Page MenuHomePhabricator

re-asses support for action=raw
Closed, DeclinedPublic

Description

action=raw is current not supported for Wikibase items. The ContentHandler branch will send a 406 Not Acceptable response if action=raw is used with non-text content.

This was done after some discussion on MediaWiki-General, the reasoning being that
a) sending anon editable data with potentially dangerous mime types is a bad idea
b) action=raw is a legacy interface and really deprecated

action=raw could, in theory, just return a serialized version of the content, using the gen= parameter as a hint to how to serialize the content. The benefits and downsides of this should be re-assessed.


Version: master
Severity: normal

Details

Reference
bz37745

Event Timeline

bzimport raised the priority of this task from to Low.Nov 22 2014, 12:24 AM
bzimport set Reference to bz37745.
bzimport added a subscriber: Unknown Object (MLST).

action=raw's original uses are largely obsoleted by the API and ResourceLoader, so I wouldn't worry too much about adding new support for other data types.

(In reply to comment #1)

action=raw's original uses are largely obsoleted by the API and ResourceLoader,
so I wouldn't worry too much about adding new support for other data types.

The thing is... i already had this implemented,. and then deliberately took it out again. But I can't recall why exactly. Security, perhaps?... Someone convinced me it was a bad idea...

The reason why action=raw is not supported is that there is no way to report the content model to the client (The HTTP header Content-Type can be used for the serialization format, but would be inappropriate for identifying the model). Legacy clients accessing pages with action=raw will expect wikitext, but may receive something else entirely, like JSON.

action=raw does not provide a good way to report all the meta data necessary for interpreting the data itself. So, it is disabled for anything that is not text.

Keep in mind that action=raw is a legacy interface and deprecated. Use the API instead, or SpecialExport. Both report the content model and serialization format along with the content.