Page MenuHomePhabricator

System message "Badaccess-groups" contradiction
Open, Needs TriagePublicBUG REPORT

Assigned To
None
Authored By
Wilf233
Mon, Apr 15, 2:16 PM
Referenced Files
Unknown Object (File)
Tue, Apr 16, 4:09 AM
Unknown Object (File)
Mon, Apr 15, 3:46 PM
F46776222: image.png
Mon, Apr 15, 2:16 PM
F46776026: image.png
Mon, Apr 15, 2:16 PM

Description

Steps to replicate the issue:

  • Log in Chinese Minecraft Wiki in an account with "patrollers", "users" and "autoconfirmed" user groups only. (This user group contains user rights browsearchive and undelete, but without the rights editinterface.) You can see the user group rights here.
  • View deleted pages in MediaWiki namespace. Here is an example.

What happens?:
A system message says,
You do not have permission to view metadata of deleted history entries, for the following reason:
The action you have requested is limited to users in one of the groups: Sysadmins, patrollers, CATS, Administrators.

What should have happened instead?:
The user group in the system message should not include "patrollers", like
You do not have permission to view metadata of deleted history entries, for the following reason:
The action you have requested is limited to users in one of the groups: Sysadmins, CATS, Administrators.

Software version (on Special:Version page; skip for WMF-hosted wikis like Wikipedia):
1.41.1

Other information (browser name/version, screenshots, etc.):

image.png (540×2 px, 119 KB)

image.png (210×674 px, 20 KB)

Event Timeline

Can confirm in MediaWiki 1.43.0-alpha (c67d907), seems caused by the permission checker can not properly handle namespace protection.

The undelete link also shows, might related to this.

Change #1020285 had a related patch set uploaded (by Anterdc99; author: Anterdc99):

[mediawiki/core@master] PermissionManager: Allow some readonly user rights bypass NSProtection

https://gerrit.wikimedia.org/r/1020285