Page MenuHomePhabricator

Blocks should not apply to implicit rights
Closed, ResolvedPublic

Description

Implicit rights represent actions granted to all users. They can be rate limited, but not revoked. This indicates that the authorizeXXX methods on Authority should return true for these rights unless a rate limit is hit, regardless of whether the user is blocked. Letting such checks fail for blocked users has caused bugs such as T350202 and T350117.

For reference, the current list of implicit rights defined by core is defined in PermissionManager:

private const CORE_IMPLICIT_RIGHTS = [
		'renderfile',
		'renderfile-nonstandard',
		'stashedit',
		'stashbasehtml',
		'mailpassword',
		'changeemail',
		'confirmemail',
		'linkpurge',
		'purge',
	];

Extensions add to this list when they specify a rate limit for an action that is not also defined as a group permission.

Event Timeline

Change 970858 had a related patch set uploaded (by Daniel Kinzler; author: Daniel Kinzler):

[mediawiki/core@master] Blocks should not apply to implicite rights.

https://gerrit.wikimedia.org/r/970858

For the 'purge' action there are explicit checks in index.php and api.php for blocks due to T280226: CVE-2021-35197: Blocked users should not be able to issue purges (action=purge)
Feels like it could regress easily when PermissionManager skips the checks now, but it works with the existing checks in PurgeAction and ApiPurge class.

Change 970858 merged by jenkins-bot:

[mediawiki/core@master] block,Permissions: Blocks should not apply to implicit rights

https://gerrit.wikimedia.org/r/970858

Change 972002 had a related patch set uploaded (by Daniel Kinzler; author: Daniel Kinzler):

[mediawiki/core@REL1_41] block,Permissions: Blocks should not apply to implicit rights

https://gerrit.wikimedia.org/r/972002

Change 972002 merged by jenkins-bot:

[mediawiki/core@REL1_41] block,Permissions: Blocks should not apply to implicit rights

https://gerrit.wikimedia.org/r/972002

Jdforrester-WMF renamed this task from Blocks should not apply to implicite rights to Blocks should not apply to implicit rights.Nov 6 2023, 10:49 PM
Jdforrester-WMF closed this task as Resolved.
Jdforrester-WMF assigned this task to daniel.