Page MenuHomePhabricator

Change deleted topic titles to be consistently visible and reflect this in permissions system
Closed, ResolvedPublic

Description

My understanding is that they are not considered private from non-privileged users.

However, history shows them as "" (which also looks broken). (You can probably find an example at https://www.mediawiki.org/w/index.php?title=Manual_talk:FAQ&action=history ):

(cur prev	topic) 22:09, 19 November 2015 . . SPage (WMF) (talk | contribs) deleted the topic "" (kgh put a "candidates for speedy deletion" template on this) . . (-80)‎

And it turns out this only shows on logs because the permissions are not enforced there. I don't think this is actually a security problem if we agree that topic title is not sensitive for deleted topics. Suppress logs are restricted by a separate mechanism (https://www.mediawiki.org/wiki/Special:Log/suppress).

So if we confirm this is not sensitive, the permission system should reflect this. Probably, they should also be visible on history. If not, though, I suggest we make a history message that does not look broken.

Event Timeline

Restricted Application added subscribers: StudiesWorld, Aklapper. · View Herald Transcript

That is all correct. Meta details of the entries in the standard deletion log are fully visible to everyone. That's also how LQT does it.

That is all correct. Meta details of the entries in the standard deletion log are fully visible to everyone. That's also how LQT does it.

Do you also agree we should change it to:

deleted the topic "Actual topic title"

instead of:

deleted the topic ""

in history?

In T119234#1821677, @Mattflaschen wrote:

Do you also agree we should change it to:

Yes. Removing the visibility of the topic title, would be more along the lines of {T116301}, IIUC.

Mattflaschen-WMF renamed this task from Be consistent about whether topic titles of deleted topics are visible to Change deleted topic titles to be consistently visible and reflect this in permissions system.Nov 20 2015, 8:57 PM

The team discussed this in a meeting, and we're in agreement that this is public data.

Change 294175 had a related patch set uploaded (by Mattflaschen):
SECURITY: Fix topic title visibility

https://gerrit.wikimedia.org/r/294175

Change 299864 had a related patch set uploaded (by Mattflaschen):
SECURITY: Fix topic title visibility

https://gerrit.wikimedia.org/r/299864

Change 299864 merged by jenkins-bot:
SECURITY: Fix topic title visibility

https://gerrit.wikimedia.org/r/299864

Change 299883 had a related patch set uploaded (by Mattflaschen):
SECURITY: Fix topic title visibility

https://gerrit.wikimedia.org/r/299883

Change 299885 had a related patch set uploaded (by Mattflaschen):
SECURITY: Fix topic title visibility

https://gerrit.wikimedia.org/r/299885

Change 299885 merged by jenkins-bot:
SECURITY: Fix topic title visibility

https://gerrit.wikimedia.org/r/299885

Change 299883 merged by jenkins-bot:
SECURITY: Fix topic title visibility

https://gerrit.wikimedia.org/r/299883

Checked in betalabs - the deleted topic titles will be displayed to all logged users and anon users on 'View history', 'Recent changes', and Special:Log/delete.

e.g.

Screen Shot 2016-08-16 at 4.28.46 PM.png (47×1 px, 35 KB)

Screen Shot 2016-08-16 at 4.50.35 PM.png (629×1 px, 213 KB)