Page MenuHomePhabricator

Article creation suggestion on search should check for permissions
Open, LowPublic

Description

When you search for a string that's a valid but non-existent title, you get a message saying Create the page "<search string>" on this wiki!. This is shown even when the user does not actually have permission to create it.

Test (logged out): https://meta.wikimedia.beta.wmflabs.org/w/index.php?search=Schema%3AFoo&title=Special:Search&go=Go

See also:
T19630: Article.php should check permissions before advising

Event Timeline

Tgr created this task.Mar 13 2019, 8:48 PM
Restricted Application added a project: Discovery-Search. · View Herald TranscriptMar 13 2019, 8:48 PM
Restricted Application added a subscriber: Aklapper. · View Herald Transcript

Some checking whether the user is allowed to create a page or not does happen, compare https://en.wikipedia.org/w/index.php?search=talk%3Adoes+not+exist&title=Special%3ASearch and https://en.wikipedia.org/w/index.php?search=does+not+exist&title=Special%3ASearch logged out. The latter is using the message searchmenu-new-nocreate.

debt moved this task from needs triage to UI tickets on the Discovery-Search board.
debt triaged this task as Low priority.
debt added a subscriber: debt.

Technically, this is a user-facing bug and a good first bug that someone could look at.

Nuria added a subscriber: Nuria.Mar 14 2019, 7:37 PM

ping @Tgr to clarify if we are thinking about ipblocks or rather status of users as autoconfirmed

Tgr added a comment.Mar 14 2019, 9:06 PM

Hm, yeah, it does seem to be checked correctly. So maybe quickUserCan does not work with whatever permission hook EventLogging handles?

(I was thinking of autoconfirmed. For blocks we don't normally hide the edit links.)