Make CheckUser record the log_id of logged actions
Open, HighPublic
Actions

Assigned To

Authored By

	dbarratt
	May 27 2020, 6:56 PM

Description

Problem.
As mentioned in T252485#6155656 there isn't a way to link to a specific logged action within CheckUser

Proposed Solution
Record the log_id in the cu_changes table so users can get a link to the specific line in the log.

Details

	Project	Branch	Lines +/-	Subject
	mediawiki/extensions/CheckUser	master	+360 -0	Add column 'cuc_log_id' to table 'cu_changes'

Customize query in gerrit

Related Objects
Search...

Status	Subtype	Assigned	Task
			Restricted Task
			Restricted Task
			Restricted Task
Resolved	Security	Zabe	T311337 CVE-2022-39193: Edits with the performer suppressed still show the performer in results from the CheckUser extension
Resolved	Security	Dreamy_Jazz	T316414 CVE-2022-39193: Special:Investigate can expose supressed information in check results
Resolved	Security	Dreamy_Jazz	T318166 CVE-2022-39193: CheckUser API can expose the suppressed performer
			Restricted Task
			Restricted Task
Open	BUG REPORT	None	T326866 Special:Investigate can expose suppressed information for log events
Open	BUG REPORT	None	T326867 CheckUser API can expose suppressed information for log events
Open	BUG REPORT	None	T326865 Special:CheckUser can expose suppressed information for log events
Open		Dreamy_Jazz	T253796 Make CheckUser record the log_id of logged actions
Open	Feature	Dreamy_Jazz	T324907 Create separate tables for log events in CheckUser
Resolved		Ladsgroup	T326105 Create cu_log_event and cu_private_event on WMF wikis
Open		None	T327447 FYI: Other changes to the CheckUser tables
Open		Dreamy_Jazz	T328992 Use CheckUserUnionSelectQueryBuilder in Special:CheckUser
Open		Dreamy_Jazz	T328995 Use the CheckUserUnionSelectQueryBuilder in Special:CheckUser's 'Get edits' mode
Open		Dreamy_Jazz	T328997 Use the CheckUserUnionSelectQueryBuilder in Special:CheckUser's 'Get users' mode
Open		Dreamy_Jazz	T328998 Use the CheckUserUnionSelectQueryBuilder in Special:CheckUser's 'Get IP Addresses' mode
Open		None	T329189 Use the CheckUserUnionSelectQueryBuilder in Special:Investigate
Open		None	T329200 Use the CheckUserUnionSelectQueryBuilder in Special:Investigate timeline tab
Open		None	T329201 Use the CheckUserUnionSelectQueryBuilder in Special:Investigate compare tab
Open		Dreamy_Jazz	T328988 Create a SelectQueryBuilder that allows selecting from all three tables
Open		None	T330158 Enable write new for the event table migration
Resolved		Dreamy_Jazz	T328874 Create temporary column in cu_changes to assist in migration to the new tables
Resolved		• Marostegui	T329203 Add new column cuc_only_for_read_old to cu_changes for migration purposes to wmf wikis

Event Timeline

dbarratt created this task.May 27 2020, 6:56 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptMay 27 2020, 6:56 PM

dbarratt added a parent task: T233004: Update CheckUser for actor and comment table.May 27 2020, 6:56 PM

dbarratt added a parent task: Restricted Task.

dbarratt mentioned this in T252485: Use TitleFormatter and SpecialPageFactory.

DannyS712 added a subscriber: DannyS712.May 27 2020, 7:06 PM

I feel like we had a separate task for it already, but cannot find it.

Anyway, one immediate issue that comes to mind is that log_id alone is not sufficient and some indication of log type (or source) should be included as well. This is because not all logs are stored in the logging table. The most obvious example is AbuseFilter logs. Other extensions may also have their own logs and want to expose them in CheckUser (e.g. Thanks althought we have not integrated it yet, or MediaWiki-extensions-LoginNotify as discussed in T174492)

Peachey88 added a subscriber: Peachey88.May 27 2020, 8:10 PM

T41013 / https://gerrit.wikimedia.org/r/#/c/mediawiki/extensions/CheckUser/+/574204/ would also add the log id for another purpose

Tchanders mentioned this in T247641: CU 2.0: Add variant display to the Timeline result list .Jun 2 2020, 2:55 PM

Umherirrender removed a subscriber: Umherirrender.Feb 27 2021, 9:19 PM

Huji added a parent task: T145265: Store check user data action text in structured format.Jan 14 2022, 2:15 AM

Zabe mentioned this in T233004: Update CheckUser for actor and comment table.Apr 1 2022, 9:19 PM

L235 added a subscriber: L235.Jun 27 2022, 12:37 AM

Dreamy_Jazz added a project: Schema-change.Sep 19 2022, 11:47 AM

Simple answer to the title: Yes.

Dreamy_Jazz mentioned this in T318166: CVE-2022-39193: CheckUser API can expose the suppressed performer.Sep 20 2022, 2:26 PM

dbarratt removed a subscriber: dbarratt.Sep 20 2022, 3:27 PM

Dreamy_Jazz triaged this task as High priority.Sep 21 2022, 12:04 AM

Aklapper renamed this task from Should CheckUser record the log_id of logged actions? to Make CheckUser record the log_id of logged actions.Sep 21 2022, 11:25 AM

Dreamy_Jazz added a subtask: Restricted Task.Oct 6 2022, 11:27 PM

Dreamy_Jazz removed a subtask: Restricted Task.

Dreamy_Jazz added a parent task: Restricted Task.

Change 856930 had a related patch set uploaded (by Dreamy Jazz; author: Dreamy Jazz):

[mediawiki/extensions/CheckUser@master] Add column 'cuc_log_id' to table 'cu_changes'

https://gerrit.wikimedia.org/r/856930

gerritbot added a project: Patch-For-Review.Nov 15 2022, 10:36 AM

Dreamy_Jazz moved this task from Unsorted to Add / Create on the Schema-change board.Nov 15 2022, 10:56 AM

Dreamy_Jazz moved this task from General / Unsorted to Patches for review on the CheckUser board.

Dreamy_Jazz claimed this task.Nov 15 2022, 11:04 AM

Dreamy_Jazz added a parent task: T311337: CVE-2022-39193: Edits with the performer suppressed still show the performer in results from the CheckUser extension.Nov 15 2022, 9:24 PM

Dreamy_Jazz added a parent task: T316414: CVE-2022-39193: Special:Investigate can expose supressed information in check results.