Page MenuHomePhabricator

Remove investigate right in favor of checkuser right for Special:Investigate
Closed, ResolvedPublic2 Estimated Story PointsAug 25 2020

Description

Goal

We introduced an investigate right to allow selective access for Special:Investigate page when we were in the development and testing phase for the project.
Now that we are in the deployment phase of the project, we no longer need to keep access rights for Special:Investigate and Special:CheckUser separate. We should deprecate/remove the investigate right and defer to checkuser and checkuser-log rights.

Acceptance criteria
  • Once Special:Investigate is deployed on a wiki all users with checkuser right should be able to access Special:Investigate & Special:InvestigateBlock and all users with checkuser-log right should be able to access Special:InvestigateLog.
  • The investigate right is removed from the code and the config.

Event Timeline

@MarcoAurelio We are planning to deprecate the investigate right and defer to the checkuser right instead. I was about to make a task for that. Does that sound acceptable?

@MarcoAurelio We are planning to deprecate the investigate right and defer to the checkuser right instead. I was about to make a task for that. Does that sound acceptable?

@Niharika I was not aware of those plans but yep, it sounds acceptable and looks simpler. Thanks. However, please make sure user groups that only have checkuser-log access can access Special:InvestigateLog.

Thanks!

@MarcoAurelio We are planning to deprecate the investigate right and defer to the checkuser right instead. I was about to make a task for that. Does that sound acceptable?

@Niharika I was not aware of those plans but yep, it sounds acceptable and looks simpler. Thanks. However, please make sure user groups that only have checkuser-log access can access Special:InvestigateLog.

Thanks!

Makes sense. I'll repurpose this task to that end.

Niharika renamed this task from Split investigate permissions to Remove investigate right in favor or checkuser right for Special:Investigate.Aug 12 2020, 4:11 AM
Niharika triaged this task as Medium priority.
Niharika updated the task description. (Show Details)
Niharika moved this task from Untriaged to Triage/To be Estimated on the Anti-Harassment board.
ARamirez_WMF changed the subtype of this task from "Task" to "Deadline".

Change 620087 had a related patch set uploaded (by Tchanders; owner: Tchanders):
[mediawiki/extensions/CheckUser@master] Use 'checkuser' or 'checkuser-log' rights instead of 'investigate'

https://gerrit.wikimedia.org/r/620087

Change 620091 had a related patch set uploaded (by Tchanders; owner: Tchanders):
[operations/mediawiki-config@master] Remove the 'investigate' right from testwiki and frwiki

https://gerrit.wikimedia.org/r/620091

Change 620092 had a related patch set uploaded (by Tchanders; owner: Tchanders):
[operations/mediawiki-config@master] Remove 'investigate' from $wgAvailableRights

https://gerrit.wikimedia.org/r/620092

Change 620087 merged by jenkins-bot:
[mediawiki/extensions/CheckUser@master] Use 'checkuser' or 'checkuser-log' rights instead of 'investigate'

https://gerrit.wikimedia.org/r/620087

Tchanders renamed this task from Remove investigate right in favor or checkuser right for Special:Investigate to Remove investigate right in favor of checkuser right for Special:Investigate.Aug 18 2020, 8:22 PM

@Tchanders Doesn't this task also involve changes to mediawiki-config? I mean CommonSettings/InitialiseSettings files.

@Niharika Yes - there are two config patches attached to this task too. We can schedule them for deployment now that the extension patch is merged.

dom_walden added a subscriber: dom_walden.

On my local environment's config, I removed the investigate right from the Check user group (simulating what we are going to do for frwiki and testwiki).

You cannot access Special:Investigate unless you have the checkuser right.

You cannot access Special:InvestigateLog unless you have the checkuser-log right.

You cannot access Special:InvestigateBlock unless you have both the checkuser right and are a member of the sysop group.

If you have just the (now removed) investigate right (not checkuser/checkuser-log), you cannot access anything.

Test environment: Local vagrant MediaWiki 1.36.0-alpha (a1ca533); CheckUser 2.5 (8adc37e).

Change 620091 merged by jenkins-bot:
[operations/mediawiki-config@master] Remove the 'investigate' right from testwiki and frwiki

https://gerrit.wikimedia.org/r/620091

Change 620092 merged by jenkins-bot:
[operations/mediawiki-config@master] Remove 'investigate' from $wgAvailableRights

https://gerrit.wikimedia.org/r/620092

Mentioned in SAL (#wikimedia-operations) [2020-09-14T18:32:09Z] <urbanecm@deploy1001> Synchronized wmf-config/InitialiseSettings.php: d2fa6533a594c8544342954eae19a4a0f7baeff0: Remove the investigate right from testwiki and frwiki (T260175) (duration: 00m 56s)

Mentioned in SAL (#wikimedia-operations) [2020-09-14T18:38:26Z] <urbanecm@deploy1001> Synchronized wmf-config/CommonSettings.php: 7d1939323cc3ea5dacf67a43d4d359c114203a66: Remove investigate from $wgAvailableRights (T260175) (duration: 00m 56s)