I am not sure whether it is already implemented, but to avoid bypassing it is necessary to be member of both interface-admin and sysop (or specific) for the following operations in MediWiki/Gadget: namespace or “another user”:
- undelete a *.js or *.css or reciprocal content model
- deleterevision for such page (to restore)
- suppressrevision for such page (to make visible again)
- import / importupload a *.js or *.css
It is necessary to be member of interface-admin for
- move into a *.js or *.css “page name extension”
To be more precise, the related editsitejs editsitecss edituserjs editusercss for the particular circumstances are required.
It is sufficient to be member of sysop (OS) for
- delete such page
- move into unrestricted namespace or page name
- deleterevision for such page when hiding
- suppressrevision for such page when hiding (OS)
However, since by such operations the page is vanishing from the vulnerable sphere, interface-admin is not required.
Related to T190015 finalization.