Page MenuHomeMiraheze

wgManageWikiPermissionsBlacklistGroups does not prevent creation/modification of listed groups
Closed, ResolvedPublic

Description

Confirmed on voidwiki that it is possible to create the checkuser group with the read permission, enable autopromotion, and gain access to Special:CheckUser by making one edit to flag autopromotion.

Event Timeline

Void triaged this task as Unbreak Now! priority.Jun 23 2020, 23:33
Void created this task.
Void created this object with visibility "Subscribers".
Void created this object with edit policy "Subscribers".
diff --git a/i18n/en.json b/i18n/en.json
index b7abd69..a5a7cfb 100644
--- a/i18n/en.json
+++ b/i18n/en.json
@@ -49,6 +49,7 @@
        "managewiki-conflicts": "Conflicts with",
        "managewiki-desc": "Allows people to manage wikis through a web interface",
        "managewiki-disabled": "This feature ($1) has not been enabled on this wiki yet.",
+        "managewiki-error-create-permission": "Failed to create group $1.",
        "managewiki-error-conflict": "The extension $1 can not enabled because it conflicts with $2.",
        "managewiki-error-disallowednamespace": "The namespace $1 is not allowed.",
        "managewiki-error-install": "The extension $1 failed to be installed.",
diff --git a/includes/formFactory/ManageWikiFormFactoryBuilder.php b/includes/formFactory/ManageWikiFormFactoryBuilder.php
index 6381706..cb1d982 100644
--- a/includes/formFactory/ManageWikiFormFactoryBuilder.php
+++ b/includes/formFactory/ManageWikiFormFactoryBuilder.php
@@ -1107,7 +1107,15 @@ class ManageWikiFormFactoryBuilder {
                string $wiki,
                string $group
        ) {
-               global $wgManageWikiPermissionsPermanentGroups, $wgManageWikiPermissionsBlacklistRights;
+               global $wgManageWikiPermissionsPermanentGroups, $wgManageWikiPermissionsBlacklistGroups, $wgManageWikiPermissionsBlacklistRights;
+
+               if ( $wgManageWikiPermissionsBlacklistGroups[$group] ?? false ) {
+                       return [
+                               'errors' => [
+                                       'managewiki-error-create-permission' => $group
+                               ],
+                       ];
+               }
 
                $mwPermissions = new ManageWikiPermissions( $wiki );
                $permList = $mwPermissions->list( $group );
Paladox changed the edit policy from "Subscribers" to "acl*security (Project)".Jun 23 2020, 23:48
Paladox changed the visibility from "Subscribers" to "acl*security (Project)".
Paladox removed a subscriber: acl*security.

I'm thinking more along the lines of

diff --git a/includes/formFactory/ManageWikiFormFactoryBuilder.php b/includes/formFactory/ManageWikiFormFactoryBuilder.php
index 6381706..25473b8 100644
--- a/includes/formFactory/ManageWikiFormFactoryBuilder.php
+++ b/includes/formFactory/ManageWikiFormFactoryBuilder.php
@@ -541,11 +541,15 @@ class ManageWikiFormFactoryBuilder {

        private static function buildDescriptorPermissions(
                string $wiki,
-               bool $ceMW,
+               bool &$ceMW,
                string $group
        ) {
                global $wgManageWikiPermissionsBlacklistRights, $wgManageWikiPermissionsBlacklistGroups;

+               if ( in_array( $group, $wgManageWikiPermissionsBlacklistGroups ) ) {
+                       $ceMW = false;
+               }
+
                $mwPermissions = new ManageWikiPermissions( $wiki );
                $permList = $mwPermissions->list( $group );
This comment was removed by Paladox.
Paladox claimed this task.
Paladox reassigned this task from Paladox to Void.
Paladox changed the visibility from "acl*security (Project)" to "Public (No Login Required)".Jun 25 2020, 16:56
Paladox changed the edit policy from "acl*security (Project)" to "All Users".