Page MenuHomePhabricator

Group names longer than the 'ug_group'/'ufg_group' db field should cause an error
Open, LowPublic

Description

Author: altsysrq

Description:
'ug_group' column in 'user_groups' table limited to 16 characters, but when modifying rights directly from LocalSettings.php configuration file, group with longer name can be added, like:

$wgGroupPermissions['copy_upload_access']['upload_by_url'] = true;

will show 'copy_upload_access' in groups list in administration panel, but no user can be added to this group, because 'copy_upload_access' is 17 characters length.

Some check of validity of at least $wgGroupPermissions should be added.

Details

Reference
bz15285

Event Timeline

bzimport raised the priority of this task from to Low.Nov 21 2014, 10:21 PM
bzimport set Reference to bz15285.
bzimport added a subscriber: Unknown Object (MLST).

Fix is trivial, should just increase the column length so it's not an issue.

Since we can't show an error when you save LocalSettings.php with your text editor, how do you expect that validity check to work?

(In reply to comment #2)

Since we can't show an error when you save LocalSettings.php with your text
editor, how do you expect that validity check to work?

We could check $wgGroupPermission sanity in Setup.php and wfWarn() if it's not.

But that'd be insane.

Like I said, make the column bigger.

How much bigger? $wgGroupPermission doesn't have any intrinsec limit.

Although we could give an specific error when you try to add it. Mysql in strict mode will give an error, in the "normal" mode, it just truncates. We could look for warnings.

(In reply to comment #4)

How much bigger? $wgGroupPermission doesn't have any intrinsec limit.

Reasonably bigger. It's currently varbinary(16). If you made it varbinary(50), I think that would cover nearly all cases. It looks like CentralAuth's global_user_group table uses varchar(255) for the gug_group column. I'm not sure you need to increase the size that much, but it's worth considering, I suppose.

If someone sets $wgGroupPermissions to something unreasonably long, they should expect breakage. I don't think there's a real need for warnings and validity checks here; I think all that's needed here is a reasonably larger size limit for the ug_group column and some common sense.

FYI, r103685 doubled it's size...

Krinkle renamed this task from groups longer than the 'ug_group'/'ufg_group' can be created to Group names longer than the 'ug_group'/'ufg_group' db field should cause an error.May 24 2017, 12:42 PM
Krinkle edited projects, added MediaWiki-User-management; removed MediaWiki-libs-Rdbms.
Krinkle updated the task description. (Show Details)
Krinkle moved this task from Backlog to User rights on the MediaWiki-User-management board.
Krinkle removed a subscriber: wikibugs-l-list.