Last modified: 2014-11-09 18:46:57 UTC

Wikimedia Bugzilla is closed!

Wikimedia has migrated from Bugzilla to Phabricator. Bug reports should be created and updated in Wikimedia Phabricator instead. Please create an account in Phabricator and add your Bugzilla email address to it.
Wikimedia Bugzilla is read-only. If you try to edit or create any bug report in Bugzilla you will be shown an intentional error message.
In order to access the Phabricator task corresponding to a Bugzilla report, just remove "static-" from its URL.
You could still run searches in Bugzilla or access your list of votes but bug reports will obviously not be up-to-date in Bugzilla.
Bug 14416 - MergeAccount should assign never-been-used accounts to the global account
MergeAccount should assign never-been-used accounts to the global account
Status: NEW
Product: MediaWiki extensions
Classification: Unclassified
CentralAuth (Other open bugs)
All All
: Normal enhancement with 6 votes (vote)
: ---
Assigned To: Victor Vasiliev
Depends on:
  Show dependency treegraph
Reported: 2008-06-05 17:56 UTC by Robert Rohde
Modified: 2014-11-09 18:46 UTC (History)
8 users (show)

See Also:
Web browser: ---
Mobile Platform: ---
Assignee Huggle Beta Tester: ---


Description Robert Rohde 2008-06-05 17:56:58 UTC
When establishing global accounts, it would be useful if Special:MergeAccount automatically assigned never-been-used accounts to the global account holder.  Right now there are a large number of accounts that were registered but have no edit/action history at all (well over 50% of all accounts on enwiki).  Rather than forcing local bureaucrats to rename these accounts, it would be simpler if global account creation automatically usurped accounts that were created but never used.
Comment 1 Al Tally 2008-06-05 18:11:40 UTC
What if the account had literally just registered, quite recently? That doesn't sound very fair.
Comment 2 Robert Rohde 2008-06-05 18:24:56 UTC
Well it is a pretty unlikely race condition that an account would have just been created, but never used, at the same time that someone else wants to unify a global account with the same name.  But if you really want to worry about that one could add a check that the unused account was at least X weeks old, for some reasonable value of X.
Comment 3 Brion Vibber 2008-06-05 20:08:51 UTC
I believe this was a temporary hack to avoid potential security issues with the email being set differently (leading to the possibility that the creator of the no-edits account could then take over the global account). This is probably obsolete now, with the global e-mail setting overriding the old local one, and can be removed
Comment 4 Will 2008-06-06 09:08:04 UTC
It would save a lot of bureaucrat time if this happened automatically. Alternatively, I am thinking of trying to get enwiki to approve a bot with bureaucrat rights to automatically rename out of the way every account with zero edits and the same name as a global account, as those attached to the global account won't be able to be renamed. It would seem simpler however if the software just gave away accounts without edits automatically, and I wanted to explore that possibility before going down the (no doubt arduous) route of getting a bot approved for this task.
Comment 5 Samuel Wantman 2008-06-21 00:59:45 UTC
I have a very common username (Sam).  There are over 60 projects that have users with accounts that are not me.  All but a handful have no edits, and most are several years old.  It would take me forever to try and usurp all these accounts.  SUL has had the effect of discouraging me from leaving messages on projects I haven't been to before.  For example,  I thought of leaving a comment on French Wikipedia.  I found that someone had my name, but there are no contributions and there is no log.  I have the option of trying to figure out how to usurp the account and then remerge my accounts or editing anonymously or editing with a different user name and later renaming and usurping the account.  None of these options are worth the time and effort involved, so I didn't leave the comment.  After these old, zero contribution accounts automatically get usurped, I'll spend the time to usurp the handful that remain.  Until then, I just don't see the point. 
Comment 6 Mike.lifeguard 2008-12-28 22:18:20 UTC
Didn't evil_plans.txt have a half-decent method of automatically merging accounts?
Comment 7 Andrew Garrett 2009-03-03 02:59:39 UTC
There are still issues. Tim notes that malicious preferences and user JS could be used to take over an account.

Would it be sensible to:
Wipe preferences and userspace when taking over an account;
Rename the old user to some new name when taking it over; or
Require user interaction to take over an account?
Comment 8 MA 2014-11-09 17:58:58 UTC
As far as I know stewards are since long time no longer able to merge global accounts via CentralAuth, and this was only possible on the begginings of SUL. Is this then still an issue? Can it be closed?

Note You need to log in before you can comment on or make changes to this bug.