Page MenuHomePhabricator
Create Task
Maniphest T335971

Prevent extensions from setting preferences for temporary accounts
Closed, ResolvedPublic3 Estimated Story Points
Actions

Description

Background

Temporary accounts will not be able to store preferences, and will instead have the same set of preferences that anon users have.

Following T332415: Update UserOptions classes to prevent temporary users having access to preferences, some extensions may encounter errors, if they are setting preferences for temporary accounts. They should be updated to not do so.

What needs doing
  • Investigate which extensions set preferences (via PHP or JS)
  • Check which of these might try to set a preference for a temporary account
  • File tasks for any that set preferences for temporary accounts, or where it's inconclusive
Notes

To help with searching:

Details

SubjectRepoBranchLines +/-
Don't set preferences for temporary accountsmediawiki/extensions/RevisionSlidermaster+1 -1
Customize query in gerrit

Related Objects
Search...

StatusSubtypeAssignedTask
Restricted Task
 ResolvedkostajhT294511 2021 Security Team wikireplicas audit
 DeclinedNoneT284948 Raw IPs of logged-out users disclosed in wiki-replicas
 In ProgressNiharikaT324492 Temporary accounts - MVP
 Resolved• AGueyteT335971 Prevent extensions from setting preferences for temporary accounts
 Resolved• AGueyteT337771 Prevent Echo Extension from setting preferences for temporary accounts
 ResolvedMusikAnimalT337772 Prevent GlobalPreferences from setting preferences for temporary accounts
 Resolved• AGueyteT337774 Prevent MobileFrontend from setting preferences for temporary accounts
 Resolvedabi_T337775 Prevent TranslationNotifications from setting preferences for temporary accounts
 Resolved• AGueyteT337776 Prevent Popups from setting preferences for temporary accounts
 Resolved• AGueyteT337777 Prevent FileImporter from setting preferences for temporary accounts
 Resolved• AGueyteT337778 Prevent GlobalWatchlist from setting preferences for temporary accounts
Resolvedabi_T337779 Prevent Translate from setting preferences for temporary accounts
 Resolvedabi_T337780 Prevent UniversalLanguageSelector from setting preferences for temporary accounts
 Resolved• TThoabalaT337781 Prevent BetaFeatures from setting preferences for temporary accounts
 Resolved• TThoabalaT337782 Prevent CentralAuth from setting preferences for temporary accounts
 Resolved• AGueyteT337783 Prevent CheckUser from setting preferences for temporary accounts
 ResolvedmatmarexT337784 Prevent DiscussionTools from setting preferences for temporary accounts
 ResolvedTchandersT337787 Prevent Math from setting preferences for temporary accounts
 Resolvedjsn.shermanT337788 Prevent PageTriage from setting preferences for temporary accounts
 Resolved• AGueyteT337789 Prevent TwoColConflict from setting preferences for temporary accounts
 ResolvedmatmarexT337796 Prevent VisualEditor from setting preferences for temporary accounts
 Resolved• AGueyteT337797 Prevent WikimediaIncubator from setting preferences for temporary accounts
 Resolved• AGueyteT337798 Prevent WikimediaMessages from setting preferences for temporary accounts
 ResolvedtstarlingT337850 Prevent LoginNotify from setting preferences for temporary accounts
 ResolvedkostajhT337851 Prevent Thanks from setting preferences for temporary accounts
 Resolved• TThoabalaT337853 Prevent WikimediaMaintenance from setting preferences for temporary accounts
 DeclinedNoneT337872 Prevent LDAP Authentication from setting preferences for temporary accounts
 Resolved• TThoabalaT337874 Prevent Skins Vector from setting preferences for temporary accounts
 ResolvedkostajhT340034 Prevent Wikibase to set preferences to Temp users
 ResolvedkostajhT340035 Prevent StructuredDiscussions/Flow to set preferences for temporary users

Event Timeline

There are a very large number of changes, so older changes are hidden. Show Older Changes
Tchanders updated the task description. (Show Details)May 4 2023, 3:22 PM
dom_walden mentioned this in T332415: Update UserOptions classes to prevent temporary users having access to preferences.May 5 2023, 3:57 PM
Tchanders moved this task from AHaT Sprint 29: The Ikseongwan to AHaT Sprint 30: Avanton Gold Cone on the Anti-Harassment board.May 9 2023, 5:43 PM
Tchanders edited projects, added Anti-Harassment (AHaT Sprint 30: Avanton Gold Cone); removed Anti-Harassment (AHaT Sprint 29: The Ikseongwan).
• TThoabala claimed this task.May 22 2023, 9:39 AM
• TThoabala moved this task from Ready 🎬 (ONLY IF YOU HAVE NO MORE CODE TO REVIEW) to In Progress 💪 on the Anti-Harassment (AHaT Sprint 30: Avanton Gold Cone) board.May 22 2023, 11:33 AM
Tchanders reassigned this task from • TThoabala to • AGueyte.May 24 2023, 4:13 PM
Tchanders added a subscriber: • TThoabala.
• AGueyte set the point value for this task to 8.May 25 2023, 2:16 PM
• AGueyte mentioned this in T337771: Prevent Echo Extension from setting preferences for temporary accounts.May 30 2023, 5:10 PM
• AGueyte mentioned this in T337772: Prevent GlobalPreferences from setting preferences for temporary accounts.May 30 2023, 5:24 PM
• AGueyte mentioned this in T337774: Prevent MobileFrontend from setting preferences for temporary accounts.May 30 2023, 5:48 PM
• AGueyte added a subtask: T337774: Prevent MobileFrontend from setting preferences for temporary accounts.
• AGueyte mentioned this in T337775: Prevent TranslationNotifications from setting preferences for temporary accounts.May 30 2023, 5:53 PM
• AGueyte mentioned this in T337776: Prevent Popups from setting preferences for temporary accounts.May 30 2023, 5:56 PM
• AGueyte mentioned this in T337777: Prevent FileImporter from setting preferences for temporary accounts.May 30 2023, 5:59 PM
• AGueyte mentioned this in T337778: Prevent GlobalWatchlist from setting preferences for temporary accounts .May 30 2023, 6:03 PM
• AGueyte mentioned this in T337779: Prevent Translate from setting preferences for temporary accounts.
• AGueyte mentioned this in T337780: Prevent UniversalLanguageSelector from setting preferences for temporary accounts.May 30 2023, 6:15 PM
• AGueyte mentioned this in T337781: Prevent BetaFeatures from setting preferences for temporary accounts.May 30 2023, 6:17 PM
• AGueyte mentioned this in T337782: Prevent CentralAuth from setting preferences for temporary accounts.
• AGueyte mentioned this in T337783: Prevent CheckUser from setting preferences for temporary accounts.May 30 2023, 6:20 PM
• AGueyte mentioned this in T337784: Prevent DiscussionTools from setting preferences for temporary accounts.
• AGueyte mentioned this in T337787: Prevent Math from setting preferences for temporary accounts.May 30 2023, 6:25 PM
• AGueyte mentioned this in T337788: Prevent PageTriage from setting preferences for temporary accounts.May 30 2023, 6:27 PM
• AGueyte mentioned this in T337789: Prevent TwoColConflict from setting preferences for temporary accounts.
• AGueyte mentioned this in T337796: Prevent VisualEditor from setting preferences for temporary accounts.May 30 2023, 8:02 PM
• AGueyte mentioned this in T337797: Prevent WikimediaIncubator from setting preferences for temporary accounts.
• AGueyte mentioned this in T337798: Prevent WikimediaMessages from setting preferences for temporary accounts.May 30 2023, 8:06 PM
• AGueyte mentioned this in T337850: Prevent LoginNotify from setting preferences for temporary accounts.May 31 2023, 11:44 AM
• AGueyte mentioned this in T337851: Prevent Thanks from setting preferences for temporary accounts.
• AGueyte mentioned this in T337853: Prevent WikimediaMaintenance from setting preferences for temporary accounts.May 31 2023, 11:47 AM
• AGueyte moved this task from In Progress 💪 to Code Review 🔍 on the Anti-Harassment (AHaT Sprint 30: Avanton Gold Cone) board.
• AGueyte moved this task from Code Review 🔍 to In Progress 💪 on the Anti-Harassment (AHaT Sprint 30: Avanton Gold Cone) board.May 31 2023, 12:00 PM
• AGueyte moved this task from In Progress 💪 to Code Review 🔍 on the Anti-Harassment (AHaT Sprint 30: Avanton Gold Cone) board.May 31 2023, 12:10 PM
• AGueyte added a comment.EditedMay 31 2023, 12:26 PM

https://codesearch.wmcloud.org/deployed/?q=UserOptionsManager

Some extensions were left out because the user of userOptionsManager was only on test files.

The tasks created cover the cases of userOptionsManager being set and saved.

• AGueyte changed the point value for this task from 8 to 5.May 31 2023, 2:27 PM
• AGueyte mentioned this in T337872: Prevent LDAP Authentication from setting preferences for temporary accounts.May 31 2023, 4:08 PM
• AGueyte mentioned this in T337874: Prevent Skins Vector from setting preferences for temporary accounts.
• AGueyte moved this task from Code Review 🔍 to Done Q4 2022-2023 on the Anti-Harassment (AHaT Sprint 30: Avanton Gold Cone) board.May 31 2023, 4:10 PM
matmarex closed subtask T337796: Prevent VisualEditor from setting preferences for temporary accounts as Resolved.May 31 2023, 11:19 PM
gerritbot added a comment.Jun 1 2023, 3:19 PM

Change 925840 had a related patch set uploaded (by Thiemo Kreuz (WMDE); author: Thiemo Kreuz (WMDE)):

[mediawiki/extensions/RevisionSlider@master] Don't set references for temporary accounts

https://gerrit.wikimedia.org/r/925840

gerritbot added a project: Patch-For-Review.Jun 1 2023, 3:19 PM
• TThoabala changed the status of subtask T337781: Prevent BetaFeatures from setting preferences for temporary accounts from Open to In Progress.Jun 2 2023, 7:04 AM
gerritbot added a comment.Jun 5 2023, 6:22 AM

Change 925840 merged by jenkins-bot:

[mediawiki/extensions/RevisionSlider@master] Don't set preferences for temporary accounts

https://gerrit.wikimedia.org/r/925840

Maintenance_bot removed a project: Patch-For-Review.Jun 5 2023, 6:30 AM
ReleaseTaggerBot added a project: MW-1.41-notes (1.41.0-wmf.12; 2023-06-06).Jun 5 2023, 7:01 AM
• AGueyte mentioned this in T338150: Prevent GrowthExperiments extension from saving preferences for Temp user .Jun 5 2023, 2:44 PM
• AGueyte changed the status of subtask T337777: Prevent FileImporter from setting preferences for temporary accounts from Open to In Progress.Jun 5 2023, 2:46 PM
• AGueyte closed subtask T337783: Prevent CheckUser from setting preferences for temporary accounts as Resolved.
• AGueyte closed subtask T337784: Prevent DiscussionTools from setting preferences for temporary accounts as Resolved.
• AGueyte closed subtask T337777: Prevent FileImporter from setting preferences for temporary accounts as Resolved.
• AGueyte closed subtask T337781: Prevent BetaFeatures from setting preferences for temporary accounts as Resolved.Jun 5 2023, 2:48 PM
• AGueyte closed subtask T337789: Prevent TwoColConflict from setting preferences for temporary accounts as Resolved.
• AGueyte closed subtask T337851: Prevent Thanks from setting preferences for temporary accounts as Resolved.Jun 5 2023, 2:55 PM
• AGueyte changed the status of subtask T337787: Prevent Math from setting preferences for temporary accounts from Open to In Progress.Jun 5 2023, 5:56 PM
Tchanders closed subtask T337787: Prevent Math from setting preferences for temporary accounts as Resolved.Jun 6 2023, 4:24 AM
• AGueyte changed the status of subtask T337774: Prevent MobileFrontend from setting preferences for temporary accounts from Open to In Progress.Jun 6 2023, 8:03 PM
• AGueyte closed subtask T337774: Prevent MobileFrontend from setting preferences for temporary accounts as Resolved.Jun 7 2023, 12:17 PM
• AGueyte changed the status of subtask T337874: Prevent Skins Vector from setting preferences for temporary accounts from Open to In Progress.
• AGueyte reopened subtask T337774: Prevent MobileFrontend from setting preferences for temporary accounts as In Progress.Jun 7 2023, 12:19 PM
• AGueyte changed the point value for this task from 5 to 3.
Mainframe98 mentioned this in T338348: Don't try to save a right rail preference for temporary accounts.Jun 7 2023, 5:29 PM
• AGueyte changed the status of subtask T337776: Prevent Popups from setting preferences for temporary accounts from Open to In Progress.Jun 7 2023, 6:27 PM
• AGueyte changed the status of subtask T337853: Prevent WikimediaMaintenance from setting preferences for temporary accounts from Open to In Progress.Jun 8 2023, 1:28 PM
• AGueyte changed the status of subtask T337872: Prevent LDAP Authentication from setting preferences for temporary accounts from Open to In Progress.
• AGueyte changed the status of subtask T337798: Prevent WikimediaMessages from setting preferences for temporary accounts from Open to In Progress.Jun 8 2023, 2:22 PM
• AGueyte changed the status of subtask T337798: Prevent WikimediaMessages from setting preferences for temporary accounts from In Progress to Open.
• AGueyte closed subtask T337872: Prevent LDAP Authentication from setting preferences for temporary accounts as Resolved.Jun 8 2023, 2:43 PM
• AGueyte closed subtask T337774: Prevent MobileFrontend from setting preferences for temporary accounts as Resolved.
Aklapper changed the status of subtask T337872: Prevent LDAP Authentication from setting preferences for temporary accounts from Resolved to Declined.Jun 8 2023, 2:53 PM
• AGueyte changed the status of subtask T337798: Prevent WikimediaMessages from setting preferences for temporary accounts from Open to In Progress.Jun 8 2023, 3:37 PM
• AGueyte changed the status of subtask T337778: Prevent GlobalWatchlist from setting preferences for temporary accounts from Open to In Progress.Jun 12 2023, 2:07 PM
• AGueyte changed the status of subtask T337797: Prevent WikimediaIncubator from setting preferences for temporary accounts from Open to In Progress.Jun 16 2023, 11:06 AM
• AGueyte changed the status of subtask T337782: Prevent CentralAuth from setting preferences for temporary accounts from Open to In Progress.
• AGueyte closed subtask T337776: Prevent Popups from setting preferences for temporary accounts as Resolved.Jun 19 2023, 2:40 PM
• AGueyte closed subtask T337874: Prevent Skins Vector from setting preferences for temporary accounts as Resolved.
• AGueyte closed subtask T337853: Prevent WikimediaMaintenance from setting preferences for temporary accounts as Resolved.Jun 20 2023, 12:39 PM
• AGueyte closed subtask T337778: Prevent GlobalWatchlist from setting preferences for temporary accounts as Resolved.Jun 21 2023, 1:05 PM
• AGueyte closed subtask T337782: Prevent CentralAuth from setting preferences for temporary accounts as Resolved.
• AGueyte mentioned this in T340034: Prevent Wikibase to set preferences to Temp users.Jun 21 2023, 1:08 PM
• AGueyte mentioned this in T340035: Prevent StructuredDiscussions/Flow to set preferences for temporary users.Jun 21 2023, 1:12 PM
• AGueyte edited projects, added Anti-Harassment (AHaT Sprint 32 - Baseball Cap); removed Anti-Harassment (AHaT Sprint 30: Avanton Gold Cone).Jun 21 2023, 1:27 PM
• AGueyte moved this task from Ready 🎬 (ONLY IF YOU HAVE NO MORE CODE TO REVIEW) to In Progress 💪 on the Anti-Harassment (AHaT Sprint 32 - Baseball Cap) board.
• AGueyte moved this task from In Progress 💪 to Done Q1 2023-2024 on the Anti-Harassment (AHaT Sprint 32 - Baseball Cap) board.Jun 22 2023, 11:41 AM
• AGueyte closed subtask T337779: Prevent Translate from setting preferences for temporary accounts as Resolved.Jul 19 2023, 2:22 PM
abi_ closed subtask T337775: Prevent TranslationNotifications from setting preferences for temporary accounts as Resolved.Jul 21 2023, 4:48 PM
Tchanders closed subtask T337798: Prevent WikimediaMessages from setting preferences for temporary accounts as Resolved.Aug 14 2023, 10:10 AM
Tchanders closed this task as Resolved.Aug 14 2023, 10:32 AM
Tchanders closed subtask T337797: Prevent WikimediaIncubator from setting preferences for temporary accounts as Resolved.Aug 14 2023, 11:06 AM
abi_ closed subtask T337780: Prevent UniversalLanguageSelector from setting preferences for temporary accounts as Resolved.Aug 29 2023, 8:12 AM
tstarling closed subtask T337850: Prevent LoginNotify from setting preferences for temporary accounts as Resolved.Sep 4 2023, 4:56 AM
• AGueyte closed subtask T337771: Prevent Echo Extension from setting preferences for temporary accounts as Resolved.Sep 5 2023, 1:51 PM
jsn.sherman changed the status of subtask T337788: Prevent PageTriage from setting preferences for temporary accounts from Open to In Progress.Sep 11 2023, 6:04 PM
Samwalton9-WMF closed subtask T337788: Prevent PageTriage from setting preferences for temporary accounts as Resolved.Oct 10 2023, 4:05 PM
MusikAnimal closed subtask T337772: Prevent GlobalPreferences from setting preferences for temporary accounts as Resolved.Feb 28 2024, 12:15 AM
kostajh closed subtask T340035: Prevent StructuredDiscussions/Flow to set preferences for temporary users as Resolved.Sep 10 2024, 12:51 PM
kostajh added a parent task: T324492: Temporary accounts - MVP.
kostajh closed subtask T340034: Prevent Wikibase to set preferences to Temp users as Resolved.Sep 10 2024, 12:56 PM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits