Page MenuHomePhabricator

urlshortener-blocked on bot account with global-ipblock-exempt
Open, Needs TriagePublicBUG REPORT

Description

List of steps to reproduce (step by step, including full links if applicable):

{"error":{"code":"urlshortener-blocked","info":"Blocked users can't make short URLs.","*":"See https://meta.wikimedia.org/w/api.php for API usage. Subscribe to the mediawiki-api-announce mailing list at <https://lists.wikimedia.org/postorius/lists/mediawiki-api-announce.lists.wikimedia.org/> for notice of API deprecations and breaking changes."},"servedby":"mwXXXX"}

What happens?:
Extension denies the access to the feature altough the user has the global-ipblock-exempt permission.

What should have happened instead?:
Extension should give access to the feature to the authenticated user with the global-ipblock-exempt permission.

Software version (if not a Wikimedia wiki), browser information, screenshots, other information, etc:
N/A

Event Timeline

MarioFinale updated the task description. (Show Details)
MarioFinale updated the task description. (Show Details)
Legoktm subscribed.

I think the problem is https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/extensions/UrlShortener/+/refs/heads/master/includes/UrlShortenerUtils.php#48 where we check both $user->isBlocked() and $user->isGloballyBlocked(). I don't know why we check for the second one explicitly - I don't think other code does that.

I'm pretty sure I was explicitly told to add that apparently isBlocked is not enough to keep globally banned users away.

Then maybe the problem is in the isBlockedGlobally() function. It should return false if the user has the global-ipblock-exempt permission I suppose.
Here: https://doc.wikimedia.org/mediawiki-core/master/php/User_8php_source.html#l02030
First it checks if the user has mGlobalBlock defined and if not then checks if the user is an IP, if not then gets the user's IP and checks if the IP is blocked. Maybe It should first check the user groups if the user is not an IP and then set mGlobalBlock accordingly.

Can someone check if this issue still persists after it got switched to $user->getBlock() in be1c0ab2595d85b75ad4e0c715bd8ebf391c96e9 / T318897?