iBet uBet web content aggregator. Adding the entire web to your favor.
iBet uBet web content aggregator. Adding the entire web to your favor.



Link to original content: https://phabricator.wikimedia.org/T354460
⚓ T354460 purge actions are affected by permission check via $wgNamespaceProtection or config pages (.js/.css)
Page MenuHomePhabricator

purge actions are affected by permission check via $wgNamespaceProtection or config pages (.js/.css)
Closed, ResolvedPublicBUG REPORT

Description

Steps to replicate the issue (include links if applicable):

or

What happens?:
The permission check is to restrict:
Without a sysop account the warning/text "This page provides interface text for the software on this wiki, and is protected to prevent abuse. To add or change translations for all wikis, please use [https://translatewiki.net/ translatewiki.net], the MediaWiki localisation project." is shown

Since the use of Authority for ratelimit (T310476 ) in Action API's action=purge (26456e5b) or index.php (07a9c87b) the purge action is affected by unrelated permission checks
I have seen it for namespace protection (like MediaWiki namespace) and protection of config pages (js/css) of users, like common.js.
This is at least a behaviour change/regression or a wanted breaking change.

What should have happened instead?:
Allow the purge as it was before or document the new permission check. Implicit rights like purge are designed to work for ratelimit only, according to the comment in code:

Implicit rights are defined to allow rate limits to be imposed on permissions

Software version (skip for WMF-hosted wikis like Wikipedia): master

Event Timeline

This seems correct to me as is. Why should you be able to purge a page you can't edit?

This seems correct to me as is. Why should you be able to purge a page you can't edit?

That is not how purges works before the change. If that is the new behaviour, maybe I should find a good place to document that.

On the other side I can purge the enwp main page, but I cannot edit it - https://en.wikipedia.org/wiki/Special:ApiSandbox#action=purge&format=json&titles=Main%20Page&formatversion=2,
so it's not about all protections/permissions (like page protections from sysops)

Tgr subscribed.

Tagging MediaWiki-Engineering - a predecessor team broke this so we should probably fix it.

Change 993195 had a related patch set uploaded (by Umherirrender; author: Umherirrender):

[mediawiki/core@master] Use Authority::authorizeAction for implicit purge/linkpurge right

https://gerrit.wikimedia.org/r/993195

Tagging MediaWiki-Engineering - a predecessor team broke this so we should probably fix it.

Right, that way me, sorry about that. And thanks for the fix, @Umherirrender!

Change 993195 merged by jenkins-bot:

[mediawiki/core@master] Use Authority::authorizeAction for implicit purge/linkpurge right

https://gerrit.wikimedia.org/r/993195

Umherirrender claimed this task.