Merge pull request from GHSA-4rcf-3cj2-46mq

* Require `(createwiki)` user right to see suppressed wiki requests * Check for `(read)`
miraheze · Mar 27, 2024 · b2fd86c · b2fd86c
1 parent 6bc0685
commit b2fd86c
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 4 deletions.
diff --git a/includes/RequestWiki/Handler/RestWikiRequest.php b/includes/RequestWiki/Handler/RestWikiRequest.php
@@ -68,7 +68,7 @@ public function run( $id ) {
 			 * being revealed to local suppressors/sysops
 			 */
 
-			if ( $wikiRequestVisibility !== 'read' ) {
+			if ( $wikiRequestVisibility !== 'read' && $this->getAuthority()->isAllowed( 'read' ) ) {
 				if ( !$this->getAuthority()->isAllowedAll( 'createwiki', $wikiRequestVisibility ) ) {
 					// User does not have permission to view this request
 					return $this->getResponseFactory()->createHttpError( 404, ['message' => 'Request not found'] );

diff --git a/includes/RequestWiki/RequestWikiRequestViewer.php b/includes/RequestWiki/RequestWikiRequestViewer.php
@@ -44,10 +44,12 @@ public function getFormDescriptor(
 		// but if we can't view the request, it also doesn't exist
 		$permissionManager = MediaWikiServices::getInstance()->getPermissionManager();
 
-		if ( !$permissionManager->userHasRight( $userR, $visibilityConds[$request->visibility] ) ) {
-			$context->getOutput()->addHTML( Html::errorBox( wfMessage( 'requestwiki-unknown' )->escaped() ) );
+		if ( !$visibilityConds[$request->visibility] !== 'read' && $permissionManager->userHasRight( $userR, 'read' ) ) {
+			if ( !$permissionManager->userHasAllRights( $userR, 'createwiki', $visibilityConds[$request->visibility] ) ) {
+				$context->getOutput()->addHTML( Html::errorBox( wfMessage( 'requestwiki-unknown' )->escaped() ) );
 
-			return [];
+				return [];
+			}
 		}
 
 		$formDescriptor = [