Page MenuHomePhabricator

ipblock-exempt permissions ignored on account creation
Closed, DuplicatePublic

Description

Steps to reproduce:

  • Be logged-in.
  • Have an account with the appropriate local or global permissions: createaccount, ipblock-exempt and globalblock-exempt (e.g. an account with sysop permissions).
  • Your IP address, or IP range is locally blocked with the "account creation disabled" flag on.
  • Now attempt to create an account for somebody else (that is, while logged with the privileged account) using Special:CreateAccount.

Actual results:
MediaWiki prevents the privileged account from creating that account for a third-party, and shows the "You're blocked" message. One would expect that at least the ipblock-exempt allowed this as well as editting (ipblock-exempt: "Bypass IP blocks, auto-blocks and range blocks").

Expected/Desired results:
MediaWiki allowed said user with the appropriate permissions to create that account for a third party.

Notes:

  • MediaWiki 1.36.0-wmf.22 (rMWf77db54ba502) --18:00, 21 December 2020.
  • CentralAuth: e162c98 -- 07:40, 14 December 2020.

Event Timeline

I looked into this issue per @MarcoAurelio's request. Immediate cause is that https://en.wikipedia.org/w/api.php?action=query&format=json&list=users&ususers=Martin%20Urbanec%20(test%2015)&usprop=cancreate&formatversion=2&errorformat=html&errorsuselocal=true&uselang=en returns (while you're under a blocked IP, like a VPN at enwiki) "cancreate": false and "cancreateerror": [ { "code": "blocked", [...] }]. That means that the API module cancreate ignores ipblock-exempt and similar permissions for some reason.

https://github.com/wikimedia/mediawiki/blob/master/includes/auth/CheckBlocksSecondaryAuthenticationProvider.php#L80 seems to check blocked status on the "to be created" anonymous user, rather than the actual creator. I can't, however, find the breaking commit, all the changes to the code seem to be pretty old. I'll upload a fixing patch.

Change 654273 had a related patch set uploaded (by Urbanecm; owner: Urbanecm):
[mediawiki/core@master] CheckBlocksSecondaryAuthenticationProvider: Check creator's permissions, not created user's permissions

https://gerrit.wikimedia.org/r/654273