SECURITY: RevDel: Check all revisions for suppression, not just the first

If any of the revisions in the list are deleted, do not allow changing
the permissions without suppressrevision.

Bug: T95589
Change-Id: Ia8a3ef13b73925d14a79775a50d46b939c01664f

diff --git a/includes/revisiondelete/RevDelList.php b/includes/revisiondelete/RevDelList.php
index 7aac3b8..7ffb427 100644 (file)
--- a/includes/revisiondelete/RevDelList.php
+++ b/includes/revisiondelete/RevDelList.php
@@ -73,6 +73,25 @@ abstract class RevDelList extends RevisionListBase {
                return $target;
        }
 
+       /**
+        * Indicate whether any item in this list is suppressed
+        * @since 1.25
+        * @return bool
+        */
+       public function areAnySuppressed() {
+               $bit = $this->getSuppressBit();
+
+               // @codingStandardsIgnoreStart Generic.CodeAnalysis.ForLoopWithTestFunctionCall.NotAllowed
+               for ( $this->reset(); $this->current(); $this->next() ) {
+                       // @codingStandardsIgnoreEnd
+                       $item = $this->current();
+                       if ( $item->getBits() & $bit ) {
+                               return true;
+                       }
+               }
+               return false;
+       }
+
        /**
         * Set the visibility for the revisions in this list. Logging and
         * transactions are done here.

diff --git a/includes/specials/SpecialRevisiondelete.php b/includes/specials/SpecialRevisiondelete.php
index c98aa46..65cb8e5 100644 (file)
--- a/includes/specials/SpecialRevisiondelete.php
+++ b/includes/specials/SpecialRevisiondelete.php
@@ -170,11 +170,10 @@ class SpecialRevisionDelete extends UnlistedSpecialPage {
                $this->typeLabels = self::$UILabels[$this->typeName];
                $list = $this->getList();
                $list->reset();
-               $bitfield = $list->current()->getBits();
                $this->mIsAllowed = $user->isAllowed( RevisionDeleter::getRestriction( $this->typeName ) );
                $canViewSuppressedOnly = $this->getUser()->isAllowed( 'viewsuppressed' ) &&
                        !$this->getUser()->isAllowed( 'suppressrevision' );
-               $pageIsSuppressed = $bitfield & Revision::DELETED_RESTRICTED;
+               $pageIsSuppressed = $list->areAnySuppressed();
                $this->mIsAllowed = $this->mIsAllowed && !( $canViewSuppressedOnly && $pageIsSuppressed );
 
                $this->otherReason = $request->getVal( 'wpReason' );