Page MenuHomePhabricator

Audit members of acl*security for more than 12 months of no activity (May 2024)
Closed, ResolvedPublic

Description

Previous tasks: T301181, T299400, T241781.
(Filing this task as individual non-public calendars are not a task tracking system.)

  1. Go to https://phabricator.wikimedia.org/conduit/method/project.query/ and query for phids = ["PHID-PROJ-koo4qqdng27q7r65x3cw"]
  2. Use the results in the members array to feed the phids into the SQL query: SELECT DISTINCT(CONCAT("https://phabricator.wikimedia.org/p/", userName)), isDisabled FROM phabricator_user.user WHERE phid NOT IN (SELECT trs.authorPHID FROM phabricator_maniphest.maniphest_transaction trs INNER JOIN phabricator_user.user u WHERE FROM_UNIXTIME(trs.dateModified) >= (NOW() - INTERVAL 1 YEAR) AND trs.authorPHID = u.phid) AND (phid = "PHID-USER-..." OR phid = "PHID-USER-...");
  3. Review the user names
  4. Once done, create a new task for the next review, and resolve this task.

Alternatively, for those with production DB access, another option is to run:
SELECT DISTINCT(CONCAT("https://phabricator.wikimedia.org/p/", usr.userName)), usr.isSystemAgent FROM phabricator_user.user usr WHERE usr.isDisabled = 0 AND usr.phid IN (SELECT e.src FROM phabricator_user.edge e WHERE e.dst = "PHID-PROJ-koo4qqdng27q7r65x3cw" AND e.type = 14 AND FROM_UNIXTIME(e.dateCreated) <= (NOW() - INTERVAL 12 MONTH)) AND usr.phid NOT IN (SELECT trs.authorPHID FROM phabricator_maniphest.maniphest_transaction trs INNER JOIN phabricator_user.user u WHERE FROM_UNIXTIME(trs.dateModified) >= (NOW() - INTERVAL 12 MONTH) AND trs.authorPHID = u.phid);

Details

Due Date
May 30 2024, 10:00 PM

Event Timeline

Aklapper changed the task status from Stalled to Open.Apr 18 2024, 11:05 AM
Aklapper raised the priority of this task from Low to Needs Triage.Apr 29 2024, 10:42 PM
Aklapper moved this task from Watching to Incoming on the Security-Team board.
Aklapper removed a project: SecTeam-Processed.

Hey @Aklapper - I'm happy to help out with this, but do I need Phab DB access to perform the first audit method? It looks like I would, since there's an SQL query to run, unless that can be done in the UI somehow. I don't believe anybody on the Security-Team has Phab DB access, so we'd probably need to have Release-Engineering-Team (or someone else with those rights) to run any steps requiring Phab DB privileges.

@sbassett: Eh, sure! (Yeah both need DB access, not sure what I thought a year ago here, sigh...)
I pasted/shared the query output with the Security-Team in non-public P61984

sbassett claimed this task.
sbassett triaged this task as Medium priority.
sbassett moved this task from Watching to Our Part Is Done on the Security-Team board.

Ok, I've completed my audit with notes in the private paste (P61984). I'm going to call this resolved for now, but let me know if there are any additional questions or concerns at this time.

Thanks! Should a new task be created for May 2025?

Thanks! Should a new task be created for May 2025?

Sure. Not urgent IMO, but that's still probably a good thing to do.

Was I caught up in this cleanup by chance @sbassett? I noticed my access seems to be gone. If so, could I be readded? I use the access for Fandom for pre-release access and checking for any crossover with our bug bounty program we run.

Was I caught up in this cleanup by chance @sbassett? I noticed my access seems to be gone. If so, could I be readded? I use the access for Fandom for pre-release access and checking for any crossover with our bug bounty program we run.

Yeah, looks like it. Sorry about that. I've added you back to acl*security_volunteer. I think we're generally a lot more stingy with this kind of access these days, but since you already had it and are using it for security release work, that should be ok.