Page MenuHomePhabricator

Investigate separate user right for creating pages with custom content models
Closed, ResolvedPublicSpike

Description

Currently, users can create, in addition to the default wikitext, javascript, json, and css pages for themselves. With the Scribunto extension, they can create Scribunto pages and with the TemplateStyles extension they can create sanitized-css pages. However, each of these custom (i.e. non-wikitext) content models is created based on extension or core rules, such as javascript being the default for pages created as *.js, etc.

Currently, users with the changecontentmodel right can arbitrarily set page content models, which can pose a security or vandalism risk; thus, on some wikis this right is restricted. However, multiple extensions, such as MassMessage and CollaborationKit, require the changecontentmodel right in order to create their pages.

Proposal: add a new user right, setcontentmodel (name open for suggestions) that allows users to (arbitrarily) define the content model of a page upon creation.

Use case:
Allow creation of MassMessageListContent, CollaborationHubContent, and CollaborationListContent by users without editcontentmodel (T226282, T92795)
Allow creation of sanitized-css pages in any namespace (currently only created in the template namespace and then moved)
Allow creation of json pages in any namespace (can be used to store data for modules)

Event Timeline

Restricted Application added a project: User-DannyS712. · View Herald TranscriptJun 30 2019, 10:45 AM
Restricted Application added a subscriber: Aklapper. · View Herald Transcript
DannyS712 changed the subtype of this task from "Task" to "Spike".Jun 30 2019, 10:45 AM

Alternatively, for T92795 and T226282, PermissionManager's addTemporaryUserRights can be used to allow the page creation without the editcontentmodel right, and SpecialPage's userCanExecute can be used to override the right restrictions to allow users to access the special page (since the rights restriction can only be used to require a specific right, not one of multiple rights)

DannyS712 updated the task description. (Show Details)Jul 22 2019, 5:51 AM

Just to be clear, your proposal is to create a new userright that allows to create a page with a non-default content model, but not change an existing page? It's an interesting idea that seems pretty reasonable at first glance.

Just to be clear, your proposal is to create a new userright that allows to create a page with a non-default content model, but not change an existing page? It's an interesting idea that seems pretty reasonable at first glance.

Yes, that is exactly what I am proposing

DannyS712 moved this task from Unsorted to Next on the User-DannyS712 board.Jul 30 2019, 3:12 PM
DannyS712 added a comment.EditedAug 2 2019, 11:28 PM

Below I've uploaded a mockup based on TemplateSandbox for how this user right could be translated into actual use. Currently, there is no special page for the creation of a new page, and the content model is assigned based on namespace and page title. This would add a bar below the editor for a user to set the content model they want, with the default content model shown being what would be automatically set if the user didn't have this right.

Pppery awarded a token.Aug 4 2019, 6:49 PM
Izno added a comment.Aug 9 2019, 3:53 AM

I'd rather just see TEs get editcontentmodel tbh.

I'd rather just see TEs get editcontentmodel tbh.

Understandable, but granting TEs and/or mass message senders, editcontentmodel would require a lot of on-wiki discussion. I don't object, but I'd still like to see this implemented

Pppery added a subscriber: Pppery.Aug 26 2019, 5:25 PM

I'd rather just see TEs get editcontentmodel tbh.

Definitely a good idea.

DannyS712 added a subscriber: CCicalese_WMF.

[snip]
Since we generally try not to add too many built-in user rights, we would say that a good first step for this would be for you to add this as an extension. If it gets wide adoption and is deemed to be generally useful, it could be considered for core.

Tagging Platform Engineering as a feature request to review/consider - does the response to the request for creating a new user right in T201495: Create a new user right for cross-namespace renames also apply here?

eprodromou added a subscriber: eprodromou.

This seems like a good conversation for TechCom to get into. Managing how and when users can create pages with different content models is probably not something we should do piecemeal, but as part of a more holistic approach. Can you turn this into an RFC for discussion?

This seems like a good conversation for TechCom to get into. Managing how and when users can create pages with different content models is probably not something we should do piecemeal, but as part of a more holistic approach. Can you turn this into an RFC for discussion?

To clarify, I should make a new task with the same proposal, but formatted as an RfC?

Also, I realized (T230968: Special:ChangeContentModel should check if a page exists) that currently Special:ChangeContentModel can be used to both create new pages and change existing ones - that could be used instead of a new option when saving

@eprodromou can you respond to my question above about how to proceed with this?