When you search for a string that's a valid but non-existent title, you get a message saying Create the page "<search string>" on this wiki!. This is shown even when the user does not actually have permission to create it.
Test (logged out): https://meta.wikimedia.beta.wmflabs.org/w/index.php?search=Schema%3AFoo&title=Special:Search&go=Go
See also:
T19630: Article.php should check permissions before advising
| Subject | Repo | Branch | Lines +/- | |
|---|---|---|---|---|
| Search: Don't invite users to create a page if they can't | mediawiki/core | master | +2 -0 |
Some checking whether the user is allowed to create a page or not does happen, compare https://en.wikipedia.org/w/index.php?search=talk%3Adoes+not+exist&title=Special%3ASearch and https://en.wikipedia.org/w/index.php?search=does+not+exist&title=Special%3ASearch logged out. The latter is using the message searchmenu-new-nocreate.
Technically, this is a user-facing bug and a good first bug that someone could look at.
ping @Tgr to clarify if we are thinking about ipblocks or rather status of users as autoconfirmed
Hm, yeah, it does seem to be checked correctly. So maybe quickUserCan does not work with whatever permission hook EventLogging handles?
(I was thinking of autoconfirmed. For blocks we don't normally hide the edit links.)
I think the issue is that, unline with Article::showMissingArticle, which checks both creating and editing permissions, the message here only checks create permissions; to create a page, one needs both the ability to create it (eg createpage) and to edit it.
Change 544427 had a related patch set uploaded (by DannyS712; owner: DannyS712):
[mediawiki/core@master] Show correct message on Special:Search if a page doesn't exist and the user cannot create it.
Change 544427 merged by jenkins-bot:
[mediawiki/core@master] Search: Don't invite users to create a page if they can't