No cascade protection on Mediawiki namespace

classic Classic list List threaded Threaded
9 messages Options
Reply | Threaded
Open this post in threaded view
|

No cascade protection on Mediawiki namespace

Techman224-3
Right now the MediaWiki namespace is protected from editing. However, if you add a template to a Mediawiki message and the template is unprotected, any user could edit the message by editing the template, creating a backdoor. There is no option to cascade protect MediaWiki messages on wiki, and there is no function in the MediaWiki software to cascade protect an entire namespace. Should this be fixed?

Techman224
_______________________________________________
Wikitech-l mailing list
[hidden email]
https://lists.wikimedia.org/mailman/listinfo/wikitech-l
Reply | Threaded
Open this post in threaded view
|

Re: No cascade protection on Mediawiki namespace

Tyler Romeo
This sounds like an issue. If others agree, I could work on this.
On Apr 20, 2013 1:09 AM, "Techman224" <[hidden email]> wrote:

> Right now the MediaWiki namespace is protected from editing. However, if
> you add a template to a Mediawiki message and the template is unprotected,
> any user could edit the message by editing the template, creating a
> backdoor. There is no option to cascade protect MediaWiki messages on wiki,
> and there is no function in the MediaWiki software to cascade protect an
> entire namespace. Should this be fixed?
>
> Techman224
> _______________________________________________
> Wikitech-l mailing list
> [hidden email]
> https://lists.wikimedia.org/mailman/listinfo/wikitech-l
_______________________________________________
Wikitech-l mailing list
[hidden email]
https://lists.wikimedia.org/mailman/listinfo/wikitech-l
Reply | Threaded
Open this post in threaded view
|

Re: No cascade protection on Mediawiki namespace

K. Peachey-2
Why not just protect the template when you add it? I think you may be
over thinking this just a tad.

_______________________________________________
Wikitech-l mailing list
[hidden email]
https://lists.wikimedia.org/mailman/listinfo/wikitech-l
Reply | Threaded
Open this post in threaded view
|

Re: No cascade protection on Mediawiki namespace

Mormegil
In reply to this post by Techman224-3
On 20 April 2013 07:08, Techman224 <[hidden email]> wrote:

> Right now the MediaWiki namespace is protected from editing. However, if
> you add a template to a Mediawiki message and the template is unprotected,
> any user could edit the message by editing the template, creating a
> backdoor.
>

Ummm... Don't do that, then? Sometimes you _want_ to include pieces of text
editable by more than just sysops (say, by autoconfirmed users), so you use
a template from a MediaWiki message. (Cf. e.g.
https://cs.wikipedia.org/wiki/MediaWiki:Recentchangestext and
https://cs.wikipedia.org/wiki/%C5%A0ablona:Ozn%C3%A1men%C3%ADRC.) Or, you
do not want to do that, then why are you using an unprotected template?
Either transclude another page in MediaWiki namespace as a template
({{MediaWiki:Something}}), or make sure you protect the used template (with
possible cascade).

-- [[cs:User:Mormegil | Petr Kadlec]]
_______________________________________________
Wikitech-l mailing list
[hidden email]
https://lists.wikimedia.org/mailman/listinfo/wikitech-l
Reply | Threaded
Open this post in threaded view
|

Re: No cascade protection on Mediawiki namespace

Techman224-3
Some people are not aware of this, and they use templates to style Mediawiki messages. If the administrator forgets to protect the template, it opens up a backdoor for other users to edit the message.

Techman224

On 2013-04-20, at 4:25 AM, Petr Kadlec <[hidden email]> wrote:

> On 20 April 2013 07:08, Techman224 <[hidden email]> wrote:
>
>> Right now the MediaWiki namespace is protected from editing. However, if
>> you add a template to a Mediawiki message and the template is unprotected,
>> any user could edit the message by editing the template, creating a
>> backdoor.
>>
>
> Ummm... Don't do that, then? Sometimes you _want_ to include pieces of text
> editable by more than just sysops (say, by autoconfirmed users), so you use
> a template from a MediaWiki message. (Cf. e.g.
> https://cs.wikipedia.org/wiki/MediaWiki:Recentchangestext and
> https://cs.wikipedia.org/wiki/%C5%A0ablona:Ozn%C3%A1men%C3%ADRC.) Or, you
> do not want to do that, then why are you using an unprotected template?
> Either transclude another page in MediaWiki namespace as a template
> ({{MediaWiki:Something}}), or make sure you protect the used template (with
> possible cascade).
>
> -- [[cs:User:Mormegil | Petr Kadlec]]
> _______________________________________________
> Wikitech-l mailing list
> [hidden email]
> https://lists.wikimedia.org/mailman/listinfo/wikitech-l


_______________________________________________
Wikitech-l mailing list
[hidden email]
https://lists.wikimedia.org/mailman/listinfo/wikitech-l
Reply | Threaded
Open this post in threaded view
|

Re: No cascade protection on Mediawiki namespace

James Forrester-2
On 20 April 2013 10:07, Techman224 <[hidden email]> wrote:
> Some people are not aware of this, and they use templates to style
> Mediawiki messages. If the administrator forgets to protect the
> template, it opens up a backdoor for other users to edit the
> message.

Incompetent sysops are a community problem; you can't usefully deal
with these kind of issues in software. :-)

The English Wikipedia, for one, uses this feature intentionally to
allow page-specific edit notices; they are transcluded (via a number
of templates, yay fun) into the MediaWiki:Editnotice-0 etc. items on a
per-page basis. The general namespace templates and page-specific
transclusion templates are protected, but more from the "this is a
major template that could break things" perspective.

J.
--
James D. Forrester
[hidden email]
[[Wikipedia:User:Jdforrester|James F.]] (speaking purely in a personal capacity)

_______________________________________________
Wikitech-l mailing list
[hidden email]
https://lists.wikimedia.org/mailman/listinfo/wikitech-l
Reply | Threaded
Open this post in threaded view
|

Re: No cascade protection on Mediawiki namespace

Brian Wolff
In reply to this post by Techman224-3
Mw namespace pages that expand templates generally arent the scary ones
from an anon editing prespective. I don't think this is really neccesary,
and can mostly be dealt with socially when needed.

-bawolff

P.s. $5 says someone will probably come up with an exception with in 10
seconds of me making such a statement.

On 2013-04-20 2:08 PM, "Techman224" <[hidden email]> wrote:
>
> Some people are not aware of this, and they use templates to style
Mediawiki messages. If the administrator forgets to protect the template,
it opens up a backdoor for other users to edit the message.
>
> Techman224
>
> On 2013-04-20, at 4:25 AM, Petr Kadlec <[hidden email]> wrote:
>
> > On 20 April 2013 07:08, Techman224 <[hidden email]> wrote:
> >
> >> Right now the MediaWiki namespace is protected from editing. However,
if
> >> you add a template to a Mediawiki message and the template is
unprotected,
> >> any user could edit the message by editing the template, creating a
> >> backdoor.
> >>
> >
> > Ummm... Don't do that, then? Sometimes you _want_ to include pieces of
text
> > editable by more than just sysops (say, by autoconfirmed users), so you
use
> > a template from a MediaWiki message. (Cf. e.g.
> > https://cs.wikipedia.org/wiki/MediaWiki:Recentchangestext and
> > https://cs.wikipedia.org/wiki/%C5%A0ablona:Ozn%C3%A1men%C3%ADRC.) Or,
you
> > do not want to do that, then why are you using an unprotected template?
> > Either transclude another page in MediaWiki namespace as a template
> > ({{MediaWiki:Something}}), or make sure you protect the used template
(with

> > possible cascade).
> >
> > -- [[cs:User:Mormegil | Petr Kadlec]]
> > _______________________________________________
> > Wikitech-l mailing list
> > [hidden email]
> > https://lists.wikimedia.org/mailman/listinfo/wikitech-l
>
>
> _______________________________________________
> Wikitech-l mailing list
> [hidden email]
> https://lists.wikimedia.org/mailman/listinfo/wikitech-l
_______________________________________________
Wikitech-l mailing list
[hidden email]
https://lists.wikimedia.org/mailman/listinfo/wikitech-l
Reply | Threaded
Open this post in threaded view
|

Re: No cascade protection on Mediawiki namespace

Tyler Romeo
Even ignoring the original problem, we have wgNamespaceProtection, wouldn't
it make sense to have wgNamespaceCascadingProtection?

*-- *
*Tyler Romeo*
Stevens Institute of Technology, Class of 2015
Major in Computer Science
www.whizkidztech.com | [hidden email]


On Sat, Apr 20, 2013 at 3:42 PM, Brian Wolff <[hidden email]> wrote:

> Mw namespace pages that expand templates generally arent the scary ones
> from an anon editing prespective. I don't think this is really neccesary,
> and can mostly be dealt with socially when needed.
>
> -bawolff
>
> P.s. $5 says someone will probably come up with an exception with in 10
> seconds of me making such a statement.
>
> On 2013-04-20 2:08 PM, "Techman224" <[hidden email]> wrote:
> >
> > Some people are not aware of this, and they use templates to style
> Mediawiki messages. If the administrator forgets to protect the template,
> it opens up a backdoor for other users to edit the message.
> >
> > Techman224
> >
> > On 2013-04-20, at 4:25 AM, Petr Kadlec <[hidden email]> wrote:
> >
> > > On 20 April 2013 07:08, Techman224 <[hidden email]> wrote:
> > >
> > >> Right now the MediaWiki namespace is protected from editing. However,
> if
> > >> you add a template to a Mediawiki message and the template is
> unprotected,
> > >> any user could edit the message by editing the template, creating a
> > >> backdoor.
> > >>
> > >
> > > Ummm... Don't do that, then? Sometimes you _want_ to include pieces of
> text
> > > editable by more than just sysops (say, by autoconfirmed users), so you
> use
> > > a template from a MediaWiki message. (Cf. e.g.
> > > https://cs.wikipedia.org/wiki/MediaWiki:Recentchangestext and
> > > https://cs.wikipedia.org/wiki/%C5%A0ablona:Ozn%C3%A1men%C3%ADRC.) Or,
> you
> > > do not want to do that, then why are you using an unprotected template?
> > > Either transclude another page in MediaWiki namespace as a template
> > > ({{MediaWiki:Something}}), or make sure you protect the used template
> (with
> > > possible cascade).
> > >
> > > -- [[cs:User:Mormegil | Petr Kadlec]]
> > > _______________________________________________
> > > Wikitech-l mailing list
> > > [hidden email]
> > > https://lists.wikimedia.org/mailman/listinfo/wikitech-l
> >
> >
> > _______________________________________________
> > Wikitech-l mailing list
> > [hidden email]
> > https://lists.wikimedia.org/mailman/listinfo/wikitech-l
> _______________________________________________
> Wikitech-l mailing list
> [hidden email]
> https://lists.wikimedia.org/mailman/listinfo/wikitech-l
>
_______________________________________________
Wikitech-l mailing list
[hidden email]
https://lists.wikimedia.org/mailman/listinfo/wikitech-l
Reply | Threaded
Open this post in threaded view
|

Re: No cascade protection on Mediawiki namespace

Techman224-3
It would have to be dependant on wgNamespaceProtection being set, else anyone could protect any page using transclusion.

Techman224

On 2013-04-20, at 6:17 PM, Tyler Romeo <[hidden email]> wrote:

> Even ignoring the original problem, we have wgNamespaceProtection, wouldn't
> it make sense to have wgNamespaceCascadingProtection?
>
> *-- *
> *Tyler Romeo*
> Stevens Institute of Technology, Class of 2015
> Major in Computer Science
> www.whizkidztech.com | [hidden email]
>
>
> On Sat, Apr 20, 2013 at 3:42 PM, Brian Wolff <[hidden email]> wrote:
>
>> Mw namespace pages that expand templates generally arent the scary ones
>> from an anon editing prespective. I don't think this is really neccesary,
>> and can mostly be dealt with socially when needed.
>>
>> -bawolff
>>
>> P.s. $5 says someone will probably come up with an exception with in 10
>> seconds of me making such a statement.
>>
>> On 2013-04-20 2:08 PM, "Techman224" <[hidden email]> wrote:
>>>
>>> Some people are not aware of this, and they use templates to style
>> Mediawiki messages. If the administrator forgets to protect the template,
>> it opens up a backdoor for other users to edit the message.
>>>
>>> Techman224
>>>
>>> On 2013-04-20, at 4:25 AM, Petr Kadlec <[hidden email]> wrote:
>>>
>>>> On 20 April 2013 07:08, Techman224 <[hidden email]> wrote:
>>>>
>>>>> Right now the MediaWiki namespace is protected from editing. However,
>> if
>>>>> you add a template to a Mediawiki message and the template is
>> unprotected,
>>>>> any user could edit the message by editing the template, creating a
>>>>> backdoor.
>>>>>
>>>>
>>>> Ummm... Don't do that, then? Sometimes you _want_ to include pieces of
>> text
>>>> editable by more than just sysops (say, by autoconfirmed users), so you
>> use
>>>> a template from a MediaWiki message. (Cf. e.g.
>>>> https://cs.wikipedia.org/wiki/MediaWiki:Recentchangestext and
>>>> https://cs.wikipedia.org/wiki/%C5%A0ablona:Ozn%C3%A1men%C3%ADRC.) Or,
>> you
>>>> do not want to do that, then why are you using an unprotected template?
>>>> Either transclude another page in MediaWiki namespace as a template
>>>> ({{MediaWiki:Something}}), or make sure you protect the used template
>> (with
>>>> possible cascade).
>>>>
>>>> -- [[cs:User:Mormegil | Petr Kadlec]]
>>>> _______________________________________________
>>>> Wikitech-l mailing list
>>>> [hidden email]
>>>> https://lists.wikimedia.org/mailman/listinfo/wikitech-l
>>>
>>>
>>> _______________________________________________
>>> Wikitech-l mailing list
>>> [hidden email]
>>> https://lists.wikimedia.org/mailman/listinfo/wikitech-l
>> _______________________________________________
>> Wikitech-l mailing list
>> [hidden email]
>> https://lists.wikimedia.org/mailman/listinfo/wikitech-l
>>
> _______________________________________________
> Wikitech-l mailing list
> [hidden email]
> https://lists.wikimedia.org/mailman/listinfo/wikitech-l


_______________________________________________
Wikitech-l mailing list
[hidden email]
https://lists.wikimedia.org/mailman/listinfo/wikitech-l