CentralAuth's group membership is not reliable
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	Urbanecm
	Jun 8 2020, 9:28 PM

Description

SpecialCentralAuth uses UserGroupMembership::getMembershipForUser, which is given an userid and a database, but the database is ignored, which results in SpecialCentralAuth receiving incorrect results. An example is available at https://en.wikipedia.beta.wmflabs.org/wiki/Special:CentralAuth/Dyolf77_TEST. The acount should have confirmed, oversight, sysop at commons, but that's not true.

A fix: Use UserGroupManagerFactory at https://github.com/wikimedia/mediawiki-extensions-CentralAuth/blob/master/includes/CentralAuthUser.php#L2554, to get the DB-specific UserGroupManager.

Details

	Subject	Repo	Branch	Lines +/-
	CentralAuthUser: Stop using depracated UserGroupMembership::getMembershipsForUser	mediawiki/extensions/CentralAuth	master	+11 -2

Customize query in gerrit

Related Objects
Search...

Status	Subtype	Assigned	Task
Resolved	Release	jeena	T254173 1.35.0-wmf.36 deployment blockers
Resolved		• Pchelolo	T234921 Factor group membership management out of User class
Resolved		Urbanecm	T254822 CentralAuth's group membership is not reliable

Event Timeline

Urbanecm created this task.Jun 8 2020, 9:28 PM

Restricted Application added a project: User-Urbanecm. · View Herald TranscriptJun 8 2020, 9:28 PM

Restricted Application added a subscriber: Aklapper. · View Herald Transcript

This is going to seriously break Special:CentralAuth in production if train goes forward.

Restricted Application added a subscriber: Liuxinyu970226. · View Herald TranscriptJun 8 2020, 9:29 PM

DannyS712 added a project: MediaWiki-User-management.Jun 8 2020, 9:29 PM

DannyS712 added parent tasks: T254173: 1.35.0-wmf.36 deployment blockers, T234921: Factor group membership management out of User class.

Urbanecm mentioned this in T254173: 1.35.0-wmf.36 deployment blockers.Jun 8 2020, 9:30 PM

@Pchelolo see above - if the fix for CentralAuth can't be reviewed in time, we'll probably need to revert https://gerrit.wikimedia.org/r/#/c/mediawiki/core/+/545690

Jdforrester-WMF awarded a token.Jun 8 2020, 9:31 PM

Agusbou2015 subscribed.Jun 8 2020, 9:33 PM

RhinosF1 subscribed.Jun 8 2020, 9:35 PM

Change 603618 had a related patch set uploaded (by Urbanecm; owner: Urbanecm):
[mediawiki/extensions/CentralAuth@master] CentralAuthUser: Stop using depracated UserGroupMembership::getMembershipsForUser

https://gerrit.wikimedia.org/r/603618

gerritbot added a project: Patch-For-Review.Jun 8 2020, 9:36 PM

Confirmed the patch above works at my local CA instance, hopefully it will work in prod too :).

Urbanecm mentioned this in T254826: Special:Investigate's determination of user groups is unreliable.Jun 8 2020, 10:08 PM

Change 603618 merged by jenkins-bot:
[mediawiki/extensions/CentralAuth@master] CentralAuthUser: Stop using depracated UserGroupMembership::getMembershipsForUser

https://gerrit.wikimedia.org/r/603618