Page MenuHomePhabricator
Create Task
Maniphest T208919

Partially blocked users should be able to review pending changes for other pages
Closed, ResolvedPublic
Actions

Description

Pending changes is a level of protection that allows unprivileged users to make edits which are saved but not displayed to readers until they are manually reviewed. It is used infrequently but still needs to cooperate with Partial Blocks.

The Beta environment has pending changes enabled — https://en.wikipedia.beta.wmflabs.org/wiki/Special:PendingChanges

You need three users to test this:

  1. Someone to make an edit to trigger pending changes. I used a logged-out IP.
  2. A user with reviewer permissions to review the changes who will be partially blocked. For my example I created User:Nov-6-18-test.
  3. An admin to block. For my example I used User:TBolliger.

Expected behavior

  • A partially blocked user with reviewer permissions...
    • 1. should not be able to review pending changes on pages defined in their partial block
    • 2. should be able to review pending changes on pages not within the parameters of their partial block

Use case 1 — success

If a user is PB'd from a page (in this case FR test they cannot review the pending changes:

Screen Shot 2018-11-06 at 4.31.06 PM.png (1,238×942 px, 347 KB)

Use case 2 — failure

If a user is not PB'd from a page, they are prohibited from reviewing all pages. Please fix this defect.

Screen Shot 2018-11-06 at 4.31.49 PM.png (1,238×942 px, 343 KB)

Related Objects
Search...

Event Timeline

• TBolliger created this task.Nov 7 2018, 12:43 AM
Restricted Application added subscribers: MGChecker, • Aklapper. · View Herald TranscriptNov 7 2018, 12:43 AM
• TBolliger triaged this task as Low priority.Nov 7 2018, 12:43 AM
• TBolliger added a subtask: T203821: After QA, enable Partial Blocks MVP on test.wikipedia.org and test.wikidata.org.
• TBolliger moved this task from Backlog to User blocking on the MediaWiki-User-management board.
dbarratt subscribed.Nov 7 2018, 4:23 PM

It looks like RevisionReviewForm::isAllowed() looks like this:

public function isAllowed() {
  // Basic permission check
  return ( $this->page && $this->page->userCan( 'review' ) );
}

Which means the problem describe in this task should be when T208862 is resolved

dbarratt added a subtask: T208862: Title::checkUserBlock should call User::isBlockedFrom for every action that requires unblock.Nov 7 2018, 4:23 PM
dbarratt removed a project: MediaWiki-User-management.
dbarratt added a parent task: T208749: 👩‍👧‍👦 Update Extensions to properly handle Partial Blocks.Nov 7 2018, 4:40 PM
• TBolliger added a comment.Nov 7 2018, 5:18 PM
In T208919#4728608, @dbarratt wrote:

It looks like RevisionReviewForm::isAllowed() looks like this:

public function isAllowed() {
  // Basic permission check
  return ( $this->page && $this->page->userCan( 'review' ) );
}

Which means the problem describe in this task should be when T208862 is resolved

Can we merge these tasks? I don't see a reason to have two tasks.

• TBolliger renamed this task from Partially blocked users should be able to review pending for other pages to Partially blocked users should be able to review pending changes for other pages.Nov 7 2018, 5:44 PM
dbarratt added a comment.Nov 7 2018, 5:53 PM
In T208919#4728820, @TBolliger wrote:

Can we merge these tasks? I don't see a reason to have two tasks.

Up to you. The only reason I would leave this one is for QA purposes (i.e. to ensure that after T208862 this ticket is fixed).

• TBolliger changed the task status from Open to Stalled.Nov 7 2018, 6:33 PM
• TBolliger moved this task from Snackbox to Analytics on the Anti-Harassment-Team board.

Blocked by T208862: Title::checkUserBlock should call User::isBlockedFrom for every action that requires unblock

• TBolliger edited projects, added: Anti-Harassment-Team (AHT Sprint 33); removed: Anti-Harassment-Team.Nov 19 2018, 9:23 PM
• TBolliger moved this task from Ready to Archive of tickets closed outside this sprint, but need someplace to go on the Anti-Harassment-Team (AHT Sprint 33) board.
• TBolliger edited projects, added: Anti-Harassment-Team; removed: Anti-Harassment-Team (AHT Sprint 33).Nov 19 2018, 9:35 PM
• TBolliger reopened subtask T203821: After QA, enable Partial Blocks MVP on test.wikipedia.org and test.wikidata.org as Open.Nov 19 2018, 9:49 PM
• TBolliger closed subtask T203821: After QA, enable Partial Blocks MVP on test.wikipedia.org and test.wikidata.org as Resolved.Nov 19 2018, 10:00 PM
dbarratt closed subtask T208862: Title::checkUserBlock should call User::isBlockedFrom for every action that requires unblock as Resolved.Nov 19 2018, 11:30 PM
Liuxinyu970226 added a project: Growth-Team.Nov 21 2018, 2:32 PM
Catrope moved this task from Inbox to External on the Growth-Team board.Nov 27 2018, 7:21 AM
• TBolliger reopened subtask T208862: Title::checkUserBlock should call User::isBlockedFrom for every action that requires unblock as Open.Dec 3 2018, 5:06 PM
• TBolliger moved this task from Analytics to Snackbox on the Anti-Harassment-Team board.Dec 12 2018, 9:13 PM
dbarratt closed subtask T208862: Title::checkUserBlock should call User::isBlockedFrom for every action that requires unblock as Resolved.Jan 8 2019, 9:16 PM
• TBolliger changed the task status from Stalled to Open.Jan 30 2019, 10:56 PM
• TBolliger moved this task from Snackbox to Triage/To be Estimated on the Anti-Harassment-Team board.
• TBolliger added a project: MediaWiki-User-management.
• aezell updated the task description. (Show Details)Feb 7 2019, 6:17 PM
• TBolliger claimed this task.Feb 7 2019, 6:18 PM

to re-test on beta

• TBolliger moved this task from Triage/To be Estimated to Product/Tech backlog on the Anti-Harassment-Team board.Feb 7 2019, 6:19 PM
• TBolliger closed this task as Resolved.Feb 11 2019, 10:35 PM

Tested again. The situation has been resolved!

Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits