819289 - Do not depend on HTTP Referer to allow a wiki edit

Status: RESOLVED DUPLICATE of bug 789016

(developer.mozilla.org Graveyard :: User management, task)

Description

[David Bruant]

My user account is "dbruant".
I can login, I can click on "edit" and see the editor, but on clicking either "preview changes" or "save changes", I see an error page saying I'm not allowed to and the change isn't performed.

Comment 1

[Jean-Yves Perrier [:teoli]]

I just made a modification. Can you try again?

Comment 2

[David Bruant]

I don't see a difference :-(

Comment 3

[David Bruant]

Apparently, I can't edit any page...
Originally tried https://developer.mozilla.org/en-US/docs/Mozilla/Boot_to_Gecko/Debugging_on_Boot_to_Gecko/Setting_up
But also tried https://developer.mozilla.org/en-US/docs/DOM/document.createComment

Comment 4

[David Bruant]

I can edit pages on Chrome.
I tried to clear my Firefox (Aurora) cookies and restart it, but I have the same problem even after that. I don't really know what to do next.

Comment 5

[Jean-Yves Perrier [:teoli]]

I also tried to "ban" him and "unban", but without success.

Comment 6

[Jean-Yves Perrier [:teoli]]

Daniel Holbert got the same problem today. It works in Chrome but not with Nightly.
He tried with a new profile and it solved it. Could you confirm?

Comment 7

[David Walsh :davidwalsh]

Any news here Jean-Yves or David?

Comment 8

[David Bruant]

(In reply to David Walsh :davidwalsh from comment #7)
> Any news here Jean-Yves or David?
I had given up and worked from Chrome.

(In reply to Jean-Yves Perrier [:teoli] from comment #6)
> Daniel Holbert got the same problem today. It works in Chrome but not with
> Nightly.
> He tried with a new profile and it solved it. Could you confirm?
I just tried safe mode and I could edit. So it comes from one of my add-ons... and it actually wasn't hard to pin down which one: RefControl https://addons.mozilla.org/fr/firefox/addon/refcontrol/
I have configured it to never send the Referer header to any website.

For whatever reason or purpose, edits on Kuma rely on the Referer header being sent.
For my own personal case, I've just configured RefControl to send the Referer normally to dev.moz.org (and I can edit). But probably Kuma should accept edits even if there is no referer... maybe Kuma uses the referer to figure out which page is being edited?

Comment 9

[David Walsh :davidwalsh]

Requiring a referer can sometimes be a spam prevention technique; I'll see what the rest of the team says.

Comment 10

[David Bruant]

(In reply to David Walsh :davidwalsh from comment #9)
> Requiring a referer can sometimes be a spam prevention technique; 
In this particular instance (editing the wiki), the user has to be logged-in, so if he/she is spamming, the account can be suspended and it might be possible to remove all spamish content in one click (is there something like that implemented or on track?).

> I'll see what the rest of the team says.
Repurposing the bug, you can invite them here to discuss :-)

Comment 11

[David Walsh :davidwalsh]

Yep, I understand that you must log in to make edits;  my thought was that there's probably a blanket Django policy that requires a referrer.  I'm sure we can work this out.