Moves circumvent the requirement to have createpagemainns
Open, MediumPublic
Actions

Assigned To

None

Authored By

	JJMC89
	Jan 5 2019, 8:59 PM

Description

Users without the createpagemainns right but with the move right can create a page outside of the main namespace and move it to the main namespace.

This situation currently exists for confirmed users, but T213003: Autoconfirmed rights set by extensions are out of sync with confirmed seeks to resolve that.

From: T213003#4857057

Related Objects

Mentioned Here: T204016: ArticleCreationWorkflow does not actually enforce enwp's autoconfirmed requirement for page creation in the permission system
T213003: Autoconfirmed rights set by extensions are out of sync with confirmed

Event Timeline

JJMC89 created this task.Jan 5 2019, 8:59 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJan 5 2019, 8:59 PM

Amorymeltzer subscribed.Jan 5 2019, 10:29 PM

Xaosflux added a project: acl*security.Jan 6 2019, 3:57 AM

This appears to be a bypass for T204016

sbassett subscribed.Jan 16 2019, 5:49 AM

Wugapodes subscribed.Jan 21 2019, 3:25 AM

• chasemp triaged this task as Medium priority.Dec 9 2019, 4:33 PM

• chasemp added a project: Security.Feb 10 2020, 10:57 PM

• chasemp removed a project: acl*security.Feb 20 2020, 8:06 PM

Moves circumvent the requirement to have createpagemainnsOpen, MediumPublicActions

Description

Related Objects

Event Timeline

Moves circumvent the requirement to have createpagemainns
Open, MediumPublic
Actions