Page MenuHomePhabricator

It should be possible to look up global preference for central users without local accounts
Closed, ResolvedPublic

Description

It should be possible to look up global preference for central users without local accounts.

The current use case is T42050, where we want to centralize password resets, which would also allow initiating them on wikis where you don't have a local account. There is a preference that allows you to require the correct email address to be provided in order to request a password reset (added in T234401). We want this preference to apply when requesting a password reset on any wiki, even on wikis where you don't have a local account, so that this anti-harassment feature can't be bypassed.

This could be useful for other preferences that affect how you appear to other users. The main thing that comes to mind is the gender preference (although currently the GenderCache code hard-codes using local preferences only). I also thought of GlobalUserPage, but it turns out that its global preference has been removed (T188423) and it doesn't work without a local account anyway (T162648).

Event Timeline

Restricted Application added a subscriber: Aklapper. · View Herald Transcript

Change #1057994 had a related patch set uploaded (by Bartosz Dziewoński; author: Bartosz Dziewoński):

[mediawiki/core@master] UserOptionsManager: Allow global prefs for users without local accounts

https://gerrit.wikimedia.org/r/1057994

Probably also useful for notifications.

Change #1065294 had a related patch set uploaded (by Bartosz Dziewoński; author: Bartosz Dziewoński):

[mediawiki/extensions/CentralAuth@master] CentralAuthIdLookup: Treat central users without local accounts as attached

https://gerrit.wikimedia.org/r/1065294

Change #1069695 had a related patch set uploaded (by Bartosz Dziewoński; author: Bartosz Dziewoński):

[mediawiki/core@master] CentralIdLookup: Introduce concept of "owned" accounts

https://gerrit.wikimedia.org/r/1069695

Change #1069696 had a related patch set uploaded (by Bartosz Dziewoński; author: Bartosz Dziewoński):

[mediawiki/extensions/GlobalPreferences@master] Allow lookup of global preferences for users without local accounts

https://gerrit.wikimedia.org/r/1069696

This ended up being a bit more complex than planned, because while on WMF wikis we can assume that a non-existent local account can only be created by the same person who controls the global account with the same name, this is not always the case for other configurations on CentralAuth (pre-SUL-unification) or for other authentication providers. The extra patches are needed to provide a provider-independent interface in MediaWiki that can be used to look up the non-existent local account's owner, if one exists.

Change #1069695 merged by jenkins-bot:

[mediawiki/core@master] CentralIdLookup: Introduce concept of "owned" accounts

https://gerrit.wikimedia.org/r/1069695

Change #1065294 merged by jenkins-bot:

[mediawiki/extensions/CentralAuth@master] CentralAuthIdLookup: Treat central users without local accounts as owned

https://gerrit.wikimedia.org/r/1065294

Change #1057994 merged by jenkins-bot:

[mediawiki/core@master] UserOptionsManager: Allow global prefs for users without local accounts

https://gerrit.wikimedia.org/r/1057994

Change #1069696 merged by jenkins-bot:

[mediawiki/extensions/GlobalPreferences@master] Allow lookup of global preferences for users without local accounts

https://gerrit.wikimedia.org/r/1069696