Page MenuHomePhabricator

New user account creations (mostly spambots) not logged in loginwiki
Closed, ResolvedPublic

Description

(Apologize if duplicate)
For some time now, the spammers in small wikis are not logged in loginwiki. As a result, checkusers could not easily check those accounts.

For example, most of the locally created account below are spambots, and not logged in loginwiki

https://id.wikisource.org/wiki/Istimewa:Catatan/newusers?uselang=en
https://id.wikisource.org/w/index.php?namespace=2&tagfilter=&title=Istimewa%3APerubahan+terbaru

Event Timeline

Bennylin created this task.Jan 2 2015, 5:07 PM
Bennylin updated the task description. (Show Details)
Bennylin raised the priority of this task from to Needs Triage.
Bennylin added a subscriber: Bennylin.
Krenair added a subscriber: Krenair.
Krenair added a subscriber: csteipp.
Aklapper triaged this task as Normal priority.Jan 2 2015, 5:42 PM

@Bennylin: Which other "small wikis" are you aware of that are affected?

I don't think is a "for some time now" issue. I've seen many bot accounts with no account on loginwiki ever since loginwiki's creation

On top of my head:

id.wikisource
id.wiktionary
id.wikibooks
id.wikiquote

I've made a list in checkuserwiki: [[User:Bennylin/Spambots_on_Indonesian_wikis]]

Change 182560 had a related patch set uploaded (by Glaisher):
Link to wikiset ID on Special:GlobalGroupPermissions

https://gerrit.wikimedia.org/r/182560

Patch-For-Review

Change 182560 had a related patch set uploaded (by Glaisher):
Link to wikiset ID on Special:GlobalGroupPermissions

https://gerrit.wikimedia.org/r/182560

...wrong task

Krenair set Security to None.
TTO added a subscriber: TTO.Jan 3 2015, 10:01 AM

I just created account "TTO test id.ws2" on Indonesian Wikisource using the API. After doing that (without logging in), Special:CentralAuth for this user only showed an entry for id.wikisource.org.

I then logged into this account via the API - still no auto-creation on loginwiki (or any other wikis). The global account still only existed on id.wikisource.org.

I then logged into the account using Special:UserLogin, and lo and behold, an account was auto-created on loginwiki and enwikisource.

So I guess this is API-specific, and that these spambots are using the API. (I mean, why wouldn't they? We've made their life a lot easier by offering a "createaccount" API action...)

@Bennylin: Which other "small wikis" are you aware of that are affected?

It happens on all wikis, not just small ones, see for example: https://meta.wikimedia.org/wiki/Special:CentralAuth/LeonidaMcAdams. And while it mostly contains spambots, I've also seen 'real' users. As Glaisher points out, this happens since loginwiki was created. We (as stewards) reported it multiple times, from the early stage on, but not officially on bugzilla. Only via email etc. Maybe this bug helps to finally solve the problem.

Stryn added a subscriber: Stryn.Jan 3 2015, 11:02 PM

Change 182560 had a related patch set uploaded (by Glaisher):
Link to wikiset ID on Special:GlobalGroupPermissions

https://gerrit.wikimedia.org/r/182560

Patch-For-Review

Change 182560 merged by jenkins-bot:
Link to wikiset ID on Special:GlobalGroupPermissions

https://gerrit.wikimedia.org/r/182560

hoo closed this task as Resolved.Jan 4 2015, 4:07 AM
hoo claimed this task.
Glaisher reopened this task as Open.Jan 4 2015, 4:09 AM
Glaisher removed hoo as the assignee of this task.

again..

Aklapper closed this task as Resolved.Jan 4 2015, 12:21 PM
Aklapper claimed this task.

This has presumably been fixed by https://gerrit.wikimedia.org/r/182560. The fix will be part of 1.25wmf14. See https://www.mediawiki.org/wiki/MediaWiki_1.25/Roadmap for availability dates.
If you have reasons to think that the patch did not fix this, please elaborate on the reasons.

Glaisher reopened this task as Open.Jan 4 2015, 12:22 PM
Glaisher removed Aklapper as the assignee of this task.

no... see comment above.. these offtopic comments probably need to be removed to remove confusion.. sorry for the mess

hoo added a subscriber: hoo.Jan 4 2015, 12:25 PM

This has presumably been fixed by https://gerrit.wikimedia.org/r/182560. The fix will be part of 1.25wmf14. See https://www.mediawiki.org/wiki/MediaWiki_1.25/Roadmap for availability dates.
If you have reasons to think that the patch did not fix this, please elaborate on the reasons.

The patch was linked with this change only by error, the patch actually was about T61707.

Ah. Thanks for clarifying and sorry.

matmarex renamed this task from New user account (mostly spambots) not logged in loginwiki to New user account creations (mostly spambots) not logged in loginwiki.Jan 5 2015, 1:29 AM

Change 204059 had a related patch set uploaded (by Glaisher):
Autocreate some local accounts when global account is created

https://gerrit.wikimedia.org/r/204059

Change 204059 merged by jenkins-bot:
Autocreate some local accounts when global account is created

https://gerrit.wikimedia.org/r/204059

Change 220970 had a related patch set uploaded (by Gergő Tisza):
Autocreate local versions of global accounts on meta, mw.o

https://gerrit.wikimedia.org/r/220970

Tgr added a subscriber: Tgr.Jun 25 2015, 10:02 PM

Change 220970 merged by jenkins-bot:
Autocreate accounts on meta, mediawiki.org, loginwiki

https://gerrit.wikimedia.org/r/220970

Tgr closed this task as Resolved.Jul 6 2015, 11:11 PM
Tgr claimed this task.