Page MenuHomePhabricator

Restrict who can edit the worklist
Closed, DeclinedPublic

Description

As an event organizer, I want to limit worklist editing to organizers and co-organizers (or at least registered participants), so that the list is protected from vandalism and disruptive edits.
Context: Anyone can currently edit the worklist, since it is a public wiki page. Flagged as an abuse risk.

Acceptance criteria:

  • Editing the worklist is restricted to a defined role set.
  • The permitted roles are configurable or clearly specified.
  • Attempts to edit outside those roles are prevented, with a clear message.

Related Objects

StatusSubtypeAssignedTask
OpenNone
DeclinedNone

Event Timeline

This can be achieved via page protection in specific cases. We chose not to implement event-based restrictions because 1) worklists aren't necessarily attached to a specific event, and 2) they can be attached to multiple events, which makes the restriction useless. Also, there are many reasons why someone might want to edit a worklist (fixing redirects, dropping deleted pages, claiming articles as in T433903, ...). These use cases don't necessarily have a shared user group.

Per above, we have decided not to do this, at least for the time being.