Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fluff: Only add links if the user has necessary perms to edit the page #632

Merged

Conversation

Amorymeltzer
Copy link
Collaborator

@Amorymeltzer Amorymeltzer commented May 12, 2019

Closes #605. Basically, we need a way to check for ability to edit the covers both explicit (protection) and implicit (namespace and content model) restrictions.

Since we're on the page in question, diff and oldid (#562) can be handled together with mostly-accurate results by simply checking wgIsProbablyEditable. It won't handle cascading protection or TitleBlacklist restrictions, but neither does MediaWiki when choosing to display either "edit this page" or "view source"; being more accurate than the software would require an API check a la contributions (see following section as well as https://gerrit.wikimedia.org/r/c/mediawiki/core/+/65009).

contributions is the more complex interesting implementation, since we've got to check each and every page. Querying for edit in intestactions is excellent, because it covers all bases (i.e., it includes the "expensive" checks that wgIsProbablyEditable skips, hence Probably). I also restructured/split the contributions routine to avoid doing async and to look more Twinkley.

intestactions was added in MW 1.25 (https://www.mediawiki.org/wiki/MediaWiki_1.25) circa 2014-2015, and should probably be used more frequently by Twinkle, particularly in Morebits, as it's a more correct determiner of whether the user can edit (or move or protect or...) the page in question.

The first commit (remove redundant checks; better way of doing #630 aka e0f3d9c) is worth doing regardless.

@Amorymeltzer Amorymeltzer changed the title fluff: Only select pages on contribs with more than one revision, remove redundant checks fluff: Only add links if the user has necessary perms to edit the page May 12, 2019
@Amorymeltzer
Copy link
Collaborator Author

Amorymeltzer commented May 12, 2019

@MusikAnimal, Pinging you for a a look since you had thoughts on #562 aka #511. Despite delaying loading of links on Special:Contributions, I think this'd be a good addition. If you think it'd be worth it, we could add a query check before loading on diffs/oldid to be more accurate than the software, but diffs and old revisions can take long enough to load and the edge cases (cascading, TitleBlacklist) are comparatively infrequent.

cc @pppery

Copy link
Contributor

@pppery pppery left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't see any need to be "more accurate than the software" on diff/oldid pages.

modules/twinklefluff.js Outdated Show resolved Hide resolved
Closes wikimedia-gadgets#605.  Basically, we need a way to check for ability to edit the covers both explicit (protection) and implicit (namespace and content model) restrictions.

Since we're on the page in question, `diff` and `oldid` (wikimedia-gadgets#562) can be handled together with mostly-accurate results by simply checking `wgIsProbablyEditable`.  It won't handle cascading protection or TitleBlacklist restrictions, but neither does MediaWiki when choosing to display either "edit this page" or "view source"; being more accurate than the software would require an API check a la contributions (see following section as well as https://gerrit.wikimedia.org/r/c/mediawiki/core/+/65009).

`contributions` is the more <s>complex</s> interesting implementation, since we've got to check each and every page.  Querying for `edit` in `intestactions` is excellent, because it covers all bases (i.e., it includes the "expensive" checks that `wgIsProbablyEditable` skips, hence `Probably`).  I also restructured/split the contributions routine to avoid doing `async` and to look more Twinkley.

`intestactions` was added in MW 1.25 (https://www.mediawiki.org/wiki/MediaWiki_1.25) circa 2014-2015, and should probably be used more frequently by Twinkle, particularly in `Morebits`, as it's a more correct determiner of whether the user can edit (or move or protect or...) the page in question.
@siddharthvp
Copy link
Member

@Amorymeltzer I should probably have said earlier but I think this change was quite unnecessary. Can we revert this please? It slows down what I think is an already slow process of loading of rollback links on contribs pages. It would somewhat affect the work of RCP folks who are trying to revert vandalism fast.

Also there is this obvious bug that no rollback links show up on pages with >50 current revs, as intestactions supports only upto 50 titles. I imagine it would be possible to skip the tests in such a case, but it'd be quite tricky to code.

Easier option is to revert, as I don't see any major advantage out of this, that accounts for the additional delay in loading.

Or if this is that important, a better way to do this would be to show all rollback links at first, then silently do the API call and remove the rollback links on non-editable pages.

@Amorymeltzer
Copy link
Collaborator Author

sigh All fair points.

It slows down what I think is an already slow process of loading of rollback links on contribs pages. It would somewhat affect the work of RCP folks who are trying to revert vandalism fast.

This is what I was most worried about, but I don't think it's that much of a slowdown. My (admittedly inadequate) tests suggested it was noticeable but not significant, and split about halfway between the query and the each. I've got an old machine with a ton of user-loaded js so I generally find if it's not slow for me then it won't be for most users. Do you mind timing it out? I'm curious what you're seeing. Obviously this matters more for folks with larger contribs defaults (see below) but I'm not sure how frequent that is (although I'm one of them). Regardless, for faster machines/less weighed-down users, I guess the .each is quicker so the query would be the limiting step?

no rollback links show up on pages with >50 current revs, as intestactions supports only upto 50 titles

Yeah, no idea how I missed that. I tested on long contribs with my non-sysop alt, but I'm guessing my test users just didn't have enough unique pages edited at the time. This for me is a total dealbreaker, so I've partially reverted this (that is, just the contribs bit) on-wiki, where it was already raised on-wiki while we discuss. It should be possible to parse and break down the titles into discrete batches, but that's only going to make the above issue much worse.

show all rollback links at first, then silently do the API call and remove the rollback links on non-editable pages.

I really don't like lying to folks by showing these links, but I think that's worse. If it's noticeable enough to be an issue on their loading, users will certainly notice them leaving. Best-case scenario it's confusing, worst-case is zOMG I iz haxed.

Anyway, I think the best thing to do is basically what I did on-wiki: revert the contributions changes, leaving in the check on diffs. I think we can be smarter with auto(), covering it with the same wgIsProbablyEditable check, but that might be it.

@siddharthvp
Copy link
Member

I really don't like lying to folks by showing these links, but I think that's worse. If it's noticeable enough to be an issue on their loading, users will certainly notice them leaving. Best-case scenario it's confusing, worst-case is zOMG I iz haxed.

Disappearing of links will be noticeable, but I think that's ok. We can split the pagelist to batches of 50 (the limit is 50 for sysops too from what I read) and do the api calls after the links have been loaded. I really think this is the way to go.

I don't think this "lying" (for a few seconds, after we do the above) is an issue. Twinkle has been an extensively popular tool for reverting vandalism for 12 years, but how many times has anyone complained about this? Never, right?

Amorymeltzer added a commit to Amorymeltzer/twinkle that referenced this pull request Jun 6, 2019
…ally revert wikimedia-gadgets#632)

`intestactions` is limited to 50 unique pages for most users, so this would short-circuit otherwise.  See discussion in wikimedia-gadgets#632
@Amorymeltzer
Copy link
Collaborator Author

@siddharthvp I just merged #658, which undoes the relevant bit as you requested (also covers the case of auto() which I'd missed).

I'd be curious to see how it looks broken into batches, but I don't think it's urgent. I still think placing then removing links would be worse than the current/original situation.

The interface knows which pages are editable, or at least which pages are rollbackable, of which editable is one facet. I don't think it's explicitly exposed, though, but it'd be nice if it were.

Amorymeltzer added a commit to Amorymeltzer/twinkle that referenced this pull request May 13, 2020
…emove auto function

As far as I can tell, all the desired information is already available, thanks to some classes, so there should be no need to unnecessarily load a page.  The revert query itself should be able to handle the case where someone else has edited the page, so we don't really need the `auto` behavior now that we have the information ready.  The other loss is handling of pages that fail `wgIsProbablyEditable`, but this is manageable by making use of `intestactions=edit` (see also wikimedia-gadgets#632 and wikimedia-gadgets#658).  By not relying on auto-processing `twinklerevert` urls, we can prevent malicious providing of a link with `&twinklerevert=vand` to entice someone to revert something.  Low-profile, and I've never heard of it, but possible.

Given the above, `autorevert` has been removed in favor of a `skipTalk` item modified on contribs and recent changes to more appropriately represent what `openTalkPageOnAutoRevert` does.  That config is unfortunately named, but isn't visible so shouldn't be an issue beyond maintenance.
Amorymeltzer added a commit to Amorymeltzer/twinkle that referenced this pull request Jun 7, 2020
…emove auto function

As far as I can tell, all the desired information is already available, thanks to some classes, so there should be no need to unnecessarily load a page.  The revert query itself should be able to handle the case where someone else has edited the page, so we don't really need the `auto` behavior now that we have the information ready.  The other loss is handling of pages that fail `wgIsProbablyEditable`, but this is manageable by making use of `intestactions=edit` (see also wikimedia-gadgets#632 and wikimedia-gadgets#658).  By not relying on auto-processing `twinklerevert` urls, we can prevent malicious providing of a link with `&twinklerevert=vand` to entice someone to revert something.  Low-profile, and I've never heard of it, but possible.

Given the above, `autorevert` has been removed in favor of a `skipTalk` item modified on contribs and recent changes to more appropriately represent what `openTalkPageOnAutoRevert` does.  That config is unfortunately named, but isn't visible so shouldn't be an issue beyond maintenance.
Amorymeltzer added a commit to Amorymeltzer/twinkle that referenced this pull request Jun 7, 2020
…emove auto function

As far as I can tell, all the desired information is already available, thanks to some classes, so there should be no need to unnecessarily load a page.  The revert query itself should be able to handle the case where someone else has edited the page, so we don't really need the `auto` behavior now that we have the information ready.  The other loss is handling of pages that fail `wgIsProbablyEditable`, but this is manageable by making use of `intestactions=edit` (see also wikimedia-gadgets#632 and wikimedia-gadgets#658).  By not relying on auto-processing `twinklerevert` urls, we can prevent malicious providing of a link with `&twinklerevert=vand` to entice someone to revert something.  Low-profile, and I've never heard of it, but possible.

Given the above, `autorevert` has been removed in favor of a `skipTalk` item modified on contribs and recent changes to more appropriately represent what `openTalkPageOnAutoRevert` does.  That config is unfortunately named, but isn't visible so shouldn't be an issue beyond maintenance.
wiki-ST47 pushed a commit to wiki-ST47/twinkle that referenced this pull request Sep 2, 2020
…emove auto function

As far as I can tell, all the desired information is already available, thanks to some classes, so there should be no need to unnecessarily load a page.  The revert query itself should be able to handle the case where someone else has edited the page, so we don't really need the `auto` behavior now that we have the information ready.  The other loss is handling of pages that fail `wgIsProbablyEditable`, but this is manageable by making use of `intestactions=edit` (see also wikimedia-gadgets#632 and wikimedia-gadgets#658).  By not relying on auto-processing `twinklerevert` urls, we can prevent malicious providing of a link with `&twinklerevert=vand` to entice someone to revert something.  Low-profile, and I've never heard of it, but possible.

Given the above, `autorevert` has been removed in favor of a `skipTalk` item modified on contribs and recent changes to more appropriately represent what `openTalkPageOnAutoRevert` does.  That config is unfortunately named, but isn't visible so shouldn't be an issue beyond maintenance.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Twinkle shouldn't show rollback links for pages you can't edit
3 participants