action=growthsetmentor ignores blocks
Closed, ResolvedPublicSecurity
Actions

Description

While working on T321799, I noticed that action=growthsetmentor API ignores blocks, ie. blocked users can make use of the API.

In the case of action=growthsetmentor, this means:

Blocked mentors can harass users by claiming them (this triggers notifications)
Blocked mentees can change their own mentor (this does not trigger any notification, so the only issue is the entries in Special:Log).

	Subject	Repo	Branch	Lines +/-
	ApiSetMentor: Respect blocks	mediawiki/extensions/GrowthExperiments	master	+6 -0

		Status	Subtype	Assigned	Task
					Restricted Task
		Resolved	Security	• Urbanecm_WMF	T321807 action=growthsetmentor ignores blocks

• Urbanecm_WMF triaged this task as High priority.

• Urbanecm_WMF created this task.

KStoller-WMF changed the task status from Open to In Progress.Nov 3 2022, 9:01 PM

Change 863025 had a related patch set uploaded (by Urbanecm; author: Urbanecm):

[mediawiki/extensions/GrowthExperiments@master] ApiSetMentor: Respect blocks

Urbanecm changed the visibility from "Custom Policy" to "Public (No Login Required)".Dec 1 2022, 7:22 PM

Urbanecm changed the edit policy from "Custom Policy" to "All Users".

Change 863025 merged by jenkins-bot:

[mediawiki/extensions/GrowthExperiments@master] ApiSetMentor: Respect blocks