Page MenuHomePhabricator

writeapi permission required for * group even if logged in for rest.php
Open, Needs TriagePublic

Description

When using VisualEditor with rest.php, writeapi is required for the * group. Even if the user is logged in and the user group has it.

We have this set:

	// Required for Flow to work with rest.php
	wfLoadExtension( "Parsoid", "$IP/vendor/wikimedia/parsoid/extension.json" );

	// Automatically uses the local rest.php (hence url isn't set).
	// We need to set 'forwardCookies' for private wikis and
	// for pages restricted by protection.
	$wgVirtualRestConfig['modules']['parsoid'] = [
                'url' => "$wgServer/w/rest.php",
 		'domain' => $wgServer,
 		'prefix' => $wgDBname,
 		'forwardCookies' => true,
 		'restbaseCompat' => false,
 	];

running mediawiki 1.35.1 and php 7.3.