mediawiki-extensions-AbuseF.../includes/pagers/AbuseFilterExaminePager.php
Daimona Eaytoy 103dfa3b66 Remove info leak
Oversighted/deleted edits and log actions were entirely accessible to
non-oversighters via AbuseFilter/examine for RC, and via AbuseFilter/test.
Now, we take into account the revision/log visibility and user permissions to
determine what to show.
Other changes in this patch:
*Show the examine link if and only if the user can examine the given row
*If a revision is hidden but the user can see it, don't hide its elements in
 ChangesList (only leave them striked/greyed)
*Make APIs better understand revision visibility.
*Make a clear distinction between deleted and suppressed edits/log
entries.

Co-authored with rxy <git@rxy.jp>

Bug: T207085
Change-Id: Icfa48e366a7e5e3abd5d2155ecfddfc09b378088
2018-10-23 10:53:39 +00:00

83 lines
1.9 KiB
PHP

<?php
class AbuseFilterExaminePager extends ReverseChronologicalPager {
public $mChangesList, $mPage;
/**
* @param AbuseFilterViewExamine $page
* @param AbuseFilterChangesList $changesList
*/
public function __construct( $page, $changesList ) {
parent::__construct();
$this->mChangesList = $changesList;
$this->mPage = $page;
}
/**
* @return array
*/
public function getQueryInfo() {
$dbr = wfGetDB( DB_REPLICA );
$conds = [];
if ( (string)$this->mPage->mSearchUser !== '' ) {
$conds[] = ActorMigration::newMigration()->getWhere(
$dbr, 'rc_user', User::newFromName( $this->mPage->mSearchUser, false )
)['conds'];
}
$startTS = strtotime( $this->mPage->mSearchPeriodStart );
if ( $startTS ) {
$conds[] = 'rc_timestamp>=' . $dbr->addQuotes( $dbr->timestamp( $startTS ) );
}
$endTS = strtotime( $this->mPage->mSearchPeriodEnd );
if ( $endTS ) {
$conds[] = 'rc_timestamp<=' . $dbr->addQuotes( $dbr->timestamp( $endTS ) );
}
$conds[] = $this->mPage->buildTestConditions( $dbr );
$rcQuery = RecentChange::getQueryInfo();
$info = [
'tables' => $rcQuery['tables'],
'fields' => $rcQuery['fields'],
'conds' => array_filter( $conds ),
'options' => [ 'ORDER BY' => 'rc_timestamp DESC' ],
'join_conds' => $rcQuery['joins'],
];
return $info;
}
/**
* @param stdClass $row
* @return string
*/
public function formatRow( $row ) {
$rc = RecentChange::newFromRow( $row );
$rc->counter = $this->mPage->mCounter++;
return $this->mChangesList->recentChangesLine( $rc, false );
}
/**
* @return string
*/
public function getIndexField() {
return 'rc_id';
}
/**
* @return Title
*/
public function getTitle() {
return $this->mPage->getTitle( 'examine' );
}
/**
* @return string
*/
public function getEmptyBody() {
return $this->msg( 'abusefilter-examine-noresults' )->parseAsBlock();
}
}