Page MenuHomePhabricator

Provide a warning to admins who test whether the usernames can be created
Open, Needs TriagePublicFeature

Description

Feature summary (what you would like to be able to do and where):
For usprop=cancreate API, provide extra information if a username trigger antispoof but can be bypassed by override-antispoof right.

Use case(s) (list the steps that you performed to discover that problem, and describe the actual underlying problem which you want to solve. Do not describe only a solution):
As a admin on zhwiki. I rarely use override-antispoof right to create accounts. I don't want to create a username very similar to other. When I handle ACC request on zhiwki, I usually ask user to pick another username if the username triggered antispoof.
I recently created a JavaScript tools to handle this task. The tool use mw.Api to check if the username can be created. mw.Api includes my cookie in the requests. So It didn't tell me a username is similar to others (as I report at T303913: usprop=cancreate API returns a username can be created on some wikis but not actually).
I hope the API returns a warning in this case. For example:

{
    "name": "BrionVIBBER",
    "missing": "",
    "cancreate": "",
    "cancreatewarning": [
        {
            "message": "$1",
            "params": [
                "The username &quot;BrionVIBBER&quot; is too similar to the following usernames:<ul><li>Brion VIBBER</li><li>Brion VIBBEr</li><li>Brion Vibber</li></ul>Please choose another username."
            ],
            "code": "_1",
            "type": "warning"
        }
    ]
}

Compare to the result for users who have no permission.

{
    "name": "BrionVIBBER",
    "missing": "",
    "cancreateerror": [
        {
            "message": "$1",
            "params": [
                "The username &quot;BrionVIBBER&quot; is too similar to the following usernames:<ul><li>Brion VIBBER</li><li>Brion VIBBEr</li><li>Brion Vibber</li></ul>Please choose another username."
            ],
            "code": "_1",
            "type": "error"
        }
    ]
}

It tells me the username can be created with my override-antispoof right and I need to use the right to create the user.

Benefits (why should this be implemented?):
Clearer information as above.
A similar behavior: When I query deleted revisions, the result contains a texthidden attribute to indicate the revision was deleted.

Event Timeline

Change 800669 had a related patch set uploaded (by A2093064; author: A2093064):

[mediawiki/extensions/AntiSpoof@master] Provide warning messages for users who has the override right

https://gerrit.wikimedia.org/r/800669

Tgr subscribed.

Needs a concept of cancreate warnings in core.

FWIW if you try to create the user and it's an AntiSpoof match, it will fail, even if you have override-antispoof. You'll have to add an ignoreAntiSpoof parameter the the createaccount API request. That's a bit clunkier than a warning, but not too hard to build into a gadget.

FWIW if you try to create the user and it's an AntiSpoof match, it will fail, even if you have override-antispoof. You'll have to add an ignoreAntiSpoof parameter the the createaccount API request. That's a bit clunkier than a warning, but not too hard to build into a gadget.

That information gets provided (for priviliged users) already by the authmanager infos (and is also shown in the UI), which needs to be called before doing account creation - https://www.mediawiki.org/w/api.php?action=query&meta=authmanagerinfo&amirequestsfor=create

"requests": [
    {
        "id": "MediaWiki\\Extension\\AntiSpoof\\AntiSpoofAuthenticationRequest",
        "metadata": {},
        "required": "required",
        "provider": "MediaWiki\\Extension\\AntiSpoof\\AntiSpoofAuthenticationRequest",
        "account": "MediaWiki\\Extension\\AntiSpoof\\AntiSpoofAuthenticationRequest",
        "fields": {
            "ignoreAntiSpoof": {
                "type": "checkbox",
                "label": "Ignore spoofing checks",
                "help": "Allows users with sufficient privileges to create an account even if its name is similar to that of an existing account.",
                "optional": ""
            }
        }
    },

Sure, you can ignore proactively, but then you won't know whether this specific username triggered an antispoof rule, and the gadget should probably expose that warning to the user.