Improve Special:MergeHistory so history merges from Special:Undelete can be disallowed
Closed, ResolvedPublic

Description

MergeHistory was enabled on three small projects, apparently without code review being done. We have not enabled MergeHistory on WMF projects in the past, for the following reasons:

  • The write query changes an unlimited number of rows, and so can cause slave lag.
  • The action is potentially extremely difficult to reverse, and so could cause a great deal of damage to a wiki if a sysop account were compromised.

Now, it is true that the delete/undelete method for merging history has the same two caveats, and so Special:MergeHistory is basically a nicer frontend for the same feature. But providing a simplified frontend for a feature is a kind of promotion, and it would be best if the backend were sensible before we did such promotion.

Note that the fact that undeletion can merge history was accidental. The feature was certainly not reviewed for the potential of malicious or accidental damage before it was deployed, because the first people to discover it were users, not developers.

I suggest:

  • Deferring and throttling history merges, like what we do for user renames. Or alternatively, limiting history merges to pages with a few thousand revisions.
  • Adding an "unmerge" feature, accessible from a link on the merge log line. Perhaps this could work by traversal of rev_parent_id starting from a rev_id stored in log_params.

Once this is done, the mergehistory right can be given to sysops by default in the MW core and on all WMF wikis, and then the misfeature allowing Special:Undelete to merge histories can be removed.


Version: unspecified
Severity: enhancement

Details

Reference
bz66155
Anomie added a comment.Jun 9 2014, 9:12 PM

(In reply to Tim Starling from comment #0)

Once this is done, the mergehistory right can be given to sysops by default
in the MW core and on all WMF wikis, and then the misfeature allowing
Special:Undelete to merge histories can be removed.

One other thing I've seen done is using Special:Undelete to unmerge histories, for example if someone comes along and replaces one article entirely with a different article.

aaron added a comment.Jun 10 2014, 9:00 PM

The special page already enforces that only non-overlapping parts of the source page can be moved to the destination page. An "unmerge" link is included in the move log to reverse it.

What is indeed missing is a simple max-revision limit.

Change 138735 had a related patch set uploaded by Aaron Schulz:
Added a 5000 revision limit to Special:MergeHistory

https://gerrit.wikimedia.org/r/138735

Change 138735 merged by jenkins-bot:
Some improvements to Special:MergeHistory

https://gerrit.wikimedia.org/r/138735

Change 141892 had a related patch set uploaded by Aaron Schulz:
Give "mergehistory" to sysops

https://gerrit.wikimedia.org/r/141892

Change 141892 abandoned by Aaron Schulz:
Give "mergehistory" to sysops

https://gerrit.wikimedia.org/r/141892

Change 144861 had a related patch set uploaded by Aaron Schulz:
Give "mergehistory" to sysops

https://gerrit.wikimedia.org/r/144861

Change 144861 had a related patch set uploaded by Krinkle:
Give "mergehistory" to sysops

https://gerrit.wikimedia.org/r/144861

Change 144861 merged by jenkins-bot:
Give "mergehistory" to sysops

https://gerrit.wikimedia.org/r/144861

Add Comment