Page MenuHomePhabricator

Investigate: Do we still need to use placeholder temp user for edit permission checks?
Open, Needs TriagePublic

Description

When making edits as a logged out user who has not yet created a temp account, the placeholder temp user is used for permission checks by EditPage, APIEdit and ApiVisualEditor.

This was originally done so that we could set wgGroupPermissions['*']['edit'] to false. This was to ensure that an IP actor could not accidentally be allowed to do something.

However it was decided that we would instead require wgGroupPermissions['*']['actionThatCreatesATempUser'] to be true and ensure that an IP actor could not accidentally be allowed to do something by throwing an error if MediaWiki tries to create an IP actor.

This task is for:

  • Investigating any advantages/disadvantages with still using the placeholder temp user in these permissions checks
  • Deciding whether we should remove them

Event Timeline

In theory I think you'd still need the temp user as long as temp users might have different permissions from anonymous users (by default they don't but the system does offer the possibility of temp-user-specific permissions).

Change 1007648 had a related patch set uploaded (by Tchanders; author: Tchanders):

[mediawiki/core@master] DNM Experimental: Remove unsaved temp user from EditPage

https://gerrit.wikimedia.org/r/1007648

I wonder (though I'm on the fence still) if we could just make the decision that $wgGroupPermissions['*']['edit'] must be true in order for temp accounts to be created via edit. You could still give temp accounts other additional rights, but an anon user must make a successful edit (or whatever other action you've configured to create a temp user) first.

We're expecting other workflows to do this rather than handle unsaved/placeholder temp users (see our guidance about this).

The unsaved temp user is proving a bit odd, e.g. AbuseFilter logs the name, but it never gets mapped to a real user (T334623#9587082).