Maniphest T205992

Allusers query auprop=rights does not include global rights (and is possibly wrong in other ways)
Closed, ResolvedPublicBUG REPORT
Actions

Assigned To

Authored By

	Krenair
	Oct 2 2018, 5:13 PM

Description

I just noticed that https://en.wikipedia.org/w/api.php?action=query&list=allusers&aufrom=Krenair&auto=Krenair&auprop=rights does not include editinterface for example

var realRights, auRights;
mw.user.getRights().then(function (r) { realRights = r; });
new mw.Api().get({'action': 'query', 'list': 'allusers', 'aufrom': 'Krenair', 'auto': 'Krenair', 'auprop': 'rights'}).then(function (d) { auRights = d.query.allusers[0].rights; });

console.log(realRights.length, auRights.length);
56 43

realRights.filter(x => auRights.indexOf(x) < 0);
(13) ["editcontentmodel", "editeditorprotected", "editextendedsemiprotected", "editinterface", "editprotected", "editsitecss", "editsitejs", "editsitejson", "editusercss", "edituserjs", "oathauth-enable", "protect", "suppressredirect"]

auRights.filter(x => realRights.indexOf(x) < 0);
[]

<bawolff> it also presumably doesnt include other rights from hooks or revoked rights from session (botpassword etc)

Details

	Subject	Repo	Branch	Lines +/-
	use getUserPermissions in query allusers api calls to get user rights	mediawiki/core	master	+26 -1

Customize query in gerrit

Related Objects

Mentioned In: T347633: Allow implicit user groups in the augroup and aurights parameters of the allusers API
Mentioned Here: rMWd05ddf6e0649: Make action=query&list=users use User::getRights()

Event Timeline

Krenair created this task.Oct 2 2018, 5:13 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptOct 2 2018, 5:13 PM

Krenair updated the task description. (Show Details)Oct 2 2018, 5:14 PM

Krenair updated the task description. (Show Details)Oct 2 2018, 5:18 PM

Rxy added a project: MediaWiki-extensions-CentralAuth.Oct 2 2018, 5:41 PM

Rxy moved this task from Backlog to Internal bugs on the MediaWiki-extensions-CentralAuth board.

Rxy subscribed.

(Might be CentralAuth, might also be a missing Hooks::run call or something in core. I haven't dug into it yet.)

https://en.wikipedia.org/w/api.php?action=query&meta=userinfo&uiprop=blockinfo%7Cgroups%7Crights%7Chasmsg is included global permission.

CentralAuth uses "UserGetRights" hook for implement global user rights. https://phabricator.wikimedia.org/diffusion/ECAU/browse/master/includes/CentralAuthHooks.php$897-909

ApiQueryAllUsers.php is calling User::getGroupPermissions method. but I seems it is no hook in User::getGroupPermissions and that method is simply expand local group permissions.
https://phabricator.wikimedia.org/source/mediawiki/browse/master/includes/api/ApiQueryAllUsers.php$323-327
https://phabricator.wikimedia.org/source/mediawiki/browse/master/includes/user/User.php$4945-4964

What ApiQueryAllUsers currently returns is the list of rights given by the local groups the user belongs to. It doesn't run the hooks used by CentralAuth to give rights from global groups, and it doesn't run the hooks other extensions might use to try to remove rights. At the most simple level, the fix could be to just use User->getRights() instead.

I note rMWd05ddf6e0649: Make action=query&list=users use User::getRights() fixed a similar issue in ApiQueryUsers, and seems to generally have more database-friendly code. Ideally the two would be rewritten to share common code for everything except the bits building the WHERE and ORDER BY bits of the query and the related parameter definitions.

Aklapper removed a subscriber: Anomie.Oct 16 2020, 5:01 PM

Restricted Application added a project: Platform Engineering. · View Herald TranscriptOct 16 2020, 5:01 PM

• AMooney removed a project: Platform Engineering.Oct 20 2020, 7:25 PM

Aklapper changed the subtype of this task from "Task" to "Bug Report".Nov 21 2022, 2:52 PM

Daimona mentioned this in T347633: Allow implicit user groups in the augroup and aurights parameters of the allusers API.Sep 28 2023, 8:58 PM

Tgr assigned this task to ArielGlenn.Oct 23 2023, 3:26 PM

Tgr added a project: MediaWiki-Platform-Team.

Tgr moved this task from Inbox, needs triage to Current Sprint on the MediaWiki-Platform-Team board.

I note that User::getRights() was deprecated in 1.34 and removed in 1.38. Apparently we are intended to use PermissionManager::getUserPermissions() instead.

Change 973730 had a related patch set uploaded (by ArielGlenn; author: ArielGlenn):

[mediawiki/core@master] run the UserGetRights hook in query allusers api calls

https://gerrit.wikimedia.org/r/973730

gerritbot added a project: Patch-For-Review.Nov 13 2023, 10:37 AM

What do folks think of something like the above? (Untested)

Change 973730 merged by jenkins-bot:

[mediawiki/core@master] use getUserPermissions in query allusers api calls to get user rights

https://gerrit.wikimedia.org/r/973730

ReleaseTaggerBot added a project: MW-1.42-notes (1.42.0-wmf.9; 2023-12-12).Dec 11 2023, 9:00 PM

Maintenance_bot removed a project: Patch-For-Review.Dec 11 2023, 9:10 PM

The above patch went out with last week's train, and is on all wikis (1.42.0-wmf.9) but the behaviour is unchanged so I'll need to look into this further.

Seems to work fine for me.

In T205992#9413542, @Tgr wrote:

Seems to work fine for me.

I tried both the link in the task description as well as using the web console and looking at that list, no editinterface in there. Tried both as logged out and logged in user. I wonder why you're getting different results.

Krenair is not a global interface editor anymore. You can test with some other account e.g. from here.

The one thing I didn't think to check. Of course it works fine on other accounts. Closing!

Allusers query auprop=rights does not include global rights (and is possibly wrong in other ways)Closed, ResolvedPublicBUG REPORTActions

Description

Details

Related Objects

Event Timeline

Allusers query auprop=rights does not include global rights (and is possibly wrong in other ways)
Closed, ResolvedPublicBUG REPORT
Actions