When experimenting with WikiLambda locally, I noticed that the check at https://github.com/wikimedia/mediawiki-extensions-WikiLambda/blob/4b79c3a9a148cf73d37c5754c940398d72f32486/includes/Special/SpecialCreateObject.php#L76 is not working correctly: $block->appliesToRight( 'createpage' ) always returns null and therefore bypasses the check. The logic in AbstractBlock always returns null for createpage (at least if $wgBlockDisablesLogin is false, which is the case on public wikis). DatabaseBlock also doesn't recognize createpage because it is not in BlockActionInfo::getAllBlockActions() (which I verified by checking the valid values for the actionrestrictions of action=block at Special:ApiSandbox). Therefore, SpecialCreateObject::userCanExecute() is always true if the user has the permission but is blocked.
However, this check only restricts the frontend. The API (action=wikilambda_edit/ApiZObjectEditor) does not check for blocks at all; ZObjectAuthorization::authorize only calls Authority::isAllowed(), and according to the docs, This method will not apply rate limit checks or evaluate user blocks..
Reproduction steps
I performed the following steps locally:
- Grant your alt account a group with the wikilambda-create permission
- Create a sitewide block at Special:Block for your alt
- Log into your alt and go to /wiki/Special:ApiSandbox#action=wikilambda_edit&format=json&summary=Test%20summary&zobject=%7B%22Z1K1%22%3A%22Z2%22%2C%22Z2K1%22%3A%7B%22Z1K1%22%3A%22Z6%22%2C%22Z6K1%22%3A%22Z0%22%7D%2C%22Z2K2%22%3A%22%22%2C%22Z2K3%22%3A%7B%22Z1K1%22%3A%22Z12%22%2C%22Z12K1%22%3A%5B%22Z11%22%2C%7B%22Z1K1%22%3A%22Z11%22%2C%22Z11K1%22%3A%22Z1002%22%2C%22Z11K2%22%3A%22Test%20object%202%22%7D%5D%7D%2C%22Z2K4%22%3A%7B%22Z1K1%22%3A%22Z32%22%2C%22Z32K1%22%3A%5B%22Z31%22%5D%7D%2C%22Z2K5%22%3A%7B%22Z1K1%22%3A%22Z12%22%2C%22Z12K1%22%3A%5B%22Z11%22%2C%7B%22Z1K1%22%3A%22Z11%22%2C%22Z11K1%22%3A%22Z1002%22%2C%22Z11K2%22%3A%22Test%20description%22%7D%5D%7D%7D&token=c4de66c7d54d7619a65beda7153ab4996a2a03df%2B%5C&formatversion=2
- Click "Make request" (and click the button to correct the token)
The object was created despite the alt account being blocked and not being able to edit any other pages.
Additional information
MW: 1.47.0-alpha (639bcdd)
WikiLambda: 4b79c3a