T414277 requested removing the movestable right from the autoconfirmed and confirmed groups. However, despite the attached config change setting 'movestable' => false for those two groups, they still have the right after that change was deployed:
$ curl -sLA'https://phabricator.wikimedia.org/T414684' 'https://uk.wikipedia.org/w/api.php?action=query&meta=siteinfo&siprop=usergroups&format=j son&formatversion=2' | jq '.query.usergroups | .[] | select(.rights | contains(["movestable"])) | { name, rights }' { "name": "autoconfirmed", "rights": [ "movestable", "reupload", "upload", "move", "collectionsaveasuserpage", "collectionsaveascommunitypage", "autoconfirmed", "editsemiprotected", "skipcaptcha", "abusefilter-log-detail", "abusefilter-view", "abusefilter-log", "transcode-reset", "transcode-status" ] } { "name": "bot", "rights": [ /* snip */ ] } { "name": "sysop", "rights": [ /* snip */ ] } { "name": "autoreview", "rights": [ /* snip */ ] } { "name": "editor", "rights": [ /* snip */ ] } { "name": "confirmed", "rights": [ "movestable", "reupload", "upload", "move", "collectionsaveasuserpage", "collectionsaveascommunitypage", "autoconfirmed", "editsemiprotected", "skipcaptcha", "abusefilter-log-detail", "abusefilter-view", "abusefilter-log", "transcode-reset", "transcode-status" ] }
@A_smart_kitten suspects (#wikimedia-operations 2026-01-15) that this is due to FlaggedRevs’ special config handling, and that the setting needs to be set in flaggedrevs.php instead. And indeed that file already contains other group permission changes, such as:
} elseif ( $wgDBname == 'elwikinews' ) { $wgFlaggedRevsNamespaces[] = NS_CATEGORY; $wgFlaggedRevsNamespaces[] = 100; $wgGroupPermissions['editor']['rollback'] = true; $wgGroupPermissions['editor']['autoreview'] = false; $wgGroupPermissions['sysop']['stablesettings'] = true; $wgGroupPermissions['sysop']['autoreview'] = false; unset( $wgGroupPermissions['reviewer'] ); }
Based on this, I expect we should:
- move movestable right assignments from core-Permissions.php to flaggedrevs.php (not just for ukwiki, but also for ruwikinews, which has a similar override credited to T201265), and
- add a PHPUnit test to check for any mistaken movestable right assignments in core-Permissions.php (with a message like “you need to add this to flaggedrevs.php instead”), to catch other instances of this mistake in CI in future