Page MenuHomePhabricator

Allow Administrators to delete site-wide script pages
Closed, DeclinedPublicFeature

Description

Administrators are not able to use their delete access on scripts pages such as MediaWiki:*.[css|js]

Normal admins can delete user's javascript pages, but cannot delete site-wide javascript pages unless they are interface admins

See also the discussion at T256427: Normal admin cannot delete site-wide javascript page

Event Timeline

Restricted Application added a subscriber: Aklapper. · View Herald Transcript

This task just proposes a solution, without describing what problem it intends to solve, and I believe it should be declined. I'd leave that to @Tgr though (who is the main architect for creating interface-admin group)

Normal admins can deleted user's javascript pages...

The reason for that was already given in T200176, and as I have explained in T256427, the rationale does not apply to siteconfig pages, therefore there's no need for that exception.

The exception for userconfig pages was made because the page can be edited by the user it belongs to, and if they put something that needs to be removed, requiring that only interface admin be able to delete is not ideal, that's why exception was added.

But this reason does not apply to siteconfig pages completely. Only interface admin can create such pages in the first place, and they're highly trusted that we believe they'll not post anything that will pose a risk or require immediate deletion. And this is self-evident, since creation of the userright, we never heard of a case where a supposedly malicious interface-admin put something in siteconfig page, and it was left there because admins couldn't delete it. Do we?

Even the deletion discussion that led to the misunderstanding in T256427. It was actually non-incident. The page was seamlessly deleted by another admin after they were temporarily given interface admin rights by a bureaucrat. That's the essence of the separation of the rights.

In addition, even in hypothetical unfortunate case where an interface-admin goes berserk, then another interface admin/global one or stewards can deal with the situation, that's why we have them. But there's no reason actually for sysop to be able to delete MediaWiki:Common.js, that will defeat the very purpose of interface-admin creation, and with this increasing addition of exceptions, we'd be better to just remove the interface-admin group and return the rights back to normal admins.

This task just proposes a solution, without describing what problem it intends to solve, and I believe it should be declined. I'd leave that to @Tgr though.

This task requests a feature, i.e. allowing normal admins to delete site-wide js pages. It isn't a solution for a problem. But, if one should be provided:

Problem:
As an admin, I am unable to delete pages where there is community consensus for deletion, because I am not an interface admin

Solution:
Allow admins that are not interface admins to delete sitewide js

Normal admins can deleted user's javascript pages...

The reason for that was already given in T200176, and as I have explained in T256427, the rationale does not apply to siteconfig pages, therefore there's no need for that exception.

The same rationale doesn't apply, but a different one does - mediawiki ns pages can be deleted by community consensus, and normal admins should be able to implement such consensus. There is a different need for that exception

The exception for userconfig pages was made because the page can be edited by the user it belongs to, and if they put something that needs to be removed, requiring that only interface admin be able to delete is not ideal, that's why exception was added.

But this reason does not apply to siteconfig pages completely. Only interface admin can create such pages in the first place, and they're highly trusted that we believe they'll not post anything that will pose a risk or require immediate deletion. And this is self-evident, since creation of the userright, we never heard of a case where a supposedly malicious interface-admin put something in siteconfig page, and it was left there because admins couldn't delete it. Do we?

Even the deletion discussion that led to the misunderstanding in T256427. It was actually non-incident. The page was seamlessly deleted by another admin after they were temporarily given interface admin rights by a bureaucrat. That's the essence of the separation of the rights.

The purpose of the separation of rights was to restrict who could edit the sitewide js, not who could delete it (which is why the interface admin group, on its own, isn't enough to delete sitewide js, because it lacks the delete right)

In addition, even in hypothetical unfortunate case where an interface-admin goes berserk, then another interface admin/global one or stewards can deal with the situation, that's why we have them. But there's no reason actually for sysop to be able to delete MediaWiki:Common.js, that will defeat the very purpose of interface-admin creation, and with this increasing addition of exceptions, we'd be better to just remove the interface-admin group and return the rights back to normal admins.

The purpose of creating the interface-admin group was to restrict who can edit sidewide js, because it is an attack vector. Deleting such js is in no way comparable to editing it - deletion doesn't add more js to be executed, only removes it. And while its unlikely that normal sysops will need to delete common.js, its more likely that, as was the case here, they will need to delete other js pages in the mediawiki namespace.

Xaosflux renamed this task from Normal admin cannot delete site-wide javascript page, should be able to to Administrators cannot delete site-wide script pages.Jul 20 2020, 12:47 PM
Xaosflux updated the task description. (Show Details)

Is this a regression, feels like this was working before? Notably, non interface admins can rev-del mediawiki:*.[css|js] revisions, just not the entire page.

Is this a regression, feels like this was working before? Notably, non interface admins can rev-del mediawiki:*.[css|js] revisions, just not the entire page.

I thought it was, but @Ammarpad wrote that it wasn't (i.e. that since the introduction of interface admin, normal admins haven't been able to delete these at all)

Xaosflux renamed this task from Administrators cannot delete site-wide script pages to Allow Administrators to delete site-wide script pages.Jul 20 2020, 5:11 PM
Xaosflux changed the subtype of this task from "Task" to "Feature Request".

Is this a regression,

No, it's not.

feels like this was working before?

Yes, it's of course working. (that's deleting siteconfig page requires editsite* permission)

Notably, non interface admins can rev-del mediawiki:*.[css|js] revisions, just not the entire page.

I believe you're recollecting wrong, or maybe you're remembering the logs before the rights were separated. If you are sure it once worked (after creating interface-admin), please provide a link to the deletion log, maybe I am the one recollecting wrong.

Probably just bad memory - think it was overlap with the not working/then working deleting of userjss/usercss

Change 634262 had a related patch set uploaded (by DannyS712; owner: DannyS712):
[mediawiki/core@master] PermissionManager: Allow sysops to view deleted config pages

https://gerrit.wikimedia.org/r/634262

^ patch rescoped to not include this, will do as a follow-up

I second Ammarpad here. I don't see why admins should be able to delete sitewide config pages - IAs are the only one who can _create_ them, and it's IA's responsibility to make sure they have the correct content. Allowing admins to delete something they're not deemed to understand doesn't make any sense to me.

Should this task be declined, per last comments?

@Urbanecm - last I checked, Int-admins can't actually delete these type of pages (or anything other page, as they don't have the delete permission assigned by default)

You have to be both an admin and an interface admin to delete sitewide CSS/JS pages. Most interface admins are, so I don't think that's a problem in practice, and deleting a page has a nontrivial security surface (e.g. it could set up a T257545 type attack on Common.js). So I agree this should be declined, unless there is more convincing proof that it creates problems.