Page MenuHomePhabricator

Able to create Scribunto pages with Lua errors with contentmodel changes
Closed, ResolvedPublic


Modules (scribunto content model) do not allow a user to save the page if there are Lua errors. However, a user could change the content model to wikitext or something else, make an edit, and change it back to create a page with Lua errors. See

I don't know how blocking this issue is...

Note on above page: I created initially as a TimedText page, moved it to the Project (WP) space, and the Module space (where I changed the contentmodel to Scribunto), and moved it back to WP.

It appears that change to "Scribunto" is allowed only in the Module ns. I cannot change a Wikipedia page to "Scribunto", but a module page can be moved out of it to WP ns.

Event Timeline

Interesting, nice find. It appears that ScribuntoContent doesn't implement either of Content::isValid() or Content::prepareSave(), so you can save invalid content with it, if you use a code path that bypasses the EditFilterMerged hook. I already have a patch to make Special:ChangeContentModel run the EditFilterMergedContent hook, but we should also fix this in Scribunto.

Change 310463 had a related patch set uploaded (by Legoktm):
Improve validation of ScribuntoContent

Change 310463 merged by jenkins-bot:
Improve validation of ScribuntoContent