Page MenuHomePhabricator

Makesysop shouldn't have userrights-interwiki
Closed, InvalidPublic

Description

Author: whitwood1986

Description:
Makesysop, as mentioned at [[:mw:Extension:Makesysop]] installs OK, but apparently I have to use
$wgGroupPermissions['bureaucrat']['userrights-interwiki'] = true; in order to get user rights changed on my other wikis:
e.g.

  • Admin changed user rights for Testuser1@testwiki from sysop to sysop, checkuser
  • Admin changed user rights for Exampleuser@mywiki from sysop, bureaucrat to sysop, bureaucrat, checkuser, oversight
  • Admin changed user rights for FooBar@examplewiki from sysop, bureaucrat to sysop, bureaucrat, steward

I find it strange that [[Special:Userrights]] has taken over from [[Special:Makesysop]] to configure cross-wiki permissions change, and also is the line:
$wgGroupPermissions['bureaucrat']['userrights-interwiki'] = true;

needed?? It was far better beforehand, when [[:bug:11645]] showed an error in Makesysop

The MediaWiki page at mediawiki.org says "Special:Makesysop shows the same form in Special:Userrights. In the "user name" field the database name should be added after the account, e.g. MyUser@foowikidb instead of just "MyUser".

I'm trying to copy Wikimedia's setup for my wiki farm: hopefully my report will benefit others here.


Version: 1.12.x
Severity: major

Details

Reference
bz12960

Event Timeline

bzimport raised the priority of this task from to High.Nov 21 2014, 10:02 PM
bzimport set Reference to bz12960.
bzimport added a subscriber: Unknown Object (MLST).

Special:Makesysop no longer includes any cross-wiki user rights abilities, as that has been merged into Special:Userrights in MediaWiki 1.12.

The remaining stub of Special:Makesysop contains only the restricted form for promoting local users to sysop and/or bureaucrat (also obsolete, but perhaps more user-friendly than restricted use of Special:Userrights for some uses).

Cross-wiki user rights modification in MediaWiki itself are disabled by default per the [[principle of least privilege]].

It may be that that's unnecessary, given that to actually do anything you still have to set up $wgLocalDatabases.

But given that you have to set up $wgLocalDatabases, it's not a great difficulty to also add the userrights-interwiki privilege to the group of your choice (which may, or may not, be 'bureaucrat'.)