Page MenuHomePhabricator

Cookie blocks apply regardless of ipblock-exempt right
Open, MediumPublic2 Estimate Story PointsBUG REPORT

Description

Sysops are automatically granted the ipblock-exempt right. As such, they shouldn't be affected by IP blocks, but that turns out to be false.

Steps to reproduce:

  1. Block an account indefinitely with autoblock enabled
  2. Sign in with that account and then logout
  3. Go back to your account with sysop access

You'll find yourself autoblocked and unable to take any action due to the removal of the unblock-self right.


From the merged-in task

It appears that admins are affected by IP autoblocks, despite having IP block exemption.
18:31: I block my test account (User:WK-test) on enwiki with autoblock disabled for 10 minutes.
18:32: I log out of my admin account (User:Writ Keeper) to log into my test account and make a test edit to User talk:WK-test. It completes successfully. I then log out of my test account and back into my main account and verify that I can still edit pages.
18:34: I change the block settings on WK-test to enable autoblock, and nothing else.
18:35: Again, I log out of Writ Keeper and into WK-test and make a test edit to User talk:WK-test. I log out and back into Writ Keeper, and the Writ Keeper account is now affected by the autoblock, despite being an admin, which should imply exemption from autoblocks.
Screenshot of the message shown (note the time--18:40, while the 18:31 block is still active--and that the logged-in user is Writ Keeper): https://commons.wikimedia.org/wiki/File:AdminAutoblock.png

Details

Related Gerrit Patches:

Event Timeline

Sakretsu created this task.Sep 20 2019, 5:21 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptSep 20 2019, 5:21 PM

Thanks for reporting - this appears to be happening because of cookie blocks rather than autoblocks. Following the steps locally, I find:

  • the sysop is only blocked if cookie blocks are enabled ($wgCookieSetOnAutoblock = true)
  • the sysop sees the same block message as the blocked user, rather than the autoblock message
  • the block ID cookie is set

Note that to confirm this, you'll need to make sure the cookie is cleared first, e.g. by setting the config to false, unblocking the blocked user, and opening the editor as the newly-unblocked user. After that, following the steps in the task description, the sysop should not be blocked (and there should still be an autoblock for anonymous users).

Cookie blocks that spawn from user account blocks are intended to block other logged in users (T5233), and there is currently no 'cookieblock-exempt' right. Perhaps there should be - or perhaps the 'ipblock-exempt' right should protect from cookie blocks too?

It may be that this issue has only been noticed recently because the default config for cookie blocks have recently changed: T191922. I notice that in T191922#4122153 @Krinkle suggested leaving the default in DefaultSettings as false and overriding CommonSettings to true for all WMF wikis. Worth revisiting that idea since cookie blocks can be quite aggressive?

To summarize, this is not strictly speaking a bug, but it may be worth considering:

  • should 'ipblock-exempt' exempt users from cookie blocks too (or should we have a 'cookieblock-exempt' right)?
  • should $wgCookieSetOnAutoblock (and $wgCookieSetOnIpBlock) be false by default in core?

@dmaza - do you have any thoughts on changing the config back to false in core?

dmaza added a comment.Sep 23 2019, 8:19 PM

@dmaza - do you have any thoughts on changing the config back to false in core?

I believe my argument for that patch was that cookie blocking should be a standard feature and thus be enabled by default in core. We were already enabling it for all our wikis via CommonSettings.

should 'ipblock-exempt' exempt users from cookie blocks too

I think this make sense. Cookie blocks only represent ip targets and if you are ipblock-exempt you should not be affected by it(?).

I believe my argument for that patch was that cookie blocking should be a standard feature and thus be enabled by default in core.

Thanks, I saw your comment on the original task but thought it might be worth revisiting the decision given the confusion that arose here...

Cookie blocks only represent ip targets

Cookie blocks can arise from blocks against IPs or against user accounts. If a cookie block comes from a user account block, it will block logged-in users. That's what's happening to cause this issue.

Tchanders renamed this task from Autoblocks apply regardless of ipblock-exempt right to Cookie blocks apply regardless of ipblock-exempt right.Oct 24 2019, 7:06 PM
Restricted Application added a subscriber: MGChecker. · View Herald TranscriptJan 15 2020, 7:24 PM
Niharika triaged this task as Medium priority.Jan 15 2020, 9:06 PM
Niharika updated the task description. (Show Details)
Niharika moved this task from Untriaged to Cards ready to be discussed on the Anti-Harassment board.

Let's discuss this in our next estimation.

You'll find yourself autoblocked and unable to take any action due to the removal of the unblock-self right.

This is not entirely true. Deleting the cookie will remove the block.

Jony added a subscriber: Jony.Jan 16 2020, 2:49 AM
Niharika changed the subtype of this task from "Task" to "Bug Report".Jan 23 2020, 7:11 PM
Niharika set the point value for this task to 2.

Change 570771 had a related patch set uploaded (by Tchanders; owner: Tchanders):
[mediawiki/core@master] Exempt users with 'ipblock-exempt' right from cookie blocks

https://gerrit.wikimedia.org/r/570771

Tchanders claimed this task.Fri, Feb 7, 2:35 AM
Tchanders moved this task from Ready to In Progress on the Anti-Harassment (The Letter Song) board.

Change 570771 merged by jenkins-bot:
[mediawiki/core@master] Exempt users with 'ipblock-exempt' right from all cookie blocks

https://gerrit.wikimedia.org/r/570771

dom_walden added a subscriber: dom_walden.

Autoblock cookie remains after logging in as admin, but not applied. Remains after logging out (so user is blocked again).

IP block is removed when you log in, so does not matter.

Version: https://en.wikipedia.beta.wmflabs.org MediaWiki 1.35.0-alpha (8035384) 09:23, 22 February 2020