Page MenuHomePhabricator
Create Task
Maniphest T35429

Make the title blacklist allow auto creations for global accounts
Closed, ResolvedPublic
Actions

Description

Because of problems like this https://meta.wikimedia.org/w/index.php?title=Talk:Title_blacklist&oldid=3192814#Fakes_of_Wikimedia_Deutschland_.28WMDE.29_staff it would be good, if user names listed on the title blacklist could still be auto created if there is a valid global account. In my opinion, that shouldn't apply to all rules, but only to some specifically marked ones (maybe with allowautocreate or smth. like that).

See also: T38939: User name blacklist should be managed globally to avoid SUL fragmentation

Details

Reference
bz33429
SubjectRepoBranchLines +/-
Add config option to disable blocking auto account creationsmediawiki/extensions/TitleBlacklistmaster+20 -2
Allow auto creations of global accounts in title blacklistmediawiki/extensions/TitleBlacklistmaster+1 -2
Customize query in gerrit

Related Objects
Search...

Event Timeline

• bzimport raised the priority of this task from to Low.Nov 22 2014, 12:02 AM
• bzimport added a project: TitleBlacklist.
• bzimport set Reference to bz33429.
• bzimport added a subscriber: Unknown Object (MLST).
hoo created this task.Dec 30 2011, 2:11 AM
Eloquence added a comment.May 17 2012, 6:14 PM

I don't think the blacklist should be managed locally at all. This is just a recipe for ongoing SUL fragmentation. See bug 36939.

vvv added a comment.Jul 28 2012, 10:41 PM
  • Bug 38762 has been marked as a duplicate of this bug. ***
• MZMcBride added a comment.Aug 8 2012, 10:39 PM

(In reply to comment #1)

I don't think the blacklist should be managed locally at all. This is just a
recipe for ongoing SUL fragmentation. See bug 36939.

I'm not sure bug 36939 is related to this bug.

This bug is about a bad user creating a "Jdoe (WMF)" account and using it to impersonate a Wikimedia Foundation staffer. As a response to this scenario, admins at Meta-Wiki have attempted to blacklist accounts ending in " (WMF)" and " (WMDE)", thinking that administrators/staffers will be able to override the title blacklist when creating new WMF or WMDE accounts. However, even if an administrator can create the account, the new and unprivileged WMF or WMDE account is going to always hit issues on other wikis where the global title blacklist applies, unless these accounts are explicitly given a global user group allowing them to override the global title blacklist.

As I understand it, that is what this bug is discussing. Yes, the local title blacklists probably need to be done away with for accounts (bug 36939), but that seems like a largely separate issue from what's being discussed here.

Nemo_bis added a comment.Apr 30 2013, 5:38 PM

(In reply to comment #3)

(In reply to comment #1)

I don't think the blacklist should be managed locally at all. This is just a
recipe for ongoing SUL fragmentation. See bug 36939.

I'm not sure bug 36939 is related to this bug.

It's not alternative to it, but I'd say it depends on it, because whatever solution you come up with can only be global.

Glaisher updated the task description. (Show Details)Mar 12 2015, 5:10 PM
Glaisher added a project: SUL-Finalization.
Glaisher set Security to None.
Glaisher removed a subscriber: Unknown Object (MLST).
Glaisher subscribed.
Glaisher updated the task description. (Show Details)Mar 12 2015, 5:14 PM
gerritbot subscribed.Mar 12 2015, 5:16 PM

Change 196266 had a related patch set uploaded (by Glaisher):
Allow auto creations of global accounts in title blacklist

https://gerrit.wikimedia.org/r/196266

gerritbot added a project: Patch-For-Review.Mar 12 2015, 5:16 PM
gerritbot added a comment.Mar 13 2015, 8:48 AM

Change 196266 abandoned by Glaisher:
Allow auto creations of global accounts in title blacklist

Reason:
Hmm, yeah. Better to implement a <allowautocreate> tag or sth like that.

https://gerrit.wikimedia.org/r/196266

Glaisher removed projects: Patch-For-Review, SUL-Finalization.Mar 13 2015, 8:48 AM
Legoktm closed subtask T38939: User name blacklist should be managed globally to avoid SUL fragmentation as Resolved.Apr 8 2015, 11:20 PM
• MZMcBride added a comment.Jun 30 2015, 12:36 AM

I'm not actually clear what's needed here. Today, if we globally re-blacklist .+ (WMF) and .+ (WMDE) accounts, then only privileged users will be able to create such accounts. If a user then has a "Foo (WMF)" account made for them by a privileged user and begins using this "Foo (WMF)" account, their accounts should be able to be auto-created on local wikis, correct? So this needs a... CentralAuth change?

Glaisher added a comment.Jun 30 2015, 12:37 PM

I don't think this would be a CentralAuth change (unless all autocreations are by CentralAuth). Proper way to do this would be to introduce a new tag to TitleBlacklist which would allow autocreations even when blacklisted (i.e., what the task description asks for).

gerritbot added a comment.Jul 9 2015, 6:41 PM

Change 223717 had a related patch set uploaded (by Legoktm):
Add config option to disable blocking auto account creations

https://gerrit.wikimedia.org/r/223717

gerritbot added a project: Patch-For-Review.Jul 9 2015, 6:41 PM
gerritbot added a comment.Jul 9 2015, 6:43 PM

Change 223717 merged by jenkins-bot:
Add config option to disable blocking auto account creations

https://gerrit.wikimedia.org/r/223717

Krenair mentioned this in rMEXT879a5e11b34f: Updated mediawiki/extensions Project: mediawiki/extensions/TitleBlacklist….Jul 9 2015, 6:43 PM
Legoktm mentioned this in rETBLe483b741afa0: Add config option to disable blocking auto account creations.Jul 9 2015, 6:47 PM
• Forrestbot added a project: WMF-deploy-2015-07-14_(1.26wmf14).Jul 9 2015, 7:00 PM
Legoktm subscribed.Jul 10 2015, 3:25 AM

The $wgTitleBlacklistBlockAutoAccountCreation setting can now be used to disable the filtering of autocreation.

Legoktm closed this task as Resolved.Jul 10 2015, 3:25 AM
Legoktm assigned this task to Krenair.
Bugreporter mentioned this in T348388: Use central login wiki for login (SUL3).Jan 8 2024, 2:22 AM
Maintenance_bot removed a project: Patch-For-Review.Jan 8 2024, 2:30 AM
Pppery awarded a token.Jan 8 2024, 3:08 AM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL