Last modified: 2014-05-10 16:01:24 UTC
On a wiki where you can export/import: 1) find on Special:ProtectedPages a message you can't edit, or ask someone to make one; 2) identify the group it belongs to and do a Special:Translate export in po format; 3) change something in the po file for that message; 4) upload the po translations in Special:ImportTranslations and confirm. I. Expected: the change is discarded. II. Observed: the edit goes through. III. Note: both TUX and the old translation editor (e.g. <https://meta.wikimedia.org/w/index.php?title=Special%3ATranslate&taction=proofread&group=Centralnotice-tgroup-B13_0701_txtpm_CntrlEnt_dr_enSG&language=qqq&limit=100&task=reviewall>) let me open the message for translation but then correctly fail with «Errore durante il salvataggio della traduzione: The "editprotected" right is required to edit this page».
Protected pages and translatable pages are fundamentally incompatible. Unmark a page for translation if you want to be able to protect it. This feature request will not be honored.
Siebrand, you may need to read more carefully: not the page, but a message is protected. I was told to file this bug by Niklas.
(In reply to comment #2) > a message is protected. Thank you for making the effort to file a bug, Federico. I think this makes it even more clear page protection and translatable pages are incompatible. Niklas telling you to file a bug is not relevant for the bug state.
The example page is from central notice translations, not translatable page.
(In reply to comment #1) > Protected pages and translatable pages are fundamentally incompatible. Shouldn't $title->userCan('edit') work on any type of page? This seems like a pretty large bug. Can you "import" a translation to overwrite a page in the MediaWiki namespace?
(In reply to comment #5) > Can you "import" a translation to overwrite a page in the MediaWiki > namespace? Needs testing on an appropriately configured wiki. On Meta (and most wikis) you can't make a MediaWiki page directly translatable and when a page doesn't belong to a message group any handcrafted po import will probably fail in way earlier stages.
Reopening. While I don't generally care about supporting protected pages with translation, it is not good to be able to bypass restrictions. There is is chance that in due time someone will use this together with some other vulnerability to do a nasty exploit.
Can/must be addressed by being stricter in or around allowProcess() in MessageWebImporter?
