Page MenuHomePhabricator
Create Task
Maniphest T344720

Update requireLogin to use requireNamed in OATHAuth special pages
Closed, ResolvedPublic
Actions

Description

In T344276, we want to make sure SpecialPage::requireLogin is used only when temporary accounts should be allowed to use the special page. As for now, we want to treat temporary users just like anonymous or IP users in most situations.

For the MediaWiki-extensions-OATHAuth extension, we should disallow temporary accounts from using the following special pages:

  • src/Special/DisableOATHForUser.php - Because this should only be done by users with advanced rights
  • src/Special/OATHManage.php - Because 2FA for temporary accounts would not be effective (as you cannot log into a temporary account)

Code Search Link

Details

Related Changes in Gerrit:
SubjectAuthorRepoBranchLines +/-
feat: exclude temporary accounts from VerifyOATHForUser special pagePmiazgamediawiki/extensions/OATHAuthmaster+1 -0
Add 'requireNamedUser' checks to all Special PagesAmdrelmediawiki/extensions/OATHAuthmaster+17 -3
Filter temporary accounts from dropdown on Special:DisableOATHForUserAmdrelmediawiki/extensions/OATHAuthmaster+1 -0
Customize query in gerrit

Related Objects
Search...

Event Timeline

• AGueyte created this task.Aug 22 2023, 3:14 PM
• AGueyte updated the task description. (Show Details)Aug 22 2023, 3:20 PM
• AGueyte updated the task description. (Show Details)Aug 22 2023, 3:25 PM
• Niharika added a project: Anti-Harassment-Team (AHaT Sprint 32 - Baseball Cap).Aug 28 2023, 5:15 PM
Tchanders edited projects, added: MediaWiki-Platform-Team; removed: Anti-Harassment-Team (AHaT Sprint 32 - Baseball Cap).Oct 11 2023, 7:47 PM
• larissagaulia removed a project: MediaWiki-Platform-Team.Oct 16 2023, 2:08 PM
Amdrel subscribed.Aug 17 2024, 12:31 AM

It looks like Special:DisableOATHForUser checks if the user is an administrator and Special:OATHManage checks if the user has the user role (temporary users don't have this), so as of right now neither of these pages render for temporary users. If that's the intended outcome then nothing needs to change.

Speaking of improving temporary users support for this extension, I did notice one thing. The user search input on Special:DisableOATHForUser should probably be configured to filter out temporary users since temporary users cannot have two-factor configured in the first place. I don't think it makes sense to autofill them there.

kostajh assigned this task to Amdrel.Aug 21 2024, 8:11 AM
kostajh subscribed.
In T344720#10070992, @Amdrel wrote:

It looks like Special:DisableOATHForUser checks if the user is an administrator and Special:OATHManage checks if the user has the user role (temporary users don't have this), so as of right now neither of these pages render for temporary users. If that's the intended outcome then nothing needs to change.

Sounds good.

Speaking of improving temporary users support for this extension, I did notice one thing. The user search input on Special:DisableOATHForUser should probably be configured to filter out temporary users since temporary users cannot have two-factor configured in the first place. I don't think it makes sense to autofill them there.

That makes sense, could you make a patch for this please?

Amdrel changed the task status from Open to In Progress.Aug 21 2024, 5:48 PM
gerritbot added a comment.Aug 21 2024, 6:48 PM

Change #1064447 had a related patch set uploaded (by Amdrel; author: Amdrel):

[mediawiki/extensions/OATHAuth@master] Filter temporary accounts from dropdown on Special:DisableOATHForUser

https://gerrit.wikimedia.org/r/1064447

gerritbot added a project: Patch-For-Review.Aug 21 2024, 6:48 PM
kostajh moved this task from Inbox to Backlog on the Temporary accounts board.Sep 10 2024, 12:42 PM
Dreamy_Jazz subscribed.Sep 19 2024, 9:47 AM

We should require named users for both special pages, because 2FA is only relevant to accounts which can be logged in to. This does not include temporary accounts.

We also need to update the special pages to require a named user per the task description, but the patch attached here should be good to go.

Dreamy_Jazz added a project: Trust and Safety Product Sprint (Sprint Beatboxing (Sept 16-27)).Sep 19 2024, 9:58 AM
Dreamy_Jazz moved this task from Priority Backlog to Ready on the Trust and Safety Product Sprint (Sprint Beatboxing (Sept 16-27)) board.
Dreamy_Jazz renamed this task from Update requireLogin() for temp users on OATHAuth extension to Update requireLogin to use requireNamedUsers in OATHAuth special pages.Sep 19 2024, 10:01 AM
Dreamy_Jazz renamed this task from Update requireLogin to use requireNamedUsers in OATHAuth special pages to Update requireLogin to use requireNamed in OATHAuth special pages.
Dreamy_Jazz updated the task description. (Show Details)
gerritbot added a comment.Sep 19 2024, 10:08 AM

Change #1064447 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@master] Filter temporary accounts from dropdown on Special:DisableOATHForUser

https://gerrit.wikimedia.org/r/1064447

Maintenance_bot removed a project: Patch-For-Review.Sep 19 2024, 10:31 AM
ReleaseTaggerBot added a project: MW-1.43-notes (1.43.0-wmf.24; 2024-09-24).Sep 19 2024, 11:00 AM
gerritbot added a comment.Sep 24 2024, 9:27 PM

Change #1075317 had a related patch set uploaded (by Amdrel; author: Amdrel):

[mediawiki/extensions/OATHAuth@master] Add 'requireNamedUser' checks to all Special Pages

https://gerrit.wikimedia.org/r/1075317

gerritbot added a project: Patch-For-Review.Sep 24 2024, 9:27 PM
Dreamy_Jazz moved this task from Ready to Needs review on the Trust and Safety Product Sprint (Sprint Beatboxing (Sept 16-27)) board.Sep 24 2024, 10:07 PM
Dreamy_Jazz moved this task from Needs review to Needs QA on the Trust and Safety Product Sprint (Sprint Beatboxing (Sept 16-27)) board.Sep 25 2024, 9:56 AM
gerritbot added a comment.Sep 25 2024, 10:10 AM

Change #1075317 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@master] Add 'requireNamedUser' checks to all Special Pages

https://gerrit.wikimedia.org/r/1075317

Maintenance_bot removed a project: Patch-For-Review.Sep 25 2024, 10:31 AM
ReleaseTaggerBot edited projects, added: MW-1.43-notes (1.43.0-wmf.25; 2024-10-01); removed: MW-1.43-notes (1.43.0-wmf.24; 2024-09-24).Sep 25 2024, 11:00 AM
Djackson-ctr moved this task from Needs QA to Done on the Trust and Safety Product Sprint (Sprint Beatboxing (Sept 16-27)) board.Sep 28 2024, 4:11 AM
Djackson-ctr subscribed.

QA has been completed, and the new code change(s) are functioning as expected (The Username textfield on Special:DisableOATHForUser will not autofill/nor submit Temporary Account Usernames, also Special:OATHManage and Special:DisableOATHForUser have been changed to use the logic for requireNamedUser).

kostajh closed this task as Resolved.Sep 29 2024, 2:57 PM
Dreamy_Jazz reopened this task as Open.Nov 12 2024, 3:32 PM
Dreamy_Jazz edited projects, added: Trust and Safety Product Sprint (Sprint Accordion October 28 - November 15); removed: Trust and Safety Product Sprint (Sprint Beatboxing (Sept 16-27)).

We missed the Special:VerifyOATHForUser page. This page does not prevent a user inputting a temporary account and checking the whether the temporary account has 2FA enabled. Considering that temporary accounts cannot be logged in to, we should make the form not do anything for a temporary account and also not suggest temporary account usernames in the dropdown.

Dreamy_Jazz closed this task as Resolved.Nov 12 2024, 3:36 PM

Actually, I'll re-open T326925 as that's a more relevant ticket.

gerritbot added a comment.Nov 13 2024, 12:52 PM

Change #1090841 had a related patch set uploaded (by Pmiazga; author: Pmiazga):

[mediawiki/extensions/OATHAuth@master] feat: exclude temporary accounts from Disable and Verify OATH pages

https://gerrit.wikimedia.org/r/1090841

gerritbot added a project: Patch-For-Review.Nov 13 2024, 12:52 PM
gerritbot added a comment.Nov 13 2024, 6:54 PM

Change #1090841 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@master] feat: exclude temporary accounts from VerifyOATHForUser special page

https://gerrit.wikimedia.org/r/1090841

ReleaseTaggerBot added a project: MW-1.44-notes (1.44.0-wmf.4; 2024-11-19).Nov 13 2024, 7:00 PM
Maintenance_bot removed a project: Patch-For-Review.Nov 13 2024, 7:31 PM
Dreamy_Jazz moved this task from Priority Backlog to Done on the Trust and Safety Product Sprint (Sprint Accordion October 28 - November 15) board.Nov 14 2024, 1:06 PM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits