The 1.x migration can be run by any user who can view its page

Problem

ReleaseNotes.Code.MigrationFrom1x converts every 1.x ChangesClass object of the wiki into the 2.x EntryClass plus ChangeClass pair, and saves every page it touches. The conversion is one-shot and irreversible: the 1.x object is removed from the page as part of it.

The page validates a form token, so the migration cannot be triggered from another site, but it checks no right at all. Any user who can view the page runs the migration by following the "Start the migration" link the page itself displays to them.

A user who cannot edit the change pages does not get far, since $doc.save() refuses a page the current user has no edit right on. But it refuses it by throwing, so the migration stops there and leaves the wiki half converted: the pages saved before the refusal carry the 2.x objects, the rest still carry the 1.x one.

Fix

Only display and run the migration for a user who can administer the wiki. The migration writes across the whole wiki, since its query is not restricted to the ReleaseNotes space, so wiki administration right is the right bar for it.