Page MenuHomePhabricator

Test and make sure saved translations are accessed only by the creator
Closed, ResolvedPublic

Description

Test and make sure that drafts are accessed only by their creators. Even manipulating URLs should not allow another translator to retrieve it.

Event Timeline

santhosh raised the priority of this task from to Medium.
santhosh updated the task description. (Show Details)
santhosh changed Security from none to None.
santhosh subscribed.
Amire80 renamed this task from Test and make sure saved translations are accessed by only creator to Test and make sure saved translations are accessed only by the creator.Dec 10 2014, 2:08 PM

(posted wrongly in the tracker task earlier)

Currently, when trying to view a draft by using the URL the following happens:

  1. user can see a broken translation view with emptiness in the source and target columns. Only titles are displayed.
  2. the page gets saved in the user's dashboard as a draft (which again opens the same broken translation view)

Can this be changed to redirect to the current user's dashboard? Possibly add a warning message saying that they don't have permission to view another user's draft.

Screen_Shot_2014-12-19_at_7.19.40_pm.png (788×1 px, 91 KB)

Arrbee subscribed.
Arrbee raised the priority of this task from Medium to High.Dec 23 2014, 2:27 PM

Change 182435 had a related patch set uploaded (by Santhosh):
Fetch the translation and drafts of current user alone

https://gerrit.wikimedia.org/r/182435

Patch-For-Review

Change 182435 merged by jenkins-bot:
Fetch the translation and drafts of current user alone

https://gerrit.wikimedia.org/r/182435

Arrbee raised the priority of this task from High to Unbreak Now!.Jan 7 2015, 5:53 PM

The current patch doesn't fix the issue and adds regressions.

  1. Drafts can be accessed by other users, including user's who have not enabled CX as a beta feature.
  2. No warnings are shown
  3. The other users can publish the article (directly into the main namespace)
  4. In case they publish the article, it removes the original draft from the original translator's dashboard and shows up in the list of published articles.

We need a check if a pair is being worked on by somebody else.

Change 183435 had a related patch set uploaded (by Santhosh):
If wrong draftid passed, take the user to dashboard

https://gerrit.wikimedia.org/r/183435

Patch-For-Review

santhosh lowered the priority of this task from Unbreak Now! to High.

Change 183446 had a related patch set uploaded (by Santhosh):
Check if another translator working on same translation

https://gerrit.wikimedia.org/r/183446

Patch-For-Review

Change 183435 merged by jenkins-bot:
If wrong draftid passed, take the user to dashboard

https://gerrit.wikimedia.org/r/183435

Screenshot of translation conflict warning

pasted_file (445×1 px, 76 KB)

Amire80 subscribed.

I merged the patch because it's good progress, but there are still some issues:

  • If the user didn't enable the beta feature, the translation interface starts loading and only after that redirects to a "no such special page" error page. This may be worth of a separate task.
  • If the beta feature is enabled, the warning is shown for a few seconds and then the user is redirected to the dashboard. It's an improvement, but maybe it's better to show a more stable warning. @Pginer-WMF, what do you think?

Change 183446 merged by jenkins-bot:
Check if another translator working on same translation

https://gerrit.wikimedia.org/r/183446