The issue appears to be that FileImporter only does checks for create and upload, but not edit. This results in no errors being returned because the PermissionManager::checkCascadingSourcesRestrictions check directly compares the given action to the cascading action restriction (which is only ever edit), this means any checks for actions other than edit will never return errors for cascading restrictions. It looks like the abandoned patch https://gerrit.wikimedia.org/r/c/mediawiki/core/+/233207 would have addressed this bug.

In T294256#7603240, @Dylsss wrote:

The issue appears to be that FileImporter only does checks for create and upload, but not edit. This results in no errors being returned because the PermissionManager::checkCascadingSourcesRestrictions check directly compares the given action to the cascading action restriction (which is only ever edit), this means any checks for actions other than edit will never return errors for cascading restrictions. It looks like the abandoned patch https://gerrit.wikimedia.org/r/c/mediawiki/core/+/233207 would have addressed this bug.

I tried to solve the issue by adding a check for edit permissions. But from my local smoke tests it did not seem to work. Maybe I misunderstood the comment, and this would only work anyways with the other patch mentioned. 🤔
See https://gerrit.wikimedia.org/r/c/mediawiki/extensions/FileImporter/+/757022

What I did to test:

• Transcluded a non existing file page ( {{File:Test.jpg}} ) into a page ( Main Page ) on my wiki.
• Used and admin account to cascade protect Main Page and only allow changes for admins.
• Used a normal user account with the FileImporter to import a random .jpg file and use the name Test for the import.
• There should be an error on the import preview page but there's nothing.

I also tried to just upload a file with that name as a normal user and that also worked although the file page should be cascade protected.

@WMDE-Fisch Your patch works locally for me?

In T294256#7650447, @Dylsss wrote:

@WMDE-Fisch Your patch works locally for me?

Thanks for testing, still have not figured out, why I can not test it locally. We might just merge the patch and test it on the beta cluster before train rollout.

@WMDE-Fisch I looked over your comment again, and I think it's not working because you are transcluding it like {{File:Test.jpg}} instead of [[File:Test.jpg]]. The former doesn't get any cascading protection.

In T294256#7660456, @Dylsss wrote:

@WMDE-Fisch I looked over your comment again, and I think it's not working because you are transcluding it like {{File:Test.jpg}} instead of [[File:Test.jpg]]. The former doesn't get any cascading protection.

🤦 thanks for looking at it again and the clarification. Now I could confirm it working as well. Nice!

Eh, well, I guess this went through gerrit: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/FileImporter/+/757022. I'lll track it for the next supplemental release (T297839) and we can make the bug public once wmf.20 is done rolling out this week.