Thijs/wiki.techinc.nl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Apply proper restrictions on file revert action

Browse source 
Users should have 'reupload' or 'reupload-own' rights to do file revert.

Bug: T304474
Change-Id: I2d0eaeeea237286741708c2b5920fe7cca3acf50
(cherry picked from commit 7b4aee237e257954195c4d695b2cfe2a9a3b4116)
This commit is contained in:
Func 2021-11-09 09:47:14 +00:00 committed by Reedy
parent 524b93e175
commit 06b9aa64b2
2 changed files with 17 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
includes/actions/RevertAction.php
View file

@ -71,6 +71,7 @@ class RevertAction extends FormAction {
}
public function getRestriction() {
// Required permissions of revert are complicated, will be checked below.
return 'upload';
}
@ -78,6 +79,16 @@ class RevertAction extends FormAction {
if ( $this->getTitle()->getNamespace() !== NS_FILE ) {
throw new ErrorPageError( $this->msg( 'nosuchaction' ), $this->msg( 'nosuchactiontext' ) );
}
$rights = [ 'reupload' ];
if ( $user->equals( $this->getFile()->getUploader() ) ) {
// reupload-own is more basic, put it in the front for error messages.
array_unshift( $rights, 'reupload-own' );
}
if ( !$user->isAllowedAny( ...$rights ) ) {
throw new PermissionsError( $rights[0] );
}
parent::checkCanExecute( $user );
$oldimage = $this->getRequest()->getText( 'oldimage' );

6
includes/api/ApiFileRevert.php
View file

@ -61,6 +61,12 @@ class ApiFileRevert extends ApiBase {
// Check whether we're allowed to revert this file
$this->checkTitleUserPermissions( $this->file->getTitle(), [ 'edit', 'upload' ] );
$rights = [ 'reupload' ];
if ( $this->getUser()->equals( $this->file->getUploader() ) ) {
// reupload-own is more basic, put it in the front for error messages.
array_unshift( $rights, 'reupload-own' );
}
$this->checkUserRightsAny( $rights );
$sourceUrl = $this->file->getArchiveVirtualUrl( $this->archiveName );
$status = $this->file->upload(