HomePhabricator

Don’t show pages with unpatrolled creation to user

Tags
None
Referenced Files
None
Subscribers
None

Description

Don’t show pages with unpatrolled creation to user

When showing a page to a user with the “patrol” right, MediaWiki will
add a “mark this page as patrolled” link if the recentchange that
created this page was not mark as patrolled yet. To protect the link
against clickjacking attacks, it will also send an X-Frame-Options: DENY
header in that case, which means our user sees a blank page embedded in
the tool instead of the item view.

I couldn’t find a way to prevent this, so we detect when MediaWiki will
show this link and skip such diffs in any_diff(). Fortunately, this is
information we can cache per page, even if multiple revisions of the
same page are considered for showing to the user, so the performance
impact shouldn’t be too bad. However, since that recentchange could be
patrolled at some point, after which we should show the page to users
again, that cache is limited to five minutes. (We could cache “was
already patrolled” results forever, since the page should never return
from that to the previous state, but I don’t think value-dependent TTL
is easy to do with cachetools.)

Details

Provenance
LucasWerkmeisterAuthored on Apr 9 2019, 11:01 PM
Parents
R2469:581f783b08dd: Cache rev_id→title together with rev_id→page_id
Branches
Unknown
Tags
Unknown
ChangeId
None