Page MenuHomePhabricator

Non-admins are able to see the title and edit summary of posts that are within deleted topics in Flow
Open, MediumPublic

Description

See [[mw:Special:Contributions/93.182.159.63]]

While it makes sense that sysops should be able to see the contents of deleted topics, it doesn't make much sense that other users are able to see the contents of deleted posts in Flow as this doesn't happen with the current system. This is also visible in Special:RecentChanges. The following shows what can be seen from RecentChanges.

  • Talk:Sandbox; 03:06 . . (+187)‎ . . 93.182.159.63 (talk) commented on This topic was deleted by Glaisher ( <-- spam contents of the post here --> ).

This how it should appear in RecentChanges, imo. http://www.mediawiki.org/w/index.php?title=Special%3ALog&type=delete&user=&page=Talk%3AFlow+QA

See also [[mw:Special:Contributions/93.182.133.139]]


Version: unspecified
Severity: normal
See Also:
https://bugzilla.wikimedia.org/show_bug.cgi?id=60972

Details

Reference
bz62561

Event Timeline

bzimport raised the priority of this task from to Medium.Nov 22 2014, 3:02 AM
bzimport set Reference to bz62561.
bzimport added a subscriber: Unknown Object (MLST).

This behavior in Flow is modeled on how regular Mediawiki page deletion works now. See this screenshot of English Wikipedia's recent changes: http://imgur.com/LwZyEpj. The last entry is a page deletion action, and you can see the title of the page even as a logged out user – so if the title were spam, you'd be seeing spam in recent changes/contributions as a non-admin.

Of course, it doesn't *have* to work like this - but we've found that when we try to show things different in rc/contribs/etc., people complain that it doesn't work as expected :)

(In reply to Maryana Pinchuk from comment #1)

This behavior in Flow is modeled on how regular Mediawiki page deletion
works now. See this screenshot of English Wikipedia's recent changes:
http://imgur.com/LwZyEpj. The last entry is a page deletion action, and you
can see the title of the page even as a logged out user – so if the title
were spam, you'd be seeing spam in recent changes/contributions as a
non-admin.

Not quite. In your screenshot, we can't see who edited the page that was deleted, nor any of their edit summaries.

Longer explanation:
In regular MediaWiki page deletions, the individual page edits are removed from public view, and only the final page-deletion action is visible to all.

eg. http://i.imgur.com/ivZVvRI.png - Here, #1) User:Derklion makes 2 edits to a page, then in #2) User:Quiddity deletes that page, which removes Derklion's contributions entirely from public view (both RC and Contribs), and places them into the "Deleted user contributions" feed.

See http://i.imgur.com/QzLAC2t.png for #1) Derklion edits #2) Quiddity deletes the page which hides those edits #3) those 2 edits are now only visible in "deleted user contributions".

(Hopefully that's explained clearly. And our apologies for the imgur links, to those that hate them ;)

Quiddity - right, that's why I said "modeled on," not "identical to" ;)

Flow actions are fundamentally different from page edit actions, so they come with extra meta-data that may or may not contain inappropriate material. However, my point stands that if the root issue here is "I think it's bad that some non-admins might see spam/inappropriate words/etc. in contribs or recent changes," then that's no different from the current system today, because deleted page titles can include spam, personal attacks, etc., and are visible to users without admin rights.

Anyway, since we're moving to a more granular revdel-like system of deletion and suppression in the next sprint, I trust the local admins to make the call whether a Flow action and its associated meta-data needs to be deleted or deleted & suppressed.