ayg wrote:

Workaround: don't cascade semi-protected pages until this is fixed. It might be advisable to add
this as a note to the system message for now.

I agree that there's not any mileage in allowing cascading semi-protects at all. It's only a tool
to prevent casual vandalism in the first place, so it's no big deal if someone can avoid it by going
to a little trouble.

Good idea. Ixfd64 put such a warning, and I made it more forceful.

How is this just an enhancement? It seems like a privilege escalation
vulnerability to me.

thekid7590 wrote:

I changed to major, seems more like that to me.

titoxd.wikimedia wrote:

And this was reported on Wikizine:

http://en.wikizine.org/2007/03/year-2007-week-11-number-64.html

Great, so everyone knows about it now, and everyone can exploit it. Recommend
raising priority.

(Note that this isn't really a privilege escalation, since you doesn't let you
_do_ new things; at worst it blocks anonymous editing to more pages than were
asked. It cannot, for instance, allow you to edit pages you weren't supposed to
be able to.)

Fixed in r20461. Cascade only applies if all the protection types are set to
groups that can "protect".

robchur wrote:

(In reply to comment #5)

And this was reported on Wikizine:

Some people have absolutely no sense of responsibility.

walter wrote:

This is not a matter of irresponsibility but of informing the users. The possibility
of abuse by this function was limited. For sysops to know how to solve problems the
need to know how things work so you know for what to look to solve a problem.