Page MenuHomePhabricator

ProtectSite extension doesn't respect users in required groups when disallow certain actions
Open, Needs TriagePublicBUG REPORT

Description

Steps to replicate the issue (include links if applicable):

  • Visit Special:ProtectSite as an administrator
  • Set Allow creation of new accounts by to Registered users and administrators
  • Set Allow editing of pages by to Registered users and administrators
  • Press Protect button
  • Log in as a normal registered user and try to create an account and edit a page.

What happens?:
Permission error
You do not have permission to create this user account, for the following reason:
The action you have requested is limited to users in one of the groups: Staff, Administrators.

What should have happened instead?:
Normal registered users should have rights to edit and create an account.

Software version (on Special:Version page; skip for WMF-hosted wikis like Wikipedia):
1.41.5, 1.43.3

Other information (browser name/version, screenshots, etc.):

Event Timeline

So I was able to partially confirm this on latest master of ProtectSite w/ MW 1.43.0. I'm able to edit pages just fine but the account creation part indeed fails and throws an error message, despite that regular users should be able to create accounts.
The bug is most likely in ProtectSite#setup, likely related to these two lines:

			$wgGroupPermissions['*']['createaccount'] = ( $wgGroupPermissions['*']['createaccount'] ?? false ) && !( $prot['createaccount'] >= 1 );
			$wgGroupPermissions['user']['createaccount'] = ( $wgGroupPermissions['user']['createaccount'] ?? false ) && !( $prot['createaccount'] == 2 );

since changing the latter conditional to $wgGroupPermissions['user']['createaccount'] = !( $prot['createaccount'] == 2 ); does seemingly fix this issue, but I think it also reintroduces T273687.

Not sure how to proceed here, but one thing did come to mind as I was testing out this bug: perhaps ProtectSite would be better off using $wgRevokePermissions instead of $wgGroupPermissions? (After all, I'm fairly certain the only reason ProtectSite is still using $wgGroupPermissions is that it was written in the pre-MW 1.10 era or so, and compared to that, $wgRevokePermissions is a fairly recent addition to MW core.)