Page MenuHomePhabricator

Make sure users with enabled confirmation prompt cannot accidentally rollback without confirmation
Closed, ResolvedPublic

Description

Motivation
When the confirmation prompt is added through javascript, it is possible that the page has loaded, but the confirmation prompt logic has not. If that is the case, it should still not be possible to accidentally rollback without confirmation

User Story
As an editor with enabled rollback confirmation prompt
I want to be sure I am always asked for confirmation
so that I don't ever have to fear misclicks when it comes to rollbacks

Acceptance Criteria

  • It should never be humanly possible to trigger a rollback action without previously having seen the confirmation prompt (if that is the user setting). It would both be ok if
  • the user saw a non-js page for confirmation purposes instead
  • the user's click was "delayed" for a bit (sth similar was done in the minerva skin: Having a small standin js snippet)

Notes

  • What does the thanks button do?

Event Timeline

Lea_WMDE triaged this task as Medium priority.Jan 31 2019, 1:04 PM
Lea_WMDE created this task.

The "Thank You" button shows non-JS users a special page with a confirmation button:

Screenshot_20190205_130001.png (602×998 px, 55 KB)

The URL for this would be https://en.wikipedia.org/wiki/Special:Thanks/<ID>.

Lea_WMDE changed the task status from Open to Stalled.Feb 5 2019, 5:16 PM

This should not be done before T215303: No-js page for rollbacking

Is this actually desired? I know some wikis have scripts to do this sort of thing, but scripts sound exactly the place for it in the first place - for the most part, the relevant problems we have onwiki are with insufficient tools to counter vandals and spammers, not that they're too powerful.

And there already is a confirmation: the diff page that is shown upon completion. From there, if the action was performed in error, it's exactly one click to revert: another rollback. This is the same number of clicks for an accident (undesired outcome) as you are proposing here to require for the intended, when the intentional use should by far be exceeding the accidental (and if it isn't, that's what onwiki scripts are for, or perhaps when a user should simply consider giving up the right/removing the links entirely).

Or is this a particular issue with specific devices, such as on mobile? Because if it's a lot easier to accidentally click on it on a phone, having a confirmation specifically on those devices could make a lot more sense (so perhaps as a part of MF?).

The target here is a bit a unclear.

Hi @Isarra, the confirmation prompt is not primarily designed for people who work on countering vandals and spammers, but for people who don't and still have that right. That is e.g. ~20.000 people on de- and pl-wiki, where the rollback right comes in a bundle that you receive automatically. But it also applys to admins and other rightsholders who received the rollback right in a bundle but are hardly ever using it.
And you are absolutely right, the problem occurs even more when people use mobile devices.

I was under the impression that the entire point of the right was for countering vandals and spammers. It sounds like maybe these two wikis should perhaps considering changing that configuration, if it's a problem, as well?

Aside from that, it sounds like there are two main targets here:

  1. Users who don't use it much/at all, but for whatever reason have the right anyway
  2. Users on different devices that have less precision

So for 1 it sounds like making this governed by a user preference option (as opposed to a wiki-wide configuration setting) might make the most sense, as that could cover those users (and still allow you to set that as the default setting on projects where everyone has it) while allowing those who do need it to not be impaired by such a change. For 2, that would probably depend on MF or such actually using it, but if it's a thing that could be reused/turned on by extensions, that would do it.

Sorry if this is all what you're doing anyway, or stuff. I just saw this come up and... worried.

So for 1 it sounds like making this governed by a user preference option (as opposed to a wiki-wide configuration setting) might make the most sense, as that could cover those users (and still allow you to set that as the default setting on projects where everyone has it) while allowing those who do need it to not be impaired by such a change.

This is how it is planned :) It will definitely be a off-by-default feature for wikis such as en-wiki (with a setting so users can still turn it on, if they want to).

For 2, that would probably depend on MF or such actually using it, but if it's a thing that could be reused/turned on by extensions, that would do it.

It is a user setting in core, so I think it should appear automatically wherever rollback links are featured (if the setting is turned on of course)

Sorry if this is all what you're doing anyway, or stuff. I just saw this come up and... worried.

All good :) If you want to read more about the project I can also recommend our project page or the main ticket T199534

Okay, thank you, that makes me feel so much better about all this. Cool!

Aklapper changed the task status from Stalled to Open.Aug 16 2022, 9:23 PM

Reopening as T215303 is done

thiemowmde subscribed.

As far as I understand it this is solved via T215303.