Page MenuHomePhabricator

Pages can be protected to levels you aren't in
Closed, ResolvedPublic


Author: shaiaquanature

Pages can be protected to levels you aren't in (and then you can't unprotect), and can be deleted without having the edit right for that page.

Version: 1.12.x
Severity: enhancement



Event Timeline

bzimport raised the priority of this task from to Medium.Nov 21 2014, 10:11 PM
bzimport set Reference to bz14241.

Auh, can you give some examples of this, or how to do it?

As far as deletion goes, I don't see why they would need to be coupled.

They only way to protect to levels beyond yourself is with some strange custom configurations. I'm not even sure if that is necessarily *wrong* either.

shaiaquanature wrote:

I added a right to the protection list, that's the only config change I made for this.
It lets you protect the page, but then it stops you from unprotecting it.

skizzerz wrote:

I've noticed this too on my local wiki where I added in an additional level to $wgRestrictionLevels. You can protect past your level, but cannot subsequently unprotect the page. As for deletion, I agree with Aaron in not seeing why they would need to be coupled together.

Anyway, I'll take this bug since I made a working patch for this on 1.11.0 (and subsequently lost it when upgrading without keeping the diff file, but it shouldn't be hard to make it again for the latest trunk), so I already know what I'm doing.

I'm holding off on implementing the deletion aspect as that is a completely different topic and probably deserves its own bug unless comments below lead to a consensus that it should also be implemented.

shaiaquanature wrote:

Alright, thanks.

Should I make the other bug report, or is it not really an issue?

skizzerz wrote:

make the report if you think it should be a feature

skizzerz wrote:

Fixed protection issue in r35285, changed bug summary to not include the deletion aspect, open up a new bug for that

shaiaquanature wrote:

I replaced the old protectionform.php with the new one, and now &action=protect shows a blank page.

(In reply to comment #8)

I replaced the old protectionform.php with the new one, and now &action=protect
shows a blank page.

Of course it does. ProtectionForm.php depends on lots of other files, you need to upgrade *all files*.

shaiaquanature wrote:

That was the only file in the patch... Do I need to download the entire program from svn?