Page MenuHomePhabricator

Redirect is broken because $wgScript is used instead of $wgArticlePath
Closed, ResolvedPublicBUG REPORT

Description

List of steps to reproduce

  • Install MediaWiki 1.35 and AccessControl 4.1.
  • Use the <accesscontrol> tag or an AccessControl template
  • Protect a page from anonymous users
  • Access this page as an anonymous user

What happens?

  • AccessControl redirect anonymous users to /index.php/MySitename:Deny_user
  • The server respond with a 404 Not Found HTTP status (because index.php is not handled in the nginx configuration)

What should have happened instead?:

  • AccessControl should redirect to /wiki/MyMetaNamespace:Deny_user as the $wgArticlePath is set to /wiki/$1 and $wgMetaNamespace is made for this usage

Solution

In AccessControl.hooks.php, at line 760:
replace $wgScript . "/" . $wgSitename . ":" . wfMessage( $info )->text()
with str_replace( '$1', $wgMetaNamespace . ":" . wfMessage( $info )->text(), $wgArticlePath)

Software version

ProductVersion
MediaWiki1.35.6
PHP7.3.33 (fpm-fcgi)
MariaDB10.3.32
ICU65.1
Lua5.1.5
ExtensionVersion
AccessControl4.1

Event Timeline

I'm not sure what this extension does exactly, but if it needs the URL of a page, Title::getFullURL is what it should use. What the current code does looks very fragile and it smells of reinventing the wheel.

Want subscribed.

It's simple. Do redirect to info page early, than is blocked access by rights. The parser do redirect, without continue in processing of the content of the protected page.

I integrated into code new global variable $wgAccessControlMeta, which can change redirect target to page from $wgSitename (default), to use $wgMetaNamespace, if value 'true'. (commit d8bc0e0f11fe22f21e80986f20b3e9822a155310)