Page MenuHomePhabricator

Remove the medlem user group and the editallpages user right on se.wikimedia.org
Closed, ResolvedPublic

Description

Originally the swwikimedia wiki limited editing to the members of the medlem (member) user group only. That limitation was lifted in T41671: Open editing on se.wikimedia.org for any logged-in user but both the user group and the associated user right editallpages were left.

It has now been discovered that these leftovers interfere with the available grants and therfore also both OAuth and BotPasswords. The easiest solution is to clean up the config and remove the medlem group and editallpages right.


Was: API error protectednamespace incorrectly triggered when logged in using BotPassword
When trying to do edits to the Projekt namespace on the wmse chapterwiki I repeatedly get a "API error protectednamespace: You do not have permission to edit pages in the Projekt namespace." warning despite the bot having the correct permissions to edit this namespace (you need the editallpages permission which is given to logged in users). The bot is logged in using a BotPassword

Logging the bot in using the main password allows me to do the same changes so the error is either caused by BotPasswords or by pywikibots implementation of it.

The grants given to the BotPassword "account" were

  • Basic rights
  • High-volume editing
  • Edit existing pages
  • Edit protected pages
  • Create, edit, and move pages
  • Upload, replace and move files
  • Patrol changes to pages

I encounter this both when using the replace.py script and when using pywikibot as a library. I also encounter it even when logging the bot in as a sysop (and making the bot a sysop).

Event Timeline

Adding Oauth tag as that is the closest I can find to one for the BotPasswords functionallity (please change if wrong)

There isn't an issue with BotPasswords or Pywikibot. None of the grants on that wiki have editallpages, so when using a BotPassword or OAuth you effectively don't have that right. A configuration change is required to add editallpages to one (or more) of the existing grants.

Xqt triaged this task as High priority.Jan 16 2018, 3:23 PM

Thanks @JJMC89 I'd missed that editallpages had been especially crafted for sewikimedia. I guess it can either be added to the editpage grant (or maybe the sewikimedia config might be simplified by now).

Quick note to self: Should be possible to add the following at about line 12421 of wmf-config/InitialiseSettings.php

# wgGrantPermissions @{
'wgGrantPermissions' => [
  'sewikimedia' => [
    'editpage' => [ 'editallpages' => true ], // T184981
  ],
],
# @} end of wgGrantPermissions

Probably more like '+sewikimedia', although even that might replace editpage instead of merging into it (if that's the case you'd have to add it in CommonSettings.php).

Probably more like '+sewikimedia', although even that might replace editpage instead of merging into it (if that's the case you'd have to add it in CommonSettings.php).

I looked into the source of the extra right and found that neither it nor the extra user group are used anymore. I'll update the task description and submit a patch.

Thanks everyone for figuring out the source of this behaviour.

Lokal_Profil renamed this task from API error protectednamespace incorrectly triggered when logged in using BotPassword to Remove the medlem user group and the editallpages user right on se.wikimedia.org.Jan 18 2018, 9:07 AM
Lokal_Profil updated the task description. (Show Details)

Change 404942 had a related patch set uploaded (by Lokal Profil; owner: Lokal Profil):
[operations/mediawiki-config@master] Drop the medlem user group and editallpages user right

https://gerrit.wikimedia.org/r/404942

Please do not forget to remove all users from that group. If you do not remove the users from the group previously, the result is that they'll still will hold the 'medlem' right in the shadows and will appear as such in Special:ListUsers. If there are many, you can get them removed from the group by manually issuing a SQL command. See example at T171682 (although there are more I filled but I can't find them atm).

Please do not forget to remove all users from that group. If you do not remove the users from the group previously, the result is that they'll still will hold the 'medlem' right in the shadows and will appear as such in Special:ListUsers. If there are many, you can get them removed from the group by manually issuing a SQL command. See example at T171682 (although there are more I filled but I can't find them atm).

Thanks. I've now removed all of the members from that group.

I feel sorry you had to do all that by hand. MediaWiki core should offer a maintenance script to do this.

I feel sorry you had to do all that by hand. MediaWiki core should offer a maintenance script to do this.

Not too bad since not too many. But for larger wikis a maintenance script would be good.
Is there anything else needed from the patch?

The patch looks good to me now. @Urbanecm can you have a look at it as well? Thanks.

Change 404942 merged by jenkins-bot:
[operations/mediawiki-config@master] Drop the medlem user group and editallpages user right

https://gerrit.wikimedia.org/r/404942

Mentioned in SAL (#wikimedia-operations) [2018-02-28T14:50:22Z] <zfilipin@tin> Synchronized wmf-config/InitialiseSettings.php: SWAT: [[gerrit:404942|Drop the medlem user group and editallpages user right (T184981)]] (duration: 00m 57s)

MarcoAurelio assigned this task to Lokal_Profil.
MarcoAurelio removed a project: Patch-For-Review.