Page MenuHomePhabricator

Disallow eliminators to block sysops on fawiki
Open, LowPublic

Description

Fawiki is one of the (I think) 2 or 3 wikis that has an "eliminator" group. This group is not sysop, but has the block right. Selection for this group is also not as rigorous as it is for becoming a sysop. The local policy specifically does not allow eliminators to block users who have any of the following rights: sysop, patrol, autopatrol, revert. We enforce this by retrospectively reviewing the logs.

Given T150826, we would like to make it technically impossible for eliminators to block sysops. My initial survey of the code shows this is not a quick fix. Ideas are welcome; my thought right now is to create an extension that (a) defines the "eliminator" role, and (b) calls the rights hooks to prevent the block attempts.

Event Timeline

Huji created this task.Nov 28 2018, 6:33 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptNov 28 2018, 6:33 PM
Huji triaged this task as Low priority.Nov 28 2018, 6:33 PM

I am setting priority, as I will be working on it myself.

I am setting it to low for now, to match the parent task. But indeed, since T150826 has been already implemented, this might deserve a higher priority.

@Huji maybe we could add a new global config, for instance wgGroupBlockRestrictions to serve this purpose. In fawiki's case, that would take a value of $wgGroupBlockRestrictions['eliminator'] = ['sysop']. This doesn't allow a customization based on user rights instead of user groups, but it could still be useful in a broader range of cases.

Huji claimed this task.Nov 29 2018, 1:40 AM

Excellent idea! Patch coming shortly.

Change 476439 had a related patch set uploaded (by Huji; owner: Huji):
[mediawiki/core@master] Enable restricting certain groups from blocking certain groups.

https://gerrit.wikimedia.org/r/476439

Huji moved this task from Backlog to Config - to process on the Wikimedia-Site-requests board.

Change 476503 had a related patch set uploaded (by Huji; owner: Huji):
[operations/mediawiki-config@master] Dissallow eliminators to block certain groups on fawiki

https://gerrit.wikimedia.org/r/476503

Huji added a comment.Nov 29 2018, 6:53 PM

Test instructions for https://gerrit.wikimedia.org/r/476439

  1. Add the following to LocalSettings.php :
$wgGroupBlockRestrictions['eliminator'] = [ 'sysop' ];
$wgGroupPermissions['eliminator']['block']  = true;
  1. Create an account and promote them to the "eliminator" group. Make sure you also have a user in the "sysop" group.
  2. Log in using the "eliminator" user and try to block the "sysop" user. You should get a warning message disallowing you. Submitting the form should also result in failure.
Sannita renamed this task from Dissallow eliminators to block sysops on fawiki to Disallow eliminators to block sysops on fawiki.Dec 15 2018, 8:51 PM

Change 476439 abandoned by Huji:
Enable restricting certain groups from blocking certain groups.

Reason:
Too many people have described this as config creep, so I am going to abandon this.

https://gerrit.wikimedia.org/r/476439

Change 476503 abandoned by Huji:
Dissallow eliminators to block certain groups on fawiki

https://gerrit.wikimedia.org/r/476503

Huji removed Huji as the assignee of this task.Jul 27 2019, 12:13 AM