Page MenuHomePhabricator

Disallow eliminators to block sysops on fawiki
Closed, DeclinedPublic

Description

Fawiki is one of the (I think) 2 or 3 wikis that has an "eliminator" group. This group is not sysop, but has the block right. Selection for this group is also not as rigorous as it is for becoming a sysop. The local policy specifically does not allow eliminators to block users who have any of the following rights: sysop, patrol, autopatrol, revert. We enforce this by retrospectively reviewing the logs.

Given T150826, we would like to make it technically impossible for eliminators to block sysops. My initial survey of the code shows this is not a quick fix. Ideas are welcome; my thought right now is to create an extension that (a) defines the "eliminator" role, and (b) calls the rights hooks to prevent the block attempts.

Event Timeline

Huji triaged this task as Low priority.Nov 28 2018, 6:33 PM

I am setting priority, as I will be working on it myself.

I am setting it to low for now, to match the parent task. But indeed, since T150826 has been already implemented, this might deserve a higher priority.

@Huji maybe we could add a new global config, for instance wgGroupBlockRestrictions to serve this purpose. In fawiki's case, that would take a value of $wgGroupBlockRestrictions['eliminator'] = ['sysop']. This doesn't allow a customization based on user rights instead of user groups, but it could still be useful in a broader range of cases.

Excellent idea! Patch coming shortly.

Change 476439 had a related patch set uploaded (by Huji; owner: Huji):
[mediawiki/core@master] Enable restricting certain groups from blocking certain groups.

https://gerrit.wikimedia.org/r/476439

Change 476503 had a related patch set uploaded (by Huji; owner: Huji):
[operations/mediawiki-config@master] Dissallow eliminators to block certain groups on fawiki

https://gerrit.wikimedia.org/r/476503

Test instructions for https://gerrit.wikimedia.org/r/476439

  1. Add the following to LocalSettings.php :
$wgGroupBlockRestrictions['eliminator'] = [ 'sysop' ];
$wgGroupPermissions['eliminator']['block']  = true;
  1. Create an account and promote them to the "eliminator" group. Make sure you also have a user in the "sysop" group.
  2. Log in using the "eliminator" user and try to block the "sysop" user. You should get a warning message disallowing you. Submitting the form should also result in failure.
Sannita renamed this task from Dissallow eliminators to block sysops on fawiki to Disallow eliminators to block sysops on fawiki.Dec 15 2018, 8:51 PM

Change 476439 abandoned by Huji:
Enable restricting certain groups from blocking certain groups.

Reason:
Too many people have described this as config creep, so I am going to abandon this.

https://gerrit.wikimedia.org/r/476439

Change 476503 abandoned by Huji:
Dissallow eliminators to block certain groups on fawiki

https://gerrit.wikimedia.org/r/476503

Huji removed Huji as the assignee of this task.Jul 27 2019, 12:13 AM
Ammarpad closed this task as Declined.EditedOct 14 2019, 7:05 AM

Don't give impression config setting like this is going to happen anytime soon, per the several unintended consequences described in the parent patch.