What happens?:
Users can register account with an allowed email and then change it to a blocked email address.
What should have happened instead?:
The checks should also happen when user changes email.
Software version (skip for WMF-hosted wikis like Wikipedia):
MW1.38.2
| Subject | Repo | Branch | Lines +/- | |
|---|---|---|---|---|
| Add Check for changing email | mediawiki/extensions/SpamBlacklist | master | +21 -1 | |
| Create UserCanChangeEmail Hook | mediawiki/core | master | +50 -1 |
Change #1035844 had a related patch set uploaded (by Lens0021; author: Lens0021):
[mediawiki/core@master] Create UserCanChangeEmail Hook
Change #1035845 had a related patch set uploaded (by Lens0021; author: Lens0021):
[mediawiki/extensions/SpamBlacklist@master] Add Check for changing email
See also: T224921: Code Stewardship Review: SpamBlacklist.
This might be of interest to the Trust and Safety Product Team, tagging as such, but please feel free to untag if this should be owned elsewhere.
I don't know if we should claim this extension, but I don't think we currently have the capacity to deal with SpamBlacklist due to the Temporary accounts work.
Change #1035844 merged by jenkins-bot:
[mediawiki/core@master] Create UserCanChangeEmail Hook
Change #1035845 merged by jenkins-bot:
[mediawiki/extensions/SpamBlacklist@master] Add Check for changing email