Last modified: 2007-12-04 23:11:43 UTC

Wikimedia Bugzilla is closed!

Wikimedia has migrated from Bugzilla to Phabricator. Bug reports should be created and updated in Wikimedia Phabricator instead. Please create an account in Phabricator and add your Bugzilla email address to it.
Wikimedia Bugzilla is read-only. If you try to edit or create any bug report in Bugzilla you will be shown an intentional error message.
In order to access the Phabricator task corresponding to a Bugzilla report, just remove "static-" from its URL.
You could still run searches in Bugzilla or access your list of votes but bug reports will obviously not be up-to-date in Bugzilla.
Bug 12195 - Deleted revisions permission scheme is wacky
Deleted revisions permission scheme is wacky
Product: MediaWiki
Classification: Unclassified
General/Unknown (Other open bugs)
All All
: Normal enhancement (vote)
: ---
Assigned To: Nobody - You can work on this!
Depends on:
  Show dependency treegraph
Reported: 2007-12-04 15:21 UTC by Roan Kattouw
Modified: 2007-12-04 23:11 UTC (History)
3 users (show)

See Also:
Web browser: ---
Mobile Platform: ---
Assignee Huggle Beta Tester: ---


Description Roan Kattouw 2007-12-04 15:21:26 UTC
Some research shows that the following restrictions are enforced:

1. To delete pages, the 'delete' right is required (that's logical)
2. To view deleted revision metadata (timestamps, comments, users), the 'deletedhistory' right is required (also makes sense)
3. To view deleted revision *content*, the 'delete' right is required (?!?)
4. To restore deleted revisions, the 'delete' right is also required (also wacky).

IMO, the following should happen:
- A separate 'undelete' right should be created
- Viewing deleted revisions, *including content*, should be possible with the 'deletedhistory' right
- Restoring them should be possible with the 'undelete' right

One could argue that being able to view deleted revision content is just a copy+paste away from being able to restore them. Alternatively, 'deletedhistory' and 'undelete' could be merged.

Either way, the situation as it is now (undeletion requiring the 'delete' right) doesn't make sense.
Comment 1 Rotem Liss 2007-12-04 15:41:21 UTC
"deletedhistory" right should not be changed to include the content, as it breaks backwards compatibility and may grant the users permissions they are intended to get. It is possible to have a "viewdeletedcontent" right.

Splitting the "delete" permission to "delete" (for deletions) and "undelete" (for restorations and viewing deleted content) makes sense.

Merging "deletedhistory" and "undelete" doesn't make sense, as it means an all-or-nothing situation: Either you can do everything with deleted content, or you can do nothing. However, the current "deletedhistory" permission is much more harmless than the merged one: Just viewing the information about deleted revisions, conveniently viewing the deletion log and matching it to the versions. It only means summaries cannot be hidden. This right was even granted to all the users by default for some months. Viewing the actual content may be problematic in case of copyvios, but viewing the information is generally harmless.
Comment 2 Roan Kattouw 2007-12-04 15:43:07 UTC
(In reply to comment #1)
> Merging "deletedhistory" and "undelete" doesn't make sense, as it means an
> all-or-nothing situation
True, some people will want to retain the current metadata/content split.
Comment 3 Roan Kattouw 2007-12-04 20:34:22 UTC
I split off the 'undelete' right from the 'delete' right in r28151.

Note You need to log in before you can comment on or make changes to this bug.