Convert DatabaseBlock and AbstractBlock to UserIdentity, and make them cross-wiki aware.
Closed, ResolvedPublic
Actions

Description

Problem: CentralAuthUser calls DatabaseBlock::insert, passing a DB connection to another wiki. The User instance inside DatabaseBlock does not know about that DB, and may load data from the local DB, causing confusion. This was the root cause of T260485, which has a workaround in place.

Solution: DatabaseBlock and AbstractBlock should always use a string as the target and a UserIdentity (or Authority?) as the blocker. They should never create User instances.

NOTE: DatabaseBlock and AbstractBlock are designed to support "foreign" users (which are local actors referring to users on another wiki, using a prefixed user name). They do not properly support cross-wiki user instances.

NOTE: getBlocker() should return a UserIdentity instead of a User. This is a breaking change, but there is only one usage outside core, in the RegexBlock extension, which is trivial to fix.

Details

Subject	Repo	Branch	Lines +/-
Throw for mismatched wiki in AbstractBlock::getId()	mediawiki/core	master	+4 -2
AbstractBlock: Hard-deprecate accessing block IDs cross-wiki	mediawiki/core	master	+4 -4
Throw for mismatched wiki in AbstractBlock::getBy()	mediawiki/core	master	+5 -3
DatabaseBlock: assert the blocker to be from the correct wiki	mediawiki/core	master	+5 -13
DatabaseBlock: fetch a database connection for the correct wiki	mediawiki/core	master	+62 -9
Make Block objects aware of which wiki they belong to	mediawiki/core	master	+148 -33
Set wiki parameter for cross-wiki suppressions	mediawiki/extensions/CentralAuth	master	+1 -0

Customize query in gerrit

Related Objects
Search...

Status	Subtype	Assigned	Task
Resolved	Security	• Pchelolo	T281972 ActorStore::checkDatabaseDomain: InvalidArgumentException: DB connection domain does not match when suppressing via Special:CentralAuth (CVE-2021-36128)
Resolved	Security	Zabe	T284873 Regression: CentralAuth Lock+Suppress is issuing local blocks without autoblock
Open		None	T291994 Properly support cross-wiki blocking
Resolved		Zabe	T274817 Convert DatabaseBlock and AbstractBlock to UserIdentity, and make them cross-wiki aware.
Resolved	Security	Zabe	T299655 [regression] Cannot globally suppress any global account

Event Timeline

daniel created this task.Feb 15 2021, 8:05 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptFeb 15 2021, 8:05 PM

daniel triaged this task as High priority.Feb 15 2021, 8:05 PM

daniel updated the task description. (Show Details)

daniel mentioned this in T273972: Survey cross-wiki User object creation and replace with ActorStore.Feb 15 2021, 8:11 PM

See also T266409 for other blocking-related code (there might be a need to change all of these together, although I haven't really investigated).

daniel updated the task description. (Show Details)Feb 16 2021, 7:49 PM

Urbanecm mentioned this in T281972: ActorStore::checkDatabaseDomain: InvalidArgumentException: DB connection domain does not match when suppressing via Special:CentralAuth (CVE-2021-36128).May 15 2021, 1:17 PM

Urbanecm mentioned this in T284873: Regression: CentralAuth Lock+Suppress is issuing local blocks without autoblock.Jun 13 2021, 11:15 AM

Urbanecm added subtasks: T284873: Regression: CentralAuth Lock+Suppress is issuing local blocks without autoblock, T281972: ActorStore::checkDatabaseDomain: InvalidArgumentException: DB connection domain does not match when suppressing via Special:CentralAuth (CVE-2021-36128).Jun 14 2021, 4:35 PM

Urbanecm removed subtasks: T281972: ActorStore::checkDatabaseDomain: InvalidArgumentException: DB connection domain does not match when suppressing via Special:CentralAuth (CVE-2021-36128), T284873: Regression: CentralAuth Lock+Suppress is issuing local blocks without autoblock.

Urbanecm added parent tasks: T284873: Regression: CentralAuth Lock+Suppress is issuing local blocks without autoblock, T281972: ActorStore::checkDatabaseDomain: InvalidArgumentException: DB connection domain does not match when suppressing via Special:CentralAuth (CVE-2021-36128).

FYI: Both parent tasks I just added will be resolved together with this one, T284873 will only need T281972#7090252 to be reverted (currently deployed as a secpatch).

Zabe subscribed.Jun 14 2021, 6:11 PM

Two related patches:

Change 723790 had a related patch set uploaded (by Zabe; author: Zabe):

[mediawiki/core@master] Make Block objects aware of which wiki they belong to.

https://gerrit.wikimedia.org/r/723790

gerritbot added a project: Patch-For-Review.Sep 27 2021, 3:13 PM

Zabe added a parent task: T291849: Create a DatabaseBlockStoreFactory in order to make DatabaseBlockStore a proper cross-wiki store.Sep 27 2021, 9:17 PM

Zabe claimed this task.Sep 28 2021, 5:34 PM

Zabe added a project: User-Zabe.

Zabe mentioned this in T291994: Properly support cross-wiki blocking.Sep 28 2021, 6:27 PM

Zabe added a parent task: T291994: Properly support cross-wiki blocking.

Change 738546 had a related patch set uploaded (by Zabe; author: Zabe):

[mediawiki/extensions/CentralAuth@master] Set wiki parameter for cross-wiki suppressions

https://gerrit.wikimedia.org/r/738546

Change 738546 merged by jenkins-bot:

[mediawiki/extensions/CentralAuth@master] Set wiki parameter for cross-wiki suppressions

https://gerrit.wikimedia.org/r/738546

ReleaseTaggerBot added a project: MW-1.38-notes (1.38.0-wmf.12; 2021-12-06).Dec 5 2021, 3:00 PM

Zabe mentioned this in T298223: Global suppressions throw 'Deprecated cross-wiki access' warnings.Dec 23 2021, 1:16 PM

Zabe mentioned this in T298784: Security Issue Access Request for Zabe.Jan 10 2022, 11:00 PM

Change 723790 merged by jenkins-bot:

[mediawiki/core@master] Make Block objects aware of which wiki they belong to

https://gerrit.wikimedia.org/r/723790

ReleaseTaggerBot edited projects, added MW-1.38-notes (1.38.0-wmf.18; 2022-01-17); removed MW-1.38-notes (1.38.0-wmf.12; 2021-12-06).Jan 17 2022, 10:00 PM

Maintenance_bot removed a project: Patch-For-Review.Jan 17 2022, 10:10 PM

Zabe removed parent tasks: T291849: Create a DatabaseBlockStoreFactory in order to make DatabaseBlockStore a proper cross-wiki store, T281972: ActorStore::checkDatabaseDomain: InvalidArgumentException: DB connection domain does not match when suppressing via Special:CentralAuth (CVE-2021-36128), T284873: Regression: CentralAuth Lock+Suppress is issuing local blocks without autoblock.Jan 17 2022, 11:11 PM

Blocks are using UserIdentity and are wikiaware now. There is still a lot to do until we properly support cross-wiki blocking, tracked at T291994: Properly support cross-wiki blocking.

taavi added a subtask: T299655: [regression] Cannot globally suppress any global account.Jan 20 2022, 4:53 PM

Change 755758 had a related patch set uploaded (by Zabe; author: Zabe):

[mediawiki/core@master] DatabaseBlock: fetch a database connection for the correct wiki

https://gerrit.wikimedia.org/r/755758

gerritbot added a project: Patch-For-Review.Jan 20 2022, 8:23 PM

Change 755758 merged by jenkins-bot:

[mediawiki/core@master] DatabaseBlock: fetch a database connection for the correct wiki

https://gerrit.wikimedia.org/r/755758

Maintenance_bot removed a project: Patch-For-Review.Jan 21 2022, 9:10 AM

Zabe closed subtask T299655: [regression] Cannot globally suppress any global account as Resolved.Jan 21 2022, 9:52 AM

Change 756129 had a related patch set uploaded (by Zabe; author: Zabe):

[mediawiki/core@master] DatabaseBlock: assert the blocker to be from the correct wiki