Require editsitecss/editsitejs for editing raw messages

Bug: T45646
Change-Id: Ib16db04e499ad28216ee08b8cccccf3f141e2bad

diff --git a/RELEASE-NOTES-1.32 b/RELEASE-NOTES-1.32
index ec8c022..1deca12 100644 (file)
--- a/RELEASE-NOTES-1.32
+++ b/RELEASE-NOTES-1.32
@@ -40,6 +40,8 @@ production.
 * The $wgPasswordSenderName setting, ignored since 1.23 by MediaWiki and almost
   all extensions, is no longer set at all. Instead, you can modify the system
   message `emailsender`.
+* A new configuration setting, $wgRawHtmlMessages, is added, for listing
+  messages which are displayed as raw HTML.
 
 === New features in 1.32 ===
 * (T112474) Generalized the ResourceLoader mechanism for overriding modules

diff --git a/docs/extension.schema.v1.json b/docs/extension.schema.v1.json
index c9a887d..0ff169c 100644 (file)
--- a/docs/extension.schema.v1.json
+++ b/docs/extension.schema.v1.json
@@ -668,6 +668,13 @@
                                "type": "string"
                        }
                },
+               "RawHtmlMessages": {
+                       "type": "array",
+                       "description": "Messages which are rendered as raw HTML",
+                       "items": {
+                               "type": "string"
+                       }
+               },
                "callback": {
                        "type": [
                                "array",

diff --git a/docs/extension.schema.v2.json b/docs/extension.schema.v2.json
index 24212a9..7de5ed5 100644 (file)
--- a/docs/extension.schema.v2.json
+++ b/docs/extension.schema.v2.json
@@ -690,6 +690,13 @@
                                "type": "string"
                        }
                },
+               "RawHtmlMessages": {
+                       "type": "array",
+                       "description": "Messages which are rendered as raw HTML",
+                       "items": {
+                               "type": "string"
+                       }
+               },
                "callback": {
                        "type": [
                                "array",

diff --git a/includes/DefaultSettings.php b/includes/DefaultSettings.php
index 9b0899d..ea368bc 100644 (file)
--- a/includes/DefaultSettings.php
+++ b/includes/DefaultSettings.php
@@ -8845,6 +8845,22 @@ $wgCSPHeader = false;
  */
 $wgCSPReportOnlyHeader = false;
 
+/**
+ * List of messages which might contain raw HTML.
+ * Extensions should add their messages here. The list is used for access control:
+ * changing messages listed here will require editsitecss and editsitejs rights.
+ *
+ * @since 1.32
+ * @var string[]
+ */
+$wgRawHtmlMessages = [
+       'copyright',
+       'history_copyright',
+       'googlesearch',
+       'feedback-terms',
+       'feedback-termsofuse',
+];
+
 /**
  * Mapping of event channels (or channel categories) to EventRelayer configuration.
  *

diff --git a/includes/Title.php b/includes/Title.php
index c919b18..96176f6 100644 (file)
--- a/includes/Title.php
+++ b/includes/Title.php
@@ -1480,6 +1480,22 @@ class Title implements LinkTarget {
                );
        }
 
+       /**
+        * Is this a message which can contain raw HTML?
+        *
+        * @return bool
+        * @since 1.32
+        */
+       public function isRawHtmlMessage() {
+               global $wgRawHtmlMessages;
+
+               if ( $this->inNamespace( NS_MEDIAWIKI ) ) {
+                       return false;
+               }
+               $message = lcfirst( $this->getRootText() );
+               return in_array( $message, $wgRawHtmlMessages, true );
+       }
+
        /**
         * Is this a talk page of some sort?
         *
@@ -2392,6 +2408,13 @@ class Title implements LinkTarget {
                                $error = [ 'sitejsonprotected', $action ];
                        } elseif ( $this->isSiteJsConfigPage() && !$user->isAllowed( 'editsitejs' ) ) {
                                $error = [ 'sitejsprotected', $action ];
+                       } elseif ( $this->isRawHtmlMessage() ) {
+                               // Raw HTML can be used to deploy CSS or JS so require rights for both.
+                               if ( !$user->isAllowed( 'editsitejs' ) ) {
+                                       $error = [ 'sitejsprotected', $action ];
+                               } elseif ( !$user->isAllowed( 'editsitecss' ) ) {
+                                       $error = [ 'sitecssprotected', $action ];
+                               }
                        }
 
                        if ( $error ) {

diff --git a/includes/registration/ExtensionProcessor.php b/includes/registration/ExtensionProcessor.php
index bf61779..eb56e13 100644 (file)
--- a/includes/registration/ExtensionProcessor.php
+++ b/includes/registration/ExtensionProcessor.php
@@ -45,6 +45,7 @@ class ExtensionProcessor implements Processor {
                'MediaHandlers',
                'PasswordPolicy',
                'RateLimits',
+               'RawHtmlMessages',
                'RecentChangesFlags',
                'RemoveCredentialsBlacklist',
                'RemoveGroups',