Page MenuHomePhabricator

Current he.wiki interface-editor group config doesn't comply with privacy policy
Closed, ResolvedPublic

Description

Currently he.wiki's interface-editor group has the following userrights:
*abusefilter-hidden-log
*abusefilter-hide-log
which are oversight-level rights. As soon as a request to suppress some abuselog's entry will come, this config will break privacy policy by giving access to suppressed data to non-identified users.

Event Timeline

Vituzzu created this task.Sep 3 2015, 8:01 PM
Vituzzu raised the priority of this task from to Needs Triage.
Vituzzu updated the task description. (Show Details)
Vituzzu added subscribers: Vituzzu, Snowolf, MarcoAurelio and 2 others.
Restricted Application added subscribers: Matanya, Aklapper. · View Herald TranscriptSep 3 2015, 8:01 PM
Krenair added a subscriber: Krenair.EditedSep 3 2015, 8:06 PM

I checked back through the history of that permission earlier, unfortunately it seems to predate the migration of mediawiki-config to the public git repository, and the history of the old private SVN repository was lost.

Snowolf added a comment.EditedSep 3 2015, 8:11 PM

The matter was originally discussed on T34048 it seems. The original requested is already cc'ed on this bug.

I left this note on a gerrit change earlier but, yes, this is a suppression level right and it should be removed. I see how it happened (just adding all of the abusefilter rights and it's not well documented) but that's how it's been used (essentially deleting logs which contain private data and being able to view those deleted logs).

Change 235960 had a related patch set uploaded (by Alex Monk):
Revoke suppression-level rights from interface editors on hewiki

https://gerrit.wikimedia.org/r/235960

Change 235960 merged by jenkins-bot:
Revoke suppression-level rights from interface editors on hewiki

https://gerrit.wikimedia.org/r/235960

Krenair closed this task as Resolved.Sep 4 2015, 1:58 AM
Krenair claimed this task.
Krenair moved this task from Backlog to Done on the Wikimedia-Site-requests board.Sep 8 2015, 4:22 PM
IKhitron added a subscriber: IKhitron.