Page MenuHomePhabricator

Unable to change visibility of log entries on at least metawiki, outreachwiki and wikimania2018wiki
Closed, ResolvedPublic

Description

Hi,

I've noticed today that when attempting to change the visibility of a log entry, I was no longer able to do so and redirected to Meta-Wiki's Main Page instead.

I started by selecting a log/checkbox here: https://meta.wikimedia.org/wiki/Special:Log/delete and then clicking change visibility.

It then redirects to https://meta.wikimedia.org/w/index.php?action=historysubmit&type=logging&revisiondelete=1&ids%5B28602506%5D=1
Which /should/ have loaded up the form to preform the change.

But instead the link just immediately redirects to https://meta.wikimedia.org/w/index.php?title=Main_Page&action=historysubmit

Event Timeline

Az1568 created this task.Oct 1 2018, 6:21 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptOct 1 2018, 6:21 PM
Az1568 updated the task description. (Show Details)Oct 1 2018, 6:22 PM
Az1568 triaged this task as High priority.Oct 1 2018, 11:20 PM

I can confirm this buggy behavior on Meta-Wiki. I was able to replicate the issue described in the task description.

Base added a subscriber: Base.Oct 7 2018, 1:20 AM

I experience this on Meta as well. I also observe it on outreachwiki and wikimania2018wiki.

On the other hand on ukwikiquote, ukwikinews, testwiki, and uawikimedia I do not observe it.

Base added a subscriber: Vogone.Oct 7 2018, 1:20 AM
Vogone renamed this task from Unable to change visibility of log entries on Meta-Wiki to Unable to change visibility of log entries on at least metawiki, outreachwiki and wikimania2018wiki.Oct 7 2018, 1:37 AM
Base added a comment.EditedOct 7 2018, 1:37 AM

As a workaround it is still possible to use API for this. You can use your favourite bot framework or Special:APISandbox:

Just as a note since there’s been some confusion: this doesn’t appear to be affecting en.wp

Base added a comment.Oct 9 2018, 11:24 PM

It seems that to observe this bug the permissions needed for actual page usage are not necessary. You either get redirected to main page when this is observed, or get permission error.

With this I was able to see that besides wikimania2018 this is also observed on wikimania2017, wikimania2016, and wikimania2015, but not on other wikimania wikis.

This might as well be some faulty rewrite or other server misconfiguration, thus adding Operations.

Krenair added a subscriber: Krenair.

This is likely between MW code and Wikimedia's MW config.

I can reproduce the observed issue at https://meta.wikimedia.org/w/index.php?action=historysubmit&type=logging&revisiondelete=1&ids%5B28602506%5D=1.

However, there is no redirect. It's a JavaScript address bar change. As such, not due to server or rewrite configuration. I looked at this because we're currently doing some maintenance on the Apache server configurations. And ruled it out as a possible cause.

jrbs added a subscriber: jrbs.
Matiia added a subscriber: Matiia.Oct 29 2018, 9:12 PM
jrbs moved this task from Backlog to Security/Abuse on the Trust-and-Safety board.Nov 2 2018, 5:35 PM
Base added a comment.Nov 3 2018, 7:21 PM

With the above in mind I have decided to see what happens when I have JavaScript disabled. It looks that the URL indeed does not change. That being said I still see Main Page instead of the Special page.

Teles added a subscriber: Teles.Nov 28 2018, 5:04 PM
Jalexander set Security to Software security bug.Nov 28 2018, 7:45 PM
Jalexander added a project: acl*security.
Jalexander changed the visibility from "Public (No Login Required)" to "Custom Policy".
Jalexander added a subscriber: Jalexander.

moving to security given attack vector possibilites

Jalexander changed the visibility from "Custom Policy" to "Custom Policy".Nov 28 2018, 7:47 PM
Anomie added a subscriber: Anomie.Nov 29 2018, 10:24 PM

When visiting https://meta.wikimedia.org/w/index.php?action=historysubmit&type=logging&revisiondelete=1&ids%5B28602506%5D=1, MediaWiki::parseTitle() doesn't find any of various parameters that would specify the title, so it loads the main page as the title. Since September 27, 2018‎, at Meta that has been "Special:MyLanguage/Main Page".

Slightly later in the request, Action::getActionName() correctly determines that the action it wants is "revisiondelete", but then it hits a check that says if the current Title is a Special page it forces the 'view' action instead. Thus it acts like you actually visited https://meta.wikimedia.org/wiki/Special:MyLanguage/Main_Page and you wind up redirected to the main page.

I see that outreachwiki and wikimania2018wiki have MediaWiki:Mainpage set to similar values.

So the quick fix would be to not have MediaWiki:Mainpage be set to a Special page. Or if that's really wanted someone could figure out a code change to work around using Special:MyLanguage for the main page, e.g. resolving the RedirectSpecialPage in Title::newMainPage(), or set $wgForceUIMsgAsContentMsg on those wikis like Commons does.

I think that rather than loading the main page, and get confused when it's a special page, it should not attempt to use that as a title.

As an even faster workaround, I would try using https://meta.wikimedia.org/w/index.php?action=historysubmit&type=logging&revisiondelete=1&ids%5B28602506%5D=1&title=foo

I think that rather than loading the main page, and get confused when it's a special page, it should not attempt to use that as a title.

The defaulting to the main page there is also what makes a link like https://en.wikipedia.org/wiki/ go to the main page rather than being some sort of error. And in turn that's what makes an interwiki link to e.g. [[en:]] work to get to enwiki's main page without having to know that it's named "Main Page" rather than "Main page" or "Wikipedia:Main Page" or "Portal:Main page" or whatever.

Vogone closed this task as Resolved.Nov 30 2018, 11:45 AM
Vogone claimed this task.

Thanks a lot for investigating the issue!

So the quick fix would be to not have MediaWiki:Mainpage be set to a Special page. Or if that's really wanted someone could figure out a code change to work around using Special:MyLanguage for the main page, e.g. resolving the RedirectSpecialPage in Title::newMainPage(), or set $wgForceUIMsgAsContentMsg on those wikis like Commons does.

That sounds like a terrible idea, since Commons's main page is broken. Just try setting your interface to a less common language (for example ht, but it is the case with all interface languages which do not have a main page translation available) and you will have a lot of fun with a red link main page.

Vogone reopened this task as Open.Nov 30 2018, 11:45 AM
Vogone removed Vogone as the assignee of this task.Nov 30 2018, 11:51 AM

Hello. As an oversighter for Meta, I am unable to perform my duties due to this bug. Is there anything we can do locally, for now, to solve this? Thanks.

Anomie added a comment.Dec 4 2018, 8:51 PM

As mentioned in T205908#4787443, you could change https://meta.wikimedia.org/wiki/MediaWiki:Mainpage to not be referring to a Special page.

Base added a subscriber: Kaganer.Oct 14 2019, 8:18 PM

There is any progress for resolving this bug?

Krinkle removed a subscriber: Krinkle.Feb 10 2020, 11:26 PM
Urbanecm merged a task: Restricted Task.Feb 20 2020, 9:23 AM

No longer an issue on metawiki - see https://meta.wikimedia.org/w/index.php?title=Special:Log&dir=prev&offset=20200704131641&limit=2&type=delete
Can someone check outreach and wikimania2018wiki ?

Urbanecm closed this task as Resolved.Sat, Jul 4, 7:21 PM

Works for me, closing.

Urbanecm changed the visibility from "Custom Policy" to "Public (No Login Required)".Sat, Jul 4, 7:21 PM