Page MenuHomePhabricator

Userinfo API call creates account in all wikis where user is active
Open, Needs TriagePublicBUG REPORT

Description

Steps to replicate the issue (include links if applicable):

What happens?:
A request to https://ru.wikipedia.org/w/rest.php/checkuser/v0/userinfo created local accounts in wikis you never visited, but the requested person has accounts in.

What should have happened instead?:
No new local accounts should be created.

Event Timeline

Restricted Application added a subscriber: Aklapper. · View Herald Transcript

This has the same underlying issue as T385752#10780513. I don't see a good solution for how to address this.

This has the same underlying issue as T385752#10780513. I don't see a good solution for how to address this.

We could use CentralAuth to validate that a user has an account on that wiki before making the API call? If they don't have an account, then we could assume they lack the rights to see anything on that wiki?

This is quite annoying and confusing indeed, in particular the welcome bots spam that follows. I probably would have thought twice before enabling this tool/keeping it active, had there been some sort of warning about this side effect.