Last modified: 2014-02-12 13:17:21 UTC

Wikimedia Bugzilla is closed!

Wikimedia migrated from Bugzilla to Phabricator. Bug reports are handled in Wikimedia Phabricator.
This static website is read-only and for historical purposes. It is not possible to log in and except for displaying bug reports and their history, links might be broken. See T62758, the corresponding Phabricator task for complete and up-to-date bug report information.
Bug 60758 - mw.message output formats other than plain allowing unintended behaviors
mw.message output formats other than plain allowing unintended behaviors
Status: RESOLVED FIXED
Product: MediaWiki extensions
Classification: Unclassified
Scribunto (Other open bugs)
unspecified
All All
: Unprioritized normal (vote)
: ---
Assigned To: Nobody - You can work on this!
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2014-02-03 13:36 UTC by Jackmcbarn
Modified: 2014-02-12 13:17 UTC (History)
4 users (show)

See Also:
Web browser: ---
Mobile Platform: ---
Assignee Huggle Beta Tester: ---


Attachments

Description Jackmcbarn 2014-02-03 13:36:35 UTC
Using mw.message.newRawMessage allows performing several actions that are otherwise disabled because they break things, such as checking if a page exists without incrementing the expensive function count or adding a pagelink (see https://en.wikipedia.org/wiki/Wikipedia_talk:Lua#Ifexist_alternative for more), and for getting Wikidata properties of pages other than the current one, which also won't be updated properly (see https://en.wikipedia.org/wiki/Wikipedia_talk:Lua#.22Hacking.22_into_Wikidata_to_get_properties_of_miscellaneous_articles for more). Is there some way that newRawMessage could be tweaked to either not allow this type of thing at all, or to make it happen properly?
Comment 1 Brad Jorsch 2014-02-03 15:10:26 UTC
The problem is that it's not happening in Scribunto, it's the underlying Message classes that are doing this.

The ideal thing to do might be to remove mw.message:parse, mw.message:parseAsBlock, mw.message:text, and mw.message:escaped. mw.message:plain would continue to be available; this is the equivalent of the {{int:}} magic word.
Comment 2 Brad Jorsch 2014-02-03 15:11:10 UTC
Also note it's not just RawMessage, someone with editinterface could put the same problematic things in the MediaWiki namespace and use it that way.
Comment 3 Gerrit Notification Bot 2014-02-03 20:10:49 UTC
Change 110983 had a related patch set uploaded by Jackmcbarn:
Remove message formats other than plain

https://gerrit.wikimedia.org/r/110983
Comment 4 Gerrit Notification Bot 2014-02-06 17:01:03 UTC
Change 110983 merged by jenkins-bot:
Remove message formats other than plain

https://gerrit.wikimedia.org/r/110983
Comment 5 Brad Jorsch 2014-02-06 17:04:44 UTC
The change will be deployed to WMF wikis with 1.23wmf14, see https://www.mediawiki.org/wiki/MediaWiki_1.23/Roadmap for the schedule.

Note You need to log in before you can comment on or make changes to this bug.


Navigation
Links