Page MenuHomePhabricator
Create Task
Maniphest T154229

Agree first user group that will be able to create newsletters in Wikimedia
Closed, ResolvedPublic
Actions

Description

In T115095#2368812, @dpatrick wrote:

@Qgil I think it's fine to go ahead and remove AbuseFilter integration as a blocker, as long as initial permission is restricted to a set of trusted users.

OK, we have different options:

  • By default the extension sets the permission to create newsletters to a specific user group: 'newsletter-create'. In practice, this means that administrators should give this right on a case by case basis.
  • MassMessage_senders would be the next sensible option. This user groups is only available in Meta. This is fine for the initial deployment of the Newsletter extension (which targets Meta only). (the first wiki will be mediawiki.org, where this user right is not available)
  • Autopatrollers would be a next logical step, using a standard MediaWiki user group.
  • Confirmed users would be probably the most open and still sensible option. We are trusting confirmed users for many actions, and Newsletters are ultimately no different than wiki pages.

Whatever works for the Security review and the mediawiki.org admins will work for us Newsletter maintainers too.

(I'm not sure Wikimedia-Site-requests applies here, feel free to remove it if not.)

Related Objects
Search...

Event Timeline

QuimGil created this task.Dec 28 2016, 11:12 AM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptDec 28 2016, 11:12 AM
QuimGil added a parent task: T115095: Security review of Newsletter extension.Dec 28 2016, 11:13 AM
QuimGil added a comment.Dec 28 2016, 11:34 AM

I have mentioned this task in https://meta.wikimedia.org/wiki/Meta:Requests_for_help_from_a_sysop_or_bureaucrat#Initial_user_group_that_will_be_able_to_create_newsletters_in_Meta

QuimGil updated the task description. (Show Details)Dec 28 2016, 12:03 PM
QuimGil added a comment.Dec 28 2016, 12:09 PM

Er... silly me, the first wiki will be mediawiki.org, not Meta (T116271#2344835).

I have mentioned this task in mw:Project:Current issues.

MarcoAurelio subscribed.Dec 28 2016, 12:35 PM

I'd say initial phase should be restricted to administrators and that 'newsletter-create' should be part of the sysop grants by default, at least for now. MM-sender is a group that only exists on few projects but can be enabled w/o much fuss for every project that requests it. I'd not advocate granting this to autopatrollers or other 'easy-to-get' user groups due to the heterogeneous composition of its members and to avoid abuse of the system.

QuimGil added a subscriber: 01tonythomas.Jan 3 2017, 10:16 PM
In T154229#2904838, @MarcoAurelio wrote:

I'd say initial phase should be restricted to administrators and that 'newsletter-create' should be part of the sysop grants by default, at least for now.

Sounds sensible. Let's do it.

@01tonythomas, how is this defined in the extension today. Hardcoded, or is there a configuration variable for LocalSettings.php?

Qgil closed this task as Resolved.Jan 6 2017, 4:56 PM
Qgil claimed this task.
Qgil added a subtask: T154534: Restrict 'newsletter-{create,manage,destroy}' only to 'sysop' by default.

Agreed (only sysops will be able to create newsletters initially) and implemented: T154534: Restrict 'newsletter-{create,manage,destroy}' only to 'sysop' by default.

Resolving.

Qgil mentioned this in T173111: Testing Newsletter extension in test.wikipedia.org.Aug 16 2017, 8:32 AM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL