The createaccount permission is not revoked properly when using extension registration
Open, Needs TriagePublic
Actions

Assigned To

None

Authored By

	IijimaYun
	Sep 26 2020, 7:00 PM

Description

When using the latest version of ConfirmAccount and activating it via wfLoadExtension( 'ConfirmAccount' ) the createaccount permission for * is not revoked by default, allowing spammers to use the CreateAccount page.

Event Timeline

IijimaYun created this task.Sep 26 2020, 7:00 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptSep 26 2020, 7:00 PM

IijimaYun updated the task description. (Show Details)Sep 26 2020, 7:20 PM

CC @Legoktm

Seems to be an issue related to merging/overriding of config... This time with GroupPermissions

I guess this isn't a common case we see in extensions; them changing the default config of MW core extensions...

Reedy renamed this task from The createaccount permission is not revoked properly when using wfLoadExtension to The createaccount permission is not revoked properly when using extension registration.Sep 26 2020, 7:23 PM

Reedy added a project: MediaWiki-Configuration.

The createaccount permission is not revoked properly when using extension registrationOpen, Needs TriagePublicActions

Description

Event Timeline

The createaccount permission is not revoked properly when using extension registration
Open, Needs TriagePublic
Actions