From 4c4bee6981525aea8de136e8ff433f1ce84da4b7 Mon Sep 17 00:00:00 2001
From: Alexander Ebert <ebert@woltlab.com>
Date: Thu, 17 Jan 2019 16:31:48 +0100
Subject: [PATCH] Restrict the mentioning of groups using a permission

See #2804
---
 com.woltlab.wcf/userGroupOption.xml                          | 5 +++++
 wcfsetup/install/files/lib/data/user/UserAction.class.php    | 4 ++--
 .../install/files/lib/data/user/group/UserGroup.class.php    | 4 ++++
 wcfsetup/install/files/lib/util/MessageUtil.class.php        | 2 +-
 wcfsetup/install/lang/de.xml                                 | 1 +
 wcfsetup/install/lang/en.xml                                 | 1 +
 6 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/com.woltlab.wcf/userGroupOption.xml b/com.woltlab.wcf/userGroupOption.xml
index 182536ce47..c84d2f599a 100644
--- a/com.woltlab.wcf/userGroupOption.xml
+++ b/com.woltlab.wcf/userGroupOption.xml
@@ -588,6 +588,11 @@ pdf</defaultvalue>
 				<categoryname>user.message</categoryname>
 				<optiontype>BBCodeSelect</optiontype>
 			</option>
+			<option name="user.message.canMentionGroups">
+				<categoryname>user.message</categoryname>
+				<optiontype>boolean</optiontype>
+				<defaultvalue>1</defaultvalue>
+			</option>
 			<!-- /user.message -->
 			<!-- user.message.comment -->
 			<option name="user.comment.floodControlTime">
diff --git a/wcfsetup/install/files/lib/data/user/UserAction.class.php b/wcfsetup/install/files/lib/data/user/UserAction.class.php
index af4e7916dd..a48403bfcf 100644
--- a/wcfsetup/install/files/lib/data/user/UserAction.class.php
+++ b/wcfsetup/install/files/lib/data/user/UserAction.class.php
@@ -505,13 +505,13 @@ class UserAction extends AbstractDatabaseObjectAction implements IClipboardActio
 		$list = [];
 		
 		if ($this->parameters['data']['includeUserGroups']) {
-			$accessibleGroups = UserGroup::getAccessibleGroups();
+			$accessibleGroups = UserGroup::getMentionableGroups();
 			foreach ($accessibleGroups as $group) {
 				if (!empty($this->parameters['data']['restrictUserGroupIDs']) && !in_array($group->groupID, $this->parameters['data']['restrictUserGroupIDs'])) {
 					continue;
 				}
 				
-				if ($this->parameters['data']['scope'] === 'mention' && !$group->canBeMentioned()) {
+				if ($this->parameters['data']['scope'] === 'mention' && (!WCF::getSession()->getPermission('user.message.canMentionGroups') || !$group->canBeMentioned())) {
 					continue;
 				}
 				
diff --git a/wcfsetup/install/files/lib/data/user/group/UserGroup.class.php b/wcfsetup/install/files/lib/data/user/group/UserGroup.class.php
index 9cfa83c24e..e15d888810 100644
--- a/wcfsetup/install/files/lib/data/user/group/UserGroup.class.php
+++ b/wcfsetup/install/files/lib/data/user/group/UserGroup.class.php
@@ -426,6 +426,10 @@ class UserGroup extends DatabaseObject implements ITitledObject {
 	 * @since 5.2
 	 */
 	public static function getMentionableGroups() {
+		if (!WCF::getSession()->getPermission('user.message.canMentionGroups')) {
+			return [];
+		}
+		
 		self::getCache();
 		
 		$groups = [];
diff --git a/wcfsetup/install/files/lib/util/MessageUtil.class.php b/wcfsetup/install/files/lib/util/MessageUtil.class.php
index f6357a0fcf..be136db97a 100644
--- a/wcfsetup/install/files/lib/util/MessageUtil.class.php
+++ b/wcfsetup/install/files/lib/util/MessageUtil.class.php
@@ -66,7 +66,7 @@ class MessageUtil {
 			if ($type === 'user') {
 				$usernames[] = $element->textContent;
 			}
-			else if ($type === 'group') {
+			else if ($type === 'group' && WCF::getSession()->getPermission('user.message.canMentionGroups')) {
 				$attributes = $htmlInputProcessor->getHtmlInputNodeProcessor()->parseAttributes(
 					$element->getAttribute('data-attributes')
 				);
diff --git a/wcfsetup/install/lang/de.xml b/wcfsetup/install/lang/de.xml
index a609611eac..cfc4858d8d 100644
--- a/wcfsetup/install/lang/de.xml
+++ b/wcfsetup/install/lang/de.xml
@@ -704,6 +704,7 @@
 		<item name="wcf.acp.group.option.user.comment.disallowedBBCodes.description"><![CDATA[Die hier ausgewählten BBCodes dürfen von Mitgliedern dieser Benutzergruppe <em>nicht</em> verwendet werden.]]></item>
 		<item name="wcf.acp.group.option.user.message.disallowedBBCodes"><![CDATA[Nicht erlaubte BBCodes]]></item>
 		<item name="wcf.acp.group.option.user.message.disallowedBBCodes.description"><![CDATA[Die hier ausgewählten BBCodes dürfen von Mitgliedern dieser Benutzergruppe <em>nicht</em> verwendet werden.]]></item>
+		<item name="wcf.acp.group.option.user.message.canMentionGroups"><![CDATA[Kann Benutzergruppen erwähnen]]></item>
 		<item name="wcf.acp.group.option.admin.user.rank.canManageRank"><![CDATA[Kann Benutzerränge verwalten]]></item>
 		<item name="wcf.acp.group.option.admin.user.canEditActivityPoints"><![CDATA[Kann Aktivitätspunkte bearbeiten]]></item>
 		<item name="wcf.acp.group.option.admin.user.canViewInvisible"><![CDATA[Kann unsichtbare Benutzer sehen]]></item>
diff --git a/wcfsetup/install/lang/en.xml b/wcfsetup/install/lang/en.xml
index 657bd02fae..7d643b1114 100644
--- a/wcfsetup/install/lang/en.xml
+++ b/wcfsetup/install/lang/en.xml
@@ -680,6 +680,7 @@
 		<item name="wcf.acp.group.option.user.comment.disallowedBBCodes.description"><![CDATA[Selected BBCodes <em>cannot</em> be used by the users of this user group.]]></item>
 		<item name="wcf.acp.group.option.user.message.disallowedBBCodes"><![CDATA[Disallowed BBCodes]]></item>
 		<item name="wcf.acp.group.option.user.message.disallowedBBCodes.description"><![CDATA[Selected BBCodes <em>cannot</em> be used by the users of this user group.]]></item>
+		<item name="wcf.acp.group.option.user.message.canMentionGroups"><![CDATA[Can mention user groups]]></item>
 		<item name="wcf.acp.group.option.admin.user.rank.canManageRank"><![CDATA[Can manage user ranks]]></item>
 		<item name="wcf.acp.group.option.admin.user.canEditActivityPoints"><![CDATA[Can manage activity points]]></item>
 		<item name="wcf.acp.group.option.admin.user.canViewInvisible"><![CDATA[Can view invisible users]]></item>
-- 
2.20.1