Page MenuHomePhabricator
Create Task
Maniphest T277353

electionadmin group needs to be added to testwiki to restore securepolls testing functionality
Closed, ResolvedPublic
Actions

Description

securepolls can no longer be created on testwiki as adding a user from the electionadmin group is required but the group does not exist

Steps to Reproduce:

  1. Go to https://test.wikipedia.org/wiki/Special:SecurePoll/create
  2. Attempt to create the poll

Actual Results:
Poll creation fails, it demands a value for Admins, but requires that Admins be "a member of the electionadmin group."

Expected Results:
Polls should allow the poll creator (those with (securepoll-create-poll) access) to specify admins.
Polls shouldn't be checking for a poll admin to be "in a group" - perhaps they should check if a poll admin "has a permission" - in which case said needed permission may need to be added

Apparently this breaking functionality was expected - and requires the group to be readded.

On testwiki can we

  1. initiate the group with: $wgGroupPermissions['electionadmin'] = [];
  2. Add group management of this group to testwiki bureaucrats

Details

SubjectRepoBranchLines +/-
test: Add electcomm and electionadmin groupsoperations/mediawiki-configmaster+13 -0
Customize query in gerrit

Related Objects
Search...

Event Timeline

Xaosflux created this task.Mar 13 2021, 1:20 AM
Restricted Application removed a project: Patch-For-Review. · View Herald TranscriptMar 13 2021, 1:20 AM
Xaosflux renamed this task from securepolls can no longer be created on testwiki as adding a user from the electionadmin group is required but the group does not exist to unable to create securepolls on testwiki.Mar 13 2021, 1:20 AM
Xaosflux mentioned this in T180762: Editing eligibility requirements throws error "The end date given is before the start date.".
Xaosflux updated the task description. (Show Details)
DLynch subscribed.Mar 15 2021, 4:42 PM

This was deliberately implemented by T271327.

Testwiki does indeed seem to lack the requisite group setup. We should adjust its config. (Adjusting the code to check for a permission would also be reasonable.)

DLynch edited parent tasks, added: T271327: Require that a user is in the electionadmin group in order to be an admin for a poll [M]; removed: T180762: Editing eligibility requirements throws error "The end date given is before the start date.".Mar 15 2021, 4:43 PM
DLynch removed STran as the assignee of this task.Mar 15 2021, 5:46 PM
DLynch added a subscriber: STran.
• Niharika edited projects, added Anti-Harassment; removed Anti-Harassment (The Letter Song).Mar 15 2021, 6:24 PM
• Niharika added a project: Wikimedia-Site-requests.Mar 15 2021, 6:27 PM
Tchanders removed projects: MW-1.36-notes (1.36.0-wmf.34; 2021-03-09), Platform Engineering.Mar 15 2021, 6:30 PM
Tchanders subscribed.

Thanks for filing this @Xaosflux

In T277353#6914546, @DLynch wrote:

This was deliberately implemented by T271327.

Testwiki does indeed seem to lack the requisite group setup. We should adjust its config. (Adjusting the code to check for a permission would also be reasonable.)

The config change that's needed is documented here: https://www.mediawiki.org/wiki/Extension:SecurePoll

Xaosflux changed the subtype of this task from "Bug Report" to "Task".Mar 15 2021, 9:19 PM
Xaosflux renamed this task from unable to create securepolls on testwiki to electionadmin group needs to be readded to testwiki for securepolls testing.Mar 15 2021, 9:22 PM
Xaosflux renamed this task from electionadmin group needs to be readded to testwiki for securepolls testing to electionadmin group needs to be added to testwiki to restore securepolls testing functionality.
Xaosflux updated the task description. (Show Details)
Urbanecm subscribed.Mar 15 2021, 11:15 PM

Why should we test voting on testwiki? The election database is shared anyway, so it doesn't make much sense to create an election on non-votewiki wiki.

• Niharika removed a project: Anti-Harassment.Mar 24 2021, 1:44 PM
Urbanecm closed this task as Declined.Mar 25 2021, 6:04 PM

I'm boldly closing this as declined. If securepoll has ability to make a standalone testwiki only election cluster, it can be revisited.

Xaosflux added a comment.Mar 25 2021, 9:03 PM

@Urbanecm if this is not going to be available for production community testing, any reason to leave the extension running on this project then?

Xaosflux added a comment.Mar 25 2021, 9:05 PM
In T277353#6916040, @Urbanecm wrote:

Why should we test voting on testwiki? The election database is shared anyway, so it doesn't make much sense to create an election on non-votewiki wiki.

Where else should community members test a SUL connected poll? It has been available on testwiki for testing for years, such testing is what led to reporting of the bugs that spawned the changes that broke the ability to test anymore by not adding the entitlements.

• 4nn1l2 subscribed.Jul 20 2021, 2:34 AM
• 4nn1l2 added a comment.Jul 20 2021, 2:37 AM

I want to test an STV poll and I can't. I already was able to do such tests on testwiki (here), but now I can't. I object to the closure of this task.

• 4nn1l2 reopened this task as Open.Jul 24 2021, 10:52 PM

After consulting with @Xaosflux, I am going to boldly reopen this task to get to the bottom of why there is developer pushback. If need be, I can assign it to myself and do the configuration myself.

I need to do some tests with SecurePoll, especially now that the Anti-Harassment team is adding Meek STV to the SecurePoll T281032 and this voting system is going to be used in the next Board election in less than 2 weeks.

Fawiki has pushed for this change (STV support) since at least 2015 T117127, and will hopefully use this voting method for its next ArbCom elections (late October).

• imaigwilo subscribed.Jul 26 2021, 8:26 PM
• Niharika added a project: Anti-Harassment.Jul 28 2021, 4:32 PM
• Niharika moved this task from Untriaged to Triage/To be Estimated on the Anti-Harassment board.Jul 29 2021, 12:54 AM

Anti-Harassment Tools team would also like to make this change so we can test STV on testwiki without jeopardizing votewiki or cluttering it with multiple "test" electoins. @Urbanecm does this sound fine to you?

Xaosflux added a comment.Jul 29 2021, 1:14 AM

This functionality was available for years, was there an actual problem that required restricting this?

ARamirez_WMF moved this task from Triage/To be Estimated to The Letter Song on the Anti-Harassment board.Jul 29 2021, 3:47 PM
ARamirez_WMF edited projects, added Anti-Harassment (The Letter Song); removed Anti-Harassment.
gerritbot added a comment.Jul 29 2021, 6:42 PM

Change 708794 had a related patch set uploaded (by Phuedx; author: Phuedx):

[operations/mediawiki-config@master] test: Add electcomm and electionadmin groups

https://gerrit.wikimedia.org/r/708794

gerritbot added a project: Patch-For-Review.Jul 29 2021, 6:42 PM
gerritbot added a comment.Jul 29 2021, 11:07 PM

Change 708794 merged by jenkins-bot:

[operations/mediawiki-config@master] test: Add electcomm and electionadmin groups

https://gerrit.wikimedia.org/r/708794

• Niharika closed this task as Resolved.Jul 30 2021, 9:48 PM
• Niharika assigned this task to TrangaBellam.
• Niharika reassigned this task from TrangaBellam to STran.
• Niharika moved this task from Ready 🎬 (ONLY IF YOU HAVE NO MORE CODE TO REVIEW) to Done: Q1 (2021-22) on the Anti-Harassment (The Letter Song) board.
• Niharika added a subscriber: TrangaBellam.
• Niharika removed a subscriber: TrangaBellam.

This change has now been merged. electionadmin and electcomm groups now exist on testwiki.

Urbanecm added a comment.Sep 11 2021, 6:51 PM

This was reverted, because of T290808.

Ladsgroup mentioned this in T290808: Users with no NDA can access confidential information at testwiki's SecurePoll instance (CVE-2021-46148).Sep 11 2021, 7:12 PM
Xaosflux added a comment.Sep 11 2021, 9:53 PM
In T277353#7346533, @Urbanecm wrote:

This was reverted, because of T290808.

As that task is hidden, is it open and this should be reopened and blocked?

Xaosflux reopened this task as Open.Sep 12 2021, 4:50 PM

Reopened pending some information.

Urbanecm added a comment.Sep 12 2021, 8:58 PM
In T277353#7346586, @Xaosflux wrote:
In T277353#7346533, @Urbanecm wrote:

This was reverted, because of T290808.

As that task is hidden, is it open and this should be reopened and blocked?

Sorry, I meant to reply yesterday, but I forgot to. As of now, the issue described in the restricted task does prevent deployment of the management group on any other wikis than votewiki. I expect the restricted task will likely get released reasonably soon. After that happens, it will be possible to discuss and decide about what next steps for a possible re-deployment of the management groups could be.

If you wish, I can create a public counterpart of the restricted task, so there would be a place to watch for more details about this incident.

I prefer this task being closed, as there might be different people working on a new deployment.

Xaosflux closed this task as Resolved.Sep 12 2021, 9:11 PM

Re-closing based on notes from @Urbanecm ; yes please add me to to the other ticket and I'll help follow up and/or make a shadow public task.

Urbanecm added a comment.Sep 13 2021, 11:06 AM
In T277353#7347094, @Xaosflux wrote:

Re-closing based on notes from @Urbanecm ; yes please add me to to the other ticket and I'll help follow up and/or make a shadow public task.

I'm sorry, there must've been some misunderstanding -- I wasn't offering to add you to the private task (I wanted to say that I think it will be made public reasonably soon).

Created T290856 for public tracking.

Zabe subscribed.Sep 13 2021, 1:06 PM
Mstyles mentioned this in T292236: Write and send supplementary release announcement for extensions and skins with security patches (1.35.5/1.36.3/1.37.1).Jan 10 2022, 10:45 PM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL