Page MenuHomePhabricator

The createpage right should allow creating pages even without the edit right
Closed, DeclinedPublic

Description

Author: jeffwang16

Description:
The installer's "authorized editors only" setting only blockades the rights "edit" or "createaccount", but the rights "createpage" and "createtalk" are not. I think this setting should be falsified for the installer. So

Right now:

The following permissions were set based on your choice in the installer

$wgGroupPermissions['*']['createaccount'] = false;
$wgGroupPermissions['*']['edit'] = false;

Should change to:

The following permissions were set based on your choice in the installer

$wgGroupPermissions['*']['createaccount'] = false;
$wgGroupPermissions['*']['edit'] = false;
$wgGroupPermissions['*']['createpage'] = false;
$wgGroupPermissions['*']['createtalk'] = false;


Version: 1.22.0
Severity: enhancement
See Also:
https://bugzilla.wikimedia.org/show_bug.cgi?id=38365

Details

Reference
bz35238

Event Timeline

bzimport raised the priority of this task from to Low.Nov 22 2014, 12:09 AM
bzimport set Reference to bz35238.
bzimport added a subscriber: Unknown Object (MLST).

jeffwang16 wrote:

And not only that; img_auth.php should be applied and there should be an option to integrate img_auth.php with image uploading on the installer.

Hi Jeff,
I have tried this on v1.22 - the installer still adds

$wgGroupPermissions['*']['createaccount'] = false;
$wgGroupPermissions['*']['edit'] = false;

However I could create pages as an anon.

Can you still reproduce this bug ?

jeffwang16 wrote:

Well of course this is reproduce-able, but I'm not interested in making a new wiki for the purpose of testing.

I can't reproduce this issue with 1.22. Although the installer doesn't add lines prohibiting createpage and createtalk, anons are unable to do so.

jeffwang16 wrote:

No, we need somebody to change it so that it clearly adds the lines I requested.

Why? They're not necessary. The $wgGroupPermissions['*']['edit'] = false; line prevents page creation already. I just tested it. Adding the other lines would have no benefit and would just clutter up LocalSettings.php.

jeffwang16 wrote:

Permissions are supposed to tell EXACTLY what is blocked and what is not. Some wikis may even want anons to make pages only; the software is not supposed to bundle certain rights together.

I don't really see a use case for that, but I've updated the bug report to reflect it.

Sorry, but I don't see a valid use case for a write-once-read-many medium using MediaWiki.