Page MenuHomePhabricator

Add tour as allowed special page redirect parameter
Open, MediumPublic

Description

As discussed at https://en.wikipedia.org/wiki/User_talk:Sage_Ross_%28WMF%29/sandbox, tour is not allowed as a special page parameter when redirecting.

This is particularly useful for Special:MyPage. However, there is one hook, RedirectSpecialArticleRedirectParams, that controls this for all special pages.

Adding 'tour' should not pose a security problem, since tour JavaScript is limited to the MW namespace and extension code, which are only modifiable by trusted users.


Version: master
Severity: normal

Details

Reference
bz45219

Event Timeline

bzimport raised the priority of this task from to Medium.Nov 22 2014, 1:13 AM
bzimport set Reference to bz45219.
bzimport added a subscriber: Unknown Object (MLST).

This would be especially useful to me, as I'd like to include a guidedtour link to Special:MyPage as part of the Wikipedia:Training pages. Users really want to see some interactive practice editing as part of the training, and I'm waiting on this before trying to incorporate it into the trainings.

I've added this to our Trello. The issue is that, "there is one hook,
RedirectSpecialArticleRedirectParams, that controls this for all special pages" was not correct.

RedirectSpecialArticleRedirectParams only affects redirects to "Articles". However, the definition of Article in core is basically any real (non-special page). That still doesn't include Special:Contributions, which is the issue.

This may need a new hook added to core, and it needs security review to make sure tours don't run on the login or create account pages.

Sam, I think adding a new hook in SpecialRedirectToSpecial (as you suggested on IRC) should be fine.

The alternative would be to add it to RedirectSpecialPage (the parent class), but SpecialRedirectToSpecial is the more granular approach (it can be RedirectSpecialArticle, SpecialRedirectToSpecial, both, or neither).

The starting array (to be modified by the hook) should be the one passed to the SpecialRedirectToSpecial constructor ($allowedRedirectParams).

Also, it should probably pass $this to the hook (as the first parameter), so the listener can optionally vary its behavior depending on the special page (e.g. $this->mName).

It should be safe for GuidedTour, since there is already the $isUserJsAllowed check in GuidedTourHooks.php, but this should be tested.

Deskana renamed this task from Add tour as allowed special page redirect parameter to VisualEditor.Aug 30 2018, 1:32 PM
Deskana renamed this task from VisualEditor to Add tour as allowed special page redirect parameter.Aug 30 2018, 1:45 PM