As it stands, all sorts of rights are added to various user groups for disabled by default features (Upload by url comes to mind). I think this should be wontfixed.

Yes, this and bug 26868 should both be WONTFIX'd.

We cannot conditionally set it in DefaultSettings, as any changes made in LocalSettings will not yet have taken effect.

We *could* remove the right from sysops in Setup, but that only affects the default case and doesn't remove the right(s) from groups that might have had them assigned (but the corresponding feature has been disabled).

In any case...the user still *has* the rights, the feature has been disabled by other means.

(In reply to comment #2)

We *could* remove the right from sysops in Setup, but that only affects the
default case and doesn't remove the right(s) from groups that might have had
them assigned (but the corresponding feature has been disabled).

Why not? When the corrosponding feature is disabled per default ,the user right should be removed (or comment out) from DefaultSettings.php also.

Thanks.

You can't do it in DefaultSettings because it doesn't give the user a chance to override it. The default is false, the user permission would be unassigned by default. Now, to enable trackbacks you'd have to enable it *and* assign the permission which is counterintuitive.

I guess we could remove the default case in Setup. It wouldn't on the edge case of someone assigning the trackback permission to another group but disabling the feature...but if you're doing that you're doing something wrong anyway :)

Went ahead and commented it out in r84527, added a RELEASE-NOTES entry for the (probably very few) people using this feature.