GlobalRename notes appear publically
Closed, InvalidPublicSecurity
Actions

Assigned To

None

Authored By

	DannyS712
	Jan 15 2020, 8:56 AM

Description

First occurred in August, as far as I can tell[1]

Note sure why, couldn't figure out how to add notes without rejecting or accepting a request when attempting to reproduce

Restricted Application added a subscriber: Aklapper. · View Herald Transcript

DannyS712 added subscribers: Urbanecm, Rxy.

Renamers know that the notes are public.

This isn't a security vuln, but intended.

@revi @Urbanecm where exactly do you see the "Create notes..."? I tried to do this at https://deployment.wikimedia.beta.wmflabs.org/wiki/Special:GlobalRenameQueue/request/36 and there is only a "Notes/reasoning" field, and the log entry.

It is probably configured via Mediawiki namespace page to show that interface message.

Oh, thanks. Sorry for the trouble

Legoktm changed the visibility from "Custom Policy" to "Public (No Login Required)".Jan 15 2020, 11:40 AM

Legoktm changed the edit policy from "Custom Policy" to "All Users".