Page MenuHomePhabricator

Blocked users can upload files to stash
Closed, ResolvedPublic

Description

Blocked users can stash files. This is not a big problem (since they can do nothing else with them), but still seems unintended.

Details

Related Gerrit Patches:
mediawiki/core : masterCheck if user is blocked during upload process
mediawiki/extensions/UploadWizard : masterAdd i18n keys for blocked messages

Event Timeline

matmarex created this task.Sep 2 2015, 6:04 PM
matmarex raised the priority of this task from to Needs Triage.
matmarex updated the task description. (Show Details)
matmarex added a subscriber: matmarex.
Restricted Application added a project: Multimedia. · View Herald TranscriptSep 2 2015, 6:04 PM
Restricted Application added subscribers: Steinsplitter, Aklapper. · View Herald Transcript
Matanya added a subscriber: Matanya.Sep 2 2015, 9:03 PM
Jdforrester-WMF triaged this task as Low priority.Sep 4 2015, 6:48 PM
Jdforrester-WMF set Security to None.
Jdforrester-WMF moved this task from Untriaged to Next up on the Multimedia board.Sep 4 2015, 6:57 PM

@matmarex, could you elaborate on how to reproduce this ?

I tried this on a local installation of mediawiki, where I created a user and blocked it.
Now when I login as that user, and go to the Special:Upload page, it says I was blocked.
When I login as that user, and go to the Special:UploadWizard page, it again says I was blocked.

@TasneemLo it was related to global blocks, per T111174 was my understanding.

@TasneemLo, you can only stash the file, you can't "publish" it on the wiki.

Special:Upload generally doesn't use stash (I think it does if the file is uploaded, but there are errors to be corrected in the description?), but it should be possible to reproduce with UploadWizard:

  • As user A, who is not blocked, visit Special:UploadWizard. Don't do anything else yet.
  • In a private browser tab, log in as user B and block user A.
  • As user A, continue by uploading a file and going through the whole form. You will only get an error message at the final step (when trying to publish the file), not at the first step (when it is uploaded).

(And yes, you could previously run into this when globally blocked, because UploadWizard was not checking for global blocks before displaying the form. This is now fixed and you have to be blocked while working through the form to run into this in practice.)

Change 286161 had a related patch set uploaded (by Matthias Mullie):
Check if user is blocked during upload process

https://gerrit.wikimedia.org/r/286161

Change 286413 had a related patch set uploaded (by Matthias Mullie):
Add i18n keys for blocked messages

https://gerrit.wikimedia.org/r/286413

Change 286161 merged by jenkins-bot:
Check if user is blocked during upload process

https://gerrit.wikimedia.org/r/286161

Change 286413 merged by jenkins-bot:
Add i18n keys for blocked messages

https://gerrit.wikimedia.org/r/286413

matmarex closed this task as Resolved.May 3 2016, 1:39 PM
matmarex removed a project: Patch-For-Review.