Page MenuHomePhabricator

Enforce permission checks on Special:NewLexeme
Closed, ResolvedPublic3 Estimated Story Points


Creating a Lexeme must only be possible by accounts with the "createpage" right.

Acceptance criteria

  • A user without the "createpage" right can not create a Lexeme


Scenario: Missing authorization NewLexeme page access

GIVEN I do not have the "createpage" right
WHEN I enter Special:NewLexeme
THEN I see a standard MediaWiki Permission Error

Technical notes:

  • Right checking is built into special pages and only requires you to pass the required right into the constructor of the special page. (src/Specials/SpecialNewLexeme.php)

Event Timeline

WMDE-leszek created this task.
WMDE-leszek updated the task description. (Show Details)

One area of this task that is still unclear is what is meant by "the right to create pages"

MediaWiki has a "createpage" right which can be found at
Wikibase also has a "property-create" right specifically for properties.
Items appear to use the mediawiki provided "createpage" right

@Lydia_Pintscher do we just want to check the standard "createpage" right or have our own right for creating lexemes?

Let's go with the standard createpage right as we do with items.

WMDE-leszek set the point value for this task to 3.Mar 13 2018, 11:26 AM

Per ff. it is

  • only possible to change group definitions via configuration change, not via the API
  • the "(all)" group which by default is associated with the createpage right can not be removed from users
  • and individual permissions can not be removed from users

I conclude it is not feasible to write a browser test that asserts if a page is protected by a permission.

Change 422931 merged by jenkins-bot:
[mediawiki/extensions/WikibaseLexeme@master] browser tests: use MWBot instead of nodemw

Change 423737 merged by jenkins-bot:
[mediawiki/extensions/WikibaseLexeme@master] Special:NewLexeme: Enforce user permission