| Xaosflux | |
| May 5 2026, 5:44 PM |
| F85954206: image.png | |
| Jun 1 2026, 2:02 PM |
| F79829672: image.png | |
| May 5 2026, 5:44 PM |
| F79829621: image.png | |
| May 5 2026, 5:44 PM |
Steps to reproduce:
What I expect to happen: elevated security prompt should engage, then the workflow should continue
| Subject | Author | Repo | Branch | Lines +/- | |
|---|---|---|---|---|---|
| ForceReauth: Fix link in permission error | Gergő Tisza | mediawiki/extensions/WikimediaCustomizations | master | +2 -1 |
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Open | None | T197160 All security-sensitive MediaWiki functionality should require elevated security | |||
| Open | Security | None | T425460 Unable to change content model to javascript in mediawiki space |
Note: If I get elevated using a different workflow, then the change content model interface does work during my non-expired time.
SpecialChangeContentModel needs to override getLoginSecurityLevel() (and inject AuthManager) so that FormSpecialPage::execute() triggers reauthentication before the editsitejs permission check fails.
This will be somewhat improved next week with this patch, which includes a link to the reauthentication form in the error message. That's still not exactly what we want, and we'll keep working on more improvements, but it should be slightly better and slightly less confusing than the current situation,
Change #1295944 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):
[mediawiki/extensions/WikimediaCustomizations@master] ForceReauth: Fix link in permission error
Change #1295944 merged by jenkins-bot:
[mediawiki/extensions/WikimediaCustomizations@master] ForceReauth: Fix link in permission error
