Last modified: 2012-12-13 11:17:20 UTC
MediaWiki supports different levels of page protected. We should make sure this protection is applied to changes to wikidata items. If Title::userCan() is used everywhere to check access before any modifications are applied, this *should* be sufficient, as that is supposed to check page protection too. It's a bit unclear to me on what level the checks should be performed. Probably, the API should check, and perhaps Item::save should check again. There should also be unit tests checking that user permissions and page protection are working.
Changed isAllowed with userCan, but it seems like the page is a bit overly protective as a blocked user can't see the content at all. Perhaps its only my setup?
Approx idea for permissions/protections is that page protection and user blocking forms a lower bound on protecting page content with "userCan", and a more fine grained permission is built on top of that with "isAllowed". For now individual calls to content changing calls to the API is guarded, but later individual fields could be protected if necessary.
Blocked users should be able to read, unless the wiki is private (reading is not allowed for anons) and wgBlockDisablesLogin is set. Please compare the behavior for item pages to the behavior for wikitext pages. It should be the same wrt blocking/protection.
Note: ItemViewAction needs to return false from requiresUnblock(), otherwise blocked users can't view. Maybe ItemViewAction should just extend ViewAction? Will look at this in the context of bug 37682.
Created attachment 10796 [details] Screendump showing the effect of the block message on the page display.
Changes in patchset https://gerrit.wikimedia.org/r/#/c/12907/
Write tests for this.
