Page MenuHomePhabricator

The page language for user js/css sub pages can be modified without the edituserjs/css right
Closed, DuplicatePublic

Description

To reproduce:

  • Assign a group that does not thave the edituserjs, editusercss, or the editusercssjs right the pagelang right.
  • Change the page language for a CSS or js user subpage that does not belong to the current user. The action will succeed, even though the user had no right to modify the subpage in the first place.

Expectation:

  • An error such as displayed on Special:Editcontentmodel would appear.

Environment:

  • Vagrant 1.9.2 on Windows with MediaWiki 1.29-alpha (master, cloned today)

On investigation for another bug I noticed that Special:PageLanguage does not check if the user actually can modify the page language for the title, it just does so anyway. If I compare this to Special:Editcontentmodel, that special page actually checks if the user can change the content model for the page, which is why it displays an error.

I'm also wondering why the content language of a CSS/js user subpage can be changed, but that's not relevant to this bug.

Details

Event Timeline

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptMar 17 2017, 7:37 PM
Mainframe98 updated the task description. (Show Details)Mar 17 2017, 7:55 PM
Mainframe98 updated the task description. (Show Details)Mar 17 2017, 7:58 PM

Change 343333 had a related patch set uploaded (by Gerrit Patch Uploader; owner: Mainframe98):
[mediawiki/core] Perform a permission check on the title when changing the page language

https://gerrit.wikimedia.org/r/343333

Change 343333 merged by jenkins-bot:
[mediawiki/core@master] Perform a permission check on the title when changing the page language

https://gerrit.wikimedia.org/r/343333