Page MenuHomePhabricator

Autoconfirmed rights set by extensions are out of sync with confirmed
Closed, ResolvedPublic5 Story Points

Description

On enwiki and testwiki additional restrictions for creating pages in (main) namespace were added somewhat recently (see also T204016). This access was added to the site configuration for "autoconfirmed" but not the "confirmed" usergroups. The primary purpose of the "confirmed" usergroup is to allow for manually granting access that autoconfirmed has, so this appears to be an oversight.

Short hold for comments is open at: https://en.wikipedia.org/wiki/Wikipedia_talk:Requests_for_permissions#%22confirmed%22_users_can_no_longer_create_articles

Details

Related Gerrit Patches:
operations/mediawiki-config : masterSet confirmed permissions after extensions are loaded

Event Timeline

Xaosflux created this task.Jan 5 2019, 3:45 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJan 5 2019, 3:45 PM
JJMC89 added a subscriber: JJMC89.

Testing notes (may need another task) - users without createpagemainns ARE able to create these pages if they initialize a page in another namespace, then use the MOVE process - this seems like it should be a security violation.

@MaxSem do you have any input on this, especially related to T204016?

Restricted Application added a project: Community-Tech. · View Herald TranscriptJan 15 2019, 11:28 PM

Taking Community-Tech-Sprint off until this has been reviewed by @Niharika and @jmatazzoni and/or estimated. :)

Niharika triaged this task as Normal priority.Jan 16 2019, 1:09 AM

Triaging this as Normal priority. We can estimate it in next week's meeting unless the engineers get to it first in the Engineering meeting.

Niharika set the point value for this task to 5.Jan 23 2019, 12:50 AM
Niharika moved this task from To be estimated/discussed to Estimated on the Community-Tech board.
MaxSem claimed this task.Jan 24 2019, 2:35 AM
MaxSem moved this task from Ready to In Development on the Community-Tech-Sprint board.

Oops, another permission set by extension directly - transcode-reset - is also affected.

The autopsy results:

  1. Defaults are getting set in DefaultSettings.php
  2. We customize that per-wiki in InitialiseSettings.php
  3. In CommonSettings.php we do $wgGroupPermissions['confirmed'] = $wgGroupPermissions['autoconfirmed']; to ensure that confirmed users have the same rights as autoconfirmed.
  4. We load extensions in CommonSettings.php, some of which - like ArticleCreationWorkflow and TimedMediaHandler - assign new privileges to autoconfirmed users.
  5. Boom! We're out of sync.
MaxSem renamed this task from add createpagemainns to the confirmed usergroup on testwiki and enwiki to Autoconfirmed rights set by extensions are out of sync with confirmed.Jan 24 2019, 11:38 PM

Change 486405 had a related patch set uploaded (by MaxSem; owner: MaxSem):
[operations/mediawiki-config@master] Set confirmed permissions after extensions are loaded

https://gerrit.wikimedia.org/r/486405

In general, it's fine to add TimedMediaHandler.

Change 486405 merged by jenkins-bot:
[operations/mediawiki-config@master] Set confirmed permissions after extensions are loaded

https://gerrit.wikimedia.org/r/486405

MaxSem closed this task as Resolved.Feb 5 2019, 12:30 AM
MaxSem moved this task from Needs Review/Feedback to Q3 2018-19 on the Community-Tech-Sprint board.