Page MenuHomePhabricator

Blocker must be a local user or a name that cannot be a local user
Closed, ResolvedPublic

Description

Spotted in production: Blocker must be a local user or a name that cannot be a local user

Urls look like: /w/index.php?title=Special:UserLogin&returnto=blahblahblah

Stacktrace:

#0 /srv/mediawiki/php-1.31.0-wmf.11/extensions/GlobalBlocking/includes/GlobalBlock.php(17): Block->setBlocker(User)
#1 /srv/mediawiki/php-1.31.0-wmf.11/extensions/GlobalBlocking/includes/GlobalBlocking.class.php(21): GlobalBlock->__construct(stdClass, array)
#2 /srv/mediawiki/php-1.31.0-wmf.11/extensions/GlobalBlocking/includes/GlobalBlockingHooks.php(87): GlobalBlocking::getUserBlock(User, string)
#3 /srv/mediawiki/php-1.31.0-wmf.11/includes/Hooks.php(177): GlobalBlockingHooks::onUserIsBlockedGlobally(User, string, boolean, NULL)
#4 /srv/mediawiki/php-1.31.0-wmf.11/includes/Hooks.php(205): Hooks::callHook(string, array, array, NULL)
#5 /srv/mediawiki/php-1.31.0-wmf.11/includes/user/User.php(2180): Hooks::run(string, array)
#6 /srv/mediawiki/php-1.31.0-wmf.11/includes/user/PasswordReset.php(262): User->getGlobalBlock()
#7 /srv/mediawiki/php-1.31.0-wmf.11/includes/user/PasswordReset.php(103): PasswordReset->isBlocked(User)
#8 /srv/mediawiki/php-1.31.0-wmf.11/includes/specialpage/LoginSignupSpecialPage.php(1143): PasswordReset->isAllowed(User)
#9 /srv/mediawiki/php-1.31.0-wmf.11/includes/specialpage/LoginSignupSpecialPage.php(845): LoginSignupSpecialPage->getFieldDefinitions(FakeAuthTemplate)
#10 /srv/mediawiki/php-1.31.0-wmf.11/includes/specialpage/AuthManagerSpecialPage.php(652): LoginSignupSpecialPage->onAuthChangeFormFields(array, array, array, string)
#11 /srv/mediawiki/php-1.31.0-wmf.11/includes/specialpage/LoginSignupSpecialPage.php(669): AuthManagerSpecialPage->fieldInfoToFormDescriptor(array, array, string)
#12 /srv/mediawiki/php-1.31.0-wmf.11/includes/specialpage/AuthManagerSpecialPage.php(400): LoginSignupSpecialPage->getAuthForm(array, string)
#13 /srv/mediawiki/php-1.31.0-wmf.11/includes/specialpage/LoginSignupSpecialPage.php(316): AuthManagerSpecialPage->trySubmit()
#14 /srv/mediawiki/php-1.31.0-wmf.11/includes/specialpage/SpecialPage.php(522): LoginSignupSpecialPage->execute(NULL)
#15 /srv/mediawiki/php-1.31.0-wmf.11/includes/specialpage/SpecialPageFactory.php(578): SpecialPage->run(NULL)
#16 /srv/mediawiki/php-1.31.0-wmf.11/includes/MediaWiki.php(287): SpecialPageFactory::executePath(Title, RequestContext)
#17 /srv/mediawiki/php-1.31.0-wmf.11/includes/MediaWiki.php(851): MediaWiki->performRequest()
#18 /srv/mediawiki/php-1.31.0-wmf.11/includes/MediaWiki.php(523): MediaWiki->main()
#19 /srv/mediawiki/php-1.31.0-wmf.11/index.php(43): MediaWiki->run()
#20 /srv/mediawiki/w/index.php(3): include(string)
#21 {main}

Details

Related Gerrit Patches:
mediawiki/extensions/GlobalBlocking : wmf/1.31.0-wmf.12Update for Block::setBlocker() requiring a valid user or interwiki username
mediawiki/extensions/GlobalBlocking : wmf/1.31.0-wmf.11Update for Block::setBlocker() requiring a valid user or interwiki username
mediawiki/extensions/GlobalBlocking : masterUpdate for Block::setBlocker() requiring a valid user or interwiki username
operations/mediawiki-config : masterDisable GlobalBlocking on fishbowl wikis

Event Timeline

demon created this task.Dec 7 2017, 6:53 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptDec 7 2017, 6:53 PM
demon added a comment.Dec 7 2017, 6:57 PM

I wonder if this only affects fishbowl wikis, when someone tries to login with a CA account? Seems weird.

MarcoAurelio added a subscriber: MarcoAurelio.

AFAIR fishbowl.dblist wikis ain't CentralAuth wikis.

demon added a comment.Dec 7 2017, 8:04 PM

In which case they shouldn't even have GlobalBlocking installed. But was also happening on plwikivoyage, so maybe not all fishbowl-related?

Pinging my team: Stewards-and-global-tools in case they noticed something weird with GlobalBlocking lately.

Happened to me today. I cannot access Special:UserLogin at foundationwiki. Fatal error:

[WirRFApAICkAAFlopHAAAACU] 2017-12-08 17:51:16: Fatal exception of type "InvalidArgumentException"

UBN?

Change 396437 had a related patch set uploaded (by Reedy; owner: Reedy):
[operations/mediawiki-config@master] Disable GlobalBlocking on fishbowl wikis

https://gerrit.wikimedia.org/r/396437

Reedy added a subscriber: Reedy.Dec 8 2017, 5:58 PM
2017-12-08 17:49:50 [WirQvgpAEK0AABOc-fYAAABK] mw1218 foundationwiki 1.31.0-wmf.11 exception ERROR: [WirQvgpAEK0AABOc-fYAAABK] /w/index.php?title=Special:UserLogin&returnto=Resolution%3ADelegation+of+policy-making+authority   InvalidArgumentException from line 1492 of /srv/mediawiki/php-1.31.0-wmf.11/includes/Block.php: Blocker must be a local user or a name that cannot be a local user {"exception_id":"WirQvgpAEK0AABOc-fYAAABK","exception_url":"/w/index.php?title=Special:UserLogin&returnto=Resolution%3ADelegation+of+policy-making+authority","caught_by":"mwe_handler"} 
[Exception InvalidArgumentException] (/srv/mediawiki/php-1.31.0-wmf.11/includes/Block.php:1492) Blocker must be a local user or a name that cannot be a local user
  #0 /srv/mediawiki/php-1.31.0-wmf.11/extensions/GlobalBlocking/includes/GlobalBlock.php(17): Block->setBlocker(User)
  #1 /srv/mediawiki/php-1.31.0-wmf.11/extensions/GlobalBlocking/includes/GlobalBlocking.class.php(21): GlobalBlock->__construct(stdClass, array)
  #2 /srv/mediawiki/php-1.31.0-wmf.11/extensions/GlobalBlocking/includes/GlobalBlockingHooks.php(87): GlobalBlocking::getUserBlock(User, string)
  #3 /srv/mediawiki/php-1.31.0-wmf.11/includes/Hooks.php(177): GlobalBlockingHooks::onUserIsBlockedGlobally(User, string, boolean, NULL)
  #4 /srv/mediawiki/php-1.31.0-wmf.11/includes/Hooks.php(205): Hooks::callHook(string, array, array, NULL)
  #5 /srv/mediawiki/php-1.31.0-wmf.11/includes/user/User.php(2180): Hooks::run(string, array)
  #6 /srv/mediawiki/php-1.31.0-wmf.11/includes/user/PasswordReset.php(262): User->getGlobalBlock()
  #7 /srv/mediawiki/php-1.31.0-wmf.11/includes/user/PasswordReset.php(103): PasswordReset->isBlocked(User)
  #8 /srv/mediawiki/php-1.31.0-wmf.11/includes/specialpage/LoginSignupSpecialPage.php(1143): PasswordReset->isAllowed(User)
  #9 /srv/mediawiki/php-1.31.0-wmf.11/includes/specialpage/LoginSignupSpecialPage.php(845): LoginSignupSpecialPage->getFieldDefinitions(FakeAuthTemplate)
  #10 /srv/mediawiki/php-1.31.0-wmf.11/includes/specialpage/AuthManagerSpecialPage.php(652): LoginSignupSpecialPage->onAuthChangeFormFields(array, array, array, string)
  #11 /srv/mediawiki/php-1.31.0-wmf.11/includes/specialpage/LoginSignupSpecialPage.php(669): AuthManagerSpecialPage->fieldInfoToFormDescriptor(array, array, string)
  #12 /srv/mediawiki/php-1.31.0-wmf.11/includes/specialpage/AuthManagerSpecialPage.php(400): LoginSignupSpecialPage->getAuthForm(array, string)
  #13 /srv/mediawiki/php-1.31.0-wmf.11/includes/specialpage/LoginSignupSpecialPage.php(316): AuthManagerSpecialPage->trySubmit()
  #14 /srv/mediawiki/php-1.31.0-wmf.11/includes/specialpage/SpecialPage.php(522): LoginSignupSpecialPage->execute(NULL)
  #15 /srv/mediawiki/php-1.31.0-wmf.11/includes/specialpage/SpecialPageFactory.php(578): SpecialPage->run(NULL)
  #16 /srv/mediawiki/php-1.31.0-wmf.11/includes/MediaWiki.php(287): SpecialPageFactory::executePath(Title, RequestContext)
  #17 /srv/mediawiki/php-1.31.0-wmf.11/includes/MediaWiki.php(851): MediaWiki->performRequest()
  #18 /srv/mediawiki/php-1.31.0-wmf.11/includes/MediaWiki.php(523): MediaWiki->main()
  #19 /srv/mediawiki/php-1.31.0-wmf.11/index.php(43): MediaWiki->run()
  #20 /srv/mediawiki/w/index.php(3): include(string)
  #21 {main}

Change 396437 merged by jenkins-bot:
[operations/mediawiki-config@master] Disable GlobalBlocking on fishbowl wikis

https://gerrit.wikimedia.org/r/396437

I think the issue comes when you try to log in and you're under an IP or CIDR which is globally blocked.

Legoktm raised the priority of this task from Medium to Unbreak Now!.Dec 9 2017, 11:41 AM
Legoktm added subscribers: Anomie, Legoktm.

This is still happening on SUL wikis. @Anomie can you take a look at this? You added the exception in rMW96bd79b4a36a: Avoid DB rows with usable names but ID = 0 by introducing "interwiki" usernames.

Restricted Application added subscribers: Liuxinyu970226, Jay8g, TerraCodes. · View Herald TranscriptDec 9 2017, 11:41 AM

This is still happening on SUL wikis. @Anomie can you take a look at this? You added the exception in rMW96bd79b4a36a: Avoid DB rows with usable names but ID = 0 by introducing "interwiki" usernames.

I answered this on IRC several days ago:

[19:03:29] <anomie> The most straightforward solution would probably be to prefix an interwiki prefix for wherever that blocker name comes from, like "meta>Example".

From @Anomie via @CCicalese_WMF: @Anomie would prefer someone more familiar with the extension to work on this.

According to Dev/Maintainers for the GlobalBlocking extension that'd be.... @Legoktm ?

@Legoktm can you work with @Anomie on this, please?

This is an extension without clear ownership/"stewardship", which is bad, and that should be addressed separately (cc @Jrbranaa ).

Now that I've had a chance to look a little more closely, I'll expand on the possible solutions.

  • Attempt to auto-create a local user for the blocker.
    • Note that AuthManager::autoCreateUser() takes a "source" parameter, with valid values being a PrimaryAuthenticationProvider ID (for use during login via that provider) or a special token indicating that it's being created in Setup.php because the Session says the user is logged in. You'd have to pretend to be the session creating in Setup.php; I don't know whether that will confuse anything else.
    • Since auto-creation can fail, you'd have to fall back to one of the other solutions.
  • Prefix user names (either all or just those that don't exist locally) with some configured prefix, using the recently created "interwiki username" style like "meta>Example".
  • Convert the "gb_wiki" field into the proper interwiki prefix to reach that wiki, and prepend that. I don't think we have a way to do that conversion though, and it's possible it might fail so another fallback would be needed.
  • Just prefix the name with the "gb_wiki" value. It probably won't be linked in the block log, but a user seeing "metawiki>Example" will probably not be too confused.

I don't know whether that will confuse anything else.

After further review, it would at least cause issues if the user that's globally-blocked is coming from an IP that's blocked from account creation. The creation of the blocker would fail in that situation even though that creation has nothing to do with the IP of the request.

Change 397909 had a related patch set uploaded (by Legoktm; owner: Legoktm):
[mediawiki/extensions/GlobalBlocking@master] Update for Block::setBlocker() requiring a valid user or interwiki username

https://gerrit.wikimedia.org/r/397909

Change 397909 merged by jenkins-bot:
[mediawiki/extensions/GlobalBlocking@master] Update for Block::setBlocker() requiring a valid user or interwiki username

https://gerrit.wikimedia.org/r/397909

Change 397916 had a related patch set uploaded (by Legoktm; owner: Legoktm):
[mediawiki/extensions/GlobalBlocking@wmf/1.31.0-wmf.12] Update for Block::setBlocker() requiring a valid user or interwiki username

https://gerrit.wikimedia.org/r/397916

Change 397917 had a related patch set uploaded (by Legoktm; owner: Legoktm):
[mediawiki/extensions/GlobalBlocking@wmf/1.31.0-wmf.11] Update for Block::setBlocker() requiring a valid user or interwiki username

https://gerrit.wikimedia.org/r/397917

Change 397917 merged by jenkins-bot:
[mediawiki/extensions/GlobalBlocking@wmf/1.31.0-wmf.11] Update for Block::setBlocker() requiring a valid user or interwiki username

https://gerrit.wikimedia.org/r/397917

Change 397916 merged by jenkins-bot:
[mediawiki/extensions/GlobalBlocking@wmf/1.31.0-wmf.12] Update for Block::setBlocker() requiring a valid user or interwiki username

https://gerrit.wikimedia.org/r/397916

Legoktm closed this task as Resolved.Dec 14 2017, 5:51 PM

This should be fixed now.

mmodell changed the subtype of this task from "Task" to "Production Error".Aug 28 2019, 11:09 PM