handlers: permisison check for all pages + retrieve user-specific permissions for pages (if any)

handlers/handlerhistory.cpp

@@ -23,11 +23,27 @@ SOFTWARE.
 #include "../htmllink.h"
 #include "../logger.h"
 #include "../database/exceptions.h"
-Response HandlerHistory::handle(const Request &r)
+Response HandlerHistory::handleRequest(const Request &r)
 {
 	QueryOption qo = queryOption(r);
 	std::string page = r.get("page");
 
+	if(page.empty())
+	{
+		if(!this->userSession->user.permissions.canSeeGlobalHistory())
+		{
+			return errorResponse("Permission denied", "You can't see the changes history on this wiki", 403);
+		}
+	}
+	else
+	{
+		Permissions perms = effectivePermissions(page);
+		if(!perms.canSeePageHistory())
+		{
+			return errorResponse("Permission denied", "You cannot see the changes history of this page", 403);
+		}
+	}
+
 	unsigned int count = 0;
 	std::vector<Revision> resultList;
 	auto revisionDao = this->database->createRevisionDao();
@@ -102,3 +118,8 @@ Response HandlerHistory::handle(const Request &r)
 	response.setStatus(200);
 	return response;
 }
+
+bool HandlerHistory::canAccess(const Permissions &perms)
+{
+	return true; // This is a lie but we need to this a little more fine grained here, which we do in the handleRequest
+}