Issue: "Create" page (from red link) circumvents Area's "Allowed Prefix Choices" settings

Issue Tools
- View Changes

April 7, 2014 8:19 PM

Ptah

Junior Member

"Create" page (from red link) circumvents Area's "Allowed Prefix Choices" settings

Clicking "Create" atop a non-existing page-page allows for arbitrary Prefix + Area combination, athwart "Allowed Prefix Choices" defined in Area settings.

To recreate.

Given:
. an AreaX which has "Allowed Prefix Choices" narrowed down to, say, exclusively "PrefixA"
. (such that, when in AreaX, if you clicked "Create New>Page", there wouldn't even a be a dropdown for Prefix, it would just show "PrefixA" before the page title box, correctly constraining allowed-Prefixes-upon-page-creation-in-this-Area per settings)

...

1. On whatever other page, make a wiki link from that page to a non-existing page, then save.
2. Click the red wiki link
3. Click "Create"
4. Notice: both the Area and Prefix dropdowns are free selections of all possible, of-themselves-permissible, options.
5. Change the "Save to" (Area) to "AreaX"
6. Change the Prefix dropdown to something other than "PrefixA" (for instance: to another prefix that has been disallowed as an option per Area settings)
7. Fill in the form otherwise, save
8. Notice: it has allowed you to create a page in AreaX with a Prefix other than "PrefixA", to which it should have been constrained per settings?

Expectation/Suggestion: It would not allow you to save a page, as such; that "Allowed Prefix Choices" in Areas would be enforced (if not through the UI, dynamically, which I can imagine would be thorny, etc ... at least on form-submit, as a validation rule to bounce the save on POST)? ... Basically, to be orthogonal ala consistent with the Area->Create New->Page constraints, as such?

Issue Details

Issue Number 3670

Issue Type Bug

Project VaultWiki 4.x Series

Category Prefixes

Status Fixed

Priority 3 - Loss of Functionality

Affected Version 4.0.0 Gamma 4

Fixed Version 4.0.0 Gamma 5

Milestone VaultWiki 4 Gamma X

Software DependencyAny

License TypePaid

Users able to reproduce bug 0

Users unable to reproduce bug 0

Attachments 0

Assigned Users (none)

Tags (none)

April 8, 2014 9:30 AM

pegasus

VaultWiki Team

In vault/core/controller/ui/edit/vw.php, find:

Code:

if ($router->id AND $router->prefixid != $edit['prefixid'])

Replace with:

Code:

if ($router->prefixid != $edit['prefixid'])

In vault/core/controller/dm/revision/vw.php, find:

Code:

$this->page =& $pagedm;

Add after:

Code:

$this->instance->set_info('areaid', $this->get_page_field('areaid'));

In vault/core/controller/dm/base/vw.php, find:

Code:

					$area = vw_DB::get()->query()->select(array(
						'fields' => array('prefixlist'),
						'table' => 'vw_area',
						'where' => vw_DB::get()->query()->in('areaid', $areaid),
						'first' => 1
					));

Replace with:

Code:

					$area = vw_DB::get()->query()->select(array(
						'fields' => array('prefixlist'),
						'table' => 'vw_area',
						'where' => vw_DB::get()->query()->in('pageid', $areaid),
						'first' => 1
					));

April 9, 2014 4:38 PM

Ptah

Junior Member

Ok, I can confirm that this tweak causes the desired effect of constraining the prefixes to those allowed in the Area through settings.

Thanks!

Reply
April 21, 2014 10:06 AM

Ptah

Junior Member

I've noticed a problem on Gamma5 005. It seems related to this issue, so I'll put it here?

Scenario: trying to create a page from clicking "Create" on the other side of a red link (a non-existing page)...

What's odd is that when I try to change the Area from the one that it defaults to (always the first displayed ordered one, it seems), and I see the prefixes and such change accordingly (cool!), but when I try to actually save the page, I get:

Errors
There were some problems with your submission:
Could not find phrase 'vw_prefix_not_allowed'.

Even though I know for certain the given Prefix+Area is permissible... (for instance, it works properly if done through the basic Area add page button)

Reply
This petition for a change to Unconfirmed was accepted
April 21, 2014 10:07 AM

Ptah

Junior Member

(status petition, oops)

April 21, 2014 10:29 AM

pegasus

VaultWiki Team

I can only duplicate this if the target area has ALL prefix options UN-checked.

In vault/core/controller/dm/base/vw.php, find:

Code:

$allowed["$areaid"] = explode(',', $area['prefixlist']);

Replace with:

Code:

					if (empty($area['prefixlist']))
					{
						$allowed["$areaid"] = array(-1);
					}
					else
					{
						$allowed["$areaid"] = explode(',', $area['prefixlist']);
					}

April 21, 2014 10:34 AM

Ptah

Junior Member

fwiw, I have my areas reconfigured such that every Area has its own distinct prefix configured as the only possible option to it.

I'll give that tweak a try, thanks.

Reply
April 21, 2014 10:49 AM

Ptah

Junior Member

Erm... I see no such code in vault/core/controller/dm/area/vw.php?

Not in the upload source, and not in what's on my server?

Reply
April 21, 2014 10:51 AM

pegasus

VaultWiki Team

Sorry it's in dm/base

Also thanks for the info. I was able to duplicate by allowing exactly 1 prefix in an area that wasn't the auto-selected area.

Reply
April 21, 2014 11:15 AM
pegasus

VaultWiki Team
In vault/resources/js/area-switch.js, find (2x):

Code:

if (sel_val !== null)

Replace with (1st time):

Code:

if (sel_val !== null && this.prefix.get('tagName') == 'SELECT')

2nd time:

Code:

if (sel_val !== null && this.language.get('tagName') == 'SELECT')

There is also an issue where the wrong prefix is selected if you hit the back button from the preview/error screen in Firefox, but that fix is a bit more complicated.
Reply
April 21, 2014 11:22 AM

Ptah

Junior Member

Well, I made that tweak, and the problem remains.

Actually, what's really weird is that, at first I get the no permission message, but if I change nothing and just re-submit, it works as expected on the second try?

Reply
April 21, 2014 11:33 AM

pegasus

VaultWiki Team

I was able to reproduce the original problem and this change fixed it on my installation. Since this is a Javascript change, make sure that either your browser cache is cleared or that you have it disabled on your site when testing Javascript tweaks.

Reply
April 21, 2014 11:39 AM

Ptah

Junior Member

Confirmed: these tweaks resolve the issue, thanks!
(I missed the javascript tweak at first, sorry)

Reply

+ Reply

All times are GMT -4. The time now is 4:17 PM.

This site uses cookies to help personalize content, to tailor your experience, and to keep you logged in if you register.
By continuing to use this site, you are consenting to our use of cookies.

Learn more… Accept Remind me later

Welcome to VaultWiki.org, home of the wiki add-on for vBulletin and XenForo!

Issue: "Create" page (from red link) circumvents Area's "Allowed Prefix Choices" settings

Issue Tools