From 6756575f038ea95ecade6e546bf633601f256542 Mon Sep 17 00:00:00 2001 From: Sam Smith Date: Mon, 18 Apr 2016 10:53:13 +0100 Subject: [PATCH] SECURITY: Don't list deleted edits without rights If the current user doesn't have the appropriate rights, then don't list deleted or suppressed edits in a user's contributions. Bug: T132653 Change-Id: Ib5e56a93af771c11412023c789d65ef53b8415f8 --- includes/specials/SpecialMobileContributions.php | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/includes/specials/SpecialMobileContributions.php b/includes/specials/SpecialMobileContributions.php index 01488ca..2a9b29f 100644 --- a/includes/specials/SpecialMobileContributions.php +++ b/includes/specials/SpecialMobileContributions.php @@ -168,6 +168,8 @@ class SpecialMobileContributions extends SpecialMobileHistory { */ protected function getQueryConditions() { $conds = array(); + $dbr = wfGetDB( DB_SLAVE, self::DB_REVISIONS_TABLE ); + if ( $this->user ) { if ( $this->user->getId() ) { $conds['rev_user'] = $this->user->getId(); @@ -175,8 +177,24 @@ class SpecialMobileContributions extends SpecialMobileHistory { $conds['rev_user_text'] = $this->user->getName(); } } + + $currentUser = $this->getContext()->getUser(); + + // T132653: Only list deleted/suppressed edits if the current user - not the + // target user (`$this->user`) – can view them. + // + // This code was taken from ContribsPager#getQueryInfo. + // + // FIXME: Make Special:MobileContributions use ContribsPager ASAP. + if ( $currentUser && $this->user ) { + if ( !$currentUser->isAllowed( 'deletedhistory' ) ) { + $conds[] = $dbr->bitAnd( 'rev_deleted', Revision::DELETED_USER ) . ' = 0'; + } elseif ( !$currentUser->isAllowedAny( 'suppressrevision', 'viewsuppressed' ) ) { + $conds[] = $dbr->bitAnd( 'rev_deleted', Revision::SUPPRESSED_USER ) . + ' != ' . Revision::SUPPRESSED_USER; + } + } if ( $this->offset ) { - $dbr = wfGetDB( DB_SLAVE, self::DB_REVISIONS_TABLE ); $conds[] = 'rev_timestamp <= ' . $dbr->addQuotes( $this->offset ); } return $conds; -- 2.6.4 (Apple Git-63)