From 1809063f6f5a9bb82660004807da7bdb734d2c9d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bartosz=20Dziewo=C5=84ski?= Date: Wed, 6 Sep 2023 17:46:41 +0200 Subject: [PATCH] RevisionArchiveRecord: Also check for permission to view deleted pages Bug: T264765 Change-Id: I12c00c9a5d547ddaa459fdd1489dd82b91fc3fe2 --- includes/Revision/RevisionArchiveRecord.php | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/includes/Revision/RevisionArchiveRecord.php b/includes/Revision/RevisionArchiveRecord.php index 909d94a7383..bae8a195eaa 100644 --- a/includes/Revision/RevisionArchiveRecord.php +++ b/includes/Revision/RevisionArchiveRecord.php @@ -165,6 +165,27 @@ class RevisionArchiveRecord extends RevisionRecord { return parent::getTimestamp(); } + private static function userCanViewDeletedPages( Authority $performer, PageIdentity $page = null ) { + $permissions = [ 'deletedhistory', 'undelete' ]; // any required for all deleted contents + if ( $page === null ) { + return $performer->isAllowedAny( ...$permissions ); + } else { + foreach ( $permissions as $perm ) { + if ( $performer->authorizeRead( $perm, $page ) ) { + return true; + } + } + return false; + } + } + + public static function userCanBitfield( $bitfield, $field, Authority $performer, PageIdentity $page = null ) { + // In addition to checking for permission to view revision-deleted fields, + // also check for permission to view revisions of deleted pages (T264765) + return static::userCanViewDeletedPages( $performer, $page ) && + parent::userCanBitfield( $bitfield, $field, $performer, $page ); + } + /** * @see RevisionStore::isComplete * -- 2.28.0.windows.1