Page MenuHomePhabricator

Allow API to test if page title is blacklisted (or is invalid for other reasons)
Closed, ResolvedPublic

Description

The MediaWiki API should be able to be given a sample input string and return whether the string would be a valid title. For example, the string "abc" would return True while the string "aB{" would return False (as "{" isn't allowed in page titles).

This would essentially be a dry-run mode of action=edit, but would allow for some sanity checks when, for example, testing whether strings are valid template parameter names.

Optionally, this test could check against other restrictions such as the local title and global blacklists or the AbuseFilter to see if a specific string matches (though this possibly opens up an attack vector).


Version: unspecified
Severity: enhancement

Details

Reference
bz28577

Event Timeline

bzimport raised the priority of this task from to Low.Nov 21 2014, 11:29 PM
bzimport set Reference to bz28577.
bzimport added a subscriber: Unknown Object (MLST).

(In reply to comment #0)

The MediaWiki API should be able to be given a sample input string and return
whether the string would be a valid title. For example, the string "abc" would
return True while the string "aB{" would return False (as "{" isn't allowed in
page titles).

Like duplicatebug says, validity can already be checked.

Optionally, this test could check against other restrictions such as the local
title and global blacklists or the AbuseFilter to see if a specific string
matches (though this possibly opens up an attack vector).

IIRC Neil is interested in and may already have written some code for the blacklist thing, CCing him.

(In reply to comment #1)

For the first part, you can use:
http://en.wikipedia.org/w/api.php?action=query&titles=abc|abc{

Huh. I never would've thought to use the query module for that. Thanks for pointing that out! Probably needs a bit better documentation somewhere.

(In reply to comment #2)

Optionally, this test could check against other restrictions such as the local
title and global blacklists or the AbuseFilter to see if a specific string
matches (though this possibly opens up an attack vector).

IIRC Neil is interested in and may already have written some code for the
blacklist thing, CCing him.

Yes, he said as much to me, I think. There are a few features that can block page creation (create-protection, title blacklists, AbuseFilter); having a dry-run mode of action=edit might be nice. I would think the people doing unit tests would need something like this (if they ever test on a live site). It's easy enough to create test pages on your own wiki, I suppose, but creating nearly invalid titles on a live project usually causes screams. :-)

neilk wrote:

yes, it's on my agenda -- I made one of the UploadWizard bugs block here so I update both.

neilk wrote:

*** Bug 29327 has been marked as a duplicate of this bug. ***

Thehelpfulonewiki wrote:

Reassigning to wikibugs-l per bug 37789