Security review for ArticleCreationWorkflow extension branch master
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	kaldari
	Aug 19 2017, 2:47 AM

Description

Project Information

Name of tool/project: ArticleCreationWorkflow
Project home page: https://www.mediawiki.org/wiki/Extension:ArticleCreationWorkflow
Name of team requesting review: Community Tech
Primary contact: @kaldari
Target date for deployment: Q1 (July 2017)
Link to code repository / patchset: https://phabricator.wikimedia.org/diffusion/EACW/browse/master/
Programming Language(s) Used: PHP

Description of the tool/project

ArticleCreationWorkflow is a simple extension that intercepts certain users when they attempt to create a new page and sends them to a special page instead. The contents of the special page are configurable on-wiki (as a MediaWiki message).

Description of how the tool will be used at WMF

The initial use of the this extension will be during the English Wikipedia ACTRIAL to direct non-autoconfirmed users to either create new articles in their user sandbox or via the Article Wizard.

Dependencies

None

Has this project been reviewed before?

Working test environment

Currently set up at http://commtech.wmflabs.org/. You can test at http://commtech.wmflabs.org/w/index.php?title=Cat&action=edit. You will need to have an account and be logged in. Ping me on IRC when you're ready to test and I can walk you through it.

Post-deployment

Community Tech will be responsible for the project after deployment.

Details

	Subject	Repo	Branch	Lines +/-
	Add config.txt mentioned in extension.json	mediawiki/extensions/ArticleCreationWorkflow	master	+29 -0

Customize query in gerrit

Related Objects

Mentioned In: T175302: Test ArticleCreationWorkflow on Test2 Wikipedia
E689: Security review for ArticleCreationWorkflow extension branch master

Event Timeline

kaldari created this task.Aug 19 2017, 2:47 AM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptAug 19 2017, 2:47 AM

kaldari moved this task from New & TBD Tickets to CL, QA, Data analysis backlog on the Community-Tech board.Aug 19 2017, 2:48 AM

kaldari moved this task from CL, QA, Data analysis backlog to New & TBD Tickets on the Community-Tech board.

MaxSem subscribed.Aug 19 2017, 2:51 AM

kaldari updated the task description. (Show Details)Aug 19 2017, 3:10 AM

TheresNoTime subscribed.Aug 23 2017, 9:03 AM

kaldari updated the task description. (Show Details)Aug 23 2017, 6:03 PM

@dpatrick: FYI, we have a deadline on this of September 7, but it's probably the smallest MediaWiki extension ever created, so it should be easy to review. Let me know if September 7th is not going to be doable, so that we can change the schedule for ACTRIAL.

• dpatrick assigned this task to Reedy.Aug 25 2017, 6:34 PM

Restricted Application added a subscriber: jeblad. · View Herald TranscriptAug 25 2017, 6:34 PM

	"config": {
		"ArticleCreationWorkflows": {
			"description": "Describes conditions when new page creation should be intercepted. See doc/config.txt for details.",
			"value": []
		}
	},

There is no doc/config.txt...

@kaldari, I spoke with @Reedy and put this on the schedule for the week of 8/28. Sam's already started working on it.

Change 373968 had a related patch set uploaded (by MaxSem; owner: MaxSem):
[mediawiki/extensions/ArticleCreationWorkflow@master] Add config.txt mentioned in extension.json

https://gerrit.wikimedia.org/r/373968

gerritbot added a project: Patch-For-Review.Aug 25 2017, 9:03 PM

Change 373968 merged by jenkins-bot:
[mediawiki/extensions/ArticleCreationWorkflow@master] Add config.txt mentioned in extension.json

https://gerrit.wikimedia.org/r/373968

jeblad unsubscribed.Aug 25 2017, 9:25 PM

Visiting Special:CreatePage

The article-creation-landing-page message has not been defined.

What should it be set as?

Reedy moved this task from Incoming to In Progress on the deprecated-security-team-reviews board.Aug 29 2017, 5:44 PM

Also..

https://www.mediawiki.org/wiki/Extension:ArticleCreationWorkflow

It requires the obsolete Extension:ClickTracking and is only shown to some users based on bucketing logic.

Is this still the case? The extension has been undeployed on WMF wikis.. No depedancy seems to be defined in extension.json/elsewhere

And I can't see any references to this in the code...

It also says needs MW 1.19, and was written by @kaldari...

Think the page needs a bit of an update :)

The code looks fine. Wanted to test the extension a bit/poke around further, but stuck on my comment above and what that actually means I need to do... And what I need to put on the page

Updated the page. Basically, redirecting you to the special page and displaying whatever article-creation-landing-page contains on the local wiki is all the functionality of this extension:)