Page MenuHomePhabricator
Create Task
Maniphest T340584

Ensure UserGroupManager::addUserToGroup is not called on temporary users from Translate extension
Closed, ResolvedPublic2 Estimated Story Points
Actions

Description

Following T340470, Ensure that UserGroupManager::addUserToGroup is not called on temporary users in Translate extension
Link to code search where calls are made can be found here

Related Objects
Search...

StatusSubtypeAssignedTask
Restricted Task
 ResolvedkostajhT294511 2021 Security Team wikireplicas audit
 DeclinedNoneT284948 Raw IPs of logged-out users disclosed in wiki-replicas
 ResolvedNiharikaT324492 Temporary accounts - MVP
 ResolvedMadalinaT326816 [Epic] Update features for temporary accounts
 ResolvedTchandersT326869 Update TSP-owned products that may be affected by IP Masking
 OpenNoneT307060 [Epic] Temporary account AbuseFilter support
 ResolvedSTranT331653 Investigate: Update AbuseFilter for IP Masking
 ResolvedUmherirrenderT328311 Special:AbuseLog is missing the `mw-tempuserlink` class from temporary account user links
 Resolved• AGueyteT335062 Update AbuseFilter with the right user verification
 Duplicate• AGueyteT335064 Investigate AbuseFilter Hook with CheckUser
 ResolvedSTranT334623 How do we log unsuccessful first edits for temporary users?
 ResolvedDreamy_JazzT357615 Create filters to distinguish anonymous/temporary/registered users
 ResolvedSTranT357772 Investigate: How will `ip_in_range` and `ip_in_ranges` function when temporary accounts are enabled
 ResolvedSTranT364833 Add `user_unnamed_ip` variable
 ResolvedSTranT363906 [Epic] Ensure filters that use PII-sensitive variables are protected
 ResolvedSTranT364465 Display changes to protected status and flags on AbuseFilter history and diff pages
 ResolvedSTranT364485 Alert a filter editor that a filter must be protected if it is saved with a protected variable
 ResolvedTchandersT365049 Investigate what to do about the AbuseFilter log revealing someone's IP address via historical logs
 ResolvedSTranT365743 Log when AbuseFilter user sees IP address associated with temp account via user_unnamed_ip variable trigger
 ResolvedTchandersT364902 How should access to IPs of temporary accounts be logged?
 ResolvedSTranT367390 Add granular query restrictions for AbuseFilter filter search
 ResolvedSTranT364834 Ensure testing tools that use `user_unnamed_ip` don't reveal it to users without the view right
 ResolvedSTranT369610 Give the `abusefilter-access-protected-vars` right to global maintainers
 OpensgrabarczukT369611 Coordinate the updates of IP-using AbuseFilter filters to use `user_unnamed_ip`
 ResolvedSTranT357774 Investigate: What to do with existing filters that temporary accounts will break
 ResolvedBUG REPORTDreamy_JazzT358632 CannotCreateActorException when creating a temporary account on an edit which causes an abuse filter log
 ResolvedSTranT365740 Document the changes introduced for temporary accounts
 Resolved• TThoabalaT331718 Undeploy SimilarEditors from Beta
 Resolved• TThoabalaT331749 Investigate: Update AntiSpoof for IP Masking
 Resolved• TThoabalaT336196 Don't store temporary user names in AntiSpoof's spoofuser table
 Resolved• AGueyteT331750 Investigate: Update SecurePoll for IP Masking
 ResolvedBUG REPORT• AGueyteT334421 BUG FIX: Display of SecurePoll logs
 ResolvedBUG REPORT• AGueyteT334490 SecurePoll Vote Details returns SQL Error
 Resolved• AGueyteT334597 Update User access to polls on SecurePoll
 Resolved• AGueyteT331751 Investigate: Update GlobalBlocking for IP Masking
 ResolvedCyndymediawiksimT331752 Investigate: Update CheckUser for IP Masking
 DuplicateNoneT332821 Should temporary users be treated as possible initiators of a check for the CheckUserLog
 ResolvedNikerabbitT326879 Update Language Team-owned products that may be affected by IP Masking
 ResolvedMadalinaT331637 Update features in MediaWiki core for IP Masking
 ResolvedTchandersT331576 Rate limits for Temporary account should match those for anon users
 ResolvedTchandersT331578 File upload defaults for Temporary account should match those for anon users
 ResolvedTchandersT331579 Email defaults for Temporary account should match those for anon users
 ResolvedTchandersT330815 Disallow preference setting by temporary users
 ResolvedCyndymediawiksimT332414 Make ApiOptions unavailable to temporary users
 Resolved• AGueyteT332415 Update UserOptions classes to prevent temporary users having access to preferences
 ResolvedTchandersT330816 [Epic] Temporary users should not be assigned to user groups
 Resolved• TThoabalaT340470 Investigate: UserGroupManager::addUserToGroup should not called on temporary users from WMF deployed extensions
 Resolvedabi_T340584 Ensure UserGroupManager::addUserToGroup is not called on temporary users from Translate extension
ResolvedFeatureEtonkovidovaT331058 Make Special:Mute only usable for named users
 ResolvedTchandersT332411 Make some authentication APIs unavailable to temporary users
 ResolvedTchandersT336187 [S] Investigate: Creating temp user on non-EditPage actions
 ResolvedDreamy_JazzT349219 [M] Investigate: Which workflows create an IP actor?
 ResolvedTchandersT349891 [S] Add some kind of logging when an actor is created with an IP address
 ResolvedTchandersT350155 [M] Investigate: Do we need to allow IP actor creation for imports?
 ResolvedkostajhT352914 Investigate: Which extensions save IP addresses
 DeclinedNoneT336195 Don't set an anonymous user's name to their IP address if IP Masking is enabled
 ResolvedTchandersT337042 Temporary account users should have the same ParserOptions as anonymous users
 ResolvedTchandersT337103 Decide a standard approach for classifying temporary, IP and registered users
 ResolvedTchandersT338836 How should blocks treat temporary users?
 ResolvedBUG REPORTDreamy_JazzT339947 IP Masking- Special:Block w/ Different Browsers; Partial Site
 ResolvedTchandersT343704 Ensure temporary users are blocked by configured IP blocks
 DeclinedTchandersT343705 Ensure temporary accounts cannot be suppressed via "hideuser"
 ResolvedTchandersT343714 Soft blocks against an IP address should block temporary accounts using that IP address
 ResolvedNiharikaT339874 Show more helpful messages when temporary users can't access features
 ResolvedDreamy_JazzT341228 Update action API to handle temporary users
 ResolvedSTranT350701 [S] Add a temp user type to UserDef::PARAM_ALLOWED_USER_TYPES
 DeclinedNoneT351632 Separate out temporary users from 'assert' param in ApiMain
 ResolvedSTranT351636 Add `temp` flag to various APIs
 ResolvedDreamy_JazzT358249 Update ApiFeedRecentChanges for temporary accounts
 ResolvedDreamy_JazzT358683 Update ApiQueryUserInfo to handle temporary users
 ResolvedTchandersT358693 Update ApiQueryWatchlist to handle temporary users
 ResolvedTchandersT345578 Ensure that an IP address cannot be saved permanently if IP Masking is enabled
 ResolvedTchandersT354207 Allow IP actors to be created for imports when temporary accounts are enabled
 ResolvedDreamy_JazzT362019 CannotCreateActorException when undeleting a page with IP contributors, with temporary accounts enabled
 ResolvedDreamy_JazzT373914 Update reassignEdits.php to prevent reassignment of edits to IP addresses when temporary accounts are enabled
 ResolvedPRODUCTION ERROR• mszaboT373318 CannotCreateActorException: Cannot create an actor for an IP user when temporary accounts are enabled

Event Timeline

• TThoabala created this task.Jun 27 2023, 9:24 PM
Nikerabbit added a parent task: T326879: Update Language Team-owned products that may be affected by IP Masking.Jun 29 2023, 10:30 AM
Nikerabbit triaged this task as Medium priority.Jul 3 2023, 11:20 AM
Nikerabbit moved this task from Backlog to maintenance and operational issues on the MediaWiki-extensions-Translate board.
Nikerabbit added projects: Localization Infrastructure FY2023-24, Language-Team (Language-2023-July-September).Jul 10 2023, 8:23 AM
Nikerabbit moved this task from Backlog to Support (LM) on the Localization Infrastructure FY2023-24 board.
Nikerabbit moved this task from Quarter Backlog to Priority: Localization infrastructure on the Language-Team (Language-2023-July-September) board.Jul 10 2023, 8:26 AM
Nikerabbit set the point value for this task to 2.Jul 10 2023, 8:30 AM
abi_ subscribed.Jul 20 2023, 4:17 PM

@TThoabala Looking at the code in UserGroupManager::addUserToGroup (GitHub link), I see that the code already throws an InvalidArgumentException if it's called with a temporary user.

Either way, the code here is called on users that have registered with an username and email so I don't think these can be temporary users.

abi_ changed the task status from Open to In Progress.Jul 20 2023, 4:18 PM
abi_ claimed this task.
abi_ moved this task from Priority: Localization infrastructure to In Progress on the Language-Team (Language-2023-July-September) board.
abi_ closed this task as Resolved.Jul 21 2023, 4:50 PM
abi_ moved this task from In Progress to Done on the Language-Team (Language-2023-July-September) board.

Similar to what's mentioned in T337779, and mentioned in the previous comment, the code here is called on users that have registered with an username and email so I don't think these can be temporary users.

Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits