Change 922588 had a related patch set uploaded (by Tchanders; author: Tchanders):

[mediawiki/core@master] Treat temporary users the same as anons in upload-related widgets

https://gerrit.wikimedia.org/r/922588

I considered updating a few things based on what was found in T326759. TL;DR There doesn't seem to be much to update in this task, and the above patch should cover it.

Permissions

Currently, using the default config, a temporary can upload if the user group can upload, because temporary users are in the user group:

// For a temporary user:
mw.user.getGroups( function ( groups ) { console.log(groups) } );
// ['*', 'user']

After T330816: [Epic] Temporary users should not be assigned to user groups, this will not be the case; temporary user permissions will be the same as IP user permissions.

For WMF production sites, this means a temporary user will not be able to upload, so I do not believe we need to do any work relating to upload permissions, additional to T330816.

UI error messages

The mw.Upload.BookletLayout and ApiUpload both prompt IP users to log in if they don't have permissions. The above patch add this for temp users too.

UploadStash

UploadStash is available to registered users, but not to IP users. Without it, some of our upload tools don't work, including uploading in VisualEditor and via UploadWizard: T233723. (However, Special:Upload does work without UploadStash, since T115822.)

Since temporary users are considered registered (they have a row in the user table), they can use UploadStash by default (in fact, introducing temporary accounts is essentially the nontrivial solution suggested in T115822#1733798).

Should we disable UploadStash for temporary users? I'm inclined to say no, for two reasons:

1. If we did, it would introduce T233723 for temporary users on any third-party wikis that allowed everyone to upload
2. It won't affect WMF production either way, so I see no positive reason to disable it (such as concern about the size of the uploadstash table, etc)

Change 922588 merged by jenkins-bot:

[mediawiki/core@master] Prompt temporary users without upload permissions to log in

https://gerrit.wikimedia.org/r/922588

@Tchanders @STran

De Wiki beta:

• In de wiki beta, I get a permission error as a temp user but I get you must be logged in as a logged-out user for Special:Upload
• In de wiki beta, I get you must be logged in for temp user and a logged-out user for Special:APISandbox

Local

• In Local, I was able to upload with a temp user and a logged-out user for Special:Upload
• In Local, I was able to upload as a temp user but I get you must be logged in as a logged-out user for Special:APISandbox
• In Local, I was able to upload as a temp user but I get you must be logged in as a logged-out user for Special:UploadWizard

Test link: https://de.wikipedia.beta.wmflabs.org/wiki/Zypern

De Wiki	TempUser	Logged Out
Special:Upload
Special:APISandbox

Local Environment	TempUser	Logged Out
Special:Upload
Special:APISandbox
Special:UploadWizard

@GMikesell-WMF Thanks for checking - it's fine that temp users can still upload after this task. We will be disabling upload for temporary users, but the investigation in this task found that we'll need to do it via the user groups.

At the moment temp users can upload is the 'user' group is allowed to upload, since temp users are in the 'user' group (as seen in your screenshot). However, we will take temp users out of the 'user' group, so they won't be able to upload. The task for that work is T330816: [Epic] Temporary users should not be assigned to user groups.