Author: carltonb

Description:
At the present time, AuthPlugin's user validity checks are limited to testing
whether the user exists, and testing whether the username and password combination
is valid. However, a MediaWiki user has other relevant states that can be mapped
to the external authenticator - mBlockedBy, mBlockedReason, mRights.

If the AuthPlugin:initUser method is used to set these attributes, the blocked user
condition is set too late to be effective. If these external checks are placed in
AuthPlugin:authenticate(), only the "incorrect password" error is displayed to the
user, even if the real cause was that the user was blocked.

At a minimum, the change could include adding an AuthPlugin:isBlocked method which
callers could use to set a "blocked" message.

This does raise the question of whether to autocreate a user that is either banned
or has special privileges. I would probably say create the blocked user but
disregard the special privileges. Sysop promotion should be a rare circumstance
with enough security consequences that it should be manual.

Version: unspecified
Severity: enhancement