Cascading protection doesn't apply to transcluded file description pages
Closed, ResolvedPublicBUG REPORT
Actions

Assigned To

Authored By

	Jackmcbarn
	Jan 15 2014, 9:56 PM

Description

If a cascading-protected page transcludes a file description page (without displaying the corresponding file, if any), the file description page will not inherit cascading protection, although anything transcluded from the file description page (except other file description pages) will properly inherit the protection.

Version: 1.23.0
Severity: minor

Details

Reference: bz60109

Related Changes in Gerrit:

Subject	Repo	Branch	Lines +/-
PermissionManager: Differentiate between cascading protection of file content and file pages	mediawiki/core	REL1_39	+265 -56
PermissionManager: Differentiate between cascading protection of file content and file pages	mediawiki/core	REL1_42	+256 -56
PermissionManager: Differentiate between cascading protection of file content and file pages	mediawiki/core	REL1_43	+247 -56
PermissionManager: Differentiate between cascading protection of file content and file pages	mediawiki/core	master	+252 -56
Protection: Rework on how cascade-protection are applied to files	mediawiki/core	master	+80 -41

Customize query in gerrit

Related Objects

Mentioned In: T140010: CVE-2025-32697: Cascading protection is not preventing file reversions
T24521: Cascade-protecting files should protect the file, not the description page

Event Timeline

• bzimport raised the priority of this task from to Low.Nov 22 2014, 2:57 AM

• bzimport added a project: MediaWiki-Page-protection.

• bzimport set Reference to bz60109.

• bzimport added a subscriber: Unknown Object (MLST).

Jackmcbarn created this task.Jan 15 2014, 9:56 PM

zhuyifei1999 mentioned this in T24521: Cascade-protecting files should protect the file, not the description page.Aug 18 2015, 2:25 PM

Change 233207 had a related patch set uploaded (by Zhuyifei1999):
Cascade-protection: Fixes for files

https://gerrit.wikimedia.org/r/233207

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptAug 23 2015, 1:57 PM

gerritbot added a project: Patch-For-Review.Aug 23 2015, 1:57 PM

Krenair subscribed.Aug 23 2015, 3:14 PM

zhuyifei1999 mentioned this in T140010: CVE-2025-32697: Cascading protection is not preventing file reversions.Jul 12 2016, 8:41 PM

Change 233207 abandoned by Zhuyifei1999:
Protection: Rework on how cascade-protection are applied to files

Reason:
I currently have no interest to fix this any time soon. If anyone else wish to work on this, feel free to restore.

https://gerrit.wikimedia.org/r/233207

Anomie merged a task: T241453: Cascading protection doesn't apply to transcluded files.Jan 6 2020, 8:02 PM

Anomie added subscribers: DannyS712, Tgr.

Maintenance_bot removed a project: Patch-For-Review.Jan 6 2020, 8:12 PM

Izno moved this task from Backlog to Cascade on the MediaWiki-Page-protection board.Jan 7 2021, 10:54 PM

putnik subscribed.Apr 5 2021, 3:46 PM

ExE-Boss subscribed.Aug 6 2021, 3:10 PM

ExE-Boss changed the subtype of this task from "Task" to "Bug Report".Aug 25 2021, 3:23 AM

Tacsipacsi subscribed.Jan 19 2025, 5:47 PM

Change #1112359 had a related patch set uploaded (by Dylsss; author: Dylsss):

[mediawiki/core@master] PermissionManager: Cascade protect file content, not wikitext

https://gerrit.wikimedia.org/r/1112359

gerritbot added a project: Patch-For-Review.Jan 19 2025, 8:59 PM

matmarex subscribed.Feb 14 2025, 10:50 PM

Change #1112359 merged by jenkins-bot:

[mediawiki/core@master] PermissionManager: Differentiate between cascading protection of file content and file pages

https://gerrit.wikimedia.org/r/1112359

Maintenance_bot removed a project: Patch-For-Review.Feb 14 2025, 11:30 PM

matmarex added a project: MediaWiki-Platform-Team.Feb 15 2025, 1:44 AM

• larissagaulia moved this task from Inbox, needs triage to In progress on the MediaWiki-Platform-Team board.Feb 17 2025, 3:38 PM

I added a draft entry for this and other recent work on cascading protection and file uploads to the Tech News for the week after next (so that we have some more time to discuss and edit them, as these changes are difficult to explain with brevity): https://meta.wikimedia.org/wiki/Tech/News/2025/10

matmarex closed this task as Resolved.Feb 21 2025, 3:53 PM

matmarex claimed this task.

Quiddity moved this task from To Triage to Announce in next Tech/News on the User-notice board.Feb 21 2025, 9:11 PM

Quiddity moved this task from Announce in next Tech/News to In current Tech/News draft on the User-notice board.Feb 27 2025, 12:25 AM

Pppery moved this task from In current Tech/News draft to Already announced/Archive on the User-notice board.Mar 22 2025, 7:31 PM

Change #1130586 had a related patch set uploaded (by Reedy; author: Dylsss):

[mediawiki/core@REL1_43] PermissionManager: Differentiate between cascading protection of file content and file pages

https://gerrit.wikimedia.org/r/1130586

Change #1130587 had a related patch set uploaded (by Reedy; author: Dylsss):

[mediawiki/core@REL1_42] PermissionManager: Differentiate between cascading protection of file content and file pages

https://gerrit.wikimedia.org/r/1130587

Change #1130588 had a related patch set uploaded (by Reedy; author: Dylsss):

[mediawiki/core@REL1_39] PermissionManager: Differentiate between cascading protection of file content and file pages

https://gerrit.wikimedia.org/r/1130588

Change #1130586 merged by jenkins-bot:

[mediawiki/core@REL1_43] PermissionManager: Differentiate between cascading protection of file content and file pages

https://gerrit.wikimedia.org/r/1130586

Change #1130587 merged by jenkins-bot:

[mediawiki/core@REL1_42] PermissionManager: Differentiate between cascading protection of file content and file pages

https://gerrit.wikimedia.org/r/1130587

Maintenance_bot edited projects, added User-notice-archive; removed User-notice.Apr 3 2025, 2:33 PM

Change #1130588 abandoned by Reedy:

[mediawiki/core@REL1_39] PermissionManager: Differentiate between cascading protection of file content and file pages

Reason:

Complexity and duplication...