Page MenuHomePhabricator

CommunityRequests created an unexpected local staff group
Closed, ResolvedPublicBUG REPORT

Description

A review of https://meta.wikimedia.org/wiki/Special:ListGroupRights showed that Meta-Wiki now has a staff local group:

image.png (2,218×174 px, 60 KB)

This group has no members (https://meta.wikimedia.org/w/index.php?title=Special:ListUsers&group=staff) and no one (except stewards) is allowed to add/remove its members.

As far as I know, the local staff group is not used for anything, neither it should be. There is, however, a global staff group (https://meta.wikimedia.org/wiki/Special:GlobalGroupPermissions), which does not have manage-wishlist or manually-edit-wishlist.

Based on my code search, this group comes from MediaWiki-extensions-CommunityRequests:

	"GroupPermissions": {
		"sysop": {
			"manage-wishlist": true,
			"manually-edit-wishlist": true
		},
		"staff": {
			"manage-wishlist": true,
			"manually-edit-wishlist": true
		},
		"community-wishlist-manager": {
			"manage-wishlist": true,
			"manually-edit-wishlist": true
		}
	},

Given the nonstandard nature of staff group (which is supposed to be a global group), this seems to be a mistake, and the intention likely was to add this permission to the global group. If that is the case, the correct procedure was to request T&S for those extra permissions.

That being said...the staff group is very powerful, and we very likely do NOT want to give it to everyone who will manage the wishlist. Whether we should make them Meta Admins or use the dedicated group is a question I do not know the answer to.

For what it is worth, Meta's Community Wishlist manager group also has no members and also cannot be granted by anyone.

Event Timeline

Change #1181171 had a related patch set uploaded (by MusikAnimal; author: MusikAnimal):

[mediawiki/extensions/CommunityRequests@master] extension:json: remove rights from staff user group

https://gerrit.wikimedia.org/r/1181171

Thanks for bringing this to my attention! The above patch should remove the staff group. It's fine for global staff to not have these permissions, and we certainly are not intending to put everyone who may manage the Wishlist in the global staff group! The local "Community Wishlist manage" group will suffice. It looks like for Meta, we'll need to add community-wishlist-manager to $wgAddGroups and $wgRemoveGroups. We can take care of that in the same patch as when enabled $wgCommunityRequestsEnable, which is still a few weeks away.

MusikAnimal changed the subtype of this task from "Task" to "Bug Report".

Change #1181171 merged by jenkins-bot:

[mediawiki/extensions/CommunityRequests@master] extension:json: remove rights from staff user group

https://gerrit.wikimedia.org/r/1181171