Page MenuHomePhabricator

Can't edit fully protected pages with AWB despite "editprotected" right
Open, Needs TriagePublic

Description

AWB ignores at least the editprotected right when trying to edit a page while not being a sysop, but having that right from other flags. See
T260344#7457297.

Original report:
In 2020 many wikis has "under-sysop" user groups, that has some of sysop rights. For example, ruwiki has "closer" user group (users in this group can summarize RfD's and delete pages) and "engineer" user group (engineers can edit sysop-protected pages and MediaWiki namespace). But AWB still doesn't know anything except for "sysop" user group: engineer can't edit fully protected page, using AWB, and closer can't delete a page (AWB has a button for page deletion). AWB should check user's rights, not user group == "sysop", it can be done with this API request: https://ru.wikipedia.org/w/api.php?action=query&format=xml&meta=userinfo&uiprop=rights

Event Timeline

You're going to have to provide a better example than that. For delete you are seemingly not correct.

https://github.com/reedy/AutoWikiBrowser/blob/master/AWB/Main.cs#L2550

For deletion it does check the rights a user has, not that they are a sysop

TheSession.User.CanDeletePage(TheSession.Page)

CanDeletePage - https://github.com/reedy/AutoWikiBrowser/blob/39e89bf1b805ee1f985f3854b414f52298b7e729/WikiFunctions/API/UserInfo.cs#L120-L123

public bool CanDeletePage(PageInfo page)
{
    return (HasRight("delete"));
}

Which calls HasRight https://github.com/reedy/AutoWikiBrowser/blob/39e89bf1b805ee1f985f3854b414f52298b7e729/WikiFunctions/API/UserInfo.cs#L98-L101

public bool HasRight(string right)
{
    return string.IsNullOrEmpty(right) || Rights.Contains(right);
}

Which checks that the user has the right listed...

For Protect, it looks like you might be, and that is easily fixed

btnProtect.Enabled = TheSession.IsSysop && btnSave.Enabled && (TheArticle != null);

OK, I will not argue, for deletion it was right in 2012, when I was closer.

But for editing protected pages, you don't understand me. I doesn't want to protect page using AWB button (I have no rights for this), I want (and can from browser, but not under AWB) to edit sysop-protected pages and MediaWiki namespace. I'm "engineer" in ruwiki, me (and my bot) has technical rights editinterface / editprotected / editsitejson, but when I try to edit such pages in AWB, I got an error "Page is protected".

But for editing protected pages, you don't understand me. I doesn't want to protect page using AWB button (I have no rights for this), I want (and can from browser, but not under AWB) to edit sysop-protected pages and MediaWiki namespace. I'm "engineer" in ruwiki, me (and my bot) has technical rights editinterface / editprotected / editsitejson, but when I try to edit such pages in AWB, I got an error "Page is protected".

If I don't understand you, it's because you've explained it poorly. You've mixed in various examples in one go, and seemingly made various assumptions, so it's hard to follow.

And most of your intial post is still wrong. AWB gets a list of the users rights from the API for years, and uses it for many actions

You get an error where?

https://github.com/reedy/AutoWikiBrowser/blob/fe2c9e12a4cb019b30822e2ac5be50bb6518e548/AWB/Main.cs#L1372-L1375

if (!TheSession.User.CanEditPage(TheSession.Page))
{
    SkipPage("Page is protected");
    return true;
}

which then calls

https://github.com/reedy/AutoWikiBrowser/blob/39e89bf1b805ee1f985f3854b414f52298b7e729/WikiFunctions/API/UserInfo.cs#L108-L112

public bool CanEditPage(PageInfo page)
{
    return (IsInGroup(page.EditProtection) || HasRight(page.EditProtection)) 
        && !(page.NamespaceID == Namespace.MediaWiki && !HasRight("editinterface"));
}

MediaWiki's editing rights etc have become more complex over the years, there's definitely numerous cases that probably aren't catered for.

Can you provide an example of which these pages are?

My case:
I am an engineer and interface administrator at ruwiki, I have the editprotected right from the "engineer" user group.

I have tried to edit:

Only the last two were successful. Logs:

image.png (82×495 px, 8 KB)

To be sure, for that test, I checked all the "Grant right" boxes in Special:BotPasswords.

Jack_who_built_the_house renamed this task from AWB should check user's rights, not just "sysop" user group to Can't edit fully protected pages with AWB despite "editprotected" right.Oct 25 2021, 11:30 PM
Jack_who_built_the_house updated the task description. (Show Details)