Permissions on security-related documentation pages are inconsistent [#1302568]

An initial version of this was reported by Lin Clark to the security team, but I'm moving it to a public issue here and expanding it a bit.

http://drupal.org/node/319685 says that http://drupal.org/writing-secure-code is one of the pages that is supposed to be locked to documentation admins (which makes sense). However, that implies that many or all of its child pages should be locked too. Lin pointed out that they are inconsistent.

I looked into this a bit more and here is a list of the current pages and the input format they are set to:

Full HTML:

http://drupal.org/writing-secure-code

Documentation format:

Filtered HTML:

Everything else

Seems to me like potentially all child pages should be set to the Documentation format and be locked.

Also, I am not sure why the one top-level page is Full HTML rather than Documentation format. Is that intentional? (Do documentation admins have access to that format even?)

Let's use this issue to straighten things out.

Comments

Comment #1

Anonymous (not verified) commented 7 October 2011 at 15:12

Subscribe.

Comment #2

scor commented 7 October 2011 at 15:49

Do documentation admins have access to that format even?

Looking at the last revision of writing secure code, it does seem to be the case, since the page was already Full HTML when @jhodgdon made the last edit.

Comment #3

greggles

he/him

English

Denver, Colorado, USA

commented 7 October 2011 at 19:01

jhodgdon also has site maintainer role - documentation team cannot edit those pages.

Personally I'd be fine allowing anyone to edit those pages. We should probably have a monthly review of the content of those pages and as part of that review we could look at revisions for inappropriate changes.

It would, of course, be awesome for at least book pages if we had an rss feed of the diff.

Comment #4

Anonymous (not verified) commented 7 October 2011 at 19:12

I think it makes a lot of sense to open up editing, at least for a while. Currently, they don't seem to have much Drupal 7 information, which I think will start to pose a major problem. If they were opened up, people could move D7 information from the DrupalCon presentations, etc, into the Docs pages. They could be closed back down again later if it turns out to be a problem.