r88574 MediaWiki - Code Review archive

Repository:MediaWiki
Revision:r88573‎ | r88574 | r88575 >
Date:13:31, 22 May 2011
Author:werdna
Status:ok
Tags:
Comment:
LiquidThreads: permissions checks for some API actions were missing
Modified paths:
  • /trunk/extensions/LiquidThreads/api/ApiThreadAction.php (modified) (history)
  • /trunk/extensions/LiquidThreads/classes/View.php (modified) (history)
  • /trunk/extensions/LiquidThreads/lqt.js (modified) (history)

Diff [purge]

Index: trunk/extensions/LiquidThreads/classes/View.php
@@ -354,7 +354,7 @@
355355 }
356356
357357 /**
358 - * Workaround for bugs caused by r82686
 358+ * Workaround for bug 27887 caused by r82686
359359 * @param $request FauxRequest object to have session data injected into.
360360 */
361361 static function fixFauxRequestSession( $request ) {
@@ -1876,6 +1876,10 @@
18771877 } else {
18781878 $class .= ' lqt-thread-no-subthreads';
18791879 }
 1880+
 1881+ if ( ! $thread->title()->userCan('edit') ) {
 1882+ $class .= ' lqt-thread-uneditable';
 1883+ }
18801884
18811885 $class .= ' lqt-thread-wrapper';
18821886
Index: trunk/extensions/LiquidThreads/api/ApiThreadAction.php
@@ -108,6 +108,13 @@
109109 }
110110
111111 $thread = array_pop( $threads );
 112+
 113+ global $wgUser;
 114+ $errors = $thread->title()->getUserPermissionsErrors( 'lqt-split', $wgUser );
 115+ if ( $errors ) {
 116+ // We don't care about multiple errors, just report one of them
 117+ $this->dieUsageMsg( reset( $errors ) );
 118+ }
112119
113120 if ( $thread->isTopmostThread() ) {
114121 $this->dieUsage( 'This thread is already a top-level thread.',
@@ -175,6 +182,13 @@
176183 $article = new Article( $title, 0 );
177184 $newParent = Threads::withRoot( $article );
178185 }
 186+
 187+ global $wgUser;
 188+ $errors = $newParent->title()->getUserPermissionsErrors( 'lqt-merge', $wgUser );
 189+ if ( $errors ) {
 190+ // We don't care about multiple errors, just report one of them
 191+ $this->dieUsageMsg( reset( $errors ) );
 192+ }
179193
180194 if ( !$newParent ) {
181195 $this->dieUsage( 'The parent thread you specified was neither the title ' .
@@ -605,6 +619,13 @@
606620 'no-specified-threads' );
607621 }
608622 $thread = array_pop( $threads );
 623+
 624+ global $wgUser;
 625+ $errors = $thread->title()->getUserPermissionsErrors( 'edit', $wgUser );
 626+ if ( $errors ) {
 627+ // We don't care about multiple errors, just report one of them
 628+ $this->dieUsageMsg( reset( $errors ) );
 629+ }
609630
610631 // Validate subject
611632 if ( empty( $params['subject'] ) ) {
@@ -677,6 +698,14 @@
678699 }
679700
680701 $thread = array_pop( $threads );
 702+
 703+ global $wgUser;
 704+ $errors = $thread->title()->getUserPermissionsErrors( 'edit', $wgUser );
 705+ if ( $errors ) {
 706+ // We don't care about multiple errors, just report one of them
 707+ $this->dieUsageMsg( reset( $errors ) );
 708+ }
 709+
681710 $thread->setSortkey( $ts );
682711 $thread->commitRevision( Threads::CHANGE_ADJUSTED_SORTKEY, null, $reason );
683712
Index: trunk/extensions/LiquidThreads/lqt.js
@@ -378,7 +378,9 @@
379379 },
380380
381381 'setupThreadMenu' : function( menu, id ) {
382 - if ( menu.find('.lqt-command-edit-subject').length ) {
 382+ if ( menu.find('.lqt-command-edit-subject').length ||
 383+ menu.closest('.lqt_thread').is('.lqt-thread-uneditable')
 384+ ) {
383385 return;
384386 }
385387

Status & tagging log