jenkins-bot has submitted this change and it was merged. (
https://gerrit.wikimedia.org/r/355036 )
Change subject: Silence mediawiki::user exec-spam
......................................................................
Silence mediawiki::user exec-spam
The SQL-based 'unless' rule for setting user groups did not work
for wikis where one of the groups (such as 'steward') did not exist.
Change-Id: Ic22468404e21dab1cff0d26a79c0b9b58aecbee2
---
M puppet/modules/mediawiki/manifests/user.pp
1 file changed, 13 insertions(+), 11 deletions(-)
Approvals:
BryanDavis: Looks good to me, approved
jenkins-bot: Verified
diff --git a/puppet/modules/mediawiki/manifests/user.pp
b/puppet/modules/mediawiki/manifests/user.pp
index 6e270db..432a518 100644
--- a/puppet/modules/mediawiki/manifests/user.pp
+++ b/puppet/modules/mediawiki/manifests/user.pp
@@ -70,15 +70,17 @@
if ! empty($groups) {
$comma_groups = join($groups, ',')
- $comma_groups_sql = join($groups, "', '")
+ $comma_groups_php = join($groups, "', '")
- $group_count = size($groups)
- $sql_unless = "
- SELECT COUNT(*)
- FROM user_groups
- JOIN user ON ug_user = user_id
- WHERE user_name = '${canonical_username}'
- AND ug_group IN ('${$comma_groups_sql}');"
+ # eval.php requires each command to be a single line
+ # double-escape $ against puppet + shell
+ $eval_unless = "
+ \\\$u = User::newFromName( '${username}' );
+ \\\$u->load( User::READ_LATEST );
+ \\\$expected_groups = array_intersect( [ '${comma_groups_php}' ],
User::GetAllGroups() );
+ \\\$actual_groups = \\\$u->getGroups();
+ echo array_diff( \\\$expected_groups, \\\$actual_groups ) ? 'Bad'
: 'Good';
+ "
mediawiki::maintenance {
"mediawiki_user_${canonical_username}_${wiki}_${comma_groups}":
command => "/usr/local/bin/mwscript createAndPromote.php
--wiki='${wiki}' \
@@ -87,9 +89,9 @@
# Check that they're already in all the requested groups,
# using counts.
- unless => "/bin/echo \"${sql_unless}\" | \
- /usr/local/bin/mwscript sql.php --wikidb='${wiki}' | \
- /bin/grep -q '=> ${group_count}'",
+ unless => "/bin/echo \"${eval_unless}\" | \
+ /usr/local/bin/mwscript eval.php --wiki='${wiki}' | \
+ /bin/grep -q '^Good$'",
require => [
Mediawiki::Maintenance["mediawiki_user_${canonical_username}_${wiki}"],
]
--
To view, visit https://gerrit.wikimedia.org/r/355036
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: merged
Gerrit-Change-Id: Ic22468404e21dab1cff0d26a79c0b9b58aecbee2
Gerrit-PatchSet: 2
Gerrit-Project: mediawiki/vagrant
Gerrit-Branch: master
Gerrit-Owner: Gergő Tisza <gti...@wikimedia.org>
Gerrit-Reviewer: BryanDavis <bda...@wikimedia.org>
Gerrit-Reviewer: Dduvall <dduv...@wikimedia.org>
Gerrit-Reviewer: jenkins-bot <>
_______________________________________________
MediaWiki-commits mailing list
MediaWiki-commits@lists.wikimedia.org
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
