Page MenuHomePhabricator
Create Task
Maniphest T374137

CentralAuthIdLookup: Enforce that UserIdentity objects belong to the right wiki in isAttached()
Open, Needs TriagePublic
Actions

Description

CentralAuthIdLookup::isAttached() takes a $wikiId parameter, but it also takes a UserIdentity object that has a wiki ID associated with it. We should enforce that the two wiki IDs match, to avoid programming errors. However, the last time we tried it, it caused problems with the GlobalUserPage extension (T374122).

Details

SubjectRepoBranchLines +/-
Do not use full User objects for cross-wiki stuff in GlobalUserPagemediawiki/extensions/GlobalUserPagemaster+18 -8
CentralAuthIdLookup: Assert that user belongs to the right wikimediawiki/extensions/CentralAuthmaster+4 -0
Customize query in gerrit

Related Objects

Event Timeline

matmarex created this task.Thu, Sep 5, 5:09 PM
Restricted Application added a project: MediaWiki-Platform-Team. · View Herald TranscriptThu, Sep 5, 5:09 PM
Restricted Application added a subscriber: Aklapper. · View Herald Transcript
matmarex added a subscriber: Zabe.Thu, Sep 5, 5:09 PM
gerritbot added a comment.Thu, Sep 5, 5:13 PM

Change #1071006 had a related patch set uploaded (by Bartosz Dziewoński; author: Bartosz Dziewoński):

[mediawiki/extensions/CentralAuth@master] CentralAuthIdLookup: Assert that user belongs to the right wiki

https://gerrit.wikimedia.org/r/1071006

gerritbot added a project: Patch-For-Review.Thu, Sep 5, 5:13 PM

Change #1070970 had a related patch set uploaded (by Bartosz Dziewoński; author: Zabe):

[mediawiki/extensions/GlobalUserPage@master] Do not use full User objects for cross-wiki stuff in GlobalUserPage

https://gerrit.wikimedia.org/r/1070970

matmarex added a comment.EditedThu, Sep 5, 5:16 PM

I'm not planning to work on this right now, it's free for taking if anyone wants to look into it. Current status is that the proposed GlobalUserPage change seems to work, but its CI isn't configured in a way that would allow the tests to pass with the change.

matmarex edited projects, added Patch-Needs-Improvement, Technical-Debt; removed Patch-For-Review.Thu, Sep 5, 5:16 PM
DAlangi_WMF moved this task from Inbox, needs triage to Backlog: non-prioritized on the MediaWiki-Platform-Team board.Fri, Sep 6, 1:22 PM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits