Page MenuHomePhabricator

SpecialCreateBlogPost doesn't check for edit right
Closed, DeclinedPublicBUG REPORT

Description

Steps to replicate the issue (include links if applicable):

  • Ensure users have no edit right
  • Create a blog

What happens?:
Blog is created, despite not being able to create/edit pages otherwise.

What should have happened instead?:
User is disallowed from creating a blog page.

Software version (on Special:Version page; skip for WMF-hosted wikis like Wikipedia):
MediaWiki 1.45.3 (bd06968)
BlogPage 3.0 (3dbe591)

Other information (browser name/version, screenshots, etc.):
Downstream: https://issue-tracker.miraheze.org/T15439

Event Timeline

Restricted Application added a subscriber: Reception123. · View Herald Transcript

Change #1293143 had a related patch set uploaded (by Pskyechology; author: Pskyechology):

[mediawiki/extensions/BlogPage@master] SpecialCreateBlogPost: check for edit right as well

https://gerrit.wikimedia.org/r/1293143

Change #1293146 had a related patch set uploaded (by Pskyechology; author: Pskyechology):

[mediawiki/extensions/BlogPage@REL1_45] SpecialCreateBlogPost: check for edit right as well

https://gerrit.wikimedia.org/r/1293146

lcawte subscribed.

I don't know when exactly core changed its permissions to tie creation things to the 'edit' right, however, the ability to decouple the permissions of this feature from the main edit right is very much an intentional choice which is left in the hands of site operators to make.

I don't know when exactly core changed its permissions to tie creation things to the 'edit' right, however, the ability to decouple the permissions of this feature from the main edit right is very much an intentional choice which is left in the hands of site operators to make.

I can't think of a single good reason to disallow editing and normal page creation, but allow the creation of pages via extension. This also places an unnecessary burden on operators to specifically account for the extension's design choice that misaligns with core to allow for a rather silly choice.

I don't know when exactly core changed its permissions to tie creation things to the 'edit' right, however, the ability to decouple the permissions of this feature from the main edit right is very much an intentional choice which is left in the hands of site operators to make.

I can't think of a single good reason to disallow editing and normal page creation, but allow the creation of pages via extension. This also places an unnecessary burden on operators to specifically account for the extension's design choice that misaligns with core to allow for a rather silly choice.

One such example off the top of my head is a (semi)-restricted editing environment that publishes official or factual content as regular wiki content, but allows the community to provide reviews (longer than something like Comments would be appropriate for) or fanon content as "blogs". Or maybe you want to use MediaWiki primarily or solely as a blogging platform?

I'd personally argue there's probably better ways to implement such things, but then again, who am I to tell someone how to run their site.