Page MenuHomePhabricator

Does not require people permission for logging in
Closed, ResolvedPublic

Description

Originally reported at: https://www.mediawiki.org/wiki/Topic:U5yoiz7dhxmn9eyw

Currently, GoogleLogin requests two scopes when logging in or registering a new account: email and profile. The profile scope is used to get the displayName of the corresponding Google+ profile when creating an account with GoogleLogin. However, as the e-mail address is retrieved from the Google+ response, too, this requires the user to actually have a Google+ account. We could, however, get the email address from the email scope only, too, which reduces the profile permission to the displayName only. I'm not really sure, if that is enough to require the users of this extension to have a Google+ profile, or whatever is needed to get back some data with the profile scope.

The question is: What is the default MediaWiki username when we do not try to get this displayName from Google+?

Event Timeline

Actually I seem to be incorrect. The extension does not require the people permission at all, as the displayName, where I thought it is used, comes from another set of data (where a server API key is used, instead of an actual permission of the user to access his data). So, let's reduce the scope of permissions here :D

Change 443014 had a related patch set uploaded (by Florianschmidtwelzow; owner: Florianschmidtwelzow):
[mediawiki/extensions/GoogleLogin@master] Remove profile permission scope from requested account permissions

https://gerrit.wikimedia.org/r/443014

Scope profile removed, *yay* :)

Change 443014 merged by jenkins-bot:
[mediawiki/extensions/GoogleLogin@master] Remove profile permission scope from requested account permissions

https://gerrit.wikimedia.org/r/443014

Change 487078 had a related patch set uploaded (by Florianschmidtwelzow; owner: Florianschmidtwelzow):
[mediawiki/extensions/GoogleLogin@REL1_31] Remove profile permission scope from requested account permissions

https://gerrit.wikimedia.org/r/487078

Change 487078 merged by Florianschmidtwelzow:
[mediawiki/extensions/GoogleLogin@REL1_31] Remove profile permission scope from requested account permissions

https://gerrit.wikimedia.org/r/487078