VOOZH about

URL: https://meta.wikimedia.org/w/index.php?diff=29939846

⇱ Steward requests/Miscellaneous: Difference between revisions - Meta-Wiki

Jump to content
From Meta, a Wikimedia project coordination wiki
Content deleted Content added
Tag: Reverted
Line 91: Line 91:
:* AS - [https://as.wikipedia.org/wiki/%E0%A6%AC%E0%A6%BF%E0%A6%B6%E0%A7%87%E0%A6%B7:%E0%A6%AC%E0%A7%B0%E0%A6%99%E0%A6%A8%E0%A6%BF%E0%A6%B8%E0%A6%AE%E0%A7%82%E0%A6%B9/Ytgb5]
:* AS - [https://as.wikipedia.org/wiki/%E0%A6%AC%E0%A6%BF%E0%A6%B6%E0%A7%87%E0%A6%B7:%E0%A6%AC%E0%A7%B0%E0%A6%99%E0%A6%A8%E0%A6%BF%E0%A6%B8%E0%A6%AE%E0%A7%82%E0%A6%B9/Ytgb5]
:Thanks, [[User:Ravensfire|Ravensfire]] ([[User talk:Ravensfire|talk]]) 02:55, 13 January 2026 (UTC)
:Thanks, [[User:Ravensfire|Ravensfire]] ([[User talk:Ravensfire|talk]]) 02:55, 13 January 2026 (UTC)

=== Opt in Wikispecies to the global sysop wikiset ===
{{status|In progress}}
Roughly a week ago, I initiated [[:wikispecies:Wikispecies:Requests_for_Comment#Proposal_to_allow_global_sysops_on_this_project|this discussion]] to allow global sysops on Wikispecies, and if I am counting correctly, it appears that three administrators and two bureaucrats are in favor of this change. Please implement this change, thank you. [[User:Codename Noreste|<span style="color:#0024FF">Codename Noreste</span>]] ([[User talk:Codename Noreste|talk]] • [[Special:Contributions/Codename Noreste|contribs]]) 15:42, 16 January 2026 (UTC)


==OAuth permissions==
==OAuth permissions==

Revision as of 15:42, 16 January 2026

This page is for Wikimedia wikis having no active administrators. Requests can be made here for specific administrative actions (such as page deletion) to be performed by a steward or global sysop. In other cases:
  • If the wiki does have active administrators, file the request with one of them.
  • If the wiki has an active editor community, any potentially controversial action (deletion of actual content, edit to a protected page, renaming of a protected page, etc.) should receive consensus from the wiki community before being requested here, and a link should be provided to that consensus in the request.
  • For global lock/block requests, file a request at Steward requests/Global.
  • For non-controversial deletion requests such as empty page, simple spam or vandalism, and non-controversial or emergency requests to block vandals, spammers or other malicious users, you may use global sysop requests instead.
  • If a consensus is considered required to act, similar principles apply as expressed at Steward requests/Permissions/Minimum voting requirements, and can be used for guidance to how and what should be done at small and medium communities to gain a consensus.

To add a new request, create a new section header at the bottom of the "Manual requests" section using the format below: 

=== Very brief description of request here ===
{{Status|In progress}}
Give details about your request here. --~~~~

It is helpful if you can provide a link to the wiki (or the specific page on the wiki) in question, either in the header or in the body of your request.

When reporting cross-wiki vandalism, the following template calls can be used to link to a user's contributions across all Wikimedia content wikis (these are for logged in users and non-logged-in users, respectively):

* {{sultool|Username}}

* {{luxotool|IP.address}}

Template {{LockHide}} can also be used in appropriate cases.

To request approval of OAuth consumers please use {{oauthapprequest}} (see the documentation before using).

Old requests are archived by the date of their last comment.

Cross-wiki requests
Meta-Wiki requests


Bot-reported requests

See Global sysops/Speedy delete requests.

Manual requests

Status:  In progress

This global RfC will turn 1 year old next week, and it is worth considering if a closure is ready. --JJPMaster (she/they) 03:26, 16 November 2025 (UTC)[]

The RfC is now one year old. Has any steward looked at this? JJPMaster (she/they) 23:34, 29 November 2025 (UTC)[]

GAMMA (Global Association of MMA)

Status:  In progress
Wiki Status
dewiki rfd Deleted
eswiki rfd 👁 Image
 In progress…
plwiki Needs review
ptwiki Needs review
ruwiki rfd 👁 Image
 In progress…
simplewiki rfd Deleted
svwiki Needs review
zhwiki Needs review

🪶-TΛNBIRUZZΛMΛN (💬) 10:26, 29 December 2025 (UTC)[]

Possible block-evasion after global ban?

Status:  In progress

I came across a new user, JoshuaMcsherryStudios, making many different edits with weird edit summaries locally on nowiki. I then saw a lot of issues pertaining to their Commons uploads. I then came across a page where the same editing pattern occurred from another account, Stellairibarne, which was globally blocked in april of 2024 for "Cross-wiki abuse". Both of these accounts use the same edit summaries ("Cool") and edit within the same categories, occasionally the same pages. I don't know if there are more accounts related to this case, but I assume something should be done? --EdoAug (talk) 22:39, 8 January 2026 (UTC)[]

Edit filter request

Status:  In progress

Pertaining to an an issue I have come across, I was advised to make a comment here to request a possible edit filter. This would likely be a private filter, though, so I this would likely be a private discussion with a filter manager or managers. --TornadoLGS (talk) 20:42, 11 January 2026 (UTC)[]

You can provide the details privately by using Special:Contact/Stewards, after you get a ticket number, link it here. — xaosflux Talk 21:21, 11 January 2026 (UTC)[]
I can help, TornadoLGS; feel free to drop me an email. Codename Noreste (talk • contribs) 21:30, 11 January 2026 (UTC)[]
@Xaosflux and Codename Noreste: I have been in touch with a steward who advised me to come here. See Ticket:2026011110000231. TornadoLGS (talk) 21:36, 11 January 2026 (UTC)[]
Note, the meta-wiki administrators like CN above can also help with that, but they can not access steward tickets. — xaosflux Talk 00:18, 12 January 2026 (UTC)[]
It's kinda a global thing anyway. TornadoLGS (talk) 03:07, 12 January 2026 (UTC)[]

Cross-wiki spam by Ltri55

Ltri55 is a now globally locked sock puppet of Tinkubhoi who has been pushing to get articles created on Laxmi Narayan Maharana for over 2 years now. Ltri55 was especially active and before being globally locked they managed to get blocked on six different wikis for spam/LTA. Unfortunately, they also used translation tools to spam their article on eight other wikis. One I was able to figure out the deletion process but the rest are beyond me. Three of those have already deleted the article as spam, but it remains on four. It was suggested I reach out here to ask a global sysop to delete the articles.

List of articles
  • BN - Created by a previous Tinkubhoi sock last month, edited by Ltri55 - [5]
  • SW - Created same article twice - [6]
  • MG - [7]
  • DA (Danish?!?! For a small-time Indian artist?) - [8]
  • MG - [9]
  • GL - Already deleted as trash/spam - [10]
  • IS - Already deleted as cross-wiki spam - [11]
  • OM - Already deleted as cross-wiki spam by a global sysop - [12]
  • PL - Already deleted as non-encyclopediac - [13]
Status:  In progress

Thank you. --Ravensfire (talk) 01:37, 12 January 2026 (UTC)[]

New globally blocked account, Ytgb5 (talk · contribs) has done the same thing. Most articles they created are already tagged for deletion.
Thanks, Ravensfire (talk) 02:55, 13 January 2026 (UTC)[]

Opt in Wikispecies to the global sysop wikiset

Status:  In progress

Roughly a week ago, I initiated this discussion to allow global sysops on Wikispecies, and if I am counting correctly, it appears that three administrators and two bureaucrats are in favor of this change. Please implement this change, thank you. Codename Noreste (talk • contribs) 15:42, 16 January 2026 (UTC)[]

OAuth permissions

👁 Image
 		Preferably permission requests should be submitted using the form from Special:OAuthConsumerRegistration.

After submitting this form, you will receive a token that your application will use to identify itself to MediaWiki. An OAuth administrator will need to approve your application before it can be authorized by other users. It is possible to request approval using {{oauthapprequest}}; please create a sub-section of this section.

A few recommendations and remarks:

  • Try to use as few grants as possible. Avoid grants that are not actually needed now.
  • Versions are of the form "major.minor.release" (the last two being optional) and increase as grant changes are needed.
  • Please provide a public RSA key (in PEM format) if possible; otherwise a (less secure) secret token will have to be used.
  • Use the JSON restrictions field to limit access of this consumer to IP addresses in those CIDR ranges.
  • You can use a project ID to restrict the consumer to a single project on this site (use "*" for all projects).
  • The email address provided must match that of your account (which must have been confirmed).


Script Publisher - OAuth Toolforge tool for publishing public Git repositories to Wikimedia JS/CSS pages

Hello Stewards and community,

I am requesting community and steward review for an OAuth-based Toolforge application called Script Publisher, which allows Wikimedia contributors to publish JavaScript and CSS files from a public Git repository (for example GitHub) to Wikimedia wiki pages such as user scripts and gadgets via a web interface.

This tool is an implementation of the Community Wishlist Survey 2022 proposal:

https://meta.wikimedia.org/wiki/Community_Wishlist_Survey_2022/Bots_and_gadgets/A_bot_or_gadget_to_publish_public_Git_repo_to_a_gadget_or_user_script

The original proposer of this wishlist item is User:Nux, who has reviewed the prototype and provided detailed technical and UX feedback.

Project background

The project started with a working web prototype (Node/Next.js): https://wikipublisher.vercel.app/

This prototype was shared with the proposer (Nux), who confirmed it matches the intent of the wishlist and suggested several improvements including OAuth, Toolforge hosting, multi-target publishing, profiles, and safeguards. Based on that feedback and mentoring from the Developer Skill Development Program India 2025 (mentor: User:KCVelaga), the project is now being migrated to a production-ready Toolforge stack using Python + Django.

Toolforge deployment: https://script-publisher.toolforge.org/

Source code (Toolforge repository): https://gitlab.wikimedia.org/toolforge-repos/script-publisher/

What the tool does

Script Publisher provides a web interface that allows a user to:

  • Provide a public Git repository
  • Browse and select JavaScript and CSS files
  • Map each file to one or more target wiki pages (user scripts, gadgets, etc.)
  • Preview the exact content and destinations before publishing
  • Trigger a manual publish action

The tool does not perform automatic or background deployments. Every deployment requires explicit user confirmation and shows exactly what will be edited.

OAuth and security model

The application uses Wikimedia OAuth for authentication. OAuth is only used to act as the authenticated user — the tool can only perform edits that the user already has permission to perform manually.

If a user can edit a JavaScript or CSS page manually, they can deploy it via the tool. If they cannot, the tool also cannot.

An OAuth client was registered for this project: https://meta.wikimedia.org/wiki/Special:OAuthListConsumers/view/e51b6e0aa6bc2a5c60a315102e88d2ee

During OAuth review, WMF security (Tgr) noted that OAuth tools which can edit JavaScript should go through a community review process comparable to bots or global interface editors. This discussion can be found here: https://meta.wikimedia.org/wiki/User_talk:Dev_Jadiya?markasread=5796209&markasreadwiki=metawiki#c-Tgr_(WMF)-20260105205500-KCVelaga-20260103085000

This request is being made following that guidance.

Why this requires global permission

Script Publisher is designed to deploy JavaScript and CSS across Wikimedia projects. Functionally, this is equivalent to tools used by Global Interface Editors or JS deployment bots, and therefore requires the same level of community and steward oversight.

The tool is hosted on Toolforge with public source code, controlled deployment, and limited developer access, so that any changes to the tool itself are auditable and reviewed.

What is being requested

I am requesting approval for Script Publisher to operate as a Toolforge OAuth application with permissions equivalent to Global Interface Editors, so that it can publish JS/CSS pages on behalf of users who already have the rights to edit those pages.

The tool will not bypass MediaWiki permission checks and will not perform unattended or hidden edits.

Thank you for reviewing this request.

Dev Jadiya (talk) 18:59, 14 January 2026 (UTC)[]

Discussion

The wikitech documentation at wikitech:OAuth#Security explicitly calls out that this will not be permitted. Has a full tech discussion of this prohibition already occurred elsewhere? — xaosflux Talk 19:46, 14 January 2026 (UTC)[]

Thank you for pointing that out.
Yes - this discussion around the OAuth security concerns and the prohibition you referenced is already ongoing here:
https://meta.wikimedia.org/wiki/User_talk:Dev_Jadiya#Script_Publisher
This thread includes comments from User:Tgr (WMF) and User:KCVelaga about the risk model, why community review is being pursued, and how the tool will explicitly require user confirmation for edits.
Thank you. Dev Jadiya (talk) 14:10, 16 January 2026 (UTC)[]

See also

Categories: