Note: the Wikibase REST API isn’t enabled in production yet, no need to panic :)
MediaWikiEditEntityFactoryItemUpdater should throw an exception in case it gets an EditMetadata object with the bot flag set to true but with a user who doesn't have the corresponding right.
| Subject | Repo | Branch | Lines +/- | |
|---|---|---|---|---|
| REST: Throw exception for insufficient bot rights | mediawiki/extensions/Wikibase | master | +66 -29 |
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Open | None | T335067 Epic: Wikidata Query Service stabilization | |||
| Resolved | Lydia_Pintscher | T314503 rollout of the new Wikibase REST API to Wikidata | |||
| Resolved | Lydia_Pintscher | T316354 Ensure rate limiting and potentially other harm preventions are in place for the Wikibase REST API | |||
| Resolved | Security | WMDE-leszek | T321318 🤖️ Wikibase REST API ignores `bot` user right, lets anyone mark edits as bot edits | ||
| Resolved | Security | Jakob_WMDE | T321567 🤖️ Check the 'bot' user privilege in REST API's ItemUpdater |