Page MenuHomePhabricator

Autoconfirmed rights set by extensions are out of sync with confirmed
Closed, ResolvedPublic5 Estimated Story Points


On enwiki and testwiki additional restrictions for creating pages in (main) namespace were added somewhat recently (see also T204016). This access was added to the site configuration for "autoconfirmed" but not the "confirmed" usergroups. The primary purpose of the "confirmed" usergroup is to allow for manually granting access that autoconfirmed has, so this appears to be an oversight.

Short hold for comments is open at:

Event Timeline

Testing notes (may need another task) - users without createpagemainns ARE able to create these pages if they initialize a page in another namespace, then use the MOVE process - this seems like it should be a security violation.

@MaxSem do you have any input on this, especially related to T204016?

Niharika triaged this task as Medium priority.Jan 16 2019, 1:09 AM

Triaging this as Normal priority. We can estimate it in next week's meeting unless the engineers get to it first in the Engineering meeting.

Niharika set the point value for this task to 5.Jan 23 2019, 12:50 AM
Niharika moved this task from Needs Discussion to Up Next (June 3-21) on the Community-Tech board.

Oops, another permission set by extension directly - transcode-reset - is also affected.

The autopsy results:

  1. Defaults are getting set in DefaultSettings.php
  2. We customize that per-wiki in InitialiseSettings.php
  3. In CommonSettings.php we do $wgGroupPermissions['confirmed'] = $wgGroupPermissions['autoconfirmed']; to ensure that confirmed users have the same rights as autoconfirmed.
  4. We load extensions in CommonSettings.php, some of which - like ArticleCreationWorkflow and TimedMediaHandler - assign new privileges to autoconfirmed users.
  5. Boom! We're out of sync.
MaxSem renamed this task from add createpagemainns to the confirmed usergroup on testwiki and enwiki to Autoconfirmed rights set by extensions are out of sync with confirmed.Jan 24 2019, 11:38 PM

Change 486405 had a related patch set uploaded (by MaxSem; owner: MaxSem):
[operations/mediawiki-config@master] Set confirmed permissions after extensions are loaded

In general, it's fine to add TimedMediaHandler.

Change 486405 merged by jenkins-bot:
[operations/mediawiki-config@master] Set confirmed permissions after extensions are loaded