Page MenuHomePhabricator

Some wikis set confirmed permissions that later get overwritten with autoconfirmed
Closed, ResolvedPublic

Description

As discovered while investigating T213003: Autoconfirmed rights set by extensions are out of sync with confirmed, some wikis set permissions for the confirmed group that later get overwritten with autoconfirmed via $wgGroupPermissions['confirmed'] = $wgGroupPermissions['autoconfirmed'] in CommonSettings.php:

eswiki:

'confirmed' => [ 'collectionsaveascommunitypage' => false ],

kowiki:

'confirmed' => [ // T85621
	'upload' => false,
	'reupload' => false,
],

nowiki:

'confirmed' => [ // T125448
	'autoconfirmed' => true,
	'collectionsaveascommunitypage' => true,
	'collectionsaveasuserpage' => true,
	'editsemiprotected' => true,
	'flow-edit-post' => true,
	'mwoauthproposeconsumer' => true,
	'mwoauthupdateownconsumer' => true,
	'move' => true,
	'reupload' => true,
	'skipcaptcha' => true,
	'transcode-reset' => true,
	'upload' => true,
],

Gotta do something about this!

Event Timeline

MaxSem created this task.Jan 24 2019, 11:58 PM
Restricted Application added subscribers: jeblad, revi, Aklapper. · View Herald TranscriptJan 24 2019, 11:58 PM

Change 486422 had a related patch set uploaded (by MaxSem; owner: MaxSem):
[operations/mediawiki-config@master] Remove explicit right grants for group 'confirmed'

https://gerrit.wikimedia.org/r/486422

revi added a comment.Jan 28 2019, 10:58 PM

Question: will removal of this settings on kowiki lead to confirmed user being able to upload file? That is against the purpose of T85621.

@revi There should be no effect, assigning/removing rights to/from confirmed user group have no effect, contrary to assigning/removing rights to/from autoconfirmed user group. Confirmed user group is defined as equivalent to autoconfirmed. If (auto)confirmed aren't able to upload files right now, they shouldn't be able to do it after this change as well.

Change 486422 merged by jenkins-bot:
[operations/mediawiki-config@master] Remove explicit right grants for group 'confirmed'

https://gerrit.wikimedia.org/r/486422

kchapman closed this task as Resolved.Mar 12 2019, 2:39 PM
kchapman claimed this task.
kchapman added a subscriber: kchapman.

This appears to be resolved, re-open if not the case.