Page MenuHomePhabricator

DynamicPageList2 extension completely breaks permissions
Open, Needs TriagePublic

Description

When this extension is enabled, wiki users cannot do anything. Bureaucrats cannot manage user rights. I can't even edit my own talk page. It says I'm not in the group "users". When I disable this extension everything works fine.

Event Timeline

Aklapper renamed this task from This extension completely breaks permissions to DynamicPageList2 extension completely breaks permissions.Jan 22 2017, 3:17 AM

Hi @Yardenack, thanks for taking the time to report this!
Unfortunately this report lacks some information. If you have time and can still reproduce the problem, please add a more complete description to this report by providing version information for MediaWiki and the extension. Ideally, exact and clear steps to reproduce should allow any other person to follow these steps (without having to interpret those steps) and see the same results. Problems that others can reliably reproduce can get fixed faster. Thanks!

Our wiki URL: https://openwetware.org/wiki/Special:Version
Mediawiki version: 1.28.0.
My user page: https://openwetware.org/wiki/User:Yardena_Cohen
User rights page: https://openwetware.org/wiki/Special:UserRights
My preferences page says: "Email confirmation: Your email address was confirmed on 20 January 2017 at 17:17."

I'm logged in as 'Yardena Cohen', a user with bureaucrat rights. I browse to the user rights page and it works as expected, asking me to "Enter a username". I browse to my own user page and I'm able to edit it.

But then I add this line to LocalSettings.php:

require_once "$IP/extensions/DynamicPageList/DynamicPageList.php";

The version is 2.3.0. It's a git repo at the HEAD of the REL1_28 branch, 7821b33.

Now when I visit the user rights page, it says:

"Permission error
You do not have permission to do that, for the following reason:
You do not have permission to add or remove user rights."

And when I try to edit my user page, it says:

"View source for User:Yardena Cohen
You do not have permission to edit this page, for the following reason:
The action you have requested is limited to users in one of the groups: Users, emailconfirmed."

Note that my email *is* confirmed. When I comment out that line in LocalSettings.php, everything works again.

I can confirm this bug. User permissions are stripped for editing and creating pages. Bureaucrats can not edit user permissions.

MW 1.30 using DPL REL1_30 and tried REL_27. Tracing the error, lots of the following:

[session] User::loadFromSession called before the end of Setup.php
#0 /home/.../public_html/w/includes/user/User.php(2230): User->load()
#1 /home/.../public_html/w/includes/user/User.php(3503): User->getId()
#2 /home/.../public_html/w/includes/user/User.php(3283): User->isLoggedIn()
#3 /home/.../public_html/w/includes/user/User.php(3571): User->getRights()
#4 /home/.../public_html/w/extensions/DynamicPageList/DPLSetup.php(1234): User->isAllowed(string)
#5 /home/.../public_html/w/extensions/DynamicPageList/DPLSetup.php(1207): ExtDynamicPageList::commonSetup()
#6 /home/.../public_html/w/includes/Setup.php(855): ExtDynamicPageList::setupDPL()
#7 /home/.../public_html/w/includes/WebStart.php(114): require_once(string)
#8 /home/.../public_html/w/index.php(40): require(string)
#9 {main}