From 54b147d87c101baf44006c7fe0f5f299b911bc90 Mon Sep 17 00:00:00 2001
From: Marcel Werk <burntime@woltlab.com>
Date: Sat, 16 May 2026 11:38:56 +0200
Subject: [PATCH] Add `canMention` permission

Closes #6578
---
 com.woltlab.wcf/templates/shared_wysiwyg.tpl              | 2 +-
 com.woltlab.wcf/userGroupOption.xml                       | 5 +++++
 wcfsetup/install/files/lib/data/user/UserAction.class.php | 7 +++++++
 wcfsetup/install/files/lib/util/MessageUtil.class.php     | 6 ++++--
 wcfsetup/install/lang/de.xml                              | 1 +
 wcfsetup/install/lang/en.xml                              | 1 +
 6 files changed, 19 insertions(+), 3 deletions(-)

diff --git a/com.woltlab.wcf/templates/shared_wysiwyg.tpl b/com.woltlab.wcf/templates/shared_wysiwyg.tpl
index 0413aaead4..f67460fcc6 100644
--- a/com.woltlab.wcf/templates/shared_wysiwyg.tpl
+++ b/com.woltlab.wcf/templates/shared_wysiwyg.tpl
@@ -81,7 +81,7 @@
 			list: true,
 			mark: {if $__wcf->getBBCodeHandler()->isAvailableBBCode('mark')}true{else}false{/if},
 			media: {if $__wcf->session->getPermission('admin.content.cms.canUseMedia')}true{else}false{/if},
-			mention: element.dataset.supportMention === "true",
+			mention: {if $__wcf->session->hasPermission('user.message.canMention')}element.dataset.supportMention === "true"{else}false{/if},
 			quoteBlock: true,
 			strikethrough: true,
 			submitOnEnter: false,
diff --git a/com.woltlab.wcf/userGroupOption.xml b/com.woltlab.wcf/userGroupOption.xml
index 41738d0c8f..c00134d16c 100644
--- a/com.woltlab.wcf/userGroupOption.xml
+++ b/com.woltlab.wcf/userGroupOption.xml
@@ -584,6 +584,11 @@ pdf</defaultvalue>
 				<categoryname>user.message</categoryname>
 				<optiontype>BBCodeSelect</optiontype>
 			</option>
+			<option name="user.message.canMention">
+				<categoryname>user.message</categoryname>
+				<optiontype>boolean</optiontype>
+				<defaultvalue>1</defaultvalue>
+			</option>
 			<option name="user.message.canMentionGroups">
 				<categoryname>user.message</categoryname>
 				<optiontype>boolean</optiontype>
diff --git a/wcfsetup/install/files/lib/data/user/UserAction.class.php b/wcfsetup/install/files/lib/data/user/UserAction.class.php
index 94de6ab4e7..46866c7f80 100644
--- a/wcfsetup/install/files/lib/data/user/UserAction.class.php
+++ b/wcfsetup/install/files/lib/data/user/UserAction.class.php
@@ -597,6 +597,13 @@ public function getSearchResultList()
             );
         }
 
+        if (
+            $this->parameters['data']['scope'] === 'mention'
+            && !WCF::getSession()->hasPermission('user.message.canMention')
+        ) {
+            return $list;
+        }
+
         // find users
         $searchString = \addcslashes($searchString, '_%');
         $parameters = [
diff --git a/wcfsetup/install/files/lib/util/MessageUtil.class.php b/wcfsetup/install/files/lib/util/MessageUtil.class.php
index 926e15e030..5ac592cd3c 100644
--- a/wcfsetup/install/files/lib/util/MessageUtil.class.php
+++ b/wcfsetup/install/files/lib/util/MessageUtil.class.php
@@ -73,7 +73,7 @@ public static function getMentionedUserIDs(HtmlInputProcessor $htmlInputProcesso
             );
 
             if ($type === 'user') {
-                if (!empty($attributes[0])) {
+                if (!empty($attributes[0]) && WCF::getSession()->hasPermission('user.message.canMention')) {
                     $userIDs[] = $attributes[0];
                 }
             } elseif (WCF::getSession()->hasPermission('user.message.canMentionGroups')) {
@@ -136,7 +136,9 @@ public static function getMentionedUsers(HtmlInputProcessor $htmlInputProcessor)
             }
 
             if ($type === 'user') {
-                $usernames[] = $element->textContent;
+                if (WCF::getSession()->hasPermission('user.message.canMention')) {
+                    $usernames[] = $element->textContent;
+                }
             } elseif (WCF::getSession()->hasPermission('user.message.canMentionGroups')) {
                 $attributes = $htmlInputProcessor->getHtmlInputNodeProcessor()->parseAttributes(
                     $element->getAttribute('data-attributes')
diff --git a/wcfsetup/install/lang/de.xml b/wcfsetup/install/lang/de.xml
index 190fe057e1..5ddf902aac 100644
--- a/wcfsetup/install/lang/de.xml
+++ b/wcfsetup/install/lang/de.xml
@@ -807,6 +807,7 @@ Sie erreichen das Fehlerprotokoll unter: {link controller='ExceptionLogView' isE
 		<item name="wcf.acp.group.option.user.comment.disallowedBBCodes.description"><![CDATA[Die hier ausgewählten BBCodes dürfen von Mitgliedern dieser Benutzergruppe <em>nicht</em> verwendet werden.]]></item>
 		<item name="wcf.acp.group.option.user.message.disallowedBBCodes"><![CDATA[Nicht erlaubte BBCodes]]></item>
 		<item name="wcf.acp.group.option.user.message.disallowedBBCodes.description"><![CDATA[Die hier ausgewählten BBCodes dürfen von Mitgliedern dieser Benutzergruppe <em>nicht</em> verwendet werden.]]></item>
+		<item name="wcf.acp.group.option.user.message.canMention"><![CDATA[Kann andere Benutzer erwähnen]]></item>
 		<item name="wcf.acp.group.option.user.message.canMentionGroups"><![CDATA[Kann Benutzergruppen erwähnen]]></item>
 		<item name="wcf.acp.group.option.admin.user.rank.canManageRank"><![CDATA[Kann Benutzerränge verwalten]]></item>
 		<item name="wcf.acp.group.option.admin.user.canEditActivityPoints"><![CDATA[Kann Aktivitätspunkte bearbeiten]]></item>
diff --git a/wcfsetup/install/lang/en.xml b/wcfsetup/install/lang/en.xml
index cdb4acb51d..a8a3de1ac8 100644
--- a/wcfsetup/install/lang/en.xml
+++ b/wcfsetup/install/lang/en.xml
@@ -783,6 +783,7 @@ You can access the error log at: {link controller='ExceptionLogView' isEmail=tru
 		<item name="wcf.acp.group.option.user.comment.disallowedBBCodes.description"><![CDATA[Selected BBCodes <em>cannot</em> be used by the users of this user group.]]></item>
 		<item name="wcf.acp.group.option.user.message.disallowedBBCodes"><![CDATA[Disallowed BBCodes]]></item>
 		<item name="wcf.acp.group.option.user.message.disallowedBBCodes.description"><![CDATA[Selected BBCodes <em>cannot</em> be used by the users of this user group.]]></item>
+		<item name="wcf.acp.group.option.user.message.canMention"><![CDATA[Can mention other users]]></item>
 		<item name="wcf.acp.group.option.user.message.canMentionGroups"><![CDATA[Can mention user groups]]></item>
 		<item name="wcf.acp.group.option.admin.user.rank.canManageRank"><![CDATA[Can manage user ranks]]></item>
 		<item name="wcf.acp.group.option.admin.user.canEditActivityPoints"><![CDATA[Can manage activity points]]></item>