Page MenuHomePhabricator

$wgRestrictedGroups: implement continuous checking of requirements
Closed, ResolvedPublic

Description

Right now, conditions for group membership set in $wgRestrictedGroups are checked only when user is added to the group. With 2FA, we'd like to be able to enforce it constantly, not only when the permissions were granted.

Even though half of this continuous enforcement is done in T414952: Prevent 2FA-required users from disabling their last 2FA method, we still need something that will help us introduce requirements to new groups. In these cases, it'll be helpful to make people aware of the conditions, before coming up with any more serious means like demoting.

We could potentially just keep the current $wgOATHRequiredForGroups mechanism, but it would be incompatible with more elaborate conditions that can be specified in $wgRestrictedGroups.

Acceptance criteria

  • All group requirements configured with $wgRestrictedGroups (except for groups with 'canBeIgnored' => true) are continuously checked (similarly to how autopromotion works).
  • If user is determined to no longer meet requirements for a given group, the group is disabled for them (not removed entirely, status similar to current effect of $wgOATHRequiredForGroups).
  • Conditions for group membership for system users are not checked.

Event Timeline

Change #1242352 had a related patch set uploaded (by Mszwarc; author: Mszwarc):

[mediawiki/core@master] Extract service for reading wgRestrictedGroups config

https://gerrit.wikimedia.org/r/1242352

Change #1243051 had a related patch set uploaded (by Mszwarc; author: Mszwarc):

[mediawiki/core@master] Extract a function for formatting a list of groups

https://gerrit.wikimedia.org/r/1243051

Change #1243052 had a related patch set uploaded (by Mszwarc; author: Mszwarc):

[mediawiki/core@master] Disable user group membership if conditions are no longer met

https://gerrit.wikimedia.org/r/1243052

Change #1243120 had a related patch set uploaded (by Mszwarc; author: Mszwarc):

[mediawiki/core@master] UserGroupManager: Don't disable groups of system users

https://gerrit.wikimedia.org/r/1243120

Change #1242352 merged by jenkins-bot:

[mediawiki/core@master] Extract service for reading wgRestrictedGroups config

https://gerrit.wikimedia.org/r/1242352

Change #1243051 merged by jenkins-bot:

[mediawiki/core@master] Extract a function for formatting a list of groups

https://gerrit.wikimedia.org/r/1243051

Change #1243052 merged by jenkins-bot:

[mediawiki/core@master] Disable user group membership if conditions are no longer met

https://gerrit.wikimedia.org/r/1243052

Change #1243120 merged by jenkins-bot:

[mediawiki/core@master] UserGroupManager: Don't disable groups of system users

https://gerrit.wikimedia.org/r/1243120

Change #1247074 had a related patch set uploaded (by Mszwarc; author: Mszwarc):

[mediawiki/core@master] Drop warning about user being likely to lose their disabled groups

https://gerrit.wikimedia.org/r/1247074

Change #1247074 merged by jenkins-bot:

[mediawiki/core@master] Drop warning about user being likely to lose their disabled groups

https://gerrit.wikimedia.org/r/1247074