Page MenuHomePhabricator

Article creation suggestion on search should check for permissions
Open, LowPublic


When you search for a string that's a valid but non-existent title, you get a message saying Create the page "<search string>" on this wiki!. This is shown even when the user does not actually have permission to create it.

Test (logged out):

See also:
T19630: Article.php should check permissions before advising

Event Timeline

Tgr created this task.Mar 13 2019, 8:48 PM
Restricted Application added a project: Discovery-Search. · View Herald TranscriptMar 13 2019, 8:48 PM
Restricted Application added a subscriber: Aklapper. · View Herald Transcript

Some checking whether the user is allowed to create a page or not does happen, compare and logged out. The latter is using the message searchmenu-new-nocreate.

debt triaged this task as Low priority.Mar 14 2019, 7:37 PM
debt added a project: patch-welcome.
debt moved this task from needs triage to UI tickets on the Discovery-Search board.
debt added a subscriber: debt.

Technically, this is a user-facing bug and a good first bug that someone could look at.

Nuria added a subscriber: Nuria.Mar 14 2019, 7:37 PM

ping @Tgr to clarify if we are thinking about ipblocks or rather status of users as autoconfirmed

Tgr added a comment.Mar 14 2019, 9:06 PM

Hm, yeah, it does seem to be checked correctly. So maybe quickUserCan does not work with whatever permission hook EventLogging handles?

(I was thinking of autoconfirmed. For blocks we don't normally hide the edit links.)