Page MenuHomePhabricator

Admins should be able to undelete wishlist entities
Closed, ResolvedPublicBUG REPORT

Description

Steps to replicate the issue (include links if applicable):

  • Create a wish
  • Delete it
  • Attempt to undelete the page (i.e. Special:Undelete/Community Wishlist/W123)

What happens?:

There's no "Undelete revisions" form.

What should have happened instead?:

You should be able to undelete revisions just like any other page.

Other information (browser name/version, screenshots, etc.):

This is because of CommunityRequestsHooks::onGetUserPermissionsErrorsExpensive(). If the page is deleted, the $title->exists() check fails and we disallow the action, even for admins. The intent was to make everyone use the form to create new entities, but we accidentally also prevented admins from undeleting entities.

The easiest solution is probably to use one of the undelete hooks and set CommuntiyRequestsHooks::allowManualEditing = true.

Here is the updated version with a separate AC2 test case for non-admin users:


Derived Requirement

Ensure that administrators can undelete Community Wishlist wish pages using Special\:Undelete, consistent with standard MediaWiki behavior.

  • Deleted wishlist pages must display the "Undelete revisions" form to administrators.
  • Administrators must be able to restore deleted revisions of wishlist entities.
  • The undelete capability must not be blocked by custom permission checks.
  • Non-admin users must not gain undelete permissions.
Test Steps

Preconditions:

  • A Community Wishlist wish page exists (e.g., Community_Wishlist/W123).
  • The page has been deleted.
  • One administrator account and one non-admin account are available.

Test Case 1: Ensure administrators can undelete wishlist entities

  1. Log in as an administrator.
  2. Navigate to Special\:Undelete/Community_Wishlist/W123.
  3. Observe whether the "Undelete revisions" form is displayed.
  4. Restore the deleted revision.
  5. Verify the wish page is accessible again.
  6. Delete the page again to reset state (if needed).
  7. ✅❓❌⬜ AC1: The administrator can see and use the "Undelete revisions" form to restore the page.

Test Case 2: Ensure non-admin users cannot undelete wishlist entities

  1. Log in as a non-admin user.
  2. Navigate to Special\:Undelete/Community_Wishlist/W123.
  3. Observe the page behavior.
  4. ✅❓❌⬜ AC2: The "Undelete revisions" form is not available and the non-admin user cannot restore the deleted page.

QA Results - Meta Beta

ACStatusDetails
1T406668#11676067
2T406668#11676067
SideT406668#11679747

Event Timeline

(I was trying to undelete https://meta.wikimedia.org/wiki/Community_Wishlist/W318 since I don't think being a duplicate is a valid reason to outright delete a wish; the later version should have remained as a historical record)

The easiest solution is probably to use one of the undelete hooks and set CommuntiyRequestsHooks::allowManualEditing = true.

That doesn't work; the only hook that runs before getUserPermissionExpensive checking for edit is getUserPermissionExpensive checking for undelete. I guess you could set a flag in the undelete hook to allow edits of that specific page, but that feels very very wrong.

Change #1221223 had a related patch set uploaded (by MusikAnimal; author: MusikAnimal):

[mediawiki/extensions/CommunityRequests@master] PermissionHooks: allow admins/Wishlist managers to undelete entities

https://gerrit.wikimedia.org/r/1221223

The easiest solution is probably to use one of the undelete hooks and set CommuntiyRequestsHooks::allowManualEditing = true.

That doesn't work; the only hook that runs before getUserPermissionExpensive checking for edit is getUserPermissionExpensive checking for undelete.

You're right there apparently is no suitable undeletion hook to use. There used to be, but my team actually removed as part of an earlier project, hehe! (T290021 – though I don't know if that worked for the action API).

I guess you could set a flag in the undelete hook to allow edits of that specific page, but that feels very very wrong.

How so? What we're doing here with the static variable I think should be safe. It's good for only one request. getUserPermissionExpensive won't even get called if the user doesn't have undelete right, so we should be able to set the static var and allow subsequent calls (in the same request) to the hook handler to return true so things work as expected.

I'm saying it feels ugly as a code-organization principle for the getUserPermissionExpensive hook to mutate state. I agree you're right it's probably safe, but I don't like it.

Change #1221223 merged by jenkins-bot:

[mediawiki/extensions/CommunityRequests@master] PermissionHooks: allow admins/Wishlist managers to undelete entities

https://gerrit.wikimedia.org/r/1221223

@HMonroy Can you please review the side issue video below and whether I should create a separate task for it or if it's fine?

Test Result - Meta Beta

Status: ✅ PASS
Environment: Meta Beta
OS: macOS Tahoe 26.3
Browser: Chrome 143
Device: MBA
Emulated Device: NA

Test Artifact(s): Deleted wishlist page, Special\:Undelete interface

https://meta.wikimedia.beta.wmcloud.org/wiki/Special:Undelete/Community_Wishlist/W46

Test Steps

Preconditions:

  • A Community Wishlist wish page exists (e.g., Community_Wishlist/W123).
  • The page has been deleted.
  • One administrator account and one non-admin account are available.

Test Case 1: Ensure administrators can undelete wishlist entities

  1. Log in as an administrator.
  2. Navigate to Special\:Undelete/Community_Wishlist/W123.
  3. Observe whether the "Undelete revisions" form is displayed.
  4. Restore the deleted revision.
  5. Verify the wish page is accessible again.
  6. Delete the page again to reset state (if needed).
  7. AC1: The administrator can see and use the "Undelete revisions" form to restore the page.

Test Case 2: Ensure non-admin users cannot undelete wishlist entities

  1. Log in as a non-admin user.
  2. Navigate to Special\:{F72561874}Undelete/Community_Wishlist/W123.
  3. Observe the page behavior.
  4. AC2: The "Undelete revisions" form is not available and the non-admin user cannot restore the deleted page.

❓Side Issue-
Did you want the voting comment removed, or should everything be as it was when you undeleted it?

GMikesell-WMF changed the task status from Open to In Progress.Mar 4 2026, 11:41 PM
GMikesell-WMF updated the task description. (Show Details)
GMikesell-WMF moved this task from QA to In Development on the Community-Tech (Sea Lion Squad) board.

Did you want the voting comment removed, or should everything be as it was when you undeleted it?

Undeleting the Votes subpage sounds appropriate given we auto-delete it, but yeah, that should be a separate task. What we did here was just about access control as opposed to actually hooking to the undelete action.

@MusikAnimal you may be able to read that task with your staff account, any suggestions would be welcome

MusikAnimal changed the task status from In Progress to Open.Mar 5 2026, 7:59 PM

Ok sounds good, I created T419180: Voting comment is removed after deleting and undeleting a wish , regarding the voting comment no reappearing after undeleting the wish. As for the task, I will mark this as Resolved. Thanks for all your work!

GMikesell-WMF updated the task description. (Show Details)
GMikesell-WMF updated Other Assignee, removed: GMikesell-WMF.