In MassMessage::getMessengerUser(), we do some evil things to create a system account that cannot be logged into:
$user = User::newFromName( $wgMassMessageAccountUsername );
$user->load();
if ( $user->getId() && $user->mPassword == '' && $user->mNewpassword == '' ) {
// We've already stolen the account
return $user;
}
Problems here are:
a) User::load() no longer loads the password members, so we can't check if they are equal to empty string.
b) null == '', should have been using triple equals.
Also, AbuseFilter has a very similar function (I got the idea from it), so we'll need to patch this there too.
Version: unspecified
Severity: major