Last modified: 2014-11-18 18:07:15 UTC
Viewing [[Special:Unreviewedpages]] and [[Special:OldReviewedpages]] requires the 'unreviewedpages' user right. I think most of the information on those pages should not be restricted - everything except the watchlist data is publicly accessible through other pages anyway, and the ability to view which pages are sighted slower helps identifying bias and increasing transparency. Public watchlist data, however, could be sort of a security problem, as it could be used by a clever vandal to identify easy targets (not to mention the privacy implications). There should exist separate rights to view these two special pages, and to see watchlist data when viewing them - the already existing 'unwatchedpages' could be used for the latter. (Personally, I would give unreviewedpages right by default to all autoconfirmed users, at the very least, but that is not the point of this request.)
Did oldreviewedpages in r46088, not sure about unreviewedpages. Still gives a list of easier vandal targets.
(In reply to comment #1) > Did oldreviewedpages in r46088, not sure about unreviewedpages. Still gives a > list of easier vandal targets. > Closed.
Isn't the API properly coupled? Although [[de:Special:Oldreviewedpages]] works, http://de.wikipedia.org/w/api.php?action=query&list=oldreviewedpages&ornamespace=0 gives the following error: <error code="orpermissiondenied" info="You need the unreviewedpages right to request the list of old reviewed pages." xml:space="preserve"> Re-opening or new bug?
Adding Roan Kattouw, as comment #3 is an API issue.
(In reply to comment #3) > Isn't the API properly coupled? > Although [[de:Special:Oldreviewedpages]] works, > http://de.wikipedia.org/w/api.php?action=query&list=oldreviewedpages&ornamespace=0 > gives the following error: > > <error code="orpermissiondenied" info="You need the unreviewedpages right to > request the list of old reviewed pages." xml:space="preserve"> > > Re-opening or new bug? > The API module does its own permissions checks. It should be easy enough to remove the general permissions check and add one for the watchlist stuff. Added comment in Code Review (I'd do it myself, but I'm busy :( )
API changed in r54972
