Page MenuHomePhabricator
Create Task
Maniphest T235333

Local steward flag assigned to Base on some closed wikis
Closed, InvalidPublic
Actions

Description

I have randomly viewed my own CentralAuth information ( https://meta.wikimedia.org/wiki/Special:CentralAuth/Base ) and discovered that I have local steward flags on the following closed wikis:

  • wikimania2014wiki
  • amwikiquote
  • angwikibooks

I could not find any local or Meta logs granting me the permissions. Nor do other stewards have the flags there.

I am indeed a steward so assuming there were no other random permission assignments it is not a security issue per se, but it's better to check that there weren't such.

Related Objects

Event Timeline

Base created this task.Oct 12 2019, 3:20 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptOct 12 2019, 3:20 PM
Base added projects: acl*stewards, SRE, WMF-General-or-Unknown.Oct 12 2019, 3:20 PM
Aklapper removed a project: SRE.Oct 12 2019, 3:30 PM
MarcoAurelio removed a project: acl*stewards.Oct 12 2019, 6:25 PM
MarcoAurelio changed the visibility from "Custom Policy" to "Custom Policy".
MarcoAurelio subscribed.Oct 12 2019, 6:31 PM
This comment was removed by MarcoAurelio.
Urbanecm closed this task as Invalid.Oct 13 2019, 12:20 AM
Urbanecm subscribed.

That's one of my attempts to create an account for you at (all) closed wikis as you requested, see T222117#5336682 for details. Feel free to revert if you want :).

MaxSem subscribed.Oct 13 2019, 12:38 AM

For the future, the correct way to accomplish that is CentralAuth's
createLocalAccount.php.

Base added a comment.Oct 13 2019, 6:50 AM

Oh, I didn't see that comment so it looked extremely weird. Thanks for both trying to help there and for clearing this up :)

Urbanecm added a comment.Oct 13 2019, 12:16 PM
In T235333#5570556, @MaxSem wrote:

For the future, the correct way to accomplish that is CentralAuth's
createLocalAccount.php.

Thanks! However, that's going to end up with Automatic account creation is not allowed as well :/.

Urbanecm changed the visibility from "Custom Policy" to "Public (No Login Required)".Oct 13 2019, 1:24 PM

Publishing, given no confidential issue is revealed here.

• chasemp added a project: Security.Feb 10 2020, 10:51 PM
• chasemp removed a project: acl*security.Feb 20 2020, 8:11 PM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits