Page MenuHomePhabricator
Create Task
Maniphest T109435

Disregard "edit" permission when uploading to an existing file
Open, LowPublic
Actions

Description

The usage of both "edit" and "upload" permission first appeared in cb4cef1d1032a7d4c9f9e244798e4ce19aa44f67 ("edit" was added first). However, Special:Upload does not check whether the user is allowed to "edit" or not. Besides, uploading to an existing file does not change the file description page wikitext, so checking for "edit" permission is not necessary.

Bug confirmed in beta:

upload-protect_bug.JPG (665×1 px, 106 KB)

Note: simply remove the check from UploadBase->verifyTitlePermissions will break cascade upload protection, as cascade upload protection rely on the parent page being edit protected.

Details

ProjectBranchLines +/-Subject
mediawiki/coremaster+80 -41Protection: Rework on how cascade-protection are applied to files
Customize query in gerrit

Related Objects
Search...

Event Timeline

zhuyifei1999 created this task.Aug 18 2015, 2:13 PM
zhuyifei1999 raised the priority of this task from to Needs Triage.
zhuyifei1999 updated the task description. (Show Details)
zhuyifei1999 added projects: MediaWiki-Page-protection, Commons, MediaWiki-Uploading, Multimedia.
zhuyifei1999 added a parent task: T24521: Cascade-protecting files should protect the file, not the description page.
zhuyifei1999 added subscribers: zhuyifei1999, Matanya, Aklapper and 2 others.
Jdforrester-WMF added a subscriber: Jdforrester-WMF.Aug 18 2015, 2:46 PM

Given the (vague) plans to unify the file data and description histories into one, if we "fix" this we'll end up just undoing it in a few months' time, surely?

zhuyifei1999 added a comment.Aug 19 2015, 5:45 AM
In T109435#1549086, @Jdforrester-WMF wrote:

Given the (vague) plans to unify the file data and description histories into one, if we "fix" this we'll end up just undoing it in a few months' time, surely?

Hmm. Any idea how to fix T24521 without this? Or alternatively, let file data update (if server-side) the file desc page without the need of "edit" permission, since the uploader can't really engage in an edit war by uploading afaik (if it's an upload war, the admin can simply protect the "upload" permission).

Steinsplitter moved this task from Incoming to Backlog on the Commons board.Aug 19 2015, 2:19 PM
zhuyifei1999 claimed this task.Aug 23 2015, 11:34 AM

I'm working on this.

zhuyifei1999 mentioned this in T24521: Cascade-protecting files should protect the file, not the description page.Aug 23 2015, 1:24 PM
gerritbot added a subscriber: gerritbot.Aug 23 2015, 1:57 PM

Change 233207 had a related patch set uploaded (by Zhuyifei1999):
Cascade-protection: Fixes for files

https://gerrit.wikimedia.org/r/233207

gerritbot added a project: Patch-For-Review.Aug 23 2015, 1:57 PM
Krenair added a subscriber: Krenair.Aug 23 2015, 3:14 PM
Jdforrester-WMF triaged this task as Low priority.Sep 4 2015, 6:55 PM
Jdforrester-WMF moved this task from Untriaged to Backlog on the Multimedia board.Sep 4 2015, 6:58 PM
gerritbot added a comment.Jan 20 2017, 10:26 AM

Change 233207 abandoned by Zhuyifei1999:
Protection: Rework on how cascade-protection are applied to files

Reason:
I currently have no interest to fix this any time soon. If anyone else wish to work on this, feel free to restore.

https://gerrit.wikimedia.org/r/233207

Aklapper removed zhuyifei1999 as the assignee of this task.Mar 3 2020, 5:49 AM
Aklapper removed a project: Patch-For-Review.
In T109435#2955632, @gerritbot wrote:

I currently have no interest to fix this any time soon. If anyone else wish to work on this, feel free to restore.

Resetting task assignee to reflect this.

ExE-Boss added a subscriber: ExE-Boss.Aug 6 2021, 3:09 PM
Content licensed under Creative Commons Attribution-ShareAlike 3.0 (CC-BY-SA) unless otherwise noted; code licensed under GNU General Public License (GPL) or other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL