Page MenuHomePhabricator

Special:MergeAccount can be accessed by a temporary account
Closed, ResolvedPublic1 Estimated Story PointsBUG REPORT

Description

The Special:MergeAccount page is used to connect unattached local accounts to a global account using the password of the local account and potentially auto auto-merging if the user accounts share an email address.

Temporary accounts do not have passwords or email addresses, and therefore any attempt by a temporary account to use this special page will not be successful. As such we should consider disabling access to this special page for temporary accounts.

An example of this special page being accessible by a temporary account:

image.png (1,605×455 px, 46 KB)

Event Timeline

Restricted Application added a subscriber: Aklapper. · View Herald Transcript
Dreamy_Jazz changed the subtype of this task from "Task" to "Bug Report".Nov 15 2024, 5:48 PM

Change #1093367 had a related patch set uploaded (by Dreamy Jazz; author: Dreamy Jazz):

[mediawiki/extensions/CentralAuth@master] Disallow access to Special:MergeAccount for temporary accounts

https://gerrit.wikimedia.org/r/1093367

Change #1093367 merged by jenkins-bot:

[mediawiki/extensions/CentralAuth@master] Disallow access to Special:MergeAccount for temporary accounts

https://gerrit.wikimedia.org/r/1093367

Djackson-ctr subscribed.

I have verified the special page for MergeAccount cannot be accessed for Logged-Out Users nor Temporary Accounts.

Logged-Out User trying to access Special:MergeAccount:

image.png (1,868×303 px, 40 KB)

Temporary Account trying to access Special:MergeAccount:

image.png (1,851×296 px, 45 KB)