Page MenuHomePhabricator
Create Task
Maniphest T208477

Move "privileged account' concept into MediaWiki core
Closed, ResolvedPublic
Actions

Description

IMO the kind of authentication logging we are doing is expected from any decent application by default and should live in core. (Also, for obvious reasons the config files are a poor place for business logic.) The only reason this is not trivial to do is the wfGetPrivilegedGroups method which is used to enrich the logs and is somewhat WMF-specific. We should probably move it (and the whole logging) to core.

We could have a static User::getPrivilegedGroups() method, a $wgPrivilegedGroups config settings which defaults to admin/bureaucrat/interface-admin and a GetPrivilegedGroups hook for CentralAuth and similar extensions to tie into.

See also:

Details

Related Changes in Gerrit:
Show related patches Customize query in gerrit

Related Objects
Search...

Event Timeline

Tgr created this task.Nov 1 2018, 4:02 AM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptNov 1 2018, 4:02 AM
Tgr mentioned this in T150826: Remove unblockself right on wikimedia wikis (but allow blocked admins to block their blocker).Nov 26 2018, 7:51 PM
AfroThundr3007730 subscribed.Nov 27 2018, 2:20 AM
Agabi10 subscribed.Nov 27 2018, 7:21 AM
Risker subscribed.Dec 21 2018, 5:15 AM
gerritbot subscribed.Jan 7 2019, 8:22 AM

Change 482589 had a related patch set uploaded (by Gergő Tisza; owner: Gergő Tisza):
[mediawiki/core@master] Add User::getPrivilegedGroups()

https://gerrit.wikimedia.org/r/482589

gerritbot added a project: Patch-For-Review.Jan 7 2019, 8:22 AM
Tgr mentioned this in T69936: Provide a useable way to bypass abuse filters.Nov 27 2019, 7:01 PM
• chasemp triaged this task as Medium priority.Dec 9 2019, 4:42 PM
• chasemp added a project: Security-Team.
• chasemp moved this task from Incoming to Watching on the Security-Team board.Dec 9 2019, 5:35 PM
Tgr mentioned this in T197087: Remove or limit ability to edit the user JS of another user who has higher privileges.Dec 10 2019, 5:11 AM
• chasemp added a project: Security.Feb 10 2020, 10:57 PM
• chasemp removed a project: acl*security.Feb 20 2020, 8:06 PM
Tgr mentioned this in T180896: Allow functionaries to reset second factor on low-risk accounts.Dec 20 2020, 10:37 PM
gerritbot added a comment.Feb 1 2021, 11:55 PM

Change 482589 had a related patch set uploaded (by Reedy; owner: Gergő Tisza):
[mediawiki/core@master] Add UserManager::getUserPrivilegedGroups()

https://gerrit.wikimedia.org/r/482589

Izno subscribed.Feb 23 2021, 6:42 AM
TheDJ subscribed.Jun 28 2021, 1:33 PM
Tgr mentioned this in T290790: Group OAuth grants by riskiness.Sep 2 2023, 10:26 AM
gerritbot added a comment.Sep 4 2023, 8:47 AM

Change 482589 merged by jenkins-bot:

[mediawiki/core@master] Add UserGroupManager::getUserPrivilegedGroups()

https://gerrit.wikimedia.org/r/482589

Restricted Application added a project: MediaWiki-Core-Platform-Team. · View Herald TranscriptSep 4 2023, 8:47 AM
ReleaseTaggerBot added a project: MW-1.41-notes (1.41.0-wmf.25; 2023-09-05).Sep 4 2023, 9:00 AM
• larissagaulia moved this task from Inbox, needs triage to Radar on the MediaWiki-Core-Platform-Team board.Sep 4 2023, 11:05 AM
• larissagaulia edited projects, added: MediaWiki-Core-Platform-Team (Radar); removed: MediaWiki-Core-Platform-Team.
gerritbot added a comment.Sep 4 2023, 12:11 PM

Change 954628 had a related patch set uploaded (by Reedy; author: Gergő Tisza):

[mediawiki/core@REL1_40] Add UserGroupManager::getUserPrivilegedGroups()

https://gerrit.wikimedia.org/r/954628

gerritbot added a comment.Sep 4 2023, 12:12 PM

Change 954629 had a related patch set uploaded (by Reedy; author: Gergő Tisza):

[mediawiki/core@REL1_39] Add UserGroupManager::getUserPrivilegedGroups()

https://gerrit.wikimedia.org/r/954629

Reedy subscribed.Sep 4 2023, 12:29 PM

Started basic documentation at https://www.mediawiki.org/wiki/Manual:$wgPrivilegedGroups

gerritbot added a comment.Sep 4 2023, 5:06 PM

Change 954730 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/core@master] UserGroupManager: Fixup getUserPrivilegedGroups docs

https://gerrit.wikimedia.org/r/954730

Reedy added a comment.Sep 4 2023, 5:17 PM
In T208477#9140158, @Reedy wrote:

Started basic documentation at https://www.mediawiki.org/wiki/Manual:$wgPrivilegedGroups

And https://www.mediawiki.org/wiki/Manual:Hooks/UserPrivilegedGroups

gerritbot added a comment.Sep 4 2023, 6:21 PM

Change 954730 merged by jenkins-bot:

[mediawiki/core@master] UserGroupManager: Fixup getUserPrivilegedGroups docs

https://gerrit.wikimedia.org/r/954730

gerritbot added a comment.Sep 4 2023, 6:33 PM

Change 954629 merged by jenkins-bot:

[mediawiki/core@REL1_39] Add UserGroupManager::getUserPrivilegedGroups()

https://gerrit.wikimedia.org/r/954629

gerritbot added a comment.Sep 4 2023, 6:36 PM

Change 954628 merged by jenkins-bot:

[mediawiki/core@REL1_40] Add UserGroupManager::getUserPrivilegedGroups()

https://gerrit.wikimedia.org/r/954628

ReleaseTaggerBot added projects: MW-1.39-notes, MW-1.40-notes.Sep 4 2023, 7:00 PM
gerritbot added a comment.Sep 4 2023, 7:09 PM

Change 954742 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/core@master] Expose PrivilegedGroups to extension schema

https://gerrit.wikimedia.org/r/954742

sbassett awarded a token.Sep 5 2023, 2:21 PM
gerritbot added a comment.Sep 7 2023, 2:45 PM

Change 955757 had a related patch set uploaded (by Jforrester; author: Jforrester):

[mediawiki/extensions/WikiLambda@master] Flag functioneer and functionmainters as privileged

https://gerrit.wikimedia.org/r/955757

gerritbot added a comment.Sep 7 2023, 3:04 PM

Change 955767 had a related patch set uploaded (by Jforrester; author: Jforrester):

[mediawiki/extensions/CheckUser@master] Flag checkusers privileged

https://gerrit.wikimedia.org/r/955767

gerritbot added a comment.Sep 7 2023, 3:06 PM

Change 955768 had a related patch set uploaded (by Jforrester; author: Jforrester):

[mediawiki/extensions/CentralAuth@master] Flag stewards as privileged

https://gerrit.wikimedia.org/r/955768

gerritbot added a comment.Sep 7 2023, 3:13 PM

Change 955770 had a related patch set uploaded (by Jforrester; author: Jforrester):

[mediawiki/extensions/WikimediaIncubator@master] Flag test-sysops as privileged

https://gerrit.wikimedia.org/r/955770

Jdforrester-WMF subscribed.Sep 7 2023, 3:16 PM

OK, I've quickly read through every hit on this search and I think the only four production repos we care about rights from (beyond core itself) are as patched above:

[mediawiki/extensions/WikiLambda@master] Flag functioneer and functionmainters as privileged
https://gerrit.wikimedia.org/r/955757

[mediawiki/extensions/CheckUser@master] Flag checkusers privileged
https://gerrit.wikimedia.org/r/955767

[mediawiki/extensions/CentralAuth@master] Flag stewards as privileged
https://gerrit.wikimedia.org/r/955768

[mediawiki/extensions/WikimediaIncubator@master] Flag test-sysops as privileged
https://gerrit.wikimedia.org/r/955770

gerritbot added a comment.Sep 7 2023, 3:22 PM

Change 954742 merged by jenkins-bot:

[mediawiki/core@master] Expose PrivilegedGroups to extension schema

https://gerrit.wikimedia.org/r/954742

gerritbot added a comment.Sep 7 2023, 3:24 PM

Change 955064 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/core@REL1_40] Expose PrivilegedGroups to extension schema

https://gerrit.wikimedia.org/r/955064

gerritbot added a comment.Sep 7 2023, 3:25 PM

Change 955065 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/core@REL1_39] Expose PrivilegedGroups to extension schema

https://gerrit.wikimedia.org/r/955065

gerritbot added a comment.Sep 7 2023, 3:43 PM

Change 955065 merged by jenkins-bot:

[mediawiki/core@REL1_39] Expose PrivilegedGroups to extension schema

https://gerrit.wikimedia.org/r/955065

gerritbot added a comment.Sep 7 2023, 3:47 PM

Change 955064 merged by jenkins-bot:

[mediawiki/core@REL1_40] Expose PrivilegedGroups to extension schema

https://gerrit.wikimedia.org/r/955064

ReleaseTaggerBot edited projects, added: MW-1.41-notes (1.41.0-wmf.26; 2023-09-12); removed: MW-1.41-notes (1.41.0-wmf.25; 2023-09-05).Sep 7 2023, 4:00 PM
gerritbot added a comment.Sep 7 2023, 4:33 PM

Change 955768 merged by jenkins-bot:

[mediawiki/extensions/CentralAuth@master] Flag stewards as privileged

https://gerrit.wikimedia.org/r/955768

gerritbot added a comment.Sep 7 2023, 4:48 PM

Change 955767 merged by jenkins-bot:

[mediawiki/extensions/CheckUser@master] Flag checkusers privileged

https://gerrit.wikimedia.org/r/955767

gerritbot added a comment.Sep 7 2023, 4:49 PM

Change 955788 had a related patch set uploaded (by Dreamy Jazz; author: Jforrester):

[mediawiki/extensions/CheckUser@REL1_40] Flag checkusers privileged

https://gerrit.wikimedia.org/r/955788

gerritbot added a comment.Sep 7 2023, 4:49 PM

Change 955789 had a related patch set uploaded (by Dreamy Jazz; author: Jforrester):

[mediawiki/extensions/CheckUser@REL1_39] Flag checkusers privileged

https://gerrit.wikimedia.org/r/955789

gerritbot added a comment.Sep 7 2023, 4:57 PM

Change 955788 merged by jenkins-bot:

[mediawiki/extensions/CheckUser@REL1_40] Flag checkusers privileged

https://gerrit.wikimedia.org/r/955788

Tgr added a comment.Sep 7 2023, 5:42 PM
In T208477#9150179, @Jdforrester-WMF wrote:

OK, I've quickly read through every hit on this search and I think the only four production repos we care about rights from (beyond core itself) are as patched above:

Should we add push-subscripton-managers as well? Per T259148, it's some sort of system bot account.

Jdforrester-WMF added a comment.Sep 7 2023, 5:45 PM
In T208477#9150716, @Tgr wrote:
In T208477#9150179, @Jdforrester-WMF wrote:

OK, I've quickly read through every hit on this search and I think the only four production repos we care about rights from (beyond core itself) are as patched above:

Should we add push-subscripton-managers as well? Per T259148, it's some sort of system bot account.

I felt that it wasn't a risky-enough user right set to warrant it, but I defer to others' views. :-)

gerritbot added a comment.Sep 7 2023, 5:46 PM

Change 955770 merged by jenkins-bot:

[mediawiki/extensions/WikimediaIncubator@master] Flag test-sysops as privileged

https://gerrit.wikimedia.org/r/955770

gerritbot added a comment.Sep 8 2023, 9:16 AM

Change 955801 had a related patch set uploaded (by Reedy; author: Jforrester):

[mediawiki/extensions/CentralAuth@REL1_40] Flag stewards as privileged

https://gerrit.wikimedia.org/r/955801

gerritbot added a comment.Sep 8 2023, 9:17 AM

Change 955802 had a related patch set uploaded (by Reedy; author: Jforrester):

[mediawiki/extensions/CentralAuth@REL1_39] Flag stewards as privileged

https://gerrit.wikimedia.org/r/955802

gerritbot added a comment.Sep 8 2023, 9:21 AM

Change 955802 merged by jenkins-bot:

[mediawiki/extensions/CentralAuth@REL1_39] Flag stewards as privileged

https://gerrit.wikimedia.org/r/955802

gerritbot added a comment.Sep 8 2023, 9:22 AM

Change 955801 merged by jenkins-bot:

[mediawiki/extensions/CentralAuth@REL1_40] Flag stewards as privileged

https://gerrit.wikimedia.org/r/955801

gerritbot added a comment.Sep 8 2023, 12:18 PM

Change 955789 merged by jenkins-bot:

[mediawiki/extensions/CheckUser@REL1_39] Flag checkusers privileged

https://gerrit.wikimedia.org/r/955789

gerritbot added a comment.Sep 12 2023, 12:18 AM

Change 955757 merged by jenkins-bot:

[mediawiki/extensions/WikiLambda@master] Flag functioneer and functionmainters as privileged

https://gerrit.wikimedia.org/r/955757

Reedy mentioned this in T347414: Migrate $wmgPrivilegedGroups to $wgPrivilegedGroups.Sep 26 2023, 4:40 PM
Reedy added a parent task: T347414: Migrate $wmgPrivilegedGroups to $wgPrivilegedGroups.Sep 26 2023, 4:43 PM
Jdforrester-WMF added a comment.Sep 26 2023, 4:54 PM

Resolved?

Seb35 updated the task description. (Show Details)Oct 28 2023, 3:14 PM
Tgr moved this task from Radar to Needs refinement on the MediaWiki-Core-Platform-Team board.Dec 4 2023, 9:46 PM
Tgr edited projects, added: MediaWiki-Core-Platform-Team; removed: MediaWiki-Core-Platform-Team (Radar).
Pppery removed a project: Patch-For-Review.Nov 16 2025, 3:18 AM
Seb35 updated the task description. (Show Details)Jan 12 2026, 11:01 AM
Seb35 closed this task as Resolved.Jan 12 2026, 11:16 AM
Seb35 assigned this task to Reedy.
Seb35 subscribed.

I mark this as Resolved mainly by Reedy on 1.39.5/1.40.1/1.41.0:

  • parameter $wgPrivilegedGroups added
  • method MediaWiki\User\UserGroupManager::getUserPrivilegedGroups added
  • hook onUserPrivilegedGroups added
  • extensions may declare some groups as privileged in their extension.json/skin.json

Some extensions have already used the concept of "privileged groups" (CentralAuth, CheckUser, WikimediaIncubator, WikiLambda). If other extensions want to declare some added groups as "privileged" it’s up to them (Echo mentionned above).

The task T347414: Migrate $wmgPrivilegedGroups to $wgPrivilegedGroups was created to adapt WMF config to this new core parameter.

• matmarex mentioned this in T418507: Move wmfGetPrivilegedGroups(), $wmgPrivilegedGroups, $wmgPrivilegedGlobalGroups, GetSecurityLogContext and PasswordPoliciesForUser hook handlers to WikimediaCustomizations.Apr 15 2026, 9:04 PM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits