Tue, Mar 19
Thanks for the update @jrbs so for those of us that give out int-admin locally, we'll just keep saying "you better do this" and leave it up to WMF to enforces the 2FA rules.
Breaking the redirect on the remote shared repository page (such as in https://commons.wikimedia.org/w/index.php?title=File:Lee_Dixon.jpg&oldid=343164913 ) restores the local projects access.
Fri, Mar 15
@jrbs this specific task is only about the "allowing the community to check that an account really has enabled 2FA before granting it additional rights within the regular community process" part - so from a T&S point of view can it proceed (while not stopping any other types of improvement processes)?
Wed, Mar 13
Emailed T&S asking for any update.
Mon, Mar 4
Cancelling this, was updated in fc9efe67d599
I didn't protect as a security issue since it is failing safer.
Sun, Mar 3
Fri, Mar 1
@Urbanecm - also it only is used when the only reason for account creation fail is rate limit (see examples here: https://en.wikipedia.org/wiki/Special:Log/OutreachDashboardBot)
@Urbanecm the outreach dashboard creates all accounts via enwiki (which then due to SUL get autocreated anywhere when logged in) - and this exemption is allowed via a service account between the dashbaord and enwiki (https://en.wikipedia.org/wiki/User:OutreachDashboardBot).
For what it's worth, we have recently put in an process for account creation via outreachdashboard.wmflabs.org , the throttle is bypassed if the creation is made via an event on the dashboard. This certainly doesn't solve the core complaint, but may help with anyone running an event.
Feb 22 2019
I'd like to see this information in AF variables, no opinion as to the best way to accomplish it (including if a different variable should be used). A related item may be for edits that are protected by other means as well (such as a namespace protection, or a page type protection).
Feb 16 2019
Feb 13 2019
Jan 29 2019
I may have misstated the name of the permission - but the overall concept has not changed - just looking for a way to determine a yes-no on a project as stop-gap while T150562 is being worked on. If I recall correctly the current workflow is:
Jan 25 2019
In general, it's fine to add TimedMediaHandler.
Jan 23 2019
Jan 15 2019
Jan 14 2019
This appears to be a bypass for T204016
Jan 12 2019
@Iniquity I don't think anything was actually done here - some related discussion would be to make use of TAGS
Jan 11 2019
If you hit up arrow, or down arrow, you are back at 'letter 1' and can type a new first letter in
This appears to be working correctly, it is still collecting additional characters to resolve mutli-letter conflicts.
@Anomie that bot (https://en.wikipedia.org/wiki/Special:Log/TheSandBot) hasn't made any moves in a month.
Just got again on enwiki when trying to delete as part of this move: (https://en.wikipedia.org/w/index.php?title=MediaWiki:Gadget-defaultsummaries.js&diff=prev&oldid=877868868) , was able to manually delete the target and proceed.
Jan 7 2019
On-wiki discussion points to this just being an oversight in the creation (https://en.wikipedia.org/w/index.php?title=Wikipedia_talk:Requests_for_permissions&oldid=877253922#%22confirmed%22_users_can_no_longer_create_articles) please proceed.
Jan 6 2019
Jan 5 2019
Testing notes (may need another task) - users without createpagemainns ARE able to create these pages if they initialize a page in another namespace, then use the MOVE process - this seems like it should be a security violation.
Dec 20 2018
No please by default, but perhaps an opt-in confirmation if people really want it. Don't slow down workflows.
Dec 18 2018
On enwiki, we just purposefully granted an account this combination, I suspect the other projects have as well.
Dec 15 2018
Closing as unable to be replicated and no additional information from reporter.
Dec 13 2018
I'll follow up with the reporter again.
Dec 10 2018
On your own test, where were you successful? (Was it anywhere BESIDES meta?)
@Matiia during your test which project did you use Special:Two-factor_authentication on?
@Chrissymad can you describe the problem you found more here please?
Dec 8 2018
Can a batch fix of moving them all to Project/Project_talk just be done?
Deleted via API call
Unless someone else did something, the API attempt may have succeeded as seen in log now:
Community approval for delete (admin discretion for cleanup) at: https://en.wikipedia.org/w/index.php?title=Wikipedia:Village_pump_(technical)&oldid=872693759#Special:Badtitle/NS447:Stanford_University/Technology_entrepreneurship_(2014_Spring)/Course_description
Dec 6 2018
So seems like the AND "The page is younger than the maximum age for "new pages"" isn't working at the very least.
@JJMC89 suppose we certain can try to break some more '90 day + articles' at the time of the report I checked the presented html on:
Dec 5 2018
Well it can certainly be reworded - I started this along the WMF requirements for 2FA for certain groups, in the absence of any technical controls that could do a better job. It could still be useful for stewards to be able to validate accounts before issuing other dangerous permissions (e.g. global sysop which gets int-admin on tons of projects).
Agree! Thus I was only asking for access to it to the groups charged with adding enhanced security accesses to accounts.
I'm assuming a 'mechanism' is already available for this in the API, and we are just be blocked by lack of access to :
This is running afoul of T149538 so appears to be a regression.
Dec 3 2018
Arch, of course it passes now...
Dec 2 2018
@Tgr can you add me to T207750 ?
Dec 1 2018
@Aklapper while this is similar to T210922 it should only be a duplicate if this is going to actually be worked on, else T210922 should still be solved the same way T (the one for admins to be able to delete js in general) was.
(That is if these redirects are supposed to be blocked from editing for some reason?)
@Tgr can you help identify right project tags for this?
Certainly just make them not available don't REMOVE them! For example what if you log in less access on purpose such as BotPasswords or an OAUTH grant just to use the API.
@Anomie it failed on my first try
Nov 30 2018
Was ranked #52 in the https://meta.wikimedia.org/wiki/Community_Wishlist_Survey_2019 with 44 votes
Hello @hashar do you know if anyone is actually working on this issue, I don't see anyone assigned.
May be same as T210739
Nov 20 2018
Nov 19 2018
Listed on the CWL Survey for 2019, feel free to add support here: https://meta.wikimedia.org/wiki/Community_Wishlist_Survey_2019/Admins_and_patrollers/Allow_De-Privileged_logons_to_webui