Page MenuHomePhabricator
Create Task
Maniphest T271551

ipblock-exempt permissions (inherited through CentralAuth) seems to be ignored on enwiki
Closed, ResolvedPublicSecurity
Actions

Description

My global account is in the stewards' global group which includes both ipblock-exempt and globalblock-exempt permissions. That should allow my account to edit on all wikis even if the IP or IP range I am using (or any other member of said global group) is locally or globally "hardblocked" (i.e. logged-in users using that IP or network are prohibited to edit).

Since today, I am however no longer able to do so; not even my user page and I'm suspecting a Regression of some sort is happening as I've been able to edit without issues until today, and the oldest block I can find on the VPN range dates from May 2020.

An API query (action=query&meta=userinfo&uiprop=rights) on enwiki lists my account as indeed having ipblock-exempt and globalblock-exempt permissions.

Filing privately for precaution, just in case private info is needed to identify the causes.

Details

Author Affiliation
Wikimedia Communities
SubjectRepoBranchLines +/-
Add a test for ipblock-exempt granted via hookmediawiki/coreREL1_35+53 -0
Fix fetching ipblock-exempt within BlockManager::getUserBlockmediawiki/corewmf/1.36.0-wmf.28+26 -28
Fix fetching ipblock-exempt within BlockManager::getUserBlockmediawiki/corewmf/1.36.0-wmf.27+26 -28
Fix fetching ipblock-exempt within BlockManager::getUserBlockmediawiki/coremaster+26 -30
Add a test for ipblock-exempt granted via hookmediawiki/coremaster+55 -0
Fix fetching ipblock-exempt within BlockManager::getUserBlockmediawiki/coreREL1_35+26 -28
Revert "Fix infinite recursion with wgAutopromote when using getBlock within checkCondition"mediawiki/coremaster+7 -25
Customize query in gerrit

Related Objects

Event Timeline

MarcoAurelio created this task.Jan 8 2021, 3:45 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJan 8 2021, 3:45 PM
MarcoAurelio added a project: MediaWiki-User-management.Jan 8 2021, 3:46 PM
MarcoAurelio added a project: MediaWiki-extensions-CentralAuth.

Not sure where the bug -if any- is: CentralAuth or core; so tagging both.

Base subscribed.Jan 8 2021, 7:15 PM
DannyS712 subscribed.Jan 8 2021, 8:50 PM

excluding automatic edits during global renames, which probably don't care about blocks if I remember correctly, the last edit you made appears to be http://en.wikipedia.org/wiki/Special:Diff/994765563 on 17 December 2020. This appears to have been before 1.36.0-wmf.22 reached enwiki, see T267415: 1.36.0-wmf.22 deployment blockers. So any regression would have been in the changes for .22 or .25 (since .23 and .24 were skipped).

Looking through the change logs on mediawiki, for both core and centralauth, I suspect https://gerrit.wikimedia.org/r/c/mediawiki/core/+/649910 is to blame
PermissionManager::userHasRight uses ::getUserPermissions which runs HookRunner::onUserGetRights which CentralAuth has a handler for to add global user rights, but PermissionManager::getGroupPermissions has no such hook running (or had, now its just a wrapper for the new GroupPermissionLookup service)

sbassett subscribed.Jan 8 2021, 8:55 PM
In T271551#6732763, @DannyS712 wrote:

I suspect https://gerrit.wikimedia.org/r/c/mediawiki/core/+/649910 is to blame

I was poking around gerrit as well and this seems to be the only recent ipblock-exempt-related change set that makes sense, given the timing of everything.

sbassett triaged this task as High priority.Jan 8 2021, 9:00 PM
sbassett changed the visibility from "Custom Policy" to "Public (No Login Required)".
sbassett moved this task from Incoming to Watching on the Security-Team board.
gerritbot added a comment.Jan 8 2021, 9:01 PM

Change 654865 had a related patch set uploaded (by DannyS712; owner: DannyS712):
[mediawiki/core@master] Revert "Fix infinite recursion with wgAutopromote when using getBlock within checkCondition"

https://gerrit.wikimedia.org/r/654865

RhinosF1 subscribed.Jan 8 2021, 9:03 PM
JJMC89 moved this task from Backlog to User rights on the MediaWiki-User-management board.Jan 8 2021, 9:23 PM
JJMC89 subscribed.

Please reset the edit policy.

JJMC89 unsubscribed.Jan 8 2021, 9:24 PM
MarcoAurelio changed the edit policy from "Custom Policy" to "All Users".Jan 8 2021, 9:28 PM
In T271551#6732856, @JJMC89 wrote:

Please reset the edit policy.

Done.

MarcoAurelio updated the task description. (Show Details)Jan 8 2021, 10:16 PM
gerritbot added a comment.Jan 8 2021, 10:35 PM

Change 655148 had a related patch set uploaded (by Paladox; owner: Paladox):
[mediawiki/core@master] Fix fetching ipblock-exempt within BlockManager#getUserBlock

https://gerrit.wikimedia.org/r/655148

gerritbot added a project: Patch-For-Review.Jan 8 2021, 10:35 PM
gerritbot added a comment.Jan 8 2021, 10:51 PM

Change 655147 had a related patch set uploaded (by DannyS712; owner: DannyS712):
[mediawiki/core@master] Add a test for ipblock-exempt granted via hook

https://gerrit.wikimedia.org/r/655147

Paladox subscribed.Jan 9 2021, 7:21 PM
TheVoidwalker subscribed.Jan 9 2021, 11:07 PM
taavi subscribed.Jan 16 2021, 10:01 AM
CptViraj subscribed.Jan 22 2021, 11:43 AM
revi added subscribers: Sotiale, revi.Jan 22 2021, 11:53 AM

@Sotiale was hit by this in zhwiki.

With this speed, can we expect this to be fixed next year or two?

revi added a project: Stewards-and-global-tools.Jan 22 2021, 11:56 AM
revi moved this task from Untriaged to High priority on the Stewards-and-global-tools board.
Sotiale added a comment.Jan 22 2021, 11:58 AM

It's very good that I can't work because of this, but if this delays someone's requests, people who are angry with it will complain to someone. Please, solve this problem quickly.

HakanIST subscribed.Jan 22 2021, 12:06 PM
taavi added a project: Anti-Harassment.Jan 22 2021, 12:19 PM

Would the Anti-Harassment team be willing to review the attached patches as code stewards for blocks?

MarkusRost subscribed.Jan 22 2021, 12:21 PM
Urbanecm added a project: User-Urbanecm.Jan 22 2021, 12:30 PM

I'll have a look, hopefully later today.

• Mardetanha subscribed.Jan 27 2021, 3:49 PM
gerritbot added a comment.Jan 27 2021, 9:14 PM

Change 658940 had a related patch set uploaded (by Urbanecm; owner: Paladox):
[mediawiki/core@wmf/1.36.0-wmf.27] Fix fetching ipblock-exempt within BlockManager::getUserBlock

https://gerrit.wikimedia.org/r/658940

gerritbot added a comment.Jan 27 2021, 9:17 PM

Change 658941 had a related patch set uploaded (by Urbanecm; owner: Paladox):
[mediawiki/core@wmf/1.36.0-wmf.28] Fix fetching ipblock-exempt within BlockManager::getUserBlock

https://gerrit.wikimedia.org/r/658941

gerritbot added a comment.Jan 27 2021, 9:21 PM

Change 654865 abandoned by Urbanecm:
[mediawiki/core@master] Revert "Fix infinite recursion with wgAutopromote when using getBlock within checkCondition"

Reason:
a real fix was 2'ed

https://gerrit.wikimedia.org/r/654865

gerritbot added a comment.Jan 27 2021, 9:24 PM

Change 658942 had a related patch set uploaded (by Urbanecm; owner: Paladox):
[mediawiki/core@REL1_35] Fix fetching ipblock-exempt within BlockManager::getUserBlock

https://gerrit.wikimedia.org/r/658942

gerritbot added a comment.Jan 27 2021, 9:35 PM

Change 655147 merged by jenkins-bot:
[mediawiki/core@master] Add a test for ipblock-exempt granted via hook

https://gerrit.wikimedia.org/r/655147

gerritbot added a comment.Jan 27 2021, 9:54 PM

Change 658942 merged by jenkins-bot:
[mediawiki/core@REL1_35] Fix fetching ipblock-exempt within BlockManager::getUserBlock

https://gerrit.wikimedia.org/r/658942

ReleaseTaggerBot added a project: MW-1.36-notes (1.36.0-wmf.29; 2021-02-02).Jan 27 2021, 10:00 PM
gerritbot added a comment.Jan 27 2021, 10:08 PM

Change 658944 had a related patch set uploaded (by Paladox; owner: DannyS712):
[mediawiki/core@REL1_35] Add a test for ipblock-exempt granted via hook

https://gerrit.wikimedia.org/r/658944

gerritbot added a comment.Jan 27 2021, 10:12 PM

Change 655148 merged by jenkins-bot:
[mediawiki/core@master] Fix fetching ipblock-exempt within BlockManager::getUserBlock

https://gerrit.wikimedia.org/r/655148

Paladox closed this task as Resolved.Jan 27 2021, 10:12 PM
Paladox claimed this task.
gerritbot added a comment.Jan 28 2021, 12:20 AM

Change 658940 merged by jenkins-bot:
[mediawiki/core@wmf/1.36.0-wmf.27] Fix fetching ipblock-exempt within BlockManager::getUserBlock

https://gerrit.wikimedia.org/r/658940

gerritbot added a comment.Jan 28 2021, 12:20 AM

Change 658941 merged by jenkins-bot:
[mediawiki/core@wmf/1.36.0-wmf.28] Fix fetching ipblock-exempt within BlockManager::getUserBlock

https://gerrit.wikimedia.org/r/658941

Stashbot added a comment.Jan 28 2021, 12:31 AM

Mentioned in SAL (#wikimedia-operations) [2021-01-28T00:31:25Z] <urbanecm@deploy1001> Synchronized php-1.36.0-wmf.28/includes/: rMWa67fe4f7cbf1: Fix fetching ipblock-exempt within BlockManager::getUserBlock (T271551, T270145) (duration: 01m 07s)

Stashbot added a comment.Jan 28 2021, 12:33 AM

Mentioned in SAL (#wikimedia-operations) [2021-01-28T00:33:10Z] <urbanecm@deploy1001> Synchronized php-1.36.0-wmf.27/includes/: rMWc5c39ba8b3fc: Fix fetching ipblock-exempt within BlockManager::getUserBlock (T271551, T270145) (duration: 01m 04s)

gerritbot added a comment.Jan 28 2021, 5:14 AM

Change 658944 merged by jenkins-bot:
[mediawiki/core@REL1_35] Add a test for ipblock-exempt granted via hook

https://gerrit.wikimedia.org/r/658944

ReleaseTaggerBot added a project: MW-1.35-notes.Jan 28 2021, 6:00 AM
sbassett moved this task from Watching to Our Part Is Done on the Security-Team board.Jan 28 2021, 4:38 PM
MarcoAurelio mentioned this in T330602: Special:CreateLocalAccount should comply with user's block-bypass permissions .Feb 26 2023, 4:30 PM
Maintenance_bot removed a project: Patch-For-Review.Feb 26 2023, 4:30 PM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits