(bug 15641) prevent blocked administrators from accessing deleted revisions.

diff --git a/includes/LogEventsList.php b/includes/LogEventsList.php
index 744a60c..a18d849 100644 (file)
--- a/includes/LogEventsList.php
+++ b/includes/LogEventsList.php
@@ -543,7 +543,7 @@ class LogEventsList {
                }
                $del = '';
                // Don't show useless link to people who cannot hide revisions
-               if( $wgUser->isAllowed( 'deletedhistory' ) ) {
+               if( $wgUser->isAllowed( 'deletedhistory' ) && !$wgUser->isBlocked() ) {
                        if( $row->log_deleted || $wgUser->isAllowed( 'deleterevision' ) ) {
                                $canHide = $wgUser->isAllowed( 'deleterevision' );
                                // If event was hidden from sysops
@@ -891,9 +891,9 @@ class LogPager extends ReverseChronologicalPager {
                        global $wgUser;
                        $this->mConds['log_user'] = $userid;
                        // Paranoia: avoid brute force searches (bug 17342)
-                       if( !$wgUser->isAllowed( 'deletedhistory' ) ) {
+                       if( !$wgUser->isAllowed( 'deletedhistory' ) || $wgUser->isBlocked() ) {
                                $this->mConds[] = $this->mDb->bitAnd('log_deleted', LogPage::DELETED_USER) . ' = 0';
-                       } elseif( !$wgUser->isAllowed( 'suppressrevision' ) ) {
+                       } elseif( !$wgUser->isAllowed( 'suppressrevision' ) || $wgUser->isBlocked() ) {
                                $this->mConds[] = $this->mDb->bitAnd('log_deleted', LogPage::SUPPRESSED_USER) .
                                        ' != ' . LogPage::SUPPRESSED_USER;
                        }
@@ -940,9 +940,9 @@ class LogPager extends ReverseChronologicalPager {
                        $this->mConds['log_title'] = $title->getDBkey();
                }
                // Paranoia: avoid brute force searches (bug 17342)
-               if( !$wgUser->isAllowed( 'deletedhistory' ) ) {
+               if( !$wgUser->isAllowed( 'deletedhistory' ) || $wgUser->isBlocked() ) {
                        $this->mConds[] = $db->bitAnd('log_deleted', LogPage::DELETED_ACTION) . ' = 0';
-               } elseif( !$wgUser->isAllowed( 'suppressrevision' ) ) {
+               } elseif( !$wgUser->isAllowed( 'suppressrevision' ) || $wgUser->isBlocked() ) {
                        $this->mConds[] = $db->bitAnd('log_deleted', LogPage::SUPPRESSED_ACTION) .
                                ' != ' . LogPage::SUPPRESSED_ACTION;
                }

diff --git a/includes/Skin.php b/includes/Skin.php
index d9973c2..c8d057a 100644 (file)
--- a/includes/Skin.php
+++ b/includes/Skin.php
@@ -631,7 +631,7 @@ abstract class Skin extends ContextSource {
        function getUndeleteLink() {
                $action = $this->getRequest()->getVal( 'action', 'view' );
 
-               if ( $this->getUser()->isAllowed( 'deletedhistory' ) &&
+               if ( $this->getUser()->isAllowed( 'deletedhistory' ) && !$this->getUser()->isBlocked() &&
                        ( $this->getTitle()->getArticleId() == 0 || $action == 'history' ) ) {
 
                        $includeSuppressed = $this->getUser()->isAllowed( 'suppressrevision' );

diff --git a/includes/SkinTemplate.php b/includes/SkinTemplate.php
index 4cef194..9674890 100644 (file)
--- a/includes/SkinTemplate.php
+++ b/includes/SkinTemplate.php
@@ -924,7 +924,7 @@ class SkinTemplate extends Skin {
                                }
                        } else {
                                // article doesn't exist or is deleted
-                               if ( $wgUser->isAllowed( 'deletedhistory' ) ) {
+                               if ( $wgUser->isAllowed( 'deletedhistory' ) && !$wgUser->isBlocked() ) {
                                        $includeSuppressed = $wgUser->isAllowed( 'suppressrevision' );
                                        $n = $title->isDeleted( $includeSuppressed );
                                        if( $n ) {

diff --git a/includes/api/ApiQueryDeletedrevs.php b/includes/api/ApiQueryDeletedrevs.php
index d810802..8116db1 100644 (file)
--- a/includes/api/ApiQueryDeletedrevs.php
+++ b/includes/api/ApiQueryDeletedrevs.php
@@ -43,7 +43,7 @@ class ApiQueryDeletedrevs extends ApiQueryBase {
        public function execute() {
                global $wgUser;
                // Before doing anything at all, let's check permissions
-               if ( !$wgUser->isAllowed( 'deletedhistory' ) ) {
+               if ( !$wgUser->isAllowed( 'deletedhistory' ) || $wgUser->isBlocked() ) {
                        $this->dieUsage( 'You don\'t have permission to view deleted revision information', 'permissiondenied' );
                }
 

diff --git a/includes/api/ApiQueryFilearchive.php b/includes/api/ApiQueryFilearchive.php
index e746a6c..39b87c4 100644 (file)
--- a/includes/api/ApiQueryFilearchive.php
+++ b/includes/api/ApiQueryFilearchive.php
@@ -45,7 +45,7 @@ class ApiQueryFilearchive extends ApiQueryBase {
        public function execute() {
                global $wgUser;
                // Before doing anything at all, let's check permissions
-               if ( !$wgUser->isAllowed( 'deletedhistory' ) ) {
+               if ( !$wgUser->isAllowed( 'deletedhistory' ) || $wgUser->isBlocked() ) {
                        $this->dieUsage( 'You don\'t have permission to view deleted file information', 'permissiondenied' );
                }
 

diff --git a/includes/diff/DifferenceEngine.php b/includes/diff/DifferenceEngine.php
index 034f0da..5f1a962 100644 (file)
--- a/includes/diff/DifferenceEngine.php
+++ b/includes/diff/DifferenceEngine.php
@@ -147,7 +147,7 @@ class DifferenceEngine {
         */
        function deletedLink( $id ) {
                global $wgUser;
-               if ( $wgUser->isAllowed( 'deletedhistory' ) ) {
+               if ( $wgUser->isAllowed( 'deletedhistory' ) && !$wgUser->isBlocked() ) {
                        $dbr = wfGetDB( DB_SLAVE );
                        $row = $dbr->selectRow('archive', '*',
                                array( 'ar_rev_id' => $id ),

diff --git a/includes/specials/SpecialContributions.php b/includes/specials/SpecialContributions.php
index 7c7089c..7158fac 100644 (file)
--- a/includes/specials/SpecialContributions.php
+++ b/includes/specials/SpecialContributions.php
@@ -317,7 +317,7 @@ class SpecialContributions extends SpecialPage {
                );
 
                # Add link to deleted user contributions for priviledged users
-               if( $subject->isAllowed( 'deletedhistory' ) ) {
+               if( $subject->isAllowed( 'deletedhistory' ) && !$subject->isBlocked() ) {
                        $tools[] = $sk->linkKnown(
                                SpecialPage::getTitleFor( 'DeletedContributions', $username ),
                                wfMsgHtml( 'sp-contributions-deleted' )
@@ -486,7 +486,7 @@ class ContribsPager extends ReverseChronologicalPager {
 
                $conds = array_merge( $userCond, $this->getNamespaceCond() );
                // Paranoia: avoid brute force searches (bug 17342)
-               if( !$wgUser->isAllowed( 'deletedhistory' ) ) {
+               if( !$wgUser->isAllowed( 'deletedhistory' ) || $wgUser->isBlocked() ) {
                        $conds[] = $this->mDb->bitAnd('rev_deleted',Revision::DELETED_USER) . ' = 0';
                } elseif( !$wgUser->isAllowed( 'suppressrevision' ) ) {
                        $conds[] = $this->mDb->bitAnd('rev_deleted',Revision::SUPPRESSED_USER) .

diff --git a/includes/specials/SpecialDeletedContributions.php b/includes/specials/SpecialDeletedContributions.php
index 32ed62b..77c7e84 100644 (file)
--- a/includes/specials/SpecialDeletedContributions.php
+++ b/includes/specials/SpecialDeletedContributions.php
@@ -281,6 +281,10 @@ class DeletedContributionsPage extends SpecialPage {
                        return;
                }
 
+               if( $wgUser->isBlocked() ){
+                       throw new UserBlockedError( $wgUser->getBlock() );
+               }
+
                global $wgOut, $wgRequest;
 
                $wgOut->setPageTitle( wfMsgExt( 'deletedcontributions-title', array( 'parsemag' ) ) );

diff --git a/includes/specials/SpecialRevisiondelete.php b/includes/specials/SpecialRevisiondelete.php
index 3c64325..90a2030 100644 (file)
--- a/includes/specials/SpecialRevisiondelete.php
+++ b/includes/specials/SpecialRevisiondelete.php
@@ -113,13 +113,15 @@ class SpecialRevisionDelete extends UnlistedSpecialPage {
        public function execute( $par ) {
                $output = $this->getOutput();
                $user = $this->getUser();
+
                if( !$user->isAllowed( 'deletedhistory' ) ) {
-                       $output->permissionRequired( 'deletedhistory' );
-                       return;
+                       throw new PermissionsError( 'deletedhistory' );
                } elseif( wfReadOnly() ) {
-                       $output->readOnlyPage();
-                       return;
+                       throw new ReadOnlyError;
+               } elseif( $user->isBlocked() ) {
+                       throw new UserBlockedError( $user->getBlock() );
                }
+
                $this->mIsAllowed = $user->isAllowed('deleterevision'); // for changes
                $this->setHeaders();
                $this->outputHeader();

diff --git a/includes/specials/SpecialUndelete.php b/includes/specials/SpecialUndelete.php
index e2bd40e..fca840d 100644 (file)
--- a/includes/specials/SpecialUndelete.php
+++ b/includes/specials/SpecialUndelete.php
@@ -643,6 +643,11 @@ class SpecialUndelete extends SpecialPage {
                        $this->displayRestrictionError();
                        return;
                }
+
+               if ( $this->getUser()->isBlocked() ) {
+                       throw new UserBlockedError( $this->getUser()->getBlock() );
+               }
+
                $this->outputHeader();
 
                $this->loadRequest();

diff --git a/includes/specials/SpecialUpload.php b/includes/specials/SpecialUpload.php
index 60894a4..eec28c2 100644 (file)
--- a/includes/specials/SpecialUpload.php
+++ b/includes/specials/SpecialUpload.php
@@ -313,21 +313,19 @@ class SpecialUpload extends SpecialPage {
 
                $title = Title::makeTitleSafe( NS_FILE, $this->mDesiredDestName );
                // Show a subtitle link to deleted revisions (to sysops et al only)
-               if( $title instanceof Title ) {
-                       if ( $wgUser->isAllowed( 'deletedhistory' ) ) {
-                               $canViewSuppress = $wgUser->isAllowed( 'suppressrevision' );
-                               $count = $title->isDeleted( $canViewSuppress );
-                               if ( $count > 0 ) {
-                                       $link = wfMsgExt(
-                                               $wgUser->isAllowed( 'delete' ) ? 'thisisdeleted' : 'viewdeleted',
-                                               array( 'parse', 'replaceafter' ),
-                                               $this->getSkin()->linkKnown(
-                                                       SpecialPage::getTitleFor( 'Undelete', $title->getPrefixedText() ),
-                                                       wfMsgExt( 'restorelink', array( 'parsemag', 'escape' ), $count )
-                                               )
-                                       );
-                                       $wgOut->addHTML( "<div id=\"contentSub2\">{$link}</div>" );
-                               }
+               if( $title instanceof Title && $wgUser->isAllowed( 'deletedhistory' ) && !$wgUser->isBlocked() ) {
+                       $canViewSuppress = $wgUser->isAllowed( 'suppressrevision' );
+                       $count = $title->isDeleted( $canViewSuppress );
+                       if ( $count > 0 ) {
+                               $link = wfMsgExt(
+                                       $wgUser->isAllowed( 'delete' ) ? 'thisisdeleted' : 'viewdeleted',
+                                       array( 'parse', 'replaceafter' ),
+                                       $this->getSkin()->linkKnown(
+                                               SpecialPage::getTitleFor( 'Undelete', $title->getPrefixedText() ),
+                                               wfMsgExt( 'restorelink', array( 'parsemag', 'escape' ), $count )
+                                       )
+                               );
+                               $wgOut->addHTML( "<div id=\"contentSub2\">{$link}</div>" );
                        }
                }
        }