Page MenuHomePhabricator
Create Task
Maniphest T340470

Investigate: UserGroupManager::addUserToGroup should not called on temporary users from WMF deployed extensions
Closed, ResolvedPublic3 Estimated Story Points
Actions

Description

This is for T330816: [Epic] Temporary users should not be assigned to user groups. See also T330816#8958447.

Please check:

  • Which extensions call UserGroupManager::addUserToGroup
  • Which extensions call the deprecated User::addGroup (which calls UserGroupManager::addUserToGroup)

...and file tasks to update any calls found.

Related Objects
Search...

StatusSubtypeAssignedTask
Restricted Task
 ResolvedkostajhT294511 2021 Security Team wikireplicas audit
 DeclinedNoneT284948 Raw IPs of logged-out users disclosed in wiki-replicas
 In ProgressNiharikaT324492 Temporary accounts - MVP
 OpenNoneT326816 [Epic] Update features for temporary accounts
 OpenTchandersT326869 Update TSP-owned products that may be affected by IP Masking
 OpenNoneT307060 [Epic] Temporary account AbuseFilter support
 ResolvedSTranT331653 Investigate: Update AbuseFilter for IP Masking
 ResolvedUmherirrenderT328311 Special:AbuseLog is missing the `mw-tempuserlink` class from temporary account user links
 Resolved• AGueyteT335062 Update AbuseFilter with the right user verification
 Duplicate• AGueyteT335064 Investigate AbuseFilter Hook with CheckUser
 ResolvedSTranT334623 How do we log unsuccessful first edits for temporary users?
 ResolvedDreamy_JazzT357615 Create filters to distinguish anonymous/temporary/registered users
 ResolvedSTranT357772 Investigate: How will `ip_in_range` and `ip_in_ranges` function when temporary accounts are enabled
 ResolvedSTranT364833 Add `user_unnamed_ip` variable
 ResolvedSTranT363906 [Epic] Ensure filters that use PII-sensitive variables are protected
 ResolvedSTranT364465 Display changes to protected status and flags on AbuseFilter history and diff pages
 ResolvedSTranT364485 Alert a filter editor that a filter must be protected if it is saved with a protected variable
 ResolvedkostajhT365049 Investigate what to do about the AbuseFilter log revealing someone's IP address via historical logs
 ResolvedSTranT365743 Log when AbuseFilter user sees IP address associated with temp account via user_unnamed_ip variable trigger
 ResolvedTchandersT364902 How should access to IPs of temporary accounts be logged?
 ResolvedSTranT367390 Add granular query restrictions for AbuseFilter filter search
 ResolvedSTranT364834 Ensure testing tools that use `user_unnamed_ip` don't reveal it to users without the view right
 ResolvedSTranT369610 Give the `abusefilter-access-protected-vars` right to global maintainers
 OpensgrabarczukT369611 Coordinate the updates of IP-using AbuseFilter filters to use `user_unnamed_ip`
 ResolvedSTranT357774 Investigate: What to do with existing filters that temporary accounts will break
 ResolvedBUG REPORTDreamy_JazzT358632 CannotCreateActorException when creating a temporary account on an edit which causes an abuse filter log
 ResolvedSTranT365740 Document the changes introduced for temporary accounts
 Resolved• TThoabalaT331718 Undeploy SimilarEditors from Beta
 Resolved• TThoabalaT331749 Investigate: Update AntiSpoof for IP Masking
 Resolved• TThoabalaT336196 Don't store temporary user names in AntiSpoof's spoofuser table
 Resolved• AGueyteT331750 Investigate: Update SecurePoll for IP Masking
 ResolvedBUG REPORT• AGueyteT334421 BUG FIX: Display of SecurePoll logs
 ResolvedBUG REPORT• AGueyteT334490 SecurePoll Vote Details returns SQL Error
 Resolved• AGueyteT334597 Update User access to polls on SecurePoll
 Resolved• AGueyteT331751 Investigate: Update GlobalBlocking for IP Masking
 ResolvedCyndymediawiksimT331752 Investigate: Update CheckUser for IP Masking
 DuplicateNoneT332821 Should temporary users be treated as possible initiators of a check for the CheckUserLog
 OpenNoneT331637 Update features in MediaWiki core for IP Masking
 ResolvedTchandersT330816 [Epic] Temporary users should not be assigned to user groups
 Resolved• TThoabalaT340470 Investigate: UserGroupManager::addUserToGroup should not called on temporary users from WMF deployed extensions
 Resolved• AGueyteT340578 Ensure UserGroupManager::addUserToGroup is not called on temporary users from AbuseFilter extension
ResolvedNoneT340579 Ensure UserGroupManager::addUserToGroup is not called on temporary users from Flow extension
Resolved• TThoabalaT340580 Ensure UserGroupManager::addUserToGroup is not called on temporary users from Echo extension
Resolved• TThoabalaT340583 Ensure UserGroupManager::addUserToGroup is not called on temporary users from LdapAuthentication extension
Resolvedabi_T340584 Ensure UserGroupManager::addUserToGroup is not called on temporary users from Translate extension
Resolved• TThoabalaT340587 Ensure UserGroupManager::addUserToGroup is not called on temporary users from MassMessage extension
Resolved• TThoabalaT340588 Ensure UserGroupManager::addUserToGroup is not called on temporary users from Wikibase extension
Invalid• TThoabalaT340616 Ensure User::addGroup is not called on temporary users from WikiLambda extension
 ResolvedNoneT340618 Ensure User::addGroup is not called on temporary users from CentralAuth extension

Event Timeline

Tchanders created this task.Jun 26 2023, 5:01 PM
• TThoabala claimed this task.Jun 27 2023, 9:03 AM
• TThoabala moved this task from Ready 🎬 (ONLY IF YOU HAVE NO MORE CODE TO REVIEW) to In Progress 💪 on the Anti-Harassment (AHaT Sprint 32 - Baseball Cap) board.
• TThoabala mentioned this in T340578: Ensure UserGroupManager::addUserToGroup is not called on temporary users from AbuseFilter extension .Jun 27 2023, 9:12 PM
• TThoabala mentioned this in T340579: Ensure UserGroupManager::addUserToGroup is not called on temporary users from Flow extension .Jun 27 2023, 9:16 PM
• TThoabala mentioned this in T340580: Ensure UserGroupManager::addUserToGroup is not called on temporary users from Echo extension .Jun 27 2023, 9:18 PM
• TThoabala mentioned this in T340583: Ensure UserGroupManager::addUserToGroup is not called on temporary users from LdapAuthentication extension .Jun 27 2023, 9:22 PM
• TThoabala mentioned this in T340584: Ensure UserGroupManager::addUserToGroup is not called on temporary users from Translate extension .Jun 27 2023, 9:24 PM
• TThoabala mentioned this in T340587: Ensure UserGroupManager::addUserToGroup is not called on temporary users from MassMessage extension .Jun 27 2023, 9:27 PM
• TThoabala mentioned this in T340588: Ensure UserGroupManager::addUserToGroup is not called on temporary users from Wikibase extension .Jun 27 2023, 9:44 PM
• TThoabala mentioned this in T340616: Ensure User::addGroup is not called on temporary users from WikiLambda extension.Jun 28 2023, 8:39 AM
• TThoabala mentioned this in T340618: Ensure User::addGroup is not called on temporary users from CentralAuth extension.Jun 28 2023, 8:44 AM
taavi closed subtask T340618: Ensure User::addGroup is not called on temporary users from CentralAuth extension as Resolved.Jun 28 2023, 8:47 AM
• TThoabala moved this task from In Progress 💪 to Code Review 🔍 on the Anti-Harassment (AHaT Sprint 32 - Baseball Cap) board.Jun 28 2023, 8:48 AM
• AGueyte set the point value for this task to 3.Jun 28 2023, 12:06 PM
• AGueyte moved this task from Code Review 🔍 to Done Q1 2023-2024 on the Anti-Harassment (AHaT Sprint 32 - Baseball Cap) board.Jun 28 2023, 5:28 PM
Urbanecm_WMF closed subtask T340579: Ensure UserGroupManager::addUserToGroup is not called on temporary users from Flow extension as Resolved.Jul 12 2023, 8:53 AM
abi_ changed the status of subtask T340584: Ensure UserGroupManager::addUserToGroup is not called on temporary users from Translate extension from Open to In Progress.Jul 20 2023, 4:18 PM
abi_ closed subtask T340584: Ensure UserGroupManager::addUserToGroup is not called on temporary users from Translate extension as Resolved.Jul 21 2023, 4:50 PM
Tchanders closed subtask T340587: Ensure UserGroupManager::addUserToGroup is not called on temporary users from MassMessage extension as Resolved.Aug 14 2023, 10:25 AM
Tchanders closed subtask T340583: Ensure UserGroupManager::addUserToGroup is not called on temporary users from LdapAuthentication extension as Resolved.
Tchanders closed subtask T340580: Ensure UserGroupManager::addUserToGroup is not called on temporary users from Echo extension as Resolved.
Tchanders closed subtask T340578: Ensure UserGroupManager::addUserToGroup is not called on temporary users from AbuseFilter extension as Resolved.Aug 14 2023, 10:29 AM
Tchanders closed subtask T340588: Ensure UserGroupManager::addUserToGroup is not called on temporary users from Wikibase extension as Resolved.
Tchanders closed this task as Resolved.Aug 14 2023, 10:33 AM
Tchanders closed subtask T340616: Ensure User::addGroup is not called on temporary users from WikiLambda extension as Invalid.
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits