Page MenuHomePhabricator

Admins can delete pages that they can't edit
Closed, ResolvedPublic

Description

Author: kudu

Description:
When you set up a custom protection level that isn't available to users that don't have special user groups apart from admins, admins can still delete those pages.

For example, if you create a "restricted" protection level and give the right to edit those pages to the "restricted" user group, admins (probably because they have the protect and delete rights) who aren't in the "restricted" group won't be able to edit pages that are protected at the "restricted" level, but they'll be able to delete them.


Version: unspecified
Severity: enhancement

Details

Reference
bz25059

Event Timeline

bzimport raised the priority of this task from to Low.Nov 21 2014, 11:12 PM
bzimport set Reference to bz25059.
bzimport added a subscriber: Unknown Object (MLST).

ayg wrote:

MediaWiki isn't really designed for this level of permissions granularity, so probably no one wants to bother fixing this. Someone (not me) might be willing to review patches if you're willing to write them.

kudu wrote:

There are still some other restrictions as to manipulating pages which you can't edit as an admin. For example, admins can't change the protection levels for pages they can't edit. However, they could delete the page, and restore it, to strip the protection.

Umherirrender set Security to None.
Umherirrender removed a subscriber: wikibugs-l-list.