SECURITY: Do not allow users to undelete a page they can't edit or create

[lhc/web/wiklou.git] / includes / api / ApiUndelete.php

diff --git a/includes/api/ApiUndelete.php b/includes/api/ApiUndelete.php
index f4fcb06..3aa7b60 100644 (file)
--- a/includes/api/ApiUndelete.php
+++ b/includes/api/ApiUndelete.php
@@ -33,18 +33,27 @@ class ApiUndelete extends ApiBase {
                $this->useTransactionalTimeLimit();
 
                $params = $this->extractRequestParams();
-               $user = $this->getUser();
-               if ( !$user->isAllowed( 'undelete' ) ) {
-                       $this->dieUsageMsg( 'permdenied-undelete' );
-               }
 
+               $user = $this->getUser();
                if ( $user->isBlocked() ) {
                        $this->dieBlocked( $user->getBlock() );
                }
 
                $titleObj = Title::newFromText( $params['title'] );
                if ( !$titleObj || $titleObj->isExternal() ) {
-                       $this->dieUsageMsg( [ 'invalidtitle', $params['title'] ] );
+                       $this->dieWithError( [ 'apierror-invalidtitle', wfEscapeWikiText( $params['title'] ) ] );
+               }
+
+               if ( !$titleObj->userCan( 'undelete', $user, 'secure' ) ) {
+                       $this->dieWithError( 'permdenied-undelete' );
+               }
+
+               // Check if user can add tags
+               if ( !is_null( $params['tags'] ) ) {
+                       $ableToTag = ChangeTags::canAddTagsAccompanyingChange( $params['tags'], $user );
+                       if ( !$ableToTag->isOK() ) {
+                               $this->dieStatus( $ableToTag );
+                       }
                }
 
                // Convert timestamps
@@ -64,10 +73,11 @@ class ApiUndelete extends ApiBase {
                        $params['reason'],
                        $params['fileids'],
                        false,
-                       $this->getUser()
+                       $user,
+                       $params['tags']
                );
                if ( !is_array( $retval ) ) {
-                       $this->dieUsageMsg( 'cannotundelete' );
+                       $this->dieWithError( 'apierror-cantundelete' );
                }
 
                if ( $retval[1] ) {
@@ -99,6 +109,10 @@ class ApiUndelete extends ApiBase {
                                ApiBase::PARAM_REQUIRED => true
                        ],
                        'reason' => '',
+                       'tags' => [
+                               ApiBase::PARAM_TYPE => 'tags',
+                               ApiBase::PARAM_ISMULTI => true,
+                       ],
                        'timestamps' => [
                                ApiBase::PARAM_TYPE => 'timestamp',
                                ApiBase::PARAM_ISMULTI => true,
@@ -134,6 +148,6 @@ class ApiUndelete extends ApiBase {
        }
 
        public function getHelpUrls() {
-               return 'https://www.mediawiki.org/wiki/API:Undelete';
+               return 'https://www.mediawiki.org/wiki/Special:MyLanguage/API:Undelete';
        }
 }