns-specialprotected' ) ),
76 - $this->getTitle()->getUserPermissionsErrors( 'importupload', $wgUser, true, array( 'ns-specialprotected' ) )
 75+ $this->getTitle()->getUserPermissionsErrors(
 76+ 'import', $wgUser, true,
 77+ array( 'ns-specialprotected', 'badaccess-group0', 'badaccess-groups' )
 78+ ),
 79+ $this->getTitle()->getUserPermissionsErrors(
 80+ 'importupload', $wgUser, true,
 81+ array( 'ns-specialprotected', 'badaccess-group0', 'badaccess-groups' )
 82+ )
7783 );
 84+
7885 if( $errors ){
7986 $wgOut->showPermissionsErrorPage( $errors );
8087 return;
@@ -107,6 +114,9 @@
108115 return $wgOut->permissionRequired( 'importupload' );
109116 }
110117 } elseif ( $sourceName == "interwiki" ) {
 118+ if( !$wgUser->isAllowed( 'import' ) ){
 119+ return $wgOut->permissionRequired( 'import' );
 120+ }
111121 $this->interwiki = $wgRequest->getVal( 'interwiki' );
112122 if ( !in_array( $this->interwiki, $wgImportSources ) ) {
113123 $source = Status::newFatal( "import-invalid-interwiki" );

Follow-up revisions

RevisionCommit summaryAuthorDate
r85101MFT r85099platonides23:27, 31 March 2011
r85102MFT r85099platonides23:29, 31 March 2011
r85103MFT r85099reedy23:34, 31 March 2011

Past revisions this follows-up on

RevisionCommit summaryAuthorDate
r85005(bug 15641) tweak Title::checkUserBlock() so that Title::getUserPermissionsEr...happy-melon12:53, 30 March 2011

Status & tagging log