Steps to replicate the issue (include links if applicable):
- Go to https://www.mediawiki.org/wiki/Special:ApiSandbox#action=purge&format=json&titles=MediaWiki%3AAboutsite&formatversion=2
- Press "Make Request"
or
- Visit https://www.mediawiki.org/wiki/MediaWiki:Aboutsite?action=purge
- Press "ok"
What happens?:
The permission check is to restrict:
Without a sysop account the warning/text "This page provides interface text for the software on this wiki, and is protected to prevent abuse. To add or change translations for all wikis, please use [https://translatewiki.net/ translatewiki.net], the MediaWiki localisation project." is shown
Since the use of Authority for ratelimit (T310476 ) in Action API's action=purge (26456e5b) or index.php (07a9c87b) the purge action is affected by unrelated permission checks
I have seen it for namespace protection (like MediaWiki namespace) and protection of config pages (js/css) of users, like common.js.
This is at least a behaviour change/regression or a wanted breaking change.
What should have happened instead?:
Allow the purge as it was before or document the new permission check. Implicit rights like purge are designed to work for ratelimit only, according to the comment in code:
Implicit rights are defined to allow rate limits to be imposed on permissions
Software version (skip for WMF-hosted wikis like Wikipedia): master