resourceloader: Add tests for disallowing access to private modules

[lhc/web/wiklou.git] / includes / EditPage.php

diff --git a/includes/EditPage.php b/includes/EditPage.php
index d27ef9c..d0a5080 100644 (file)
--- a/includes/EditPage.php
+++ b/includes/EditPage.php
@@ -25,6 +25,7 @@ use MediaWiki\EditPage\TextboxBuilder;
 use MediaWiki\EditPage\TextConflictHelper;
 use MediaWiki\Logger\LoggerFactory;
 use MediaWiki\MediaWikiServices;
+use MediaWiki\Storage\RevisionRecord;
 use Wikimedia\ScopedCallback;
 
 /**
@@ -621,7 +622,7 @@ class EditPage {
                        wfDebug( __METHOD__ . ": User can't edit\n" );
 
                        if ( $this->context->getUser()->getBlock() ) {
-                               // track block with a cookie if it doesn't exists already
+                               // Track block with a cookie if it doesn't exist already
                                MediaWikiServices::getInstance()->getBlockManager()
                                        ->trackBlockWithCookie( $this->context->getUser() );
 
@@ -1222,8 +1223,8 @@ class EditPage {
                                # the revisions exist and they were not deleted.
                                # Otherwise, $content will be left as-is.
                                if ( !is_null( $undorev ) && !is_null( $oldrev ) &&
-                                       !$undorev->isDeleted( Revision::DELETED_TEXT ) &&
-                                       !$oldrev->isDeleted( Revision::DELETED_TEXT )
+                                       !$undorev->isDeleted( RevisionRecord::DELETED_TEXT ) &&
+                                       !$oldrev->isDeleted( RevisionRecord::DELETED_TEXT )
                                ) {
                                        if ( WikiPage::hasDifferencesOutsideMainSlot( $undorev, $oldrev )
                                                || !$this->isSupportedContentModel( $oldrev->getContentModel() )
@@ -1245,7 +1246,7 @@ class EditPage {
                                        }
 
                                        if ( $undoMsg === null ) {
-                                               $oldContent = $this->page->getContent( Revision::RAW );
+                                               $oldContent = $this->page->getContent( RevisionRecord::RAW );
                                                $popts = ParserOptions::newFromUserAndLang(
                                                        $user, MediaWikiServices::getInstance()->getContentLanguage() );
                                                $newContent = $content->preSaveTransform( $this->mTitle, $user, $popts );
@@ -1371,7 +1372,7 @@ class EditPage {
                        $handler = ContentHandler::getForModelID( $this->contentModel );
                        return $handler->makeEmptyContent();
                }
-               $content = $revision->getContent( Revision::FOR_THIS_USER, $user );
+               $content = $revision->getContent( RevisionRecord::FOR_THIS_USER, $user );
                return $content;
        }
 
@@ -1405,7 +1406,7 @@ class EditPage {
         */
        protected function getCurrentContent() {
                $rev = $this->page->getRevision();
-               $content = $rev ? $rev->getContent( Revision::RAW ) : null;
+               $content = $rev ? $rev->getContent( RevisionRecord::RAW ) : null;
 
                if ( $content === false || $content === null ) {
                        $handler = ContentHandler::getForModelID( $this->contentModel );
@@ -1496,7 +1497,7 @@ class EditPage {
                }
 
                $parserOptions = ParserOptions::newFromUser( $user );
-               $content = $page->getContent( Revision::RAW );
+               $content = $page->getContent( RevisionRecord::RAW );
 
                if ( !$content ) {
                        // TODO: somehow show a warning to the user!
@@ -1592,7 +1593,8 @@ class EditPage {
                // This is needed since PageUpdater no longer checks these rights!
 
                // Allow bots to exempt some edits from bot flagging
-               $bot = $this->context->getUser()->isAllowed( 'bot' ) && $this->bot;
+               $permissionManager = MediaWikiServices::getInstance()->getPermissionManager();
+               $bot = $permissionManager->userHasRight( $this->context->getUser(), 'bot' ) && $this->bot;
                $status = $this->internalAttemptSave( $resultDetails, $bot );
 
                Hooks::run( 'EditPage::attemptSave:after', [ $this, $status, $resultDetails ] );
@@ -1869,6 +1871,7 @@ ERROR;
        public function internalAttemptSave( &$result, $bot = false ) {
                $status = Status::newGood();
                $user = $this->context->getUser();
+               $permissionManager = MediaWikiServices::getInstance()->getPermissionManager();
 
                if ( !Hooks::run( 'EditPage::attemptSave', [ $this ] ) ) {
                        wfDebug( "Hook 'EditPage::attemptSave' aborted article saving\n" );
@@ -1917,7 +1920,7 @@ ERROR;
                # Check image redirect
                if ( $this->mTitle->getNamespace() == NS_FILE &&
                        $textbox_content->isRedirect() &&
-                       !$user->isAllowed( 'upload' )
+                       !$permissionManager->userHasRight( $user, 'upload' )
                ) {
                                $code = $user->isAnon() ? self::AS_IMAGE_REDIRECT_ANON : self::AS_IMAGE_REDIRECT_LOGGED;
                                $status->setResult( false, $code );
@@ -1967,7 +1970,7 @@ ERROR;
                        return $status;
                }
 
-               if ( $user->isBlockedFrom( $this->mTitle ) ) {
+               if ( $permissionManager->isBlockedFrom( $user, $this->mTitle ) ) {
                        // Auto-block user's IP if the account was "hard" blocked
                        if ( !wfReadOnly() ) {
                                $user->spreadAnyEditBlock();
@@ -1987,7 +1990,7 @@ ERROR;
                        return $status;
                }
 
-               if ( !$user->isAllowed( 'edit' ) ) {
+               if ( !$permissionManager->userHasRight( $user, 'edit' ) ) {
                        if ( $user->isAnon() ) {
                                $status->setResult( false, self::AS_READ_ONLY_PAGE_ANON );
                                return $status;
@@ -1998,15 +2001,13 @@ ERROR;
                        }
                }
 
-               $permissionManager = MediaWikiServices::getInstance()->getPermissionManager();
-
                $changingContentModel = false;
                if ( $this->contentModel !== $this->mTitle->getContentModel() ) {
                        if ( !$config->get( 'ContentHandlerUseDB' ) ) {
                                $status->fatal( 'editpage-cannot-use-custom-model' );
                                $status->value = self::AS_CANNOT_USE_CUSTOM_MODEL;
                                return $status;
-                       } elseif ( !$user->isAllowed( 'editcontentmodel' ) ) {
+                       } elseif ( !$permissionManager->userHasRight( $user, 'editcontentmodel' ) ) {
                                $status->setResult( false, self::AS_NO_CHANGE_CONTENT_MODEL );
                                return $status;
                        }
@@ -3139,12 +3140,12 @@ ERROR;
                                if ( $revision ) {
                                        // Let sysop know that this will make private content public if saved
 
-                                       if ( !$revision->userCan( Revision::DELETED_TEXT, $user ) ) {
+                                       if ( !$revision->userCan( RevisionRecord::DELETED_TEXT, $user ) ) {
                                                $out->wrapWikiMsg(
                                                        "<div class='mw-warning plainlinks'>\n$1\n</div>\n",
                                                        'rev-deleted-text-permission'
                                                );
-                                       } elseif ( $revision->isDeleted( Revision::DELETED_TEXT ) ) {
+                                       } elseif ( $revision->isDeleted( RevisionRecord::DELETED_TEXT ) ) {
                                                $out->wrapWikiMsg(
                                                        "<div class='mw-warning plainlinks'>\n$1\n</div>\n",
                                                        'rev-deleted-text-view'
@@ -4158,7 +4159,8 @@ ERROR;
 
                $user = $this->context->getUser();
                // don't show the minor edit checkbox if it's a new page or section
-               if ( !$this->isNew && $user->isAllowed( 'minoredit' ) ) {
+               $permissionManager = MediaWikiServices::getInstance()->getPermissionManager();
+               if ( !$this->isNew && $permissionManager->userHasRight( $user, 'minoredit' ) ) {
                        $checkboxes['wpMinoredit'] = [
                                'id' => 'wpMinoredit',
                                'label-message' => 'minoredit',
@@ -4445,8 +4447,8 @@ ERROR;
        protected function addPageProtectionWarningHeaders() {
                $out = $this->context->getOutput();
                if ( $this->mTitle->isProtected( 'edit' ) &&
-                       MediaWikiServices::getInstance()->getNamespaceInfo()->getRestrictionLevels(
-                               $this->mTitle->getNamespace()
+                       MediaWikiServices::getInstance()->getPermissionManager()->getNamespaceRestrictionLevels(
+                               $this->getTitle()->getNamespace()
                        ) !== [ '' ]
                ) {
                        # Is the title semi-protected?