Page MenuHomePhabricator

Unable to block an autoblocked IP address
Closed, ResolvedPublicBUG REPORT

Description

List of steps to reproduce (step by step, including full links if applicable):
*Problem 1: Try to block an IP address which is currently autoblocked (e.g. to extend the block length).
*Problem 2: Try to block an autoblocked IP where the account responsible has also been globally locked and hidden

What happens?:
*Problem 1: After the new block has been submitted (but not before), the block form says that the "[IP address] is already blocked", with no option to re-block. The new block is not successful. Appending /32 for an IPv4 address does make it work.
*Problem 2: The same, but the only error message is "The user you are trying to block has already been blocked and hidden. Since you do not have the hideuser right, you cannot see or edit the user's block" - this is for the IP address.

What should have happened instead?:
Previous behaviour would be to not display any error for an autoblocked IP, which I believe is the correct behaviour, however an option to re-block should at least be provided.

Software version (if not a Wikimedia wiki), browser information, screenshots, other information, etc:
This is on English Wikipedia 1.37.0-wmf.16 (cbd846f), and it seems to have been introduced very recently

Event Timeline

I've come across this 4 or 5 times in the past day (I'm a checkuser so I do a lot of this stuff). Anyway, the second problem, with autoblocked globally locked and hidden accounts, may be related to a global IP block which is now in place. I have limited opportunities to test this.

Definitely could be.

*Problem 1: Try to block an IP address which is currently autoblocked (e.g. to extend the block length).

This sounds bad. If this is how it used to work, I guess we need to special-case this situation and just silently replace the block.

an option to re-block should at least be provided

We must not indicate the autoblock id because this would allow connecting the IP address to the blocked user.

*Problem 2: The same, but the only error message is "The user you are trying to block has already been blocked and hidden. Since you do not have the hideuser right, you cannot see or edit the user's block" - this is for the IP address.

This doesn't seem to be a regression from the change I made. The corresponding message key is cant-see-hidden-user and it can only be returned from before the code that I modified. I believe it should be reported separately if it's a problem.

Change 709244 had a related patch set uploaded (by Matěj Suchánek; author: Matěj Suchánek):

[mediawiki/core@master] BlockUser: Allow blocking autoblocked IP addresses

https://gerrit.wikimedia.org/r/709244

Deleted my previous comment to avoid confusion. There is actually no need to delete the autoblock.
The patch is now ready for review (there is one more consistency fix).

Change 709244 merged by jenkins-bot:

[mediawiki/core@master] BlockUser: Restore blocking autoblocked IP addresses

https://gerrit.wikimedia.org/r/709244

Sort-of related to this, we've now got on enwiki both 120.29.97.74 and 120.29.97.74/32 blocked. If you go to https://en.wikipedia.org/wiki/Special:Contributions/120.29.97.74, you get:

This IP address is currently blocked. The latest block log entry is provided below for reference:

(change visibility) 2021-08-16T07:21:03 Materialscientist talk contribs block blocked 120.29.97.74/32 talk with an expiration time of 1 month (account creation blocked) (Disruptive editing) (unblock | change block)

If you then click on the "block log" link, that takes you to https://en.wikipedia.org/w/index.php?title=Special:Log/block&page=User%3A120.29.97.74 which reports:

2021-08-16T13:57:41 RoySmith talk contribs block changed block settings for 120.29.97.74 talk with an expiration time of 1 month (anon. only, account creation blocked) (Abusing multiple accounts: Please see: w:en:Wikipedia:Sockpuppet investigations/Shame on PJ Santos) (unblock | change block)
2021-08-09T07:30:19 Nick Moyes talk contribs block changed block settings for 120.29.97.74 talk with an expiration time of 2021-08-16T05:52:02 (anon. only, account creation blocked, cannot edit own talk page) (Vandalism) (unblock | change block) Tag: Twinkle
2021-08-09T05:52:02 C.Fred talk contribs block blocked 120.29.97.74 talk with an expiration time of 1 week (anon. only, account creation blocked) (Vandalism) (unblock | change block) Tag: Twinkle
2021-08-07T00:21:13 Nick Moyes talk contribs block blocked 120.29.97.74 talk with an expiration time of 48 hours (anon. only, account creation blocked) (Vandalism) (unblock | change block) Tag: Twinkle

I don't know if that's wrong per-se, but it's certainly confusing, especially considering that my (non /32 block) is more recent than Materialscientist's /32 version. It's also not clear how I even managed to block the IP in the first place, since presumably there's an autoblock in place which per this bug should have prevented my block from being applied.

Seems that things have changed overnight, so it's good that you pasted the stuff here.
I think that the notice above contributions is a consequence of implementation of DatabaseBlock::chooseMostSpecificBlock:

foreach ( $blocks as $block ) {
	if ( $block->getType() == self::TYPE_RANGE ) {
		# This is the number of bits that are allowed to vary in the block, give
		# or take some floating point errors
		$target = $block->getTargetName();
		$max = IPUtils::isIPv6( $target ) ? 128 : 32;
		list( $network, $bits ) = IPUtils::parseCIDR( $target );
		$size = $max - $bits;
		# Rank a range block covering a single IP equally with a single-IP block
		$score = self::TYPE_RANGE - 1 + ( $size / $max );
	} else {
		$score = $block->getType();
	}
	if ( $score < $bestBlockScore ) {
		$bestBlockScore = $score;
		$bestBlock = $block;
	}
}

In particular, Rank a range block covering a single IP equally with a single-IP block.
So if the single-IP range block comes first, it will become the "best" one and the IP block won't beat it.
If it's confusing, it deserves a new task.

which per this bug should have prevented my block from being applied

Maybe the autoblock had already expired? The IP address was editing a few hours before you blocked it.

Change 713507 had a related patch set uploaded (by Urbanecm; author: Matěj Suchánek):

[mediawiki/core@wmf/1.37.0-wmf.18] BlockUser: Restore blocking autoblocked IP addresses

https://gerrit.wikimedia.org/r/713507

Change 713507 merged by jenkins-bot:

[mediawiki/core@wmf/1.37.0-wmf.18] BlockUser: Restore blocking autoblocked IP addresses

https://gerrit.wikimedia.org/r/713507

Mentioned in SAL (#wikimedia-operations) [2021-08-17T20:06:50Z] <urbanecm@deploy1002> Synchronized php-1.37.0-wmf.18/includes/block/BlockUser.php: d377d4fae704640c81172a6fa94b12b2efdba42c: BlockUser: Restore blocking autoblocked IP addresses (T287798) (duration: 01m 08s)

Urbanecm assigned this task to matej_suchanek.
Urbanecm added a subscriber: Urbanecm.

I've just backported the fix because of complaints of fellow CUs. I confirmed at test2.wikipedia that the fix works as expected. Boldly closing, as I don't think there's anything else to do.

Maybe converting the workarounding /32 blocks, but I don't think that's worth it -- IP blocks should be temporary, so it will eventually clear itself up.