Users without edit rights can change a page through the MediaWiki API

[nathancarter]

Users without edit rights can change a page through the MediaWiki API

[nathancarter]

I am not a MediaWiki extension developer, but I read a few docs and it seems that the missing hook is APIEditBeforeSave, which is "Called right before saving an edit submitted through api.php?action=edit" and you can "Return true to continue processing, return false to abort processing and reject the edit." Therefore it may be that a simple addition to ArticleProtection.hooks.php to handle this hook would suffice. What do you think?

[nathancarter]

I just created a branch/pull request that solves this issue. Wasn't too hard, imitating your other code. Please feel free to test and merge if you like it. Thanks!

[nischayn22]

Sorry didn't find enough time to look at this. Will merge it soon.

sent from my Nexus
Nischay
On 04-Sep-2015 1:28 am, "Nathan Carter" [email protected] wrote:

I just created a branch/pull request that solves this issue. Wasn't too
hard, imitating your other code. Please feel free to test and merge if you
like it. Thanks!

—
Reply to this email directly or view it on GitHub
#1 (comment)
.

[nischayn22]

I have merged this without testing. If you find a bug later please do push your fixes if any. Thanks for the contribution. Also feel free to add a README file with your name in Credits if you wish to 👍

[nathancarter]

Thanks for the quick reply! No credits needed.