SECURITY: Add permission check for user is permitted to view the log type

[lhc/web/wiklou.git] / includes / logging / LogEventsList.php

diff --git a/includes/logging/LogEventsList.php b/includes/logging/LogEventsList.php
index 22e5b45..d97ddfd 100644 (file)
--- a/includes/logging/LogEventsList.php
+++ b/includes/logging/LogEventsList.php
@@ -60,7 +60,7 @@ class LogEventsList extends ContextSource {
         *
         * @param IContextSource|Skin $context Context to use; formerly it was
         *   a Skin object. Use of Skin is deprecated.
-        * @param LinkRenderer|null $linkRenderer, previously unused
+        * @param LinkRenderer|null $linkRenderer previously unused
         * @param int $flags Can be a combination of self::NO_ACTION_LINK,
         *   self::NO_EXTRA_USER_LINKS or self::USE_CHECKBOXES.
         */
@@ -98,8 +98,9 @@ class LogEventsList extends ContextSource {
         * @param string $user
         * @param string $page
         * @param string $pattern
-        * @param int $year Year
-        * @param int $month Month
+        * @param int|string $year Use 0 to start with no year preselected.
+        * @param int|string $month A month in the 1..12 range. Use 0 to start with no month
+        *  preselected.
         * @param array $filter
         * @param string $tagFilter Tag to select by default
         * @param string $action
@@ -426,7 +427,7 @@ class LogEventsList extends ContextSource {
        }
 
        /**
-        * @param stdClass $row Row
+        * @param stdClass $row
         * @return string
         */
        private function getShowHideLinks( $row ) {
@@ -496,7 +497,7 @@ class LogEventsList extends ContextSource {
        }
 
        /**
-        * @param stdClass $row Row
+        * @param stdClass $row
         * @param string|array $type
         * @param string|array $action
         * @param string $right
@@ -519,15 +520,16 @@ class LogEventsList extends ContextSource {
 
        /**
         * Determine if the current user is allowed to view a particular
-        * field of this log row, if it's marked as deleted.
+        * field of this log row, if it's marked as deleted and/or restricted log type.
         *
-        * @param stdClass $row Row
+        * @param stdClass $row
         * @param int $field
         * @param User $user User to check, or null to use $wgUser
         * @return bool
         */
        public static function userCan( $row, $field, User $user = null ) {
-               return self::userCanBitfield( $row->log_deleted, $field, $user );
+               return self::userCanBitfield( $row->log_deleted, $field, $user ) &&
+                       self::userCanViewLogType( $row->log_type, $user );
        }
 
        /**
@@ -558,7 +560,27 @@ class LogEventsList extends ContextSource {
        }
 
        /**
-        * @param stdClass $row Row
+        * Determine if the current user is allowed to view a particular
+        * field of this log row, if it's marked as restricted log type.
+        *
+        * @param stdClass $type
+        * @param User|null $user User to check, or null to use $wgUser
+        * @return bool
+        */
+       public static function userCanViewLogType( $type, User $user = null ) {
+               if ( $user === null ) {
+                       global $wgUser;
+                       $user = $wgUser;
+               }
+               $logRestrictions = MediaWikiServices::getInstance()->getMainConfig()->get( 'LogRestrictions' );
+               if ( isset( $logRestrictions[$type] ) && !$user->isAllowed( $logRestrictions[$type] ) ) {
+                       return false;
+               }
+               return true;
+       }
+
+       /**
+        * @param stdClass $row
         * @param int $field One of DELETED_* bitfield constants
         * @return bool
         */
@@ -569,7 +591,7 @@ class LogEventsList extends ContextSource {
        /**
         * Show log extract. Either with text and a box (set $msgKey) or without (don't set $msgKey)
         *
-        * @param OutputPage|string $out By-reference
+        * @param OutputPage|string &$out
         * @param string|array $types Log types to show
         * @param string|Title $page The page title to show log entries for
         * @param string $user The user who made the log entries