Page MenuHomePhabricator

"sandbox" language subpages in MediaWiki namespace should not require "editinterface" rights
Closed, DeclinedPublicFeature

Description

Feature summary (what you would like to be able to do and where):

I would like to unlock "/sandbox" subpages on MediaWiki wikis that should not require "editinterface" rights. These would be editable by everyone but can still be subject to regular page protection.

The sandbox subpage would be customizable with "MediaWiki:Sandbox". Changing this message would require something to update the titles of all the existing sandbox subpages. If the message is empty or "-", then no sandbox pages in MediaWiki: space can be created or edited, and the existing sandbox subpages would be moved to "MediaWiki talk:.../sandbox[n]" (where [n] is a number only needed if a title already exists there).

Use case(s) (list the steps that you performed to discover that problem, and describe the actual underlying problem which you want to solve. Do not describe only a solution):

I go to any MediaWiki page, for example MediaWiki:Noarticletext and type "/sandbox" in the header. This page is currently not editable. The hacky workaround for this is to create the sandbox on "MediaWiki talk:Noarticletext/sandbox" but that is a talk page and not really well suited for this.

Benefits (why should this be implemented?):

This would allow for the proposal and testing of MediaWiki interface messages before they are ultimately created. It would also allow "sandbox" messages to be previewed with the URL parameter "?uselang=sandbox". Of course, for other languages not the same as MediaWiki's content language, the sandbox messages to be previewed would be "?uselang=[language code]/sandbox".

Event Timeline

Change #1116544 had a related patch set uploaded (by Awesome Aasim; author: Awesome Aasim):

[mediawiki/core@master] PermissionManager.php: Enable wikis to unlock sandbox subpages for editing (WIP, not finished yet)

https://gerrit.wikimedia.org/r/1116544

This would allow for the proposal and testing of MediaWiki interface messages before they are ultimately created. It would also allow "sandbox" messages to be previewed with the URL parameter "?uselang=sandbox".

I feel like that is problematic from a security perspective. In theory we have separated out all the JS messages, but in practise I don't think we do a good enough job at that.

There already are dozens of "sandbox" subpages here. https://en.wikipedia.org/w/index.php?title=Special%3ASearch&limit=500&offset=0&ns8=1&ns9=1&search=Sandbox+intitle%3Asandbox&advancedSearch-current=%7B%22fields%22%3A%7B%22intitle%22%3A%22sandbox%22%7D%7D&searchToken=1n5z6m27hh4vgy1npwyyfk3cq

I do agree that there may be security concerns if language subpages are not properly separated out from JS. For site JS we could maybe lock it down so that only users with (editinterface) can edit site CSS, JS, and Vue pages.

There might be a better way to do this by writing an extension rather than modifying core. Hmm...

Yeah that is true, but only because it is not possible to create a /sandbox subpage without it being protected from editing for everyone except (editinterface).

The point though is to make testing of how different interface messages appear easier for users who do not have this role. Right now the only way for me to kind of preview how interface messages would appear is to use something like the parse API, but that is not feasible for someone lacking the technical knowledge of APIs.

This proposal addresses a very niche need, and while I understand the motivation behind it, I’m not in favor of changing the long-standing interface editing restrictions. Those restrictions exist to protect against vandalism and unintended security issues, and introducing a special exception for sandboxes would add complexity without bringing much value to the broader community.

taavi subscribed.

I agree with the folks above.

Change #1116544 abandoned by Awesome Aasim:

[mediawiki/core@master] PermissionManager/MessageCache: Enable wikis to unlock some sandbox subpages for editing (still need to add tests, etc.)

https://gerrit.wikimedia.org/r/1116544

Ok this idea is dead for now. Until the broader community demonstrates that there indeed is a need to have these pages open for some reason, it is not going to happen.

And if it is going to happen, it more likely will be in some sort of extension (I am not as familiar with writing extensions at this moment) rather than a modification to Core.