revisions_view view should check individual page permission

[gasman]

The wagtail.admin.views.pages.revisions_view view (which displays a preview of a page at a given revision number, as linked from the page revision listing) does not apply any permission checks other than user_has_any_page_permission (which only checks that they have add/edit/publish/lock permission somewhere in the page tree):

wagtail/wagtail/admin/views/pages.py

Lines 1177 to 1183 in 268df8c

	@user_passes_test(user_has_any_page_permission)
	def revisions_view(request, page_id, revision_id):
	page = get_object_or_404(Page, id=page_id).specific
	revision = get_object_or_404(page.revisions, id=revision_id)
	revision_page = revision.as_page_object()
	return revision_page.serve_preview(page.dummy_request(request), page.default_preview_mode)

This means that if a Wagtail editor is able to guess a page ID and corresponding revision ID, they would potentially be able to view private pages that they would otherwise have no access to.

The view_draft view explicitly checks for edit or publish permission on the requested page, and it would make logical sense to do the same here.

wagtail/wagtail/admin/views/pages.py

Lines 586 to 588 in 268df8c

	perms = page.permissions_for_user(request.user)
	if not (perms.can_publish() or perms.can_edit()):
	raise PermissionDenied

• I have confirmed that this issue can be reproduced as described on a fresh Wagtail project: no

[chosak]

I've opened #5490 to address this issue.

[gasman]

Fixed in #5490