Also, the API disallows actions when the user is blocked and $wgBlockDisablesLogin is on, but /identify does not.

Patch:

In T148600#2727551, @Tgr wrote:

Patch:

0001-SECURITY-check-stage-and-user-locked-status-in-ident.patch1 KBDownload

-					if ( !$localUser || !$localUser->isLoggedIn() ) {
+					if ( !$localUser || !$localUser->isLoggedIn() || $localUser->isLocked() ) {
 						throw new MWOAuthException( 'mwoauth-invalid-authorization-invalid-user' );

Instead of throwing 'mwoauth-invalid-authorization-invalid-user' for the added condition, it would make more sense to throw 'mwoauth-invalid-authorization-blocked-user'. Also, you're not checking the $wgBlockDisablesLogin && ->isBlocked() case.

Fixed:

In T148600#2730214, @Tgr wrote:

Fixed:

0001-SECURITY-check-stage-and-user-blocked-locked-status-.patch2 KBDownload

Looks good, +1.

@Tgr, I will can deploy this on Monday if you've not already done so.

You guys can go ahead and announce and release this now.

In T148600#2740729, @Tgr wrote:

Thanks! (And sorry for forgetting to respond. I wanted to deploy it and then got distracted.)
Let's keep it open until it's merged in master (and the task can be made public), though.

@demon do you want to make a proper security release for this? IMO it is significant enough to warrant a backport (/identify was added in 1.23 so that means 1.23, 1.26 and 1.27) but not severe enough for the whole security release process with the pre-announcement and whatnot. If the old branches will also get new releases when 1.28 is released, IMO we can just merge to master and backport and be done with it.

Since it's not bundled I say let's do that. Push to master + all supported branches and send an announcement to the usual places.

Change 318228 had a related patch set uploaded (by Gergő Tisza):
SECURITY: check stage and user blocked/locked status in /identify

https://gerrit.wikimedia.org/r/318228

Change 318228 merged by jenkins-bot:
SECURITY: check stage and user blocked/locked status in /identify

https://gerrit.wikimedia.org/r/318228

A mistake in the patch caused T149194.