Change Details

While fixing T296537, I found an extra grant on the letter A giving access to basically any database that has the letter `a` in it. It would have been a useless grant and could have been simply removed on the grounds that it's covered by `centralauth` and `%wik%` grant and that is the case for s7. But most of s3 also has this grant (only for one range though: `10.64.%` not on `10.192.%` unlike s7) and removing this grant also removes access to databases in s3 that doesn't follow the `%wik%` pattern. These databases are: [] blocker [] boards [] boardvote [] boardvote2005 [] boardvote2006 [] boardvote2007_test [] boardvotetest [] defoundation [x] heartbeat - Needed [x] information_schema - Needed [] jamestemp [] katesdb [x] mysql - Needed [] oai [] ops [x] performance_schema - Needed [] steward [x] sys - Needed [] webshop Do we need these databases? Does wikiuser need access to them? If so why only on half of the IP ranges? We can certainly keep them but I'm not sure if half of wikiuser should be able to query these. Note: `wikiadmin` doesn't have such grants meaning any maintenance script on such dbs would fail. If the access needed, it should be added to wikiadmin as well.

While fixing T296537, I found an extra grant on the letter A giving access to basically any database that has the letter `a` in it. It would have been a useless grant and could have been simply removed on the grounds that it's covered by `centralauth` and `%wik%` grant and that is the case for s7. But most of s3 also has this grant (only for one range though: `10.64.%` not on `10.192.%` unlike s7) and removing this grant also removes access to databases in s3 that doesn't follow the `%wik%` pattern. These databases are: [] blocker [] boards [] boardvote [] boardvote2005 [] boardvote2006 [] boardvote2007_test [] boardvotetest [] defoundation [x] heartbeat - Needed [x] information_schema - Needed [] jamestemp [] katesdb [x] mysql - Needed [] oai [x] ops - Needed [x] performance_schema - Needed [] steward [x] sys - Needed [] webshop Do we need these databases? Does wikiuser need access to them? If so why only on half of the IP ranges? We can certainly keep them but I'm not sure if half of wikiuser should be able to query these. Note: `wikiadmin` doesn't have such grants meaning any maintenance script on such dbs would fail. If the access needed, it should be added to wikiadmin as well.

While fixing T296537, I found an extra grant on the letter A giving access to basically any database that has the letter `a` in it. It would have been a useless grant and could have been simply removed on the grounds that it's covered by `centralauth` and `%wik%` grant and that is the case for s7. But most of s3 also has this grant (only for one range though: `10.64.%` not on `10.192.%` unlike s7) and removing this grant also removes access to databases in s3 that doesn't follow the `%wik%` pattern. These databases are: [] blocker [] boards [] boardvote [] boardvote2005 [] boardvote2006 [] boardvote2007_test [] boardvotetest [] defoundation [x] heartbeat - Needed [x] information_schema - Needed [] jamestemp [] katesdb [x] mysql - Needed [] oai [x] ops - Needed [x] performance_schema - Needed [] steward [x] sys - Needed [] webshop Do we need these databases? Does wikiuser need access to them? If so why only on half of the IP ranges? We can certainly keep them but I'm not sure if half of wikiuser should be able to query these. Note: `wikiadmin` doesn't have such grants meaning any maintenance script on such dbs would fail. If the access needed, it should be added to wikiadmin as well.