Page MenuHomePhabricator

Blocked users can still use oversight
Closed, ResolvedPublic

Description

Author: artificial

Description:
I tested this on my own wiki, and while blocked, I was still able to oversight revisions on multiple pages and access oversighted data.

The only likely situation where a user with oversight privileges will be blocked is in the case of a compromised account, in which case any use of Special:HideRevision and Special:Oversight will not be legit. There's a potential for mischief here, given that un-oversighting revisions requires special privileges and effort beyond that of normal vandalism reversion.

It would be safer to disable access to these special pages immediately for blocked accounts. It's at least very unlikely to impede any legitimate use of them.

(This is just a suggestion, so it can be closed as WONTFIX if it's not a good idea.)


Version: unspecified
Severity: enhancement

Details

Reference
bz13036

Event Timeline

bzimport raised the priority of this task from to Medium.Nov 21 2014, 10:07 PM
bzimport set Reference to bz13036.

They could just unblock themselves anyway, unless it was a non-admin Oversight...which I suppose is possible.

'Special' rights aren't blocked, only editing is. It'll only take another second to strip someone of his oversight rights after you block him. The real fun starts when blocking sysops: they can unblock themselves if you don't remember to de-sysop them as well.

artificial wrote:

Fair enough. Strange system where admins can unblock themselves.

Reopening this bug. Blocked sysops should be able *only* to unblock himself, other actions (like deletion) should check for block status.

Blocked sysops should be able *only* to unblock himself,
other actions (like deletion) should check for block status.

What sense does it make if a sysop performs the action or they unblock themselves and perform the action anyway?

(In reply to comment #5)

Blocked sysops should be able *only* to unblock himself,
other actions (like deletion) should check for block status.

What sense does it make if a sysop performs the action or they unblock
themselves and perform the action anyway?

So it makes harder life for sysops-vandals :)