From: rxy <wikitech.rxy@rxy.jp>
Date: Sun, 28 Apr 2019 20:04:01 +0000 (+0900)
Subject: SECURITY: Add permission check for user is permitted to view the log type
X-Git-Tag: 1.34.0-rc.0~1502^2
X-Git-Url: https://git.heureux-cyclage.org/?p=lhc%2Fweb%2Fwiklou.git;a=commitdiff_plain;h=8a26fa0508e69f7cdc1680db57c4d8983a70de84

SECURITY: Add permission check for user is permitted to view the log type

Bug: T222036
Change-Id: I7584ee8db23a8834bbab21e355cab9857a293f72
---

diff --git a/includes/changetags/ChangeTagsLogItem.php b/includes/changetags/ChangeTagsLogItem.php
index 75b713ef0d..2bac909716 100644
--- a/includes/changetags/ChangeTagsLogItem.php
+++ b/includes/changetags/ChangeTagsLogItem.php
@@ -49,7 +49,7 @@ class ChangeTagsLogItem extends RevisionItemBase {
 	}
 
 	public function canView() {
-		return LogEventsList::userCan( $this->row, Revision::DELETED_RESTRICTED, $this->list->getUser() );
+		return LogEventsList::userCan( $this->row, Revision::SUPPRESSED_ALL, $this->list->getUser() );
 	}
 
 	public function canViewContent() {
diff --git a/includes/specials/SpecialEditTags.php b/includes/specials/SpecialEditTags.php
index ed398deae4..6ef6cb3f7d 100644
--- a/includes/specials/SpecialEditTags.php
+++ b/includes/specials/SpecialEditTags.php
@@ -227,6 +227,9 @@ class SpecialEditTags extends UnlistedSpecialPage {
 		$list = $this->getList();
 		for ( $list->reset(); $list->current(); $list->next() ) {
 			$item = $list->current();
+			if ( !$item->canView() ) {
+				throw new ErrorPageError( 'permissionserrors', 'tags-update-no-permission' );
+			}
 			$numRevisions++;
 			$out->addHTML( $item->getHTML() );
 		}