Last modified: 2012-04-16 09:16:10 UTC

Wikimedia Bugzilla is closed!

Wikimedia migrated from Bugzilla to Phabricator. Bug reports are handled in Wikimedia Phabricator.
This static website is read-only and for historical purposes. It is not possible to log in and except for displaying bug reports and their history, links might be broken. See T30366, the corresponding Phabricator task for complete and up-to-date bug report information.
Bug 28366 - Auto-created users without edits are shown on Special:ListUsers
Auto-created users without edits are shown on Special:ListUsers
Status: RESOLVED INVALID
Product: MediaWiki
Classification: Unclassified
Special pages (Other open bugs)
unspecified
All All
: Normal enhancement (vote)
: ---
Assigned To: Nobody - You can work on this!
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2011-04-01 15:02 UTC by Mark A. Hershberger
Modified: 2012-04-16 09:16 UTC (History)
2 users (show)

See Also:
Web browser: ---
Mobile Platform: ---
Assignee Huggle Beta Tester: ---


Attachments

Description Mark A. Hershberger 2011-04-01 15:02:49 UTC
This is a privacy issue as outlined in Bug #19161, specifically commment #43:

> Whereas before the privacy vuln required looking at the user creation log,
> which is now blank
> 
> https://secure.wikimedia.org/wikipedia/en/w/index.php?title=Special:Log&type=newusers&user=Nane2011
> 
> Now, the exact same information is visible here:
> 
> https://secure.wikimedia.org/wikipedia/en/w/index.php?title=Special%3AListUsers&username=Nane2011&group=&limit=1
Comment 1 MZMcBride 2011-04-01 15:19:33 UTC
This bug is invalid. The function of Special:ListUsers is to list users on the wiki. It doesn't matter _how_ those user accounts were created (whether through unified login, through manual creation, by an admin after an individual's request, or with the help of Indian slave labor), if the accounts exist on a given wiki, they should be listed. That's the purpose of Special:ListUsers.

As explained in bug 19161 comment 43:
> Moreover, hiding the new user creation entry is _not_ the solution.  That just
> hides it, and then the wiki database contains information which it needs to
> keep hidden in order to protect the privacy of its users.  Any number of
> oversights/screw ups with data management can result in accidental release of
> this information.  Avoid creating data that you want to remain hidden.

The issue is not that Special:ListUsers does its job to list the users on the wiki. The issue is that some people feel certain auto-created accounts should not be silently (and magically) auto-created in some situations.

Resolving this bug as invalid.
Comment 2 db [inactive,noenotif] 2011-04-01 15:21:23 UTC
And also with the api (list=allusers and list=users):
https://secure.wikimedia.org/wikipedia/en/w/api.php?action=query&list=allusers|users&ususers=Nane2011&aufrom=Nane2011&aulimit=1

Note You need to log in before you can comment on or make changes to this bug.


Navigation
Links