Web UI moves are rate-limited in MovePageForm::doSubmit(), which ApiMove has never used.
I note that MovePage (the utility class for moving pages) is a bit too low-level for the purpose, since it handles moving exactly one page while the rate limit should probably continue to apply to "submissions" that might move a page, its talk page, and its subpages all at once.
Filing this as "security" since it allows for bypassing rate limits.
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | • demon | T124940 MediaWiki 1.26.3 security release | |||
| Resolved | • csteipp | T132874 API action=move is not rate limited |
Thanks @Anomie!
I'll try to get this deployed today, and included in the next release.
I note that MovePage (the utility class for moving pages) is a bit too low-level for the purpose, since it handles moving exactly one page while the rate limit should probably continue to apply to "submissions" that might move a page, its talk page, and its subpages all at once.
Sorry for possibly irrelevant comment, but could that mean that if the work as described is implemented, if one moves a page with like 51 subpage and his limit allows him to do just 50 moves at once, just the root and 49 subpages (if we do not have talks) will be moved and the rest would stay unmoved? If so, it's probably better to throw an error right away.
Sorry again if what I have written is a gibberish in the context.
What you refer to as "the work as described" is actually what is not being done here, for the reasons that concern you.