Page MenuHomePhabricator

Disregard "edit" permission when uploading to an existing file
Open, LowPublic

Description

The usage of both "edit" and "upload" permission first appeared in cb4cef1d1032a7d4c9f9e244798e4ce19aa44f67 ("edit" was added first). However, Special:Upload does not check whether the user is allowed to "edit" or not. Besides, uploading to an existing file does not change the file description page wikitext, so checking for "edit" permission is not necessary.

Bug confirmed in beta:

upload-protect_bug.JPG (665×1 px, 106 KB)

Note: simply remove the check from UploadBase->verifyTitlePermissions will break cascade upload protection, as cascade upload protection rely on the parent page being edit protected.

Event Timeline

Given the (vague) plans to unify the file data and description histories into one, if we "fix" this we'll end up just undoing it in a few months' time, surely?

Given the (vague) plans to unify the file data and description histories into one, if we "fix" this we'll end up just undoing it in a few months' time, surely?

Hmm. Any idea how to fix T24521 without this? Or alternatively, let file data update (if server-side) the file desc page without the need of "edit" permission, since the uploader can't really engage in an edit war by uploading afaik (if it's an upload war, the admin can simply protect the "upload" permission).

Change 233207 had a related patch set uploaded (by Zhuyifei1999):
Cascade-protection: Fixes for files

https://gerrit.wikimedia.org/r/233207

Change 233207 abandoned by Zhuyifei1999:
Protection: Rework on how cascade-protection are applied to files

Reason:
I currently have no interest to fix this any time soon. If anyone else wish to work on this, feel free to restore.

https://gerrit.wikimedia.org/r/233207

Aklapper removed a project: Patch-For-Review.

I currently have no interest to fix this any time soon. If anyone else wish to work on this, feel free to restore.

Resetting task assignee to reflect this.