API action=move is not rate limited
Closed, ResolvedPublic

Description

Web UI moves are rate-limited in MovePageForm::doSubmit(), which ApiMove has never used.

I note that MovePage (the utility class for moving pages) is a bit too low-level for the purpose, since it handles moving exactly one page while the rate limit should probably continue to apply to "submissions" that might move a page, its talk page, and its subpages all at once.

Filing this as "security" since it allows for bypassing rate limits.

Anomie created this task.Apr 17 2016, 2:36 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptApr 17 2016, 2:36 PM

Anomie moved this task from Unsorted to Needs Review on the MediaWiki-API board.Apr 17 2016, 2:38 PM

+1

Thanks @Anomie!

I'll try to get this deployed today, and included in the next release.

csteipp triaged this task as "Normal" priority.
csteipp closed this task as "Resolved".May 5 2016, 7:31 PM
csteipp claimed this task.

19:30 csteipp: deployed patch for T132874

demon changed the visibility from "Custom Policy" to "Public (No Login Required)".May 20 2016, 5:28 PM
demon changed Security from Software security bug to None.
Restricted Application added a subscriber: Malyacko. · View Herald TranscriptMay 20 2016, 5:28 PM
Base added a subscriber: Base.May 20 2016, 7:33 PM

I note that MovePage (the utility class for moving pages) is a bit too low-level for the purpose, since it handles moving exactly one page while the rate limit should probably continue to apply to "submissions" that might move a page, its talk page, and its subpages all at once.

Sorry for possibly irrelevant comment, but could that mean that if the work as described is implemented, if one moves a page with like 51 subpage and his limit allows him to do just 50 moves at once, just the root and 49 subpages (if we do not have talks) will be moved and the rest would stay unmoved? If so, it's probably better to throw an error right away.

Sorry again if what I have written is a gibberish in the context.

What you refer to as "the work as described" is actually what is not being done here, for the reasons that concern you.