Page MenuHomePhabricator

Flow: Core API actions succeed on Flow-enabled page
Closed, ResolvedPublic

Description

I used Special:ApiSandbox to submit an edit in which I appended text to ee-flow's Talk:Sandbox, a page that is Flow-enabled. The edit succeeded (revision 4649), but when I went to the page it's still a Flow board and so Flow items are shown instead of the "page text". Looking at http://ee-flow.wmflabs.org/wiki/Special:Export for Talk:Sandbox, you can see the new text "Test addition with API to Flow-enabled page" in revision 4649, but when I viewed the Flow board Flow immediately created a new revision 4650 with text changed back to the default <flow-talk-taken-over> message. I tried it again and the same thing happened (revisions 4651 then 4652).

Flow blocks most URL page actions on Flow-enabled pages; I don't know if it should block or fail API actions as well. The reset of page content back to <flow-talk-taken-over> is by design (read TalkpageManager->ensureFlowRevision) and users won't see any of this content anyway until Flow is disabled on the page. So bots could make edits to Flow-enabled pages that will never be seen and are constantly reset.

Clearly we need some way for API clients to tell if a page is Flow-enabled (legoktm comments "probably easiest if we just stick it in the page_props table", but for bot writers who don't update code to check this, what's the right behavior?


Version: master
Severity: enhancement

Details

Reference
bz60808

Event Timeline

bzimport raised the priority of this task from to Medium.Nov 22 2014, 2:51 AM
bzimport set Reference to bz60808.
bzimport added a subscriber: Unknown Object (MLST).

In the situation as described, yes, the API edit should be failed via the appropriate hooks.

You should probably use both APIEditBeforeSave and PageContentSave, the former to give a useful error message to API clients and the latter to catch any other code paths (e.g. Extension:TranslationNotifications) that might try to write to a page.

It would be really nice to have some sort of graceful fallback for some things.

Could action=edit&section=new create a new topic?

It wouldn't really be unexpected behavior, and just that would take care of the majority of bots that edit talk pages (assuming they're using that and not creating the section themselves).

https://www.mediawiki.org/wiki/Talk:Flow/Architecture/API#enwiki_bots_that_edit_talk_pages

(In reply to comment #2)

It would be really nice to have some sort of graceful fallback for some
things.

Could action=edit&section=new create a new topic?

That's bug 57989 :)

  • Bug 60861 has been marked as a duplicate of this bug. ***

This still seems to be a problem. When I attempt this via the API it still reports success.

{

"edit": {
    "result": "Success",
    "pageid": 13955,
    "title": "Talk:Flow QA",
    "contentmodel": "flow-board",
    "oldrevid": 110241,
    "newrevid": 127251,
    "newtimestamp": "2014-09-08T11:16:06Z"
}

}

It doesn't seem to cause much damage though so updating with enhancement request and easy tag since should be a good volunteer task to work on.

This still seems to be a problem. When I attempt [action=edit] via the API it still reports success.

action=edit should fail because the wikitext you supply isn't application/json, and even if you do supply a chunk of JSON it should probably fail because there's almost no meaning to editing the revision content of a Flow board -- the actual board content lives in an external DB. (FYI the page revision content of a Flow board is something like {"flow-workflow":"rgv57c2vecergvei"} as you can see from Special:Export or an API query.)

However, there are requests to make action=edit&section=new add a new topic (T59989), and to make action=edit&appendtext=foo append to the Flow board header (T85197).

If you specify contentmodel=wikitext along with the new text then you're attempting to change the Flow board's contentmodel. If the wiki is not configured with $wgContentHandlerUseDB then this correctly fails with "Exception Caught: Can't save non-default content model with $wgContentHandlerUseDB disabled: model is wikitext," If $wgContentHandlerUseDB is true (see T51193) then it should also fail unless you have the editcontentmodel right and maybe the flow-create-board right, and maybe not even then (see T78634).

Mattflaschen-WMF renamed this task from Flow: API actions succeed on Flow-enabled page to Flow: Core API actions succeed on Flow-enabled page.Jun 19 2015, 12:27 AM
Mattflaschen-WMF set Security to None.

This is fixed. I tested multiple places, in production and elsewhere, and consistently get no-direct-editing. Using standard content models probably fixed it.

E.g.:

mw.loader.using( 'mediawiki.api.edit' ).done( function () { var api = new mw.Api(); api.postWithToken( 'edit', {action: 'edit', title: 'User talk:Mattflaschen-WMF', appendtext: 'Foo bar' } ).fail( function () { console.log( arguments ); } ); } );

Arguments { 0: "no-direct-editing", 1: Object, 2: Object, 3: Object, 2 more… }