Page MenuHomePhabricator
Create Task
Maniphest T330602

Special:CreateLocalAccount should comply with user's block-bypass permissions
Closed, ResolvedPublicBUG REPORT
Actions

Description

Hi!

I'm currently using a VPN service, since I'm logged in via a public connection (my IP is currently globally blocked).

I created, while I was logged in, a global account on meta-wiki via Special:CreateAccount with no issues. I cannot create the account in other wikis since my IP is gblocked, even though I have the global IP block exemption on the bot account, which rightly doesn't apply if the account doesn't exist yet there.

So I tried via Special:CreateLocalAccount from my main account on testwiki. The problem is that I can't even create it on wiki where I'm sysop, so currently I've the centralauth-createlocal and the ipblock-exempt rights, via Special:CreateLocalAccount, because I still get a warning that my IP is globally blocked (see also the attached screenshot)!

Probably Special:CreateLocalAccount should comply with user's block-bypass permissions to avoid problems such as these.

Thanks!

Schermata 2023-02-26 alle 12.52.34.png (1×1 px, 224 KB)

Related Objects

Event Timeline

Superpes15 created this task.Feb 26 2023, 12:01 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptFeb 26 2023, 12:01 PM
MarcoAurelio subscribed.EditedFeb 26 2023, 4:26 PM

Sounds like T189362: ipblock-exempt does not allow account creation when blocked to me. See also T271551: ipblock-exempt permissions (inherited through CentralAuth) seems to be ignored on enwiki which I though would've fixed this too.

JJMC89 subscribed.May 22 2023, 8:42 PM
kostajh subscribed.Aug 29 2023, 6:15 AM
Restricted Application added a project: MediaWiki-Platform-Team. · View Herald TranscriptAug 29 2023, 6:15 AM
kostajh added a project: IP-Blocking-Impacts.Aug 29 2023, 6:15 AM
larissagaulia removed a project: MediaWiki-Platform-Team.Sep 4 2023, 11:15 AM
Tgr merged a task: T322468: I'm blocked to create local account with csrf token generated via bot password or oauth token.Oct 5 2023, 3:34 AM
Tgr added subscribers: Xiplus, Stang, Ericliu1912.
Tgr subscribed.Oct 5 2023, 3:40 AM

Same goes for the corresponding API, per T322468.

In T330602#8647005, @MarcoAurelio wrote:

Sounds like T189362: ipblock-exempt does not allow account creation when blocked to me. See also T271551: ipblock-exempt permissions (inherited through CentralAuth) seems to be ignored on enwiki which I though would've fixed this too.

Those are now resolved, can you recheck if this is still an issue?

When you are autocreating your own account by visiting a wiki, permission checks are broken due to T316303: Check global rights during autocreation, but that shouldn't apply when autocreating for someone else.

I'm guessing we are checking ipblock-exempt on the account that is about to be autocreated, not the creator account. Which sorta makes sense from a narrow technical perspective, but isn't what users would expect.

Superpes15 added a comment.Nov 1 2023, 11:02 PM

@Tgr Oh sorry, I only noticed the response now. I just checked, and everything is fine!
I forced two creations via Special:CreateLocalAccount on wikifunctionswiki (while connected with a VPN) without any issue, and, checking the IP via CU just for confirmation, I can confirm the users were created via a globally blocked VPN. Many thanks, you can now close the task :D

Tgr closed this task as Resolved.Nov 2 2023, 5:06 AM
Tgr mentioned this in T316303: Check global rights during autocreation.Nov 2 2023, 5:21 AM
Stang unsubscribed.Nov 5 2023, 10:33 PM
Vermont subscribed.Apr 29 2024, 11:29 PM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits