Page MenuHomePhabricator

Able to create Scribunto pages with Lua errors with contentmodel changes
Closed, ResolvedPublic

Description

Modules (scribunto content model) do not allow a user to save the page if there are Lua errors. However, a user could change the content model to wikitext or something else, make an edit, and change it back to create a page with Lua errors. See https://en.wikipedia.beta.wmflabs.org/w/index.php?title=Wikipedia:TestTimedText&action=history

I don't know how blocking this issue is...

Note on above page: I created https://en.wikipedia.beta.wmflabs.org/wiki/Wikipedia:TestTimedText initially as a TimedText page, moved it to the Project (WP) space, and the Module space (where I changed the contentmodel to Scribunto), and moved it back to WP. https://en.wikipedia.beta.wmflabs.org/w/index.php?title=Wikipedia:TestTimedText&action=history

It appears that change to "Scribunto" is allowed only in the Module ns. I cannot change a Wikipedia page to "Scribunto", but a module page can be moved out of it to WP ns.

Event Timeline

andymw updated the task description. (Show Details)Sep 13 2016, 6:23 PM

Interesting, nice find. It appears that ScribuntoContent doesn't implement either of Content::isValid() or Content::prepareSave(), so you can save invalid content with it, if you use a code path that bypasses the EditFilterMerged hook. I already have a patch to make Special:ChangeContentModel run the EditFilterMergedContent hook, but we should also fix this in Scribunto.

Change 310463 had a related patch set uploaded (by Legoktm):
Improve validation of ScribuntoContent

https://gerrit.wikimedia.org/r/310463

Change 310463 merged by jenkins-bot:
Improve validation of ScribuntoContent

https://gerrit.wikimedia.org/r/310463

Legoktm closed this task as Resolved.Sep 14 2016, 7:28 PM
andymw removed a subscriber: andymw.Sep 14 2016, 8:54 PM