| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
| |
Change-Id: I0d8d2237500ed6f18439410c902d47c42e4119bc
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Why:
- The TSP team would like to adjust the rendering of user links
associated with temporary accounts, depending on whether the temporary
account is expired.
- This requires a mechanism to efficiently retrieve the expiration
status of temporary accounts, even when rendering large lists with
many user links, e.g. Special:RecentChanges or page histories.
What:
- Introduce the TempUserDetailsLookup class and service that holds the
expiration status of temporary accounts in an in-memory LRU cache.
This uses the new UserRegistrationLookup::getFirstRegistrationBatch
API.
- Provide a preloadExpirationStatus() method, similar to GenderCache or
LinkBatch, that allows callers to prefetch expiration status for a
batch of users. A followup patchset will add these to pagers as
needed.
Bug: T358469
Change-Id: I98ec17046c0863878eba3768d83f083bc2753e6f
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Same as Ia294bf4 did for 1-line comments. This patch removes slightly
more complex 2-line PHPDoc comments that don't add any new information
to the code, but literally repeat what the code already says.
They say "don't document the code, code the documentation", and we
are doing this more and more. We just tend to forget to remove the
obsolete comments.
Note I'm also removing a line of text in a few cases when it's very
short and literally says the same as the method name. Again, such
comments add zero new information.
Change-Id: I01535404bab458c6c47e48e5456403b7a64198ed
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
I assume these are all either auto-generated by an IDE or the
language-level type declarations have been added later. In any case
the comments don't add any new information to what the code already
says. This is just extra clutter that makes the code harder to read,
I would argue.
There are many, many more comments like this. In this patch I
intentionally focus on the most trivial 1-line comments.
Change-Id: Ia294bf4ce0d8a77036842fe25884bc175c2b0e7d
|
|
|
|
|
|
|
| |
Simplify code
Bug: T383246
Change-Id: I5e48b7dde63e5d62e316e47cd2e32bde8a17437b
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Why:
* Temporary user names contain a generated part. The method for
generating this part is configurable, and uses different
implementations of SerialMapping.
* The PlainNumericSerialMapping is used by default, but can be
difficut to read if the number that is generated is long.
What:
* Add ReadableNumericSerialMapping, similar to the plain numeric
mapping, but with hyphens after every group of 5 digits, for
readability.
* Make ReadableNumericSerialMapping the default in the config
$wgAutoCreateTempUser['serialMapping']['type'].
Bug: T381845
Change-Id: I262f1de38370c9e228f2fe804e95d9d43c49ca86
|
|
|
|
|
| |
Bug: T353458
Change-Id: Id3202c0c4f4a2043bf97b7caee081acab684155c
|
|
|
|
|
| |
Bug: T353458
Change-Id: Ifa3b6a6e0353bb4ce21a3f4456f1fc696c8d377c
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Why:
* When temporary accounts are known, the match patterns need to
be available. If no match patterns are set, the match pattern
is set to an array containing the generate pattern. Therefore
the generate pattern must also be available if temporary
accounts are known.
* This was not the case before this commit, and certain settings
caused an error to be thrown from isTempName.
What:
* Use the generate pattern for the match patterns if temp accounts
are known and no match patterns are set.
* Update the tests to use a generate pattern but no match pattern
(the same as the default config).
Change-Id: Iadfbed40b14378a9309e8d7afab6064e25480514
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Avoid the call to internal constructor of AndExpressionGroup and
OrExpressionGroup by creating a factory function similiar as the
IReadableDatabase::expr function for Expression objects.
This is also a replacement for calls to ISQLPlatform::makeList with
LIST_AND or LIST_OR argument to reduce passing sql as string to the
query builders.
Created two functions to allow the return type to be set for both
expression group to allow further calls of ->and() or ->or() on the
returned object.
Depending on the length of the array argument to makeList() it is
sometimes hard to see if the list gets converted to AND or OR, having
the operator in the function name makes it easier to read, so two
functions are helpful in this case as well.
Bug: T358961
Change-Id: Ica29689cbd0b111b099bb09b20845f85ae4c3376
|
|\ |
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Why:
* When a temporary account is created on edit, no log entry is
visible on Special:Log to indicate that the temporary account
exists.
* No log is specifically set through the call to AuthManager
::autoCreateUser having the $log parameter set always to false.
This was set in e8dbf5f80c029c4be52f1afd4ef91c59cfcd1185 which
was the commit that created the code to create temporary accounts.
* No specific reason was provided to not create a log and
in T357498 there is a request to add this log.
What:
* Remove the `false` argument for $log to AuthManager
::autoCreateUser in TempUserCreator::attemptAutoCreate.
* Update the integration tests to verify that an autocreate log is
added when a temporary user is successfully created.
Bug: T357498
Change-Id: Icf6be65a91437aa32684769c2858262a06ad0416
|
|/
|
|
|
|
|
|
|
| |
Stable interface policy says that hard deprecations MUST also
contain soft deprecations in docblock. I imagine this is for
Doxygen and IDEs.
https://www.mediawiki.org/wiki/Stable_interface_policy#Hard_deprecation
Change-Id: Ic1aeb031a4479a1c86c5a1d645c53f2a51055191
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Why:
- We want to distinguish temp account creation being enabled from a
configuration state where MediaWiki knows about temp accounts
existing (and can identify and manage them accordingly) while temp
account creation is disabled
What:
- Introduce a 'known' configuration flag to TempUserConfig
- If 'enabled' is set to true, then 'known' is automatically overridden
to true
- If an administrator wishes to disable temp account creation after
temporary accounts have been created, the administrator should set
'enabled=false' and 'known=true'
Co-authored-by: Tchanders <thalia.e.chan@googlemail.com>
Co-authored-by: Kosta Harlan <kharlan@wikimedia.org>
Bug: T356524
Change-Id: I4ce534a847461230f7fa276a565bdc1d6c9857e1
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Why:
- Using TempUserConfig is more flexible as it doesn't require us to know
about the internal details of the AutoCreateTempUser config object
What:
- Use TempUserConfig service instead of loading the AutoCreateTempUser
object
- Remove properties from ApiQuerySiteInfo that don't already have
getters. If someone has a need for more this information to be exposed
in ApiQuerySiteInfo, they can be added in a separate patch
- This seems compatible with the goals of T335532 which was about
making it possible to discover via the API if an action would result
in a temp account
- Implement __toString for Pattern, so that it can be used in
ApiQuerySiteInfo
Bug: T335532
Change-Id: Ica84b3e9b9865b8b83a9e9e513c99cd2e47661c9
|
|
|
|
|
|
|
|
| |
Need a check for RawSQLValue in Database::upsert
Also check for all int keys,
as this must not be an real list starting as index 0
Change-Id: If525243154072ebe81b5ecce2da92e5ccf773ab9
|
|
|
|
|
| |
Bug: T326274
Change-Id: I90493d7cd4c21fdc022bcc19765fc04d986a9c8f
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Why:
- In real world usages, both the Throttler and request objects are
required. We can override these objects in tests easily enough and
simplify the application code in the process.
What:
- Make Throttler and WebRequest objects required in
`TempUserCreator::create()`
Depends-On: I13cb0dbeaa78e3ad5c7250c7565ee97099d97867
Change-Id: I5eaa68b8212570b3324a0fdec452189c6b56f810
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Why:
- We don't want to allow unlimited acquisition of temp account names.
These should be rate limited in similar way to how we limit the
creation of temp accounts
What:
- Provide a TempAccountNameAcquisitionThrottle, and use it in the
acquireName() method
- Set a default that is 10 times the limit of
TempAccountNameCreationThrottle
Depends-On: If660aad1d0f04f366414084aff3f88484a19d416
Bug: T343101
Change-Id: I99d5973498a89ac227847de5837c0a8e895c28fb
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Why:
* The default value of wgAutoCreateTempUser has not changed since
the decision to use a different prefix for temporary accounts
(T332805).
* The default needs to be updated to reduce the number of overrides
in operations/mediawiki-config and also to make the development
experience more consistent with what is happening on WMF
production.
What:
* Update the wgAutoCreateTempUser default in the following ways:
** Set expireAfterDays as 365
** Set notifyBeforeExpirationDays as 10
** Set genPattern and reservedPattern to '~$1'
** Set matchPattern to null, which will mean that the genPattern
is used as the value.
* Update RealTempUserConfig::getPlaceholderName to add the year to
the placeholder name so that if the match pattern includes the
first digit of the year, then the placeholder name still is
considered a valid temporary account username.
* Replace modifications of the wgAutoCreateTempUser config in
integration tests with a use of the TempUserTestTrait to make
the code cleaner and make it easier to find tests that relies on
the values in wgAutoCreateTempUser.
* Update multiple tests to handle the new defaults for the config.
Bug: T359335
Change-Id: Ifa5a0123cd915bdb7c87e473c51fb93321622f12
|
|\ |
|
| |
| |
| |
| |
| |
| |
| | |
The idea is similar to the one behind TempUser\Pattern::toLikeValue(),
which has been effectively deprecated by allowing multiple patterns.
Change-Id: Iddb284bff21355deb8ceaa6925d3c2aea34d727e
|
|/
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Why:
- The pathway to creating a regular account is different from that of a
temporary account. It makes sense to rate limiting creation of these
two types of accounts at different rates.
What:
- Add a TempAccountCreationThrottle config with a restrictive default
that matches the existing production configuration of
AccountCreationThrottle (6 creations per day)
- Update resetAuthenticationThrottle.php to support resetting the temp
account creation throttle
- For now, not adding an equivalent hook for account creation throttle's
ExemptFromAccountCreationThrottle
Bug: T357777
Change-Id: Ibf36ac96f717107bace6f0a3326f79ed129a1dfe
|
|
|
|
|
| |
Bug: T328220
Change-Id: I4e0454ce3ad3741756e2010a76e548d6c9a6bcb5
|
|\ |
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Why:
* The TempUserConfig::getMatchPattern method was deprecated in
7f588780a048594d142e16e3a9df4c140a6779fc with a replacement of
TempUserConfig::getMatchPatterns.
* All existing usages on WMF deployed extensions have been replaced
so a call to wfDeprecated can be added.
What:
* Add a wfDeprecated call in RealTempUserConfig::getMatchPattern.
The other implementation of this method calls this method, so
this is the only call needed.
* Update the tests to expect the deprecation of ::getMatchPattern.
Depends-On: I122f001ab24e879a573b19468d642b8f579d1024
Bug: T354619
Change-Id: I74ea85429d083737c325c978e1cad04beb6a9325
|
|/
|
|
|
| |
Bug: T328220
Change-Id: Iba90f7f9b5766bccc05380d040138d74d5e9558a
|
|
|
|
| |
Change-Id: I4b0a98ce29e2ecd25da10081d545b088c0577173
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Why:
* There is a need to update the generation and match pattern on
WMF wikis to a new format that includes the year and starts with
`~`. As such, the 'matchPattern' key needs to be updated.
* Removing the old 'matchPattern' from the wgAutoCreateTempUser
config currently leaves existing temporary accounts as no longer
recongnised as temporary accounts.
* Instead, the 'matchPattern' needs to be able to take an array of
string patterns so that old patterns can still be used for matching.
What:
* Update the MainConfigSchama to indicate that 'matchPattern' in the
wgAutoCreateTempUser config can be an array of strings.
* Add TempUserConfig::getMatchPatterns and deprecate TempUserConfig::
getMatchPattern. This is needed because ::getMatchPattern was typed
to only ever return one Pattern, which is no longer the case with this
config change.
* Update the RealTempUserConfig to support multiple patterns defined in
the 'matchPattern' key. The RealTempUserConfig::getMatchPattern method
returns the pattern or first pattern if multiple are defined to allow
time for existing usages of this deprecated method to be updated.
* Update the RealTempUserConfig to rely on other methods instead of checking
object property values where possible (e.g. use ::isEnabled instead of
checking $this->enabled) to allow easier unit testing.
* Update UserSelectQueryBuilder and ChangesListSpecialPage to use TempUserConfig
::getMatchPatterns instead of ::getMatchPattern.
* Update mediawiki.util/util.js to be able to parse the 'matchPattern' value
when it is an array of strings.
* Update maintenance/userOptions.php to use ::getMatchPatterns instead of
::getMatchPattern.
* Add and update unit and integration tests for the new code, as well as
expanding coverage over existing code that was indirectly affected.
Bug: T354619
Change-Id: I3763daefe4dc7c76370bd934fb20452591c9c762
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Why:
* Part of a temporary user name is generated from an index that
increments, which is stored in the database.
* As specified in T345855, the index will be restarted each year.
* Also specified in T345855, the year will be included in
generated temporary user names.
What:
* Since the year must be included in the name in order to avoid
naming conflicts if the index is restarted each year, both are
implemented together and controlled by a single config.
* Add a new config option that, when true, restarts the name
generation index at the start of each year and add the year into
the user name: $wgAutoCreateTempUser['serialProvider']['useYear']
* Add a uas_year column to the user_autocreate_serial table, which
is unique in combination with uas_shard, so the index can be
stored for each shard/year combination.
* The year is added into the username just after the prefix, as
specified in T345855. This is based on research that having the
year near the start of the name aids understanding that the
names are not IP addresses. The position of the year within the
name is therefore not configurable (though whether to include
it is). See T345855 for the research.
Bug: T349494
Bug: T349501
Depends-On: I6b3c640a4e74f52fd4a4f46de5a2cbe80fe3b665
Change-Id: If51acb3f4efa361ce36d919c862a52501a5a7d24
|
|\ |
|
| |
| |
| |
| | |
Change-Id: I5d22c2877a6905ce9380e8963cbe297f47180052
|
|\ \ |
|
| |/
| |
| |
| |
| |
| |
| | |
This would happen due to an offset being configured too large so
can be fixed by changing the config.
Change-Id: Ie572a64e33322ce310bab09406db260fc27a6833
|
|\ \ |
|
| |/
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Why:
* When using the TempUserCreator::create or ::acquireAndStashName to
get temporary account when the chosen username already existed, that
temporary account is treated as if it doesn't exist. This causes
confusing "userexists" errors and also causes the user to be logged
into an already existing temporary account.
* Furthermore, because the user existence check in AuthManager::auto
CreateUser only checks the local wiki, if an existing temporary
account exists globally but not on the local wiki then the code
sign a new user into an existing temporary account.
* This is very bad behaviour, though shouldn't happen unless the
serialMapping configuration uses a SerialMapping class that could
provide duplicates and/or the configuration has been changed to
use a different SerialMapping class.
* There is a need to change the SerialMapping class in use to a
different class, which means that the code will attempt to use
temporary account usernames which already exist.
* As such, the code that is generating the temporary account usernames
based on the SerialMapping and SerialProvider should be aware that
it may produce an already existing temporary account username, even
if the SerialMapping class being used is asserted to never provide
duplicates.
* Therefore, the code that generates temporary account usernames
should always attempt to verify that a automatically generated
temporary account name does not already exist on the wiki.
What:
* Update TempUserCreator::acquireName to check to see if the username
it generates already exists centrally using the CentralIdLookup.
If it does, then the method returns null. Otherwise, the username
that hasn't been used yet is returned.
* Create the private method TempUserCreator::attemptAutoCreate that
attempts an autocreate for a temporary account name, and optionally
logs the account in.
* Update TempUserCreator::create to use ::attemptAutoCreate to
first to check if the account can be created and then again once
the account is created to actually login to that temporary account.
This is done to prevent logins to existing temporary accounts on
the local wiki. The second call to actually perform the login is
necessary as there is no other way to login to a temporary account.
* Update TempUserCreator::acquireAndStashName to respond to the changes
to ::acquireName, such that it returns null if ::acquireName returns
null and also does not modify the session.
* Update EditPage::maybeActivateTempUserCreate to return a Status and
return a good status in all cases except when a temporary account
name could not be acquired.
* Add IEditObject::AS_UNABLE_TO_ACQUIRE_TEMP_ACCOUNT, and use it as
the value of the fatal status returned by EditPage
::internalAttemptSave if a temporary account name could not be
acquired. This will cause the display of a useful error to the
user on edit.
* Update ApiEditPage and ApiAcquireTempUserName to die with an error
if a temporary account username was unable to be acquired.
* Provide tests for the untested ApiAcquireTempUserName.php file
including testing the new behaviour.
* Add and update tests for TempUserCreator.php
Bug: T353390
Change-Id: Id3a316ea0eba544d51d4ffcdfb03e35f4b3c54cc
|
|/
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Why:
* Naming conflicts may arise on autocreation.
* For example, when generating temporary user names, the config
wgAutoCreateTempUser['serialMapping']['type'] determines how
the unique, numerical part of the name is generated, and naming
conflicts may arise when changing types.
* Specifically we encountered the case of changing the
$wgAutoCreateTempUser['serialMapping']['type'] from 'scramble'
to 'plain-numeric'.
* In general conflict could be avoided in 'plain-numeric' mode if
the highest number used in an existing username is known, by
adding an offset.
What:
* Handle an 'offset' config option in PlainNumericSerialMapping to
allow avoiding conflicts.
Bug: T353545
Change-Id: Id2f9a5b5cc808ce859b93b597cf7ea0efcd9e269
|
|
|
|
|
| |
Bug: T350969
Change-Id: I44bb326539f68b1c6591a015424940a9c7de5030
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Why:
To inform temporary users about their account expiring
10 days before it is effectively expired.
What:
- Add optional int `notifyBeforeExpirationDays` to $wgAutoCreateTempUser,
for setting how many days before account expiration should users be notified
- Add AutoCreateTempUser config to the tempUserBanner script to use
config values for the popup alerting text logic
- Set the popup default state to open when temp user needs to be notified
- Disable the auto-close option for the popup so users need to
explictly dismiss it.
Bug: T344694
Change-Id: I530e911733c9822d6308ce92fafd425e50942d43
|
|
|
|
|
| |
Follow-up: If17bf84ee6620c8eb784b7d835682ad5e7afdfcc
Change-Id: Id995c610b211ca639ceabaa46776c5d57832f31c
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Why:
Temporary accounts (introduced as part of IP Masking)
are supposed to expire 1 year after their registration.
Automatic account expiration can be done via a maintenance
script, which would be periodically executed via cron / systemd.
Make it possible for extensions to provide their own logic
for generating a list of temporary accounts to invalidate.
This is used in CentralAuth to base registration timestamp
on the global registration timestamp.
The default behavior is "temporary accounts do not expire",
given the feature requires a maintenance script to run
periodically, which will not be the case on third party
instances.
What:
* Add `expireAfterDays` to $wgAutoCreateTempUser, controlling
how many days temporary accounts have.
* Add UserSelectQueryBuilder::whereRegisteredTimestamp(),
filtering accounts based on user_registration.
* Add ExpireTemporaryAccounts maintenance script, which is
@stable to extend.
Bug: T344695
Change-Id: If17bf84ee6620c8eb784b7d835682ad5e7afdfcc
|
|
|
|
|
|
|
|
|
|
|
| |
This was done automatically using the
`Universal.WhiteSpace.CommaSpacing` sniff, which will be included in the
next release of the MW PHPCS config.
Some of these have been adjusted manually where the autofix broke
vertical alignment.
Change-Id: I54a4668d8a2759b9d7de47742c943a535a04e211
|
|
|
|
| |
Change-Id: Ia73c3a044dfa50e9d9d43bf0e28eed2f65edcdce
|
|
|
|
|
| |
Bug: T166010
Change-Id: I7257302b485588af31384d4f7fc8e30551f161f1
|
|
|
|
|
|
|
| |
This has been approved as part of RFC T166010
Bug: T321882
Change-Id: I6bbdbbe6ea48cc1f50bc568bb8780fc7c5361a6f
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
delete()
The design principle for SelectQueryBuilder was to make the chained
builder calls look as much like SQL as possible, so that developers
could leverage their knowledge of SQL to understand what the query
builder is doing.
That's why SelectQueryBuilder::select() takes a list of fields, and by
the same principle, it makes sense for UpdateQueryBuilder::update() to
take a table. However with "insert" and "delete", the SQL designers
chose to add prepositions "into" and "from", and I think it makes sense
to follow that here.
In terms of natural language, we update a table, but we don't delete a
table, or insert a table. We delete rows from a table, or insert rows
into a table. The table is not the object of the verb.
So, add insertInto() as an alias for insert(), and add deleteFrom() as
an alias for delete(). Use the new methods in MW core callers where
PHPStorm knows the type.
Change-Id: Idb327a54a57a0fb2288ea067472c1e9727016000
|
|
|
|
|
| |
Bug: T335377
Change-Id: I0e0c3f3a9150c7a62d8fff95fe8867bdce356071
|
|
|
|
|
|
|
|
|
|
| |
This class is used heavily basically everywhere, moving it to Utils
wouldn't make much sense. Also with this change, we can move
StatusValue to MediaWiki\Status as well.
Bug: T321882
Depends-On: I5f89ecf27ce1471a74f31c6018806461781213c3
Change-Id: I04c1dcf5129df437589149f0f3e284974d7c98fa
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Why:
There are extensions that need to check a handful of
users for temp-ness at once (such as GrowthExperiments).
This is not really possible as of now (it would be necessary
to call UserIdentityUtils::isTemp several times, which can get
slow for large bulks of users).
What:
Add TempUserConfig::getMatchPattern() that can be used
to generate a LIKE database condition.
While at it, this patch also adds named() and temp() to
UserSelectQueryBuilder.
Bug: T341389
Change-Id: I90b5c59462c5c98bf5dcf9fa15d20553ef6599a5
|
|
|
|
|
|
|
|
|
|
|
| |
I found myself needing to just get the stashes name without the
placeholder for T331397, and I thought that this seems like a weird
API. The caller should get the placeholder separately if desired,
which is easy to do in all of the current callers.
Follow-up to 65f04c763aa062d90a4c72cab222bb068a433aa0.
Change-Id: Icf1d24f17b60a461ef682bc5da01be6ebc3a2d93
|