Fixed getModeratorsWhoCanHandleReport/filterViewableReports bypass Report::canView

[Xon]

Affected version

2.0.11

In nearly every case when checking report visibility, \XF\Entity\Report::canView is called. Except for two locations;

• \XF\Repository\Report::getModeratorsWhoCanHandleReport
• \XF\Repository\Report::filterViewableReports

Note;
filterViewableReports() can just be simplified to calling $reports->filterViewable()

 

[XF Bug Bot]

Thank you for reporting this issue. The issue is now resolved and we are aiming to include that in a future XF release (2.0.12).

Change log:

Consistently use code paths which result in the canView method of the report entity (rather than the handler) being used.

Any changes made as a result of this issue being resolved may not be rolled out here until later.