Page MenuHomePhabricator

[TUX] Can insert in translation editor from translation helper without translator rights
Open, LowPublic

Description

As a user without translator rights, it is possible to insert text from the translation helpers, even though the translation editor text area is read-only.

Steps to reproduce:

  1. Go to https://translatewiki.net/w/i.php?title=Special:Translate&group=ext-translate-0-all&language=fy&filter=!translated&action=translate as anonymous user
  2. Click a simple message

Observed:
I. Translation editor opens
II. Messaging is "You need permission to translate messages."
III. Textarea is read-only.

  1. In the translation helper area, click "Use as translation" below "Beheer" (or whatever is suggested)

Observed:
IV. String is inserted in editor, which remains read-only.

Expected:
V. Nothing should happen (or something else, but at least no string insertion in the editor).

One way to fix this would be to update suggestionAdder in ext.translate.editor.helpers.js to check whether the textarea is readonly.

Details

Reference
bz46557

Event Timeline

bzimport raised the priority of this task from to Low.Nov 22 2014, 1:18 AM
bzimport set Reference to bz46557.
bzimport added a subscriber: Unknown Object (MLST).

Going to the URL above without being logged in, I get
"The indicated group does not exist. Select a different message group."

Any other URL where this problem can be tested?

I've updated the URL. The first string "Translate" can be used for step 2.