Ensure UserGroupManager::addUserToGroup is not called on temporary users from AbuseFilter extension
Closed, ResolvedPublic2 Estimated Story Points
Actions

Assigned To

Authored By

	• TThoabala
	Jun 27 2023, 9:12 PM

Description

Following T340470, Ensure that UserGroupManager::addUserToGroup is not called on temporary users in AbuseFilter extension
Link to code search where calls are made can be found here

Related Objects
Search...

Status	Subtype	Assigned	Task
			Restricted Task
Resolved		kostajh	T294511 2021 Security Team wikireplicas audit
Declined		None	T284948 Raw IPs of logged-out users disclosed in wiki-replicas
Resolved		Niharika	T324492 Temporary accounts - MVP
Resolved		Madalina	T326816 [Epic] Update features for temporary accounts
Resolved		Tchanders	T326869 Update TSP-owned products that may be affected by IP Masking
Open		None	T307060 [Epic] Temporary account AbuseFilter support
Resolved		STran	T331653 Investigate: Update AbuseFilter for IP Masking
Resolved		Umherirrender	T328311 Special:AbuseLog is missing the `mw-tempuserlink` class from temporary account user links
Resolved		• AGueyte	T335062 Update AbuseFilter with the right user verification
Duplicate		• AGueyte	T335064 Investigate AbuseFilter Hook with CheckUser
Resolved		STran	T334623 How do we log unsuccessful first edits for temporary users?
Resolved		Dreamy_Jazz	T357615 Create filters to distinguish anonymous/temporary/registered users
Resolved		STran	T357772 Investigate: How will `ip_in_range` and `ip_in_ranges` function when temporary accounts are enabled
Resolved		STran	T364833 Add `user_unnamed_ip` variable
Resolved		STran	T363906 [Epic] Ensure filters that use PII-sensitive variables are protected
Resolved		STran	T364465 Display changes to protected status and flags on AbuseFilter history and diff pages
Resolved		STran	T364485 Alert a filter editor that a filter must be protected if it is saved with a protected variable
Resolved		Tchanders	T365049 Investigate what to do about the AbuseFilter log revealing someone's IP address via historical logs
Resolved		STran	T365743 Log when AbuseFilter user sees IP address associated with temp account via user_unnamed_ip variable trigger
Resolved		Tchanders	T364902 How should access to IPs of temporary accounts be logged?
Resolved		STran	T367390 Add granular query restrictions for AbuseFilter filter search
Resolved		STran	T364834 Ensure testing tools that use `user_unnamed_ip` don't reveal it to users without the view right
Resolved		STran	T369610 Give the `abusefilter-access-protected-vars` right to global maintainers
Open		sgrabarczuk	T369611 Coordinate the updates of IP-using AbuseFilter filters to use `user_unnamed_ip`
Resolved		STran	T357774 Investigate: What to do with existing filters that temporary accounts will break
Resolved	BUG REPORT	Dreamy_Jazz	T358632 CannotCreateActorException when creating a temporary account on an edit which causes an abuse filter log
Resolved		STran	T365740 Document the changes introduced for temporary accounts
Resolved		• TThoabala	T331718 Undeploy SimilarEditors from Beta
Resolved		• TThoabala	T331749 Investigate: Update AntiSpoof for IP Masking
Resolved		• TThoabala	T336196 Don't store temporary user names in AntiSpoof's spoofuser table
Resolved		• AGueyte	T331750 Investigate: Update SecurePoll for IP Masking
Resolved	BUG REPORT	• AGueyte	T334421 BUG FIX: Display of SecurePoll logs
Resolved	BUG REPORT	• AGueyte	T334490 SecurePoll Vote Details returns SQL Error
Resolved		• AGueyte	T334597 Update User access to polls on SecurePoll
Resolved		• AGueyte	T331751 Investigate: Update GlobalBlocking for IP Masking
Resolved		Cyndymediawiksim	T331752 Investigate: Update CheckUser for IP Masking
Duplicate		None	T332821 Should temporary users be treated as possible initiators of a check for the CheckUserLog
Resolved		Madalina	T331637 Update features in MediaWiki core for IP Masking
Resolved		Tchanders	T330816 [Epic] Temporary users should not be assigned to user groups
Resolved		• TThoabala	T340470 Investigate: UserGroupManager::addUserToGroup should not called on temporary users from WMF deployed extensions
Resolved		• AGueyte	T340578 Ensure UserGroupManager::addUserToGroup is not called on temporary users from AbuseFilter extension

Event Timeline

• TThoabala created this task.Jun 27 2023, 9:12 PM

• AGueyte claimed this task.Jun 28 2023, 12:01 PM

• AGueyte set the point value for this task to 2.

• AGueyte added a project: Anti-Harassment-Team (AHaT Sprint 32 - Baseball Cap).

• AGueyte moved this task from Ready 🎬 (ONLY IF YOU HAVE NO MORE CODE TO REVIEW) to In Progress 💪 on the Anti-Harassment-Team (AHaT Sprint 32 - Baseball Cap) board.Jun 28 2023, 12:06 PM

Consequences/Consequence/Degroup.php
Already clears out temp users from the function. Therefore, there is no need to verify if the user is temp in Revert() function.

Hooks/Handlers/SchemaChangesHandler.php
This one updates the user table after a schema change for system users

includes/FilterUser.php
Upgrades system users to Sysop if they are not already

The extension isn't adding or removing groups to Temporary Users
https://codesearch.wmcloud.org/deployed/?q=addUserToGroup&files=&excludeFiles=&repos=#mediawiki/extensions/AbuseFilter

• AGueyte moved this task from In Progress 💪 to Code Review 🔍 on the Anti-Harassment-Team (AHaT Sprint 32 - Baseball Cap) board.Jun 28 2023, 1:44 PM