Page MenuHomePhabricator

MWException thrown when saving an Article transcluding a Special page that needs permissions
Open, Needs TriagePublic

Description

I tried to create a transcludable special page that requires the "upload" permission. When transcluding it I get an MWException.

Steps to reproduce:

  1. (Temporarily) Create a transcludable special page that needs the "upload" permission. E.g. in SpecialListUsers.php
    1. replace parent::__construct( 'Listusers' ); by parent::__construct( 'Listusers', ' upload' ); and
    2. add $this->checkPermissions(); after $this->setHeaders();
  2. Make sure you have the required permission on the test wiki.
  3. Create an article that transcludes the special page, e.g. having wikitext {{Special:Listusers}}
  4. Save the article

Expected: Display of transcluded page (or as a minimum some kind of proper error message)

Observed: Server error (HTTP 500) with

Original exception: [b75d3c8721104ee6c2b5c15d] [no req] MWException from line 166 of /var/www/html/w/includes/FauxRequest.php: Request URL not set
Backtrace:
#0 /var/www/html/w/includes/skins/SkinTemplate.php(1126): FauxRequest->getRequestURL()
#1 /var/www/html/w/includes/skins/SkinTemplate.php(474): SkinTemplate->buildContentNavigationUrls()
#2 /var/www/html/w/includes/skins/SkinTemplate.php(249): SkinTemplate->prepareQuickTemplate()
#3 /var/www/html/w/includes/OutputPage.php(2441): SkinTemplate->outputPage()
#4 /var/www/html/w/includes/exception/PermissionsError.php(70): OutputPage->output()
#5 /var/www/html/w/includes/MediaWiki.php(529): PermissionsError->report()
#6 /var/www/html/w/index.php(43): MediaWiki->run()
#7 {main}

Event Timeline

Foxtrott created this task.May 15 2017, 3:30 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptMay 15 2017, 3:30 PM

This is one aspect of T230668: Fully implement read/view restrictions in mediawiki core. However, I suggest that, if a special page requires rights that aren't given to *, it not be includeable

Restricted Application added a subscriber: Liuxinyu970226. · View Herald TranscriptAug 22 2019, 3:01 AM

Currently: A page can be included if mIncludable is true (as checked by ->isIncludable())
Proposed: A page can be included if mIncludable is true (as checked by ->isIncludable()) and everyone is allowed to access the special page (as checked by ->isRestricted())

Restricted Application added a project: User-DannyS712. · View Herald TranscriptNov 18 2019, 3:42 AM

Change 551361 had a related patch set uploaded (by DannyS712; owner: DannyS712):
[mediawiki/core@master] Don't allow transcluding restricted special pages

https://gerrit.wikimedia.org/r/551361