Page MenuHomePhabricator

Cannot access deleted contents while in a namespace-protected namespace that cannot be edited
Closed, ResolvedPublicBUG REPORT

Assigned To
Authored By
Wilf233
Apr 15 2024, 2:16 PM
Referenced Files
Unknown Object (File)
Apr 16 2024, 4:09 AM
Unknown Object (File)
Apr 15 2024, 3:46 PM
F46776222: image.png
Apr 15 2024, 2:16 PM
F46776026: image.png
Apr 15 2024, 2:16 PM

Description

Steps to replicate the issue:

  • Log in Chinese Minecraft Wiki in an account with "patrollers", "users" and "autoconfirmed" user groups only. (This user group contains user rights deletedhistory, deletedtext, and undelete, but without the rights to edit MediaWiki namespace.) You can see the user group rights here.
  • View deleted pages in MediaWiki namespace. Here is an example.

What happens?:
Access denied, and the message says:
You do not have permission to view metadata of deleted history entries, for the following reason:
The action you have requested is limited to users in one of the groups: Sysadmins, patrollers, CATS, Administrators.

What should have happened instead?:
Can access the deleted contents, but cannot restore them.

Software version (on Special:Version page; skip for WMF-hosted wikis like Wikipedia):
1.41.1

Other information (browser name/version, screenshots, etc.):

image.png (540×2 px, 119 KB)

image.png (210×674 px, 20 KB)

Event Timeline

Can confirm in MediaWiki 1.43.0-alpha (c67d907), seems caused by the permission checker can not properly handle namespace protection.

The undelete link also shows, might related to this.

Change #1020285 had a related patch set uploaded (by Anterdc99; author: Anterdc99):

[mediawiki/core@master] PermissionManager: Allow some readonly user rights bypass NSProtection

https://gerrit.wikimedia.org/r/1020285

Pppery renamed this task from System message "Badaccess-groups" contradiction to Inaccurate error message given when trying to view deleted history for a page one can't edit.May 11 2024, 4:59 PM
Pppery removed a project: MediaWiki-General.

Change #1020285 merged by jenkins-bot:

[mediawiki/core@master] PermissionManager: Allow some readonly user rights bypass NSProtection

https://gerrit.wikimedia.org/r/1020285

Change #1034537 had a related patch set uploaded (by Anterdc99; author: Anterdc99):

[mediawiki/core@REL1_42] PermissionManager: Allow some readonly user rights bypass NSProtection

https://gerrit.wikimedia.org/r/1034537

Change #1034541 had a related patch set uploaded (by Anterdc99; author: Anterdc99):

[mediawiki/core@REL1_41] PermissionManager: Allow some readonly user rights bypass NSProtection

https://gerrit.wikimedia.org/r/1034541

Change #1034542 had a related patch set uploaded (by Anterdc99; author: Anterdc99):

[mediawiki/core@REL1_40] PermissionManager: Allow some readonly user rights bypass NSProtection

https://gerrit.wikimedia.org/r/1034542

Change #1034544 had a related patch set uploaded (by Anterdc99; author: Anterdc99):

[mediawiki/core@REL1_39] PermissionManager: Allow some readonly user rights bypass NSProtection

https://gerrit.wikimedia.org/r/1034544

Is OK if I change the title to reflect the actual commit?

Change #1035025 had a related patch set uploaded (by Anterdc99; author: Anterdc99):

[mediawiki/core@master] PermissionManagerTest: Add test for NSProtection excluded actions

https://gerrit.wikimedia.org/r/1035025

Change #1035352 had a related patch set uploaded (by Anterdc99; author: Anterdc99):

[mediawiki/core@REL1_42] PermissionManagerTest: Add test for NSProtection excluded actions

https://gerrit.wikimedia.org/r/1035352

Change #1035736 had a related patch set uploaded (by Anterdc99; author: Anterdc99):

[mediawiki/core@REL1_42] [WIP] PermissionManagerTest: Add test for NSProtection excluded actions

https://gerrit.wikimedia.org/r/1035736

Change #1035352 abandoned by Anterdc99:

[mediawiki/core@REL1_42] [WIP] PermissionManagerTest: Add test for NSProtection excluded actions

Reason:

https://gerrit.wikimedia.org/r/1035352

Wilf233 renamed this task from Inaccurate error message given when trying to view deleted history for a page one can't edit to Allow some readonly user rights bypass NSProtection.May 25 2024, 5:11 AM
Wilf233 updated the task description. (Show Details)
Anterdc99 renamed this task from Allow some readonly user rights bypass NSProtection to Cannot access deleted contents while in a namespace-protected namespace that cannot be edited.May 25 2024, 5:21 AM
Anterdc99 updated the task description. (Show Details)

Change #1034537 abandoned by Anterdc99:

[mediawiki/core@REL1_42] PermissionManager: Allow some readonly user rights bypass NSProtection

Reason:

cancel backporting per user's comment

https://gerrit.wikimedia.org/r/1034537

Change #1034541 abandoned by Anterdc99:

[mediawiki/core@REL1_41] PermissionManager: Allow some readonly user rights bypass NSProtection

Reason:

cancel backporting per user's comment

https://gerrit.wikimedia.org/r/1034541

Change #1034542 abandoned by Anterdc99:

[mediawiki/core@REL1_40] PermissionManager: Allow some readonly user rights bypass NSProtection

Reason:

cancel backporting per user's comment

https://gerrit.wikimedia.org/r/1034542

Change #1034544 abandoned by Anterdc99:

[mediawiki/core@REL1_39] PermissionManager: Allow some readonly user rights bypass NSProtection

Reason:

cancel backporting per user's comment

https://gerrit.wikimedia.org/r/1034544

Change #1035736 abandoned by Anterdc99:

[mediawiki/core@REL1_42] [WIP] PermissionManagerTest: Add test for NSProtection excluded actions

Reason:

cancel backporting per user's comment

https://gerrit.wikimedia.org/r/1035736

Change #1035025 merged by jenkins-bot:

[mediawiki/core@master] PermissionManagerTest: Add test for NSProtection excluded actions

https://gerrit.wikimedia.org/r/1035025

Anterdc99 claimed this task.