Merge "mw.ForeignApi: don’t set origin for same-origin requests"

[lhc/web/wiklou.git] / includes / page / Article.php

diff --git a/includes/page/Article.php b/includes/page/Article.php
index fcfb83d..4bede96 100644 (file)
--- a/includes/page/Article.php
+++ b/includes/page/Article.php
@@ -587,7 +587,7 @@ class Article implements Page {
         * page of the given title.
         */
        public function view() {
-               global $wgUseFileCache, $wgDebugToolbar;
+               global $wgUseFileCache;
 
                # Get variables from query string
                # As side effect this will load the revision and update the title
@@ -635,14 +635,15 @@ class Article implements Page {
                if ( $outputPage->isPrintable() ) {
                        $parserOptions->setIsPrintable( true );
                        $poOptions['enableSectionEditLinks'] = false;
-               } elseif ( $this->viewIsRenderAction
-                       || !$this->isCurrent() || !$this->getTitle()->quickUserCan( 'edit', $user )
+               } elseif ( $this->viewIsRenderAction || !$this->isCurrent() ||
+                       !MediaWikiServices::getInstance()->getPermissionManager()
+                               ->quickUserCan( 'edit', $user, $this->getTitle() )
                ) {
                        $poOptions['enableSectionEditLinks'] = false;
                }
 
                # Try client and file cache
-               if ( !$wgDebugToolbar && $oldid === 0 && $this->mPage->checkTouched() ) {
+               if ( $oldid === 0 && $this->mPage->checkTouched() ) {
                        # Try to stream the output from file cache
                        if ( $wgUseFileCache && $this->tryFileCache() ) {
                                wfDebug( __METHOD__ . ": done file cache\n" );
@@ -1181,7 +1182,8 @@ class Article implements Page {
                $title = $this->getTitle();
                $rc = false;
 
-               if ( !$title->quickUserCan( 'patrol', $user )
+               if ( !MediaWikiServices::getInstance()->getPermissionManager()
+                               ->quickUserCan( 'patrol', $user, $title )
                        || !( $wgUseRCPatrol || $wgUseNPPatrol
                                || ( $wgUseFilePatrol && $title->inNamespace( NS_FILE ) ) )
                ) {
@@ -1308,7 +1310,10 @@ class Article implements Page {
                }
 
                $outputPage->preventClickjacking();
-               if ( $user->isAllowed( 'writeapi' ) ) {
+               if ( MediaWikiServices::getInstance()
+                               ->getPermissionManager()
+                               ->userHasRight( $user, 'writeapi' )
+               ) {
                        $outputPage->addModules( 'mediawiki.page.patrol.ajax' );
                }
 
@@ -1450,6 +1455,7 @@ class Article implements Page {
 
                # Show error message
                $oldid = $this->getOldID();
+               $pm = MediaWikiServices::getInstance()->getPermissionManager();
                if ( !$oldid && $title->getNamespace() === NS_MEDIAWIKI && $title->hasSourceText() ) {
                        // use fake Content object for system message
                        $parserOptions = ParserOptions::newCanonical( 'canonical' );
@@ -1457,8 +1463,8 @@ class Article implements Page {
                } else {
                        if ( $oldid ) {
                                $text = wfMessage( 'missing-revision', $oldid )->plain();
-                       } elseif ( $title->quickUserCan( 'create', $this->getContext()->getUser() )
-                               && $title->quickUserCan( 'edit', $this->getContext()->getUser() )
+                       } elseif ( $pm->quickUserCan( 'create', $this->getContext()->getUser(), $title ) &&
+                               $pm->quickUserCan( 'edit', $this->getContext()->getUser(), $title )
                        ) {
                                $message = $this->getContext()->getUser()->isLoggedIn() ? 'noarticletext' : 'noarticletextanon';
                                $text = wfMessage( $message )->plain();
@@ -1824,7 +1830,10 @@ class Article implements Page {
                        [ 'delete', $this->getTitle()->getPrefixedText() ] )
                ) {
                        # Flag to hide all contents of the archived revisions
-                       $suppress = $request->getCheck( 'wpSuppress' ) && $user->isAllowed( 'suppressrevision' );
+
+                       $suppress = $request->getCheck( 'wpSuppress' ) && MediaWikiServices::getInstance()
+                                       ->getPermissionManager()
+                                       ->userHasRight( $user, 'suppressrevision' );
 
                        $this->doDelete( $reason, $suppress );
 
@@ -1926,6 +1935,8 @@ class Article implements Page {
 
                $outputPage->enableOOUI();
 
+               $fields = [];
+
                $options = Xml::listDropDownOptions(
                        $ctx->msg( 'deletereason-dropdown' )->inContentLanguage()->text(),
                        [ 'other' => $ctx->msg( 'deletereasonotherlist' )->inContentLanguage()->text() ]
@@ -1981,8 +1992,8 @@ class Article implements Page {
                                ]
                        );
                }
-
-               if ( $user->isAllowed( 'suppressrevision' ) ) {
+               $permissionManager = MediaWikiServices::getInstance()->getPermissionManager();
+               if ( $permissionManager->userHasRight( $user, 'suppressrevision' ) ) {
                        $fields[] = new OOUI\FieldLayout(
                                new OOUI\CheckboxInputWidget( [
                                        'name' => 'wpSuppress',
@@ -2040,7 +2051,7 @@ class Article implements Page {
                        ] )
                );
 
-               if ( $user->isAllowed( 'editinterface' ) ) {
+               if ( $permissionManager->userHasRight( $user, 'editinterface' ) ) {
                        $link = Linker::linkKnown(
                                $ctx->msg( 'deletereason-dropdown' )->inContentLanguage()->getTitle(),
                                wfMessage( 'delete-edit-reasonlist' )->escaped(),