CentralAuth lock + suppress (oversight) is no longer applying autoblocks on local account blocks, allowing further registration of abusive account names.
Local blocks issued by the CentralAuth extension always had autoblock enabled.
A quick search in our logs shows this started to happen on or about June 1, 2021.
2b7a5cad7519 may be the cause (not sure). As you can see at rECAU includes/CentralAuthUser.php L1940 has 'enableAutoblock' => true, which is not being respected now.
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | Security | Zabe | T284873 Regression: CentralAuth Lock+Suppress is issuing local blocks without autoblock | ||
| Open | None | T291994 Properly support cross-wiki blocking | |||
| Resolved | Zabe | T291983 Create a BlockRestrictionStoreFactory in order to make BlockRestrictionStore a proper cross-wiki store | |||
| Resolved | Zabe | T291849 Create a DatabaseBlockStoreFactory in order to make DatabaseBlockStore a proper cross-wiki store | |||
| Resolved | Zabe | T274817 Convert DatabaseBlock and AbstractBlock to UserIdentity, and make them cross-wiki aware. | |||
| Resolved | Security | Zabe | T299655 [regression] Cannot globally suppress any global account | ||
| Open | None | T292375 Figure out how to force-logout users cross-wiki |
This is a direct consequence of T281972: ActorStore::checkDatabaseDomain: InvalidArgumentException: DB connection domain does not match when suppressing via Special:CentralAuth (CVE-2021-36128). Long story short, blocks aren't (yet) xwiki aware, and the only reason CentralAuth is able to issue any blocks at all is a ton of hacks. As of now, xwiki blocks kinda work (thanks to hacks), but autoblocks don't. Rather than having suppression not working at all, I thought disabling autoblocks until this resolves is an acceptable tradeoff (as suppression is the only case when locks offer _any_ sort of autoblock).
Both this task and T281972 will be resolved with T274817: Convert DatabaseBlock and AbstractBlock to UserIdentity, and make them cross-wiki aware. (assuming the temporary autoblock disable would be removed).
I hope this makes sense.
Change 725894 had a related patch set uploaded (by Zabe; author: Zabe):
[mediawiki/extensions/CentralAuth@master] Reenable autoblocks for CentralAuth-issued suppression blocks
I don't think this needs to be private, there is nothing really here that is not publicly known.
Change 756131 had a related patch set uploaded (by Zabe; author: Zabe):
[mediawiki/extensions/CheckUser@master] Respect the wiki when performing autoblocks
Change 763788 had a related patch set uploaded (by Zabe; author: Zabe):
[mediawiki/core@master] Respect the wiki when performing autoblocks
@sbassett could you consider making this public. As I already wrote above, I don't see anything in the task that is not publicly known.
I think that should be fine, especially since the related gerrit change sets are all public anyways.
Change 756131 merged by jenkins-bot:
[mediawiki/extensions/CheckUser@master] Respect the wiki when performing autoblocks
Change 763788 merged by jenkins-bot:
[mediawiki/core@master] Respect the wiki when performing autoblocks
Change 810381 had a related patch set uploaded (by Zabe; author: Zabe):
[mediawiki/core@master] block: Create wiki-aware target for autoblocks
Change 810381 merged by jenkins-bot:
[mediawiki/core@master] block: Create wiki-aware target for autoblocks
Change 828126 had a related patch set uploaded (by Zabe; author: Zabe):
[mediawiki/core@master] Load potential current ip block from correct wiki
Change 828126 merged by jenkins-bot:
[mediawiki/core@master] Load potential current ip block from correct wiki
Change 998601 had a related patch set uploaded (by Zabe; author: Zabe):
[mediawiki/core@master] DatabaseBlock: Fetch correct DatabaseBlockStore for autoblock
Change 998601 merged by jenkins-bot:
[mediawiki/core@master] DatabaseBlock: Fetch correct DatabaseBlockStore
Change 725894 merged by jenkins-bot:
[mediawiki/extensions/CentralAuth@master] Reenable autoblocks for CentralAuth-issued suppression blocks