Page MenuHomePhabricator
Create Task
Maniphest T19877

No validity checks for auto-created accounts
Closed, ResolvedPublic
Actions

Description

Apparently, any username containing a : cannot be blocked by administrators. Case in point, [[Special:Contributions/WP:ANI]] on enwiki.

Version: unspecified
Severity: major

Details

Reference
bz17877

Event Timeline

• bzimport raised the priority of this task from to High.Nov 21 2014, 10:32 PM
• bzimport added a project: MediaWiki-extensions-CentralAuth.
• bzimport set Reference to bz17877.
• bzimport added a subscriber: Unknown Object (MLST).
FastLizard4 created this task.Mar 9 2009, 5:50 AM
• MZMcBride added a comment.Mar 9 2009, 5:53 AM

The user account can be renamed. And I believe this is related to namespace aliases (WP: and WT:) not colons. Summary adjusted accordingly.

Peachey88 added a comment.Mar 9 2009, 6:15 AM

In the golbal block form you can use "#<USERIDNUMBER>" in the username field, that might also work in the local block lists as well.

Peachey88 added a comment.Mar 9 2009, 6:16 AM
  • Bug 17878 has been marked as a duplicate of this bug. ***
Dragons_flight added a comment.Mar 9 2009, 7:39 AM

See also, Bug 17879 which points out that User:WP:ANI was only created because CentralAuth allowed a name to be created that would have be forbidden if one attempted to registered it locally.

I filed that separately because at least in principle one could patch this bug without tackling the AuthPlugin issue, but I believe it probably makes more sense to disallow AuthPlugin from creating accounts that lead to this scenario. If one does patch AuthPlugin it would be very difficult (though not strictly impossible) to arrive at this bug again.

• werdna added a comment.Mar 9 2009, 8:54 AM

Modifying to a correct description of the problem

• werdna added a comment.Mar 9 2009, 9:41 AM

Fixed for autologin in r48211. WORKSFORME in core login interface.

Dragons_flight added a comment.Mar 11 2009, 6:12 PM

*** Bug 17879 has been marked as a duplicate of this bug. ***

MarcoAurelio moved this task from Backlog to Done on the MediaWiki-extensions-CentralAuth board.May 5 2015, 6:10 PM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL