Page MenuHomePhabricator

"Upload file" link is shown even when a user is not authorized to upload
Closed, ResolvedPublic

Description

Author: rotemliss

Description:
Until April 24th 2005, the "upload file" link was not shown for anonymous users.
On that date, eloquence has changed this behavior, with the following explanation:

"Enable upload navigation link for non-logged-in users. From a usability
perspective, navigation should not be surprising with random elements
popping up under certain circumstances only ("How do I upload" is a FAQ).
Special:Upload will show a message "You have to be logged in" for anonymous
users, so no confusion should arise."

However, it is very normal to hide elements for anonymous users and to show them
for registered users, and so we do about minor edits, watching pages, moving
them, etc. Also, the error for anonymous users is easy to understand ("You must
be logged in to upload files."), but the error for registered users when
restricting the uploads is not so easy to understand ("The action you have
requested is limited to users with the "upload" permission assigned. See
Wiki:Administrators."). I think that like we show all the other elements for
registered users only (actually, for authorized users only, if we change the
permissions), we should also show this one for authorized users only.

The solution is very simple – changing:

if( $wgEnableUploads ) {

in SkinTemplate::buildNavUrls (includes/SkinTemplate.php) to:

if( $wgEnableUploads && $wgUser->isAllowed( 'upload' ) ) {

will do.


Version: unspecified
Severity: trivial

Details

Reference
bz6021