mediawiki - Really strange permissions issue on page titles with slashes

Question

I'm using:

• mediawiki 1.34
• php 7.4
• apache 2.4.46
• mysql 8.0.22

The problem that I'm having is that I get permissions denied errors from the api when I try to edit, move, or delete pages that have a "/" in its title. This happens through the UI and in some cases things just fail silently and I had to open up the browser's dev tools to look at the network tab.

This has been happening for a while now and we've managed to just not use "/" in any of the page titles, but recently the Translate extension was installed and has been causing issues because translations are stored in pages like title/segment/lang.

Saving a translation POSTs this data:

action=edit&
format=json&
title=Translations%3ATest%2FPage+display+title%2Fes&
text=asdasdsasd&
summary=&
assert=user&
token=XXXX19%2B%5C

and it returns this from api.php:

{
  "error":
  {
    "code":"permissiondenied",
    "info":"You are not allowed to execute the action you have requested.",
    "*":"See https://localhost/api.php for API usage. Subscribe to the mediawiki-api-announce mailing list at <https://lists.wikimedia.org/mailman/listinfo/mediawiki-api-announce> for notice of API deprecations and breaking changes."
  }
}

The user definitely has all of the translation permissions set, this happens even if I set all translate extension permissions to true for "*".

Does anyone possibly know what could be causing these issues? Or if there's some way to debug this to isolate what permission and where it's being checked? It looks like everything else works fine. I don't have very much experience with mediawiki, someone else used to manage it but they've left.

question from:https://stackoverflow.com/questions/66052896/really-strange-permissions-issue-on-page-titles-with-slashes

Answer 1

Try adding AllowEncodedSlashes NoDecode to your Apache config, and nocanon to?the ProxyPass directive in it.