Page MenuHomePhabricator

Blocked users can change tags
Closed, ResolvedPublic

Description

Blocked users can change tags. This should be prevented.

Example: I blocked my test account on frwiki and changed a tag.

Details

Related Gerrit Patches:

Event Timeline

Orlodrim created this task.Jun 10 2015, 9:18 PM
Orlodrim raised the priority of this task from to Needs Triage.
Orlodrim updated the task description. (Show Details)
Orlodrim added a subscriber: Orlodrim.
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJun 10 2015, 9:18 PM
Aklapper triaged this task as Low priority.Jul 23 2015, 1:34 PM
TTO added subscribers: TTO, Anomie.Nov 17 2015, 10:10 AM

This would potentially be a GCI task. It's not clear where this should be implemented in the code stack, though. At the level of ChangeTags::can*Tag? At the API/special page level? Or somewhere in between?

It's very difficult to tell how other parts of MediaWiki (e.g. patrolling) do this.

It's not clear where this should be implemented in the code stack, though. At the level of ChangeTags::can*Tag?

Since that's where other permissions checks are, I'd say that would be a good place for them.

At the API/special page level?

It wouldn't hurt to check up front here too, to avoid doing work that is just going to be rejected later.

Unicornisaurous added a subscriber: Unicornisaurous.

I claimed this on GCI.

Change 259442 had a related patch set uploaded (by Unicornisaurous):
Prevent blocked users from changing tags

https://gerrit.wikimedia.org/r/259442

Change 259442 merged by jenkins-bot:
Prevent blocked users from modifying change tags

https://gerrit.wikimedia.org/r/259442

Unicornisaurous closed this task as Resolved.Dec 19 2015, 9:51 PM