Page MenuHomePhabricator
Create Task
Maniphest T9610

You can `bin/auth recover` a mailing list administrator, and get a confusing error when you do
Closed, ResolvedPublic
Actions

Description

No one should really ever do this, but someone did, and our behavior when you do isn't great.

Revisions and Commits

rP Phabricator
D14325rP59c931710100 Prevent mailing lists from being bin/auth recover'd

Related Objects

Mentioned In
Z1336: General Chat

Event Timeline

epriestley created this task.Oct 22 2015, 1:00 AM
epriestley raised the priority of this task from to Low.
epriestley updated the task description. (Show Details)
epriestley added a project: Auth.
epriestley mentioned this in Z1336: General Chat.
epriestley added a subscriber: epriestley.
epriestley added a comment.Oct 22 2015, 1:05 AM

Specifically:

  • Mailing list users can currently be made into administrators. We should probably prevent this, because it seems silly. (Making a daemon an administrator is still silly, but doesn't seem completely unreasonable.)
  • Regardless, users can be marked as mailing lists and also as administrators in the database.
  • bin/auth recover will let you recover users who can not establish web login sessions as long as they are administrators, but should not.
  • When you recover such a user, a misleading error message is shown (session invalid). Instead, recovery should fail explicitly and/or the session error message should point at the root cause more directly.
joshuaspence added a subscriber: joshuaspence.Oct 23 2015, 2:43 AM
epriestley added a comment.Oct 24 2015, 1:24 PM

I guess I'm sort of OK with letting you make mailing lists administrators so they can pick up policy stuff. This is definitely pretty silly but maybe not only silly, and wouldn't hurt anything except for the other issues.

epriestley added a revision: D14325: Prevent mailing lists from being bin/auth recover'd.Oct 24 2015, 1:35 PM
epriestley claimed this task.Oct 24 2015, 1:35 PM
epriestley closed this task as Resolved by committing rP59c931710100: Prevent mailing lists from being bin/auth recover'd.Oct 25 2015, 1:13 AM
epriestley added a commit: rP59c931710100: Prevent mailing lists from being bin/auth recover'd.
Phabricator · Built by Phacility