Page MenuHomePhabricator

Using special globalcontributions is causing clients to attach to other projects triggering autocreated accounts (especially mlwiki)
Closed, DeclinedPublicBUG REPORT

Description

Steps to replicate the issue (include links if applicable):

What happens?:

  • Your SUL account gets attached to mlwiki

What should have happened instead?:

  • Your SUL account should not get attached to mlwiki

Software version (on Special:Version page; skip for WMF-hosted wikis like Wikipedia):

Other information (browser name/version, screenshots, etc.):
WMF production

Event Timeline

Can reproduce. Also triggers the mlwiki welcoming bot.

Can reproduce. Also triggers the mlwiki welcoming bot.

That seems to be "triggered" subsequently due to the the local account creation.

I've been testing with User:Myrealnamm-testingaccountsproblem, and the problem isn't just mlwiki :

  1. First, I opened m:Special:GlobalContributions/Jimbo_Wales. Nothing was attached to my Global Account.
  2. Second, I opened GlobalContribs page for my own account (Myrealnamm), and it attached my test account to the French Wikipedia. After closing Special:GlobalAccount and reopening it again it also attached to ruwiki.
  3. After searching GlobalContribs for Myrealnamm again it attached to ja.wikibooks.org.
  4. Then searching again, attached id.wiktionary.org.

So it attaches something every time I search on GlobalContribs. But only 1 account each time, not all the accounts.
Assuming the second step I searched twice by accident. If I searched once then it probably only attached one.

I'm wondering why no accounts were attached when I searched for Jimbo Wales' global contributions. Probably because the server was a little slow, but I'm assuming that it would've.

Xaosflux renamed this task from Using special globalcontributions is causing clients to attach to mlwiki to Using special globalcontributions is causing clients to attach to unrelated projects triggering autocreated accounts (especially mlwiki).Feb 6 2025, 2:49 AM
Xaosflux renamed this task from Using special globalcontributions is causing clients to attach to unrelated projects triggering autocreated accounts (especially mlwiki) to Using special globalcontributions is causing clients to attach to other projects triggering autocreated accounts (especially mlwiki).Feb 6 2025, 2:53 AM

I just tried again with yet another test account, got mlwiki; after another name ended up getting jawikibooks as well, then got ptwiki when querying an account that was created on eswiki. No idea why mlwiki is so prevalent in tests.

Attaching your account to the local wiki happens due to permissions checks as part of querying all wikis via the API with the currently logged-in user. Maybe there's a way to avoid local account creation in this scenario (cc @Tgr) but I am not sure if this would be easy or desirable to do.

Attaching your account to the local wiki happens due to permissions checks as part of querying all wikis via the API with the currently logged-in user. Maybe there's a way to avoid local account creation in this scenario (cc @Tgr) but I am not sure if this would be easy or desirable to do.

We could query the CentralAuthUser to find all local accounts for the performer of the check, and then not query those wikis? However, we would still need to find a way to determine if the user has the rights needed on that wiki. Some assumptions could be made for users with global access, and for those without that global access we could probably assume they do not have access.

Maybe there's a way to avoid local account creation in this scenario (cc @Tgr) but I am not sure if this would be easy or desirable to do.

This just came up in a different context: T387357#10593392 I'd go for simpler workarounds if they exist.

I believe it's still an issue if someone inputs an IP address.

We discussed this in sprint planning today. I don't think there is anything we (TSP) can do about this. If we make an authenticated API request to another wiki to get results, the account will get attached. As such, I am going to decline this.