Last modified: 2011-01-25 01:51:10 UTC

Wikimedia Bugzilla is closed!

Wikimedia has migrated from Bugzilla to Phabricator. Bug reports should be created and updated in Wikimedia Phabricator instead. Please create an account in Phabricator and add your Bugzilla email address to it.
Wikimedia Bugzilla is read-only. If you try to edit or create any bug report in Bugzilla you will be shown an intentional error message.
In order to access the Phabricator task corresponding to a Bugzilla report, just remove "static-" from its URL.
You could still run searches in Bugzilla or access your list of votes but bug reports will obviously not be up-to-date in Bugzilla.
Bug 17014 - Blocked users can use Special:UserRights
Blocked users can use Special:UserRights
Status: RESOLVED FIXED
Product: MediaWiki
Classification: Unclassified
Special pages (Other open bugs)
unspecified
All All
: Normal enhancement with 2 votes (vote)
: ---
Assigned To: Nobody - You can work on this!
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2009-01-14 02:20 UTC by MZMcBride
Modified: 2011-01-25 01:51 UTC (History)
3 users (show)

See Also:
Web browser: ---
Mobile Platform: ---
Assignee Huggle Beta Tester: ---


Attachments

Description MZMcBride 2009-01-14 02:20:53 UTC
# (User rights log); 02:18 . . MZMcBride (Talk | contribs | block) changed group membership for User:Bunnyrabbitholla! from (none) to Editors and Reviewers (testing)
# (Block log); 02:17 . . MZMcBride (Talk | contribs | block) blocked MZMcBride (Talk | contribs) with an expiry time of 10 minutes (autoblock disabled) (testing)

This seems rather silly. Blocked users should only be able to unblock themselves (if they have the appropriate right). Nothing else.
Comment 1 FunPika 2009-01-14 02:30:34 UTC
If a user can grant a flag with the block right, but for some reason doesn't have it (or any other flag with block) set on themselves and then gets blocked, what would they do then if they got "you are blocked" errors upon trying to give themselves the rights needed to lift the block? 
Comment 2 Gurch 2009-01-14 15:16:54 UTC
(In reply to comment #1)
> If a user can grant a flag with the block right, but for some reason doesn't
> have it (or any other flag with block) set on themselves and then gets blocked,
> what would they do then if they got "you are blocked" errors upon trying to
> give themselves the rights needed to lift the block? 

Get someone else to unblock them?
Comment 3 Niklas Laxström 2009-02-21 09:03:45 UTC
Is there any reason to do this other than "this seems silly"?
Comment 4 MZMcBride 2009-02-21 22:54:02 UTC
If a user is blocked, presumably someone didn't want them making any actions on the wiki. A user could, for example, assign themselves +editor and then remove it from themselves with spam in the edit summaries. Or an insecure bureaucrat account that has been blocked but not yet had its rights removed could remove rights from other accounts.

If an account is blocked, it should be _blocked_. It should only be able to perform a very limited set of actions (really only being able to unblock itself) and that's it.
Comment 5 Niklas Laxström 2009-02-22 08:25:17 UTC
What is the point if he can unblock himself and then do the all actions again? What if someone blocks everybody else from using user rights?
Comment 6 Splarka 2009-06-18 00:59:01 UTC
It is possible to have opt-in groups (as per test.wikipedia) whereby a user without block/unblock ability can manipulate user rights.

I suggest that anyone with access to UserRights via: $wgAddGroups $wgRemoveGroups $wgGroupsAddToSelf $wgGroupsRemoveFromSelf should be blocked from editing user rights if they are blocked.

Conversely, anyone with the 'userrights' permission should not be blocked from user rights if blocked, as this implies full access to all rights on the wiki (in theory). The reason is: having 'userrights' permission does not imply having 'block'. It is not uncommon for a 'bureaucrat' to not also be a 'sysop' (obviously does not apply to WMF projects, where bureaucrats don't have full access to userrights). 

2 cents.
Comment 7 Ryan Schmidt 2009-06-18 02:18:53 UTC
fixed in r52082

Note You need to log in before you can comment on or make changes to this bug.


Navigation
Links