Last modified: 2014-07-07 19:06:28 UTC
As discussed at https://en.wikipedia.org/wiki/User_talk:Sage_Ross_%28WMF%29/sandbox, tour is not allowed as a special page parameter when redirecting. This is particularly useful for Special:MyPage. However, there is one hook, RedirectSpecialArticleRedirectParams, that controls this for all special pages. Adding 'tour' should not pose a security problem, since tour JavaScript is limited to the MW namespace and extension code, which are only modifiable by trusted users.
This would be especially useful to me, as I'd like to include a guidedtour link to Special:MyPage as part of the Wikipedia:Training pages. Users really want to see some interactive practice editing as part of the training, and I'm waiting on this before trying to incorporate it into the trainings.
Done in https://gerrit.wikimedia.org/r/#/c/55445/, pending review.
Merged.
This is not working for https://pt.wikipedia.org/wiki/Special:MyContributions?tour=foo but it works for https://pt.wikipedia.org/wiki/Special:MyPage?tour=contribs
Ping
I've added this to our Trello. The issue is that, "there is one hook, RedirectSpecialArticleRedirectParams, that controls this for all special pages" was not correct. RedirectSpecialArticleRedirectParams only affects redirects to "Articles". However, the definition of Article in core is basically any real (non-special page). That still doesn't include Special:Contributions, which is the issue. This may need a new hook added to core, and it needs security review to make sure tours don't run on the login or create account pages.
Sam, I think adding a new hook in SpecialRedirectToSpecial (as you suggested on IRC) should be fine. The alternative would be to add it to RedirectSpecialPage (the parent class), but SpecialRedirectToSpecial is the more granular approach (it can be RedirectSpecialArticle, SpecialRedirectToSpecial, both, or neither). The starting array (to be modified by the hook) should be the one passed to the SpecialRedirectToSpecial constructor ($allowedRedirectParams). Also, it should probably pass $this to the hook (as the first parameter), so the listener can optionally vary its behavior depending on the special page (e.g. $this->mName). It should be safe for GuidedTour, since there is already the $isUserJsAllowed check in GuidedTourHooks.php, but this should be tested.
