Able to create Scribunto pages with Lua errors with contentmodel changes
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	andymw
	Sep 13 2016, 6:20 PM

Description

Modules (scribunto content model) do not allow a user to save the page if there are Lua errors. However, a user could change the content model to wikitext or something else, make an edit, and change it back to create a page with Lua errors. See https://en.wikipedia.beta.wmflabs.org/w/index.php?title=Wikipedia:TestTimedText&action=history

I don't know how blocking this issue is...

Note on above page: I created https://en.wikipedia.beta.wmflabs.org/wiki/Wikipedia:TestTimedText initially as a TimedText page, moved it to the Project (WP) space, and the Module space (where I changed the contentmodel to Scribunto), and moved it back to WP. https://en.wikipedia.beta.wmflabs.org/w/index.php?title=Wikipedia:TestTimedText&action=history

It appears that change to "Scribunto" is allowed only in the Module ns. I cannot change a Wikipedia page to "Scribunto", but a module page can be moved out of it to WP ns.

Details

	Subject	Repo	Branch	Lines +/-
	Improve validation of ScribuntoContent	mediawiki/extensions/Scribunto	master	+22 -18

Customize query in gerrit

Related Objects
Search...

Status	Assigned	Task
Declined	Vogone	T202597 'editcontentmodel' missing in metawiki's MassMessage sender group
Open	None	T92795 Users without 'editcontentmodel' user right cannot create MassMessage delivery lists
Open	None	T85847 Grant editcontentmodel right to all logged in users
Open	None	T145174 Perhaps should have a notion of titles that must use default content model
Resolved	Legoktm	T145548 Able to create Scribunto pages with Lua errors with contentmodel changes

Event Timeline

andymw created this task.Sep 13 2016, 6:20 PM

andymw edited parent tasks, added: T85847: Grant editcontentmodel right to all logged in users, T145174: Perhaps should have a notion of titles that must use default content model; removed: T145489: Allow AbuseFilter to filter edits that change content models.

andymw updated the task description. (Show Details)Sep 13 2016, 6:23 PM

Interesting, nice find. It appears that ScribuntoContent doesn't implement either of Content::isValid() or Content::prepareSave(), so you can save invalid content with it, if you use a code path that bypasses the EditFilterMerged hook. I already have a patch to make Special:ChangeContentModel run the EditFilterMergedContent hook, but we should also fix this in Scribunto.

Change 310463 had a related patch set uploaded (by Legoktm):
Improve validation of ScribuntoContent

https://gerrit.wikimedia.org/r/310463

gerritbot added a project: Patch-For-Review.Sep 13 2016, 11:50 PM

Change 310463 merged by jenkins-bot:
Improve validation of ScribuntoContent

https://gerrit.wikimedia.org/r/310463

Legoktm closed this task as Resolved.Sep 14 2016, 7:28 PM

ReleaseTaggerBot added a project: MW-1.28-release (WMF-deploy-2016-09-20_(1.28.0-wmf.20)).Sep 14 2016, 8:00 PM

andymw removed a subscriber: andymw.Sep 14 2016, 8:54 PM