SECURITY: Add permission check for user is permitted to view the log type

[lhc/web/wiklou.git] / includes / logging / LogEventsList.php

diff --git a/includes/logging/LogEventsList.php b/includes/logging/LogEventsList.php
index 7317367..e66bd69 100644 (file)
--- a/includes/logging/LogEventsList.php
+++ b/includes/logging/LogEventsList.php
@@ -174,7 +174,7 @@ class LogEventsList extends ContextSource {
 
                $context = new DerivativeContext( $this->getContext() );
                $context->setTitle( SpecialPage::getTitleFor( 'Log' ) ); // Remove subpage
-               $htmlForm = new HTMLForm( $formDescriptor, $context );
+               $htmlForm = HTMLForm::factory( 'ooui', $formDescriptor, $context );
                $htmlForm
                        ->setSubmitText( $this->msg( 'logeventslist-submit' )->text() )
                        ->setMethod( 'get' )
@@ -531,7 +531,7 @@ class LogEventsList extends ContextSource {
 
        /**
         * Determine if the current user is allowed to view a particular
-        * field of this log row, if it's marked as deleted.
+        * field of this log row, if it's marked as deleted and/or restricted log type.
         *
         * @param stdClass $row
         * @param int $field
@@ -539,7 +539,8 @@ class LogEventsList extends ContextSource {
         * @return bool
         */
        public static function userCan( $row, $field, User $user = null ) {
-               return self::userCanBitfield( $row->log_deleted, $field, $user );
+               return self::userCanBitfield( $row->log_deleted, $field, $user ) &&
+                       self::userCanViewLogType( $row->log_type, $user );
        }
 
        /**
@@ -569,6 +570,26 @@ class LogEventsList extends ContextSource {
                return true;
        }
 
+       /**
+        * Determine if the current user is allowed to view a particular
+        * field of this log row, if it's marked as restricted log type.
+        *
+        * @param stdClass $type
+        * @param User|null $user User to check, or null to use $wgUser
+        * @return bool
+        */
+       public static function userCanViewLogType( $type, User $user = null ) {
+               if ( $user === null ) {
+                       global $wgUser;
+                       $user = $wgUser;
+               }
+               $logRestrictions = MediaWikiServices::getInstance()->getMainConfig()->get( 'LogRestrictions' );
+               if ( isset( $logRestrictions[$type] ) && !$user->isAllowed( $logRestrictions[$type] ) ) {
+                       return false;
+               }
+               return true;
+       }
+
        /**
         * @param stdClass $row
         * @param int $field One of DELETED_* bitfield constants
@@ -692,6 +713,8 @@ class LogEventsList extends ContextSource {
                        $s .= $loglist->beginLogEventsList() .
                                $logBody .
                                $loglist->endLogEventsList();
+                       // add styles for change tags
+                       $context->getOutput()->addModuleStyles( 'mediawiki.interface.helpers.styles' );
                } elseif ( $showIfEmpty ) {
                        $s = Html::rawElement( 'div', [ 'class' => 'mw-warning-logempty' ],
                                $context->msg( 'logempty' )->parse() );