Last modified: 2009-02-09 09:56:53 UTC

Wikimedia Bugzilla is closed!

Wikimedia migrated from Bugzilla to Phabricator. Bug reports are handled in Wikimedia Phabricator.
This static website is read-only and for historical purposes. It is not possible to log in and except for displaying bug reports and their history, links might be broken. See T19238, the corresponding Phabricator task for complete and up-to-date bug report information.
Bug 17238 - GENDER-Parserfunction can be abused to fetch the gender of a bunch of users
GENDER-Parserfunction can be abused to fetch the gender of a bunch of users
Status: RESOLVED INVALID
Product: MediaWiki
Classification: Unclassified
Parser (Other open bugs)
unspecified
All All
: Normal normal with 1 vote (vote)
: ---
Assigned To: Nobody - You can work on this!
http://de.wikipedia.org/w/api.php?act...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2009-01-29 23:48 UTC by Christoph Müller
Modified: 2009-02-09 09:56 UTC (History)
2 users (show)

See Also:
Web browser: ---
Mobile Platform: ---
Assignee Huggle Beta Tester: ---


Attachments

Description Christoph Müller 2009-01-29 23:48:21 UTC
Currently the GENDER-parserfunction can be abused to crawel the gender:

This:

echo "http://de.wikipedia.org/w/api.php?action=expandtemplates&text=$(curl -s "http://de.wikipedia.org/w/api.php?format=jsonfm&action=query&list=allusers&augroup=sysop" |sed "s/"name": "/{{GENDER:/g"|sed "s/"/|w|m|?}}/g"|grep \{\{GENDER\:.*\|w\|m\|\?\}\}| tr -d '\n\t')"

generates an URI for the api to read out the gender of some german admins.

I think it would be an easy fix to change the behavior of the template to return only the gender of the current user instead of any other - this would also allow to leave genderspecific notes on a user talk since the gender of the text would be generated at the time of viewing but would close this privacyhole.
Comment 1 Melancholie 2009-01-30 01:53:08 UTC
Sorry, I see this as invalid.
Nobody is forced to specify his or her gender, users can leave/set it being 'Unspecified'!
If someone wants to set its account to 'male/female', its a free choice of that user (and actually nothing 'that' private, there are only two possibilities, and mostly users are male anyway ;-) -- the username itself is most often much more revealing.

The only thing that should be done is to note (beside the selection menu at [[Special:Preferences]]) that this information will be public!
Comment 2 Brion Vibber 2009-01-30 21:55:06 UTC
Indeed, this is intended to be open-visible information like the username, and exists primarily to allow proper grammatical use of the username.

Please open a separate bug for cleaning up the preferences UI.
Comment 3 Melancholie 2009-02-09 09:56:53 UTC
(In reply to comment #2)
> Please open a separate bug for cleaning up the preferences UI.
> 

Bug 17311

Note You need to log in before you can comment on or make changes to this bug.


Navigation
Links