Apart from the usability issues, currently the pattern field is (justifiedly so) escaped to prevent SQL injection. However, the way it is does not allow any pattern characters in the pattern, only exact match, making the field pretty much useless.
Description
Description
Details
Details
Related Changes in Gerrit:
| Subject | Repo | Branch | Lines +/- | |
|---|---|---|---|---|
| Update callers | mediawiki/extensions/Nuke | master | +2 -2 |
Related Objects
Related Objects
Event Timeline
Comment Actions
Verified on https://www.mediawiki.org/wiki/Special:Nuke
Steps to reproduce:
- Find a new page title in https://www.mediawiki.org/wiki/Special:NewPages (open a page, copy the title from the URL so that you have the underscores, for instance Wikimedia_Developer_Summit/2017/Room_Setup).
- Enter the title in the pattern field at https://www.mediawiki.org/wiki/Special:Nuke and submit.
I. Observed: The page is found and selected for deletion.
- Repeat (2) with a truncated title and % wildcard (e.g. Wikimedia%).
II. Observed: the form is reloaded with an error message "there are no new pages in recent changes" and the field gets emptied.
Comment Actions
Caused by 6bb05450766e2df4ea568adf377cbbd237c09b91 (T153988; https://gerrit.wikimedia.org/r/328850) which changed the field name from pattern to nuke-pattern, but did not update the caller.
Comment Actions
I don't have time to work on this. Specially, it's security-related and I'm too sloppy to handle such cases.
This comment was removed by Johnywhy.