Skip to content

Reject NeoWikiSubject as a page main content model#1108

Merged
alistair3149 merged 1 commit into
masterfrom
feature/lock-subject-content-model
Jul 20, 2026
Merged

Reject NeoWikiSubject as a page main content model#1108
alistair3149 merged 1 commit into
masterfrom
feature/lock-subject-content-model

Conversation

@JeroenDeDauw

@JeroenDeDauw JeroenDeDauw commented Jul 20, 2026

Copy link
Copy Markdown
Member

SubjectContentHandler inherited the permissive default canBeUsedOn(), which
returns true for any title. Because MediaWiki grants editcontentmodel to
logged-in users by default, a user could set an arbitrary page's main content
model to NeoWikiSubject, producing an orphan page that is not projected to the
graph and renders blank.

NeoWikiSubject is only ever valid inside the dedicated subject slot ("neo"),
whose content model is fixed by its slot role via defineRoleWithModel. That
slot role compares the model directly and never consults canBeUsedOn, so
overriding it to return false locks the model out of every main-content-model
path (the content-model change UI, the edit API, page moves, and imports)
without affecting subject slot writes.

AI-authored — Claude Code, Opus 4.8 (max); detailed spec from @JeroenDeDauw, no revisions; diff not yet human-reviewed; TDD (tests seen failing before the fix), full PHPUnit suite (1906) and phpcs+phpstan green locally, CI green; AI-reviewed (mutation + read-only code review), no blocking findings.

`SubjectContentHandler` inherited the permissive default `canBeUsedOn()`, which
returns true for any title. Because MediaWiki grants `editcontentmodel` to
logged-in users by default, a user could set an arbitrary page's main content
model to `NeoWikiSubject`, producing an orphan page that is not projected to the
graph and renders blank.

`NeoWikiSubject` is only ever valid inside the dedicated subject slot ("neo"),
whose content model is fixed by its slot role via `defineRoleWithModel`. That
slot role compares the model directly and never consults `canBeUsedOn`, so
overriding it to return false locks the model out of every main-content-model
path (the content-model change UI, the edit API, page moves, and imports)
without affecting subject slot writes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@JeroenDeDauw
JeroenDeDauw marked this pull request as ready for review July 20, 2026 20:45
@alistair3149 alistair3149 self-assigned this Jul 20, 2026
@alistair3149
alistair3149 merged commit cdba2dd into master Jul 20, 2026
6 checks passed
@alistair3149 alistair3149 removed their assignment Jul 20, 2026
@alistair3149
alistair3149 deleted the feature/lock-subject-content-model branch July 20, 2026 22:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants