Perform a permission check on the title when changing the page language

Performing this check will prevent users without the edituserjs/css to change the page language for protected user js/css subpages, similar to Special:Editcontentmodel.

Bug: T160783
Bug: T74965
Change-Id: I2b106861ea0a488308cda92baf7ebf697844ffd7

diff --git a/includes/specials/SpecialPageLanguage.php b/includes/specials/SpecialPageLanguage.php
index db05ebe..ef034fb 100644 (file)
--- a/includes/specials/SpecialPageLanguage.php
+++ b/includes/specials/SpecialPageLanguage.php
@@ -135,6 +135,16 @@ class SpecialPageLanguage extends FormSpecialPage {
                        return Status::newFatal( $ex->getMessageObject() );
                }
 
+               // Check permissions and make sure the user has permission to edit the page
+               $errors = $title->getUserPermissionsErrors( 'edit', $this->getUser() );
+
+               if ( $errors ) {
+                       $out = $this->getOutput();
+                       $wikitext = $out->formatPermissionsErrorMessage( $errors );
+                       // Hack to get our wikitext parsed
+                       return Status::newFatal( new RawMessage( '$1', [ $wikitext ] ) );
+               }
+
                // Url to redirect to after the operation
                $this->goToUrl = $title->getFullURL(
                        $title->isRedirect() ? [ 'redirect' => 'no' ] : []