Page MenuHomePhabricator

Temporary accounts can be assigned global groups through Special:GlobalUserRights
Closed, ResolvedPublic2 Estimated Story PointsBUG REPORT

Description

It appears that temporary accounts can be given global user groups through the Special:GlobalUserRights page. We disabled the ability for temporary accounts to be assigned local user groups in subtasks of T330816. However, it appears that this was not also done for Special:GlobalUserRights.

Example on the beta wikis is https://en.wikipedia.beta.wmflabs.org/w/index.php?title=Special:Log&logid=457007

image.png (173×966 px, 19 KB)

Steps to replicate the issue
  1. Have MediaWiki-extensions-CentralAuth installed
  2. Create a temporary account by making an edit to a page
  3. Log into a user with the steward group
  4. Go to Special:GlobalUserRights and enter the temporary account into the form

What happens:
You can assign global user groups to the temporary account

What should have happened instead:
You should not be able to assign user groups to the temporary account, in a similar way to Special:UserRights for local groups

Event Timeline

Restricted Application added a subscriber: Aklapper. · View Herald Transcript

Change #1102310 had a related patch set uploaded (by Dreamy Jazz; author: Dreamy Jazz):

[mediawiki/extensions/CentralAuth@master] [WIP] Prevent temporary accounts being given global groups

https://gerrit.wikimedia.org/r/1102310

Change #1102310 merged by jenkins-bot:

[mediawiki/extensions/CentralAuth@master] Prevent temporary accounts being given global groups

https://gerrit.wikimedia.org/r/1102310

Djackson-ctr subscribed.

QA is completed... new code changes have been implemented (You cannot assign global user groups to temporary accounts).