Page MenuHomePhabricator

Flow: new-topic should fail on page that isn't a Flow board
Closed, ResolvedPublic

Description

As in bug 60218. Go to [[mw:Special:ApiSandbox]]:

  • action=flow
  • page= page you want to blank, one that isn't a Flow board.
  • params={"topic_list": {"topic": "Topic!", "content": "Content!"}}
  • token=Flow token from API (request tokens type 'flow'), +\ if you're logged out

Press Make request, and the page will be replaced with the string: "This talk
page has been taken over by a
[https://www.mediawiki.org/wiki/Special:MyLanguage/Flow_Portal Flow board]."
The API request returns success and includes the chunk of HTML for the new topic.

But the page isn't a Flow board! The API request should fail.
onPerformAction checks isTalkpageOccupied but returns true if it isn't, and maybe the API should be checking too before it calls ensureFlowRevision().


Version: master
Severity: major

Details

Reference
bz60309

Event Timeline

bzimport raised the priority of this task from to High.Nov 22 2014, 2:53 AM
bzimport set Reference to bz60309.
bzimport added a subscriber: Unknown Object (MLST).

bingle-admin wrote:

The WMF core features team tracks this bug on Mingle card https://wikimedia.mingle.thoughtworks.com/projects/flow/cards/733, but people from the community are welcome to contribute here and in Gerrit.

Change 110458 had a related patch set uploaded by EBernhardson:
Limit Flow API to only respond on enabled pages

https://gerrit.wikimedia.org/r/110458

Change 110458 merged by jenkins-bot:
Limit Flow API to only respond on enabled pages

https://gerrit.wikimedia.org/r/110458