731649 - kuma: Access controls for editing Template:* pages

Status: RESOLVED FIXED

(developer.mozilla.org Graveyard :: Editing, defect)

Description

[Les Orchard [:lorchard]]

Pages whose slugs match the pattern "Template:*" are semi-trusted, wiki-editable code that runs on the server. 

Editing (and viewing?) these pages should be protected by access control and limited to a set of trusted site editors. These editors need not be Mozilla employees exclusively, but they should be very unlikely to vandalize or attempt to otherwise harm MDN.

Comment 1

[Luke Crouch [:groovecoder]]

I cringe at every mention of "Access controls" ... in this case do we think django's "is_staff" access level is suitable for this?

Comment 2

[Les Orchard [:lorchard]]

(In reply to Luke Crouch [:groovecoder] from comment #1)
> I cringe at every mention of "Access controls" ... in this case do we think
> django's "is_staff" access level is suitable for this?

is_staff might be suitable, if we're comfortable setting it for non-employees. But, we can probably do this with standard Django permissions & groups.

Comment 3

[Les Orchard [:lorchard]]

Quick mental notes unless I get to this:

* Add Django permission for wiki app, eg. "Can edit Templates"

* Enforce this permission in the wiki app view

* Create a Django group with this permission, add trusted editors to the group

Comment 4

[Luke Crouch [:groovecoder]]

Check this when creating/editing/deleting any Template: document.

Comment 5

[Les Orchard [:lorchard]]

No one scooped this up yet, so I might take a crack at it tomorrow and take a break from kumascript for a few hours.

Comment 6

[[github robot]]

Commits pushed to master at https://github.com/mozilla/kuma

https://github.com/mozilla/kuma/commit/47e0bdeb44adc14aefd96b1db2dccf21d80dd225
bug 731649: Access controls for editing Template:* pages

* Add {add,change}_template_document permissions to wiki model

* Enforce template permissions in model and view

* Bugfix for edit button on document view, would appear for edit
  permission but not revision permission

* South migration to create the new permissions

* Remove duplicate 0007 south migration

* Tests for model and view

https://github.com/mozilla/kuma/commit/8b1a0b10304b4f3d56568da18050de6c9bfec367
bug 731649: Accept initial ?slug in new_document, use ACE editor if it starts with Template:

https://github.com/mozilla/kuma/commit/58056d956d8b1ff78e19e1a7cf583875dfacaef9
Merge pull request #155 from lmorchard/bug-731649-template-permissions

Fix Bug 731649 template permissions