We need to do permission-checks in Log & CheckUser, like:
$permissions->isRevisionAllowed( $revision, 'log' ); // or 'checkuser'
https://gerrit.wikimedia.org/r/112583 introduced permission-checks on RC & Contributions entries.
It's at this point less trivial to introduce in Log & CheckUser. There's an upcoming related ticket (https://trello.com/c/S10KfqBm/62-8-history-watchlist-rc-and-contribs-changes) that may improve that, after which it should be easier to implement.
Version: unspecified
Severity: normal
Whiteboard: flow_checkuser