Maniphest T301928

It is not possible to view a deleted/suppressed log entry when the user is missing the deleterevision permission
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	Zabe
	Feb 16 2022, 11:08 PM

Description

It was reported within the OC that a member was not capable of viewing a suppressed log entry via the onwiki interface although they have the required permissions.

https://meta.wikimedia.org/w/index.php?title=Special:Log&logid=45519433 is a random revision deleted log entry.

But hitting the '(show)' button results in the following.

missing_permission.png (328×899 px, 31 KB)

This is due to Special:RevisionDelete requiring the deleterevision permission and there is no real technical implementation here which allows only viewing the log entry. It is possible to use the api, but that is quite uncomfortable.

Details

	Subject	Repo	Branch	Lines +/-
	Allow users with sufficient permissions to access Special:RevisionDelete	mediawiki/core	master	+8 -3
	Allow users with 'deletedhistory' to view Special:RevisionDelete	mediawiki/core	master	+1 -1

Customize query in gerrit

Related Objects

Mentioned In: T263297: browsearchive allows to see a deleted log entry but not to view its content
T128914: deleterevision alone does not provide any effective permission to the users
Mentioned Here: T128914: deleterevision alone does not provide any effective permission to the users

Event Timeline

Zabe created this task.Feb 16 2022, 11:08 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptFeb 16 2022, 11:08 PM

Ameisenigel subscribed.Feb 16 2022, 11:10 PM

Mykola7 subscribed.Feb 16 2022, 11:11 PM

Change 763373 had a related patch set uploaded (by Zabe; author: Zabe):

[mediawiki/core@master] Allow users with 'deletedhistory' view Special:RevisionDelete

https://gerrit.wikimedia.org/r/763373

gerritbot added a project: Patch-For-Review.Feb 16 2022, 11:42 PM

Apparently this is known, see the comments by Vogone on T128914.

Zabe mentioned this in T128914: deleterevision alone does not provide any effective permission to the users.Feb 16 2022, 11:51 PM

Faendalimas subscribed.Feb 17 2022, 3:40 AM

Faendalimas unsubscribed.

Faendalimas subscribed.

JJMC89 subscribed.Feb 17 2022, 4:32 AM

Viewing deleted log entries is closer to deletelogentry than deleterevision.
Ideally, there would be view-only versions like we have for viewsuppressed, which I think only works for suppressed revisions, not suppressed logs.

Change 763373 abandoned by Zabe:

[mediawiki/core@master] Allow users with 'deletedhistory' to view Special:RevisionDelete

Reason:

https://gerrit.wikimedia.org/r/763373

In T301928#7717148, @JJMC89 wrote:

Viewing deleted log entries is closer to deletelogentry than deleterevision.

The problem is actually far more fundamental, e.g. users with the deletelogentry can practically not delete log entries if they do not have the deleterevision permission since they can't access the special page, although they should be capable of doing so.

Ideally, there would be view-only versions like we have for viewsuppressed, which I think only works for suppressed revisions, not suppressed logs.

viewsuppressed is also the permission for suppressed revisions, suppressed log entries, etc. (see code). The only exception are hidden abuse log entries, for which you need the abusefilter-hidden-log permission.

Maintenance_bot removed a project: Patch-For-Review.Feb 17 2022, 12:10 PM

Change 763531 had a related patch set uploaded (by Zabe; author: Zabe):

[mediawiki/core@master] Allow users with sufficient permissions to access Special:RevisionDelete

https://gerrit.wikimedia.org/r/763531

gerritbot added a project: Patch-For-Review.Feb 17 2022, 3:12 PM