From b17cfdaf7cff17d14270f657ceb80c27c4c057e3 Mon Sep 17 00:00:00 2001
From: =?utf8?q?Tim=20D=C3=BCsterhus?= <duesterhus@woltlab.com>
Date: Fri, 12 Feb 2021 15:46:44 +0100
Subject: [PATCH] Bind exportMailAddress bulk process to `canEditMailAddress`
 instead of `canMailUser`

Unfortunately the `permissions` form a logical disjunction, not a conjunction,
thus we can't check both permissions. The `canEditMailAddress` is more fitting,
because even without `canMailUser` the admin could simply look up all users
manually if they are allowed to edit (and thus see) mail addresses. It's just a
larger effort.

Resolves #3963
---
 com.woltlab.wcf/objectType.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/com.woltlab.wcf/objectType.xml b/com.woltlab.wcf/objectType.xml
index 83c353b2af..50c20e882a 100644
--- a/com.woltlab.wcf/objectType.xml
+++ b/com.woltlab.wcf/objectType.xml
@@ -1246,7 +1246,7 @@
 			<definitionname>com.woltlab.wcf.bulkProcessing.user.action</definitionname>
 			<classname>wcf\system\bulk\processing\user\ExportMailAddressUserBulkProcessingAction</classname>
 			<action>exportMailAddress</action>
-			<permissions>admin.user.canMailUser</permissions>
+			<permissions>admin.user.canEditMailAddress</permissions>
 		</type>
 		<!-- /user bulk processing actions -->
 		<!-- user bulk processing conditions -->
-- 
2.20.1