Page MenuHomePhabricator

Pages protected by title blacklist extension show "edit" tab instead of "view source" even if the editor cannot edit them
Closed, DeclinedPublic


Example: if a non-logged-in user pulls up

...they are presented with an Edit tab, even though they cannot edit it.

Version: unspecified
Severity: normal



Event Timeline

bzimport raised the priority of this task from to Low.Nov 21 2014, 11:30 PM
bzimport added a project: TitleBlacklist.
bzimport set Reference to bz28589.

Is this related to bug 14104?

Based on talk on irc, this page is protected via title blacklist extension.

The title blacklist extension uses the getUserPermissionsErrorsExpensive hook, which means that its only checked when we absolutely have to (aka on an actual edit, not on when we decide what to display the edit tab as). I have no idea how expensive title blacklist is, but presumably its using that hook for a reason and probably isn't going to change.

However, with that said when we're actually on an edit page (aka ) we do have to do the expensive check, and we should probably re-use that when building the skin elements. (However I'm not sure how easy that'd be to do in practice).

(In reply to comment #1)

Is this related to bug 14104?

It is bug 11700

Will not fix. Checking pages against a list of regexes on every page view is expensive.