| Tchanders | |
| Mar 17 2023, 3:56 PM |
| F37114926: T332411_IPMasking_NotLogged_RemoveAuth.png | |
| Jun 23 2023, 5:38 PM |
| F37114924: T332411_IPMasking_NotLogged_ChangeAuth.png | |
| Jun 23 2023, 5:38 PM |
| F37114922: T332411_IPMasking_Temp_RemoveAuth.png | |
| Jun 23 2023, 5:38 PM |
| F37114920: T332411_IPMasking_Temp_ChangeAuth.png | |
| Jun 23 2023, 5:38 PM |
| F37111438: T332411_IPMasking_API_RemoveAuthData2.png | |
| Jun 21 2023, 7:35 PM |
| F37111436: T332411_IPMasking_API_RemoveAuthData1.png | |
| Jun 21 2023, 7:35 PM |
| F37111433: T332411_IPMasking_API_ChangeAuthData2.png | |
| Jun 21 2023, 7:35 PM |
| F37111431: T332411_IPMasking_API_ChangeAuthData1.png | |
| Jun 21 2023, 7:35 PM |
The following throw a notloggedin error for anonymous users, and should do the same for temporary users:
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Restricted Task | |||||
| Resolved | kostajh | T294511 2021 Security Team wikireplicas audit | |||
| Declined | None | T284948 Raw IPs of logged-out users disclosed in wiki-replicas | |||
| In Progress | Niharika | T324492 Temporary accounts - MVP | |||
| Open | None | T326816 Update features for temporary accounts | |||
| Open | None | T331637 Update features in MediaWiki core for IP Masking | |||
| Resolved | Tchanders | T332411 Make some authentication APIs unavailable to temporary users |
@tstarling Before we pick this up, is there any reason why a temporary account should have access to any of these?
Change 928869 had a related patch set uploaded (by Tchanders; author: Tchanders):
[mediawiki/core@master] Prevent temporary users from accessing APIs for changing passwords
Change 928871 had a related patch set uploaded (by Tchanders; author: Tchanders):
[mediawiki/core@master] Prevent temporary users from accessing ApiLinkAccount
Change 928871 merged by jenkins-bot:
[mediawiki/core@master] Prevent temporary users from accessing ApiLinkAccount
Change 928869 merged by jenkins-bot:
[mediawiki/core@master] Prevent temporary users from accessing APIs for changing passwords
Testing notes
ApiChangeAuthenticationData:
ApiRemoveAuthenticationData:
(Note: This shouldn't be needed since the above should just work, but to find out what to enter for changeauthrequest, use the action=query&meta=authmanagerinfo API and enter amirequestsfor=change. To find out what to enter for request, do the same but enter amirequestsfor=remove.)
ApiLinkAccount:
This is tricky to test as it's for 3rd-party authentication. It's small enough and similar enough to the others that I'm happy to bypass QA on this one.
@Tchanders I'm getting a different request as seen in my screenshots. It may be something with. my own local config?
changeauthenticationdata
removeauthenticationdata
@GMikesell-WMF What happens if you do this?
(Note: This shouldn't be needed since the above should just work, but to find out what to enter for changeauthrequest, use the action=query&meta=authmanagerinfo API and enter amirequestsfor=change. To find out what to enter for request, do the same but enter amirequestsfor=remove.)
@Tchanders After the git stash to get rid of the updates and update again, it works fine as seen in the screenshots below. I will move this to Done, thanks!
| Account | changeauthenticationdata | removeauthenticationdata |
| Temp User |  |  |
| Not Logged In |  |  |