Throw an error from API Userrights explaining that temporary users do not have groups
Closed, ResolvedPublic2 Estimated Story Points
Actions

Assigned To

Authored By

	Tchanders
	Jun 26 2023, 4:25 PM

Description

This is for T330816: [Epic] Temporary users should not be assigned to user groups. See also T330816#8958447.

We should do this once groups have been disabled for temporary users (see other subtasks of T330816: [Epic] Temporary users should not be assigned to user groups), and also after work to prevent groups being set on temporary users via ApiUserRights (which may involve updating UserDef::PARAM_ALLOWED_USER_TYPES to distinguish temporary users separately).

Details

	Subject	Repo	Branch	Lines +/-
	Update ApiUserRights to prevent temporary users to be added into groups	mediawiki/core	master	+5 -0

Customize query in gerrit

Related Objects
Search...

Status	Subtype	Assigned	Task
In Progress		Niharika	T324492 Temporary accounts - MVP
Open		None	T326816 Update features for temporary accounts
Open		Tchanders	T326869 Update TSP-owned products that may be affected by IP Masking
Open		None	T307060 [Epic] Temporary account AbuseFilter support
Resolved		STran	T331653 Investigate: Update AbuseFilter for IP Masking
Resolved		Umherirrender	T328311 Special:AbuseLog is missing the `mw-tempuserlink` class from temporary account user links
Resolved		• AGueyte	T335062 Update AbuseFilter with the right user verification
Duplicate		• AGueyte	T335064 Investigate AbuseFilter Hook with CheckUser
Resolved		STran	T334623 How do we log unsuccessful first edits for temporary users?
Resolved		Dreamy_Jazz	T357615 Create filters to distinguish anonymous/temporary/registered users
Open		STran	T357772 Investigate: How will `ip_in_range` and `ip_in_ranges` function when temporary accounts are enabled
Open		STran	T364833 Add `user_unnamed_ip` variable
Open		STran	T363906 Ensure filters that use PII-sensitive variables are protected
Resolved		STran	T364465 Display changes to protected status and flags on AbuseFilter history and diff pages
Resolved		STran	T364485 Alert a filter editor that a filter must be protected if it is saved with a protected variable
Resolved		kostajh	T365049 Investigate what to do about the AbuseFilter log revealing someone's IP address via historical logs
Open		None	T365743 Log when AbuseFilter user sees IP address associated with temp account via user_unnamed_ip variable trigger
Open		None	T364902 How should access to IPs of temporary accounts be logged?
Open		STran	T364834 Ensure testing tools that use `user_unnamed_ip` don't reveal it to users without the view right
Resolved		STran	T357774 Investigate: What to do with existing filters that temporary accounts will break
Resolved	BUG REPORT	Dreamy_Jazz	T358632 CannotCreateActorException when creating a temporary account on an edit which causes an abuse filter log
Open		None	T365740 Document the changes introduced for temporary accounts
Resolved		• TThoabala	T331718 Undeploy SimilarEditors from Beta
Resolved		• TThoabala	T331749 Investigate: Update AntiSpoof for IP Masking
Resolved		• TThoabala	T336196 Don't store temporary user names in AntiSpoof's spoofuser table
Resolved		• AGueyte	T331750 Investigate: Update SecurePoll for IP Masking
Resolved	BUG REPORT	• AGueyte	T334421 BUG FIX: Display of SecurePoll logs
Resolved	BUG REPORT	• AGueyte	T334490 SecurePoll Vote Details returns SQL Error
Resolved		• AGueyte	T334597 Update User access to polls on SecurePoll
Resolved		• AGueyte	T331751 Investigate: Update GlobalBlocking for IP Masking
Resolved		Cyndymediawiksim	T331752 Investigate: Update CheckUser for IP Masking
Duplicate		None	T332821 Should temporary users be treated as possible initiators of a check for the CheckUserLog
Open		None	T331637 Update features in MediaWiki core for IP Masking
Resolved		Tchanders	T330816 [Epic] Temporary users should not be assigned to user groups
Resolved		• AGueyte	T340458 Throw an error from API Userrights explaining that temporary users do not have groups

Event Timeline

Tchanders created this task.Jun 26 2023, 4:25 PM

JJMC89 added a project: MediaWiki-User-management.Jun 26 2023, 5:15 PM

I believe I have covered this situation in https://gerrit.wikimedia.org/r/c/mediawiki/core/+/932820

Adding a follow-up patch to cover the API part

Change 932821 had a related patch set uploaded (by AGueyte; author: AGueyte):

[mediawiki/core@master] Update ApiUserRights to prevent temporary users to be added into groups

https://gerrit.wikimedia.org/r/932821

gerritbot added a project: Patch-For-Review.Jun 27 2023, 5:43 PM

• AGueyte edited projects, added Anti-Harassment (AHaT Sprint 32 - Baseball Cap); removed Anti-Harassment.Jun 27 2023, 6:08 PM

• AGueyte set the point value for this task to 2.

• AGueyte moved this task from Ready 🎬 (ONLY IF YOU HAVE NO MORE CODE TO REVIEW) to Code Review 🔍 on the Anti-Harassment (AHaT Sprint 32 - Baseball Cap) board.

• AGueyte claimed this task.Jun 28 2023, 5:13 PM

Tchanders mentioned this in T340464: Prevent temporary users from being added to autopromote-once groups.Jul 3 2023, 1:52 PM

• AGueyte mentioned this in T340468: Throw an error from UserGroupManager::addUserToGroup if called on a temporary user.Jul 6 2023, 3:16 PM

• AGueyte renamed this task from Throw an error from Special:Userrights explaining that temporary users do not have groups to Throw an error from API Userrights explaining that temporary users do not have groups.Jul 11 2023, 12:58 PM

• AGueyte moved this task from Code Review 🔍 to Blocked/Stalled 🚧 on the Anti-Harassment (AHaT Sprint 32 - Baseball Cap) board.

• AGueyte moved this task from Blocked/Stalled 🚧 to Code Review 🔍 on the Anti-Harassment (AHaT Sprint 32 - Baseball Cap) board.Jul 17 2023, 3:28 PM

Change 932821 abandoned by Tchanders:

[mediawiki/core@master] Update ApiUserRights to prevent temporary users to be added into groups

Reason:

Not needed

https://gerrit.wikimedia.org/r/932821