I'm blocked to create local account with csrf token generated via bot password or oauth token
Closed, DuplicatePublicBUG REPORT
Actions

Assigned To

None

Authored By

	Xiplus
	Nov 5 2022, 8:15 AM

Description

Steps to replicate the issue (include links if applicable):

Note: I'm a admin on zhwiki. So I have the ipblock-exempt permission. It's included in the basic grant.

Create a bot password with required grants (basic, createaccount, createlocalaccount)
Get csrftoken
Use action=createlocalaccount API.

pywikibot code for reproducing

username = ''

import pywikibot
from pywikibot.data.api import Request

site = pywikibot.Site()
site.login()

data = Request(site=site, parameters={
    'format': 'json',
    'formatversion': '2',
    'action': 'query',
    'meta': 'tokens',
    'type': 'csrf'
}).submit()
print(data)

csrftoken = data['query']['tokens']['csrftoken']

# create local
data = Request(site=site, parameters={
    'format': 'json',
    'formatversion': '2',
    'action': 'createlocalaccount',
    'username': username,
    'reason': 'Test',
    'token': csrftoken,
}).submit()
print(data)

What happens?:
API response:

{'error': [[{'message': 'blockedtext', 'params': ['[[User:Xiplus|\u202aXiplus\u202c]]', '{{blocked proxy}}', 'xxx.xxx.xxx.xxx', '\u202aXiplus\u202c', 400xxx, '202x年x月xx日 (x) xx:xx', 'xxx.xxx.xxx.xxx/24', '202x年x月x日 (x) xx:xx'], 'code': 'blocked', 'type': 'error'}]]}