Page MenuHomePhabricator

Cascading protection does not affect <includeonly> content
Closed, DeclinedPublic

Description

Cascading protection does not affect transclusions wrapped with <includeonly>,
which affects content in protected templates or pages like "Project:Protected
inexistent pages".


Version: unspecified
Severity: normal

Details

Reference
bz9333

Related Objects

Event Timeline

bzimport raised the priority of this task from to Lowest.Nov 21 2014, 9:35 PM
bzimport set Reference to bz9333.
bzimport added a subscriber: Unknown Object (MLST).

This is difficult to fix (the list of included templates is created in a parse
operation) and of limited value. The intention of the cascading page protection
feature is to protect a page against template vandalism, not to provide hacks to
protect non-existent pages. Protecting non-existent pages should be a separate
feature.

Propose WONTFIX.

ayg wrote:

It seems logical for cascade protection to work properly whether the page is transcluded or
viewed directly. The parse operation that generates the list shouldn't strip either <noinclude>
or <includeonly> sections. I'm surprised if we don't have an option for that lying around
somewhere, but it seems logical to add if we don't.

I don't see what this has to do with protection of nonexistent pages (bug 2919)?

The intention of cascading protection is to protect the "final product" page -
the one displayed to the user... not the actual page text itself - the raw
content stored in the text table. To do this, the templates included on the page
need to be protected - but the ones in includeonly needn't be, because they're
not shown on the final page displayed to users. Anyway, as I said, this is a
fairly difficult bug to fix, because it involves re-parsing things, as opposed
to piggybacking off parse operations that would have occurred anyway (as the
behaviour is currently). This is problematic from a performance perspective.

As I'm not involved with the project in any meaningful way anymore, I shan't
close this. However, I would recommend it be closed as WONTFIX.