Grant certain groups the ipinfo-view-full right
Closed, ResolvedPublic2 Estimated Story Points
Actions

Assigned To

Authored By

	phuedx
	Nov 25 2021, 7:36 PM

Description

Background

From T292755: Epic: IP Info access:

Access will work as follows for the MVP version:

"Full" access: Limited to sysop, bureaucrat, checkuser, oversight and steward user groups.

AC

sysops, bureaucrats, checkusers, oversight members, and stewards all have the ipinfo, ipinfo-view-basic and ipinfo-view-full rights, e.g.

operations/mediawiki-config/wmf-config/CommonSettings.php

// See https://gerrit.wikimedia.org/g/operations/mediawiki-config/+/944b45a6d4a47f00d7dcdafbc7ddb5e5a88a5f67/wmf-config/CommonSettings.php#4012
if ( $wmgUseIPInfo ) {
  wfLoadExtension( 'IPInfo' );

  $wgGroupPermissions['sysop']['ipinfo-view-full'] = true;
  // etc
}

The staffgroup is assigned the ipinfo-view-log right, as above

Notes

See the MediaWiki manual entry for $wgGroupPermissions

Details

	Subject	Repo	Branch	Lines +/-
	Add IPInfo viewing rights for certain groups	operations/mediawiki-config	master	+7 -0

Customize query in gerrit

Related Objects
Search...

Status	Subtype	Assigned	Task
Open		None	T261555 Allow CheckUser to provide IP addresses for logged in edits/actions
Open		None	T285977 IP Info
Resolved		Niharika	T287648 Reviews and deployment
Resolved		Tchanders	T260597 Deploy IP Info extension to all wikis (as a beta feature)
Resolved		Niharika	T261372 Replace mock data returned from API endpoint with live data
Resolved		Dzahn	T288844 Update MaxMind GeoIP2 license key and product IDs for application servers
Resolved	BUG REPORT	Clement_Goubert	T288375 IPInfo MediaWiki extension depends on presence of maxmind db in the container/host
Resolved	Spike	Niharika	T263637 Determine on which pages IPInfo should be available
Resolved		Niharika	T292755 Epic: IP Info access
Resolved		STran	T296499 Grant certain groups the ipinfo-view-full right
Resolved		Tchanders	T260598 Deploy IP Info extension to test.wikipedia.org
Resolved		Tchanders	T260599 Deploy IP Info extension to beta cluster
Resolved		sbassett	T262963 Security Readiness Review For geoip2/geoip2
Resolved	Dec 15 2020	Tchanders	T266136 Update CI config once geoip2 is available
Resolved		Tchanders	T269475 Add geoip2/geoip2 library to mediawiki/vendor
Resolved		Tchanders	T260602 Complete the necessary reviews for the IP Info extension
Invalid		None	T260601 Remove the static mock data from the popup and make a request to the API endpoint for dynamic mock data
Resolved	Sep 22 2020	Tchanders	T260603 Create an API endpoint that accepts a log id or revision id and returns mock data about the IP address
Resolved	Sep 22 2020	Tchanders	T260604 Display a popup with fixed mock data for an IP address on the specified page(s)
Resolved		Tchanders	T260605 Add IP Info extension to translatewiki.net
Resolved		dbarratt	T260607 Deploy the IP Info extension to The Good Place
Resolved		Tchanders	T260609 Create a basic extension.json file and a new wikipage for the IP Info extension
Resolved		dbarratt	T260611 Request a repository for the IP Info Extension
Resolved		Tchanders	T260610 Request the necessary reviews of the IP Info extension
Resolved		sbassett	T260822 Security review of IP Info extension
Resolved		Niharika	T260821 Performance review of IP Info extension
Invalid		None	T270347 Remove 'ipinfo' right from administrators on the Beta Cluster

Event Timeline

phuedx created this task.Nov 25 2021, 7:36 PM

phuedx added a project: Anti-Harassment.

phuedx moved this task from Untriaged to Triage/To be Estimated on the Anti-Harassment board.

phuedx mentioned this in T292842: Log when the user's access level changes.Dec 15 2021, 2:38 PM

Tchanders renamed this task from Grant certain groups the ipinfo-view-full right to Grant certain groups the ipinfo-view-full right [2].Jan 25 2022, 6:15 PM

Tchanders moved this task from Triage/To be Estimated to Cards ready for development on the Anti-Harassment board.

Tchanders renamed this task from Grant certain groups the ipinfo-view-full right [2] to Grant certain groups the ipinfo-view-full right.Jan 25 2022, 6:18 PM

Tchanders added a subtask: T260598: Deploy IP Info extension to test.wikipedia.org.

Tchanders set the point value for this task to 2.

Tchanders moved this task from Cards ready for development to The Letter Song on the Anti-Harassment board.Jan 25 2022, 6:21 PM

Tchanders edited projects, added Anti-Harassment (The Letter Song); removed Anti-Harassment.

Tchanders moved this task from Ready 🎬 (ONLY IF YOU HAVE NO MORE CODE TO REVIEW) to Blocked/Stalled 🚧 on the Anti-Harassment (The Letter Song) board.

ARamirez_WMF moved this task from The Letter Song to Blocked/Stalled on the Anti-Harassment board.Feb 8 2022, 4:45 PM

ARamirez_WMF edited projects, added Anti-Harassment; removed Anti-Harassment (The Letter Song).

ARamirez_WMF moved this task from Blocked/Stalled to Cards ready for development on the Anti-Harassment board.Feb 22 2022, 6:15 PM

ARamirez_WMF moved this task from Cards ready for development to AHaT Sprint 2: The Pork Pie on the Anti-Harassment board.Feb 22 2022, 6:18 PM

ARamirez_WMF edited projects, added Anti-Harassment (AHaT Sprint 2: The Pork Pie); removed Anti-Harassment.

STran claimed this task.Mar 1 2022, 12:29 AM

Change 766882 had a related patch set uploaded (by STran; author: STran):

[operations/mediawiki-config@master] Add IPInfo viewing rights for certain groups

https://gerrit.wikimedia.org/r/766882

gerritbot added a project: Patch-For-Review.Mar 1 2022, 12:32 AM

STran moved this task from Ready 🎬 (ONLY IF YOU HAVE NO MORE CODE TO REVIEW) to In Progress 💪 on the Anti-Harassment (AHaT Sprint 2: The Pork Pie) board.Mar 1 2022, 12:37 AM

STran moved this task from In Progress 💪 to Code Review 🔍 on the Anti-Harassment (AHaT Sprint 2: The Pork Pie) board.Mar 1 2022, 12:40 AM

@phuedx Do we also want to assign ipinfo and ipinfo-view-basic to these groups here too, or are we intending to rely on the autopromote mechanism in T296184? (Though I guess they don't really need ipinfo-view-basic if they have ipinfo-view-full...)

Tchanders moved this task from Code Review 🔍 to Blocked/Stalled 🚧 on the Anti-Harassment (AHaT Sprint 2: The Pork Pie) board.Mar 2 2022, 12:50 PM

@Niharika Just wanted to confirm - do we not want to grant these groups the ipinfo-view-log right? We discussed giving it to the staff group, but I wondered whether these groups would expect it too (and it might take the burden off T&S staff if more people can see the logs).

In T296499#7747277, @Tchanders wrote:

@Niharika Just wanted to confirm - do we not want to grant these groups the ipinfo-view-log right? We discussed giving it to the staff group, but I wondered whether these groups would expect it too (and it might take the burden off T&S staff if more people can see the logs).

Queuing this up to ask Legal. I agree it might be a fine thing to do but I want to confirm with Legal first.

Thanks @Niharika.

@STran I'm updating the AC of this task to include giving the ipinfo-view-log right to the staff group

Tchanders updated the task description. (Show Details)Mar 2 2022, 9:01 PM

Tchanders moved this task from Blocked/Stalled 🚧 to Code Review 🔍 on the Anti-Harassment (AHaT Sprint 2: The Pork Pie) board.

In T296499#7747238, @Tchanders wrote:

@phuedx Do we also want to assign ipinfo and ipinfo-view-basic to these groups here too, or are we intending to rely on the autopromote mechanism in T296184? (Though I guess they don't really need ipinfo-view-basic if they have ipinfo-view-full...)

I think it might be best to grant them all the rights that they need in one go. It's less prone to timing/coordination issues.

Thanks @phuedx - AC updated.

ARamirez_WMF edited projects, added Anti-Harassment (AHaT Sprint 3: Lady Dimitrescu); removed Anti-Harassment (AHaT Sprint 2: The Pork Pie).Mar 7 2022, 7:35 PM

ARamirez_WMF moved this task from Ready 🎬 (ONLY IF YOU HAVE NO MORE CODE TO REVIEW) to Code Review 🔍 on the Anti-Harassment (AHaT Sprint 3: Lady Dimitrescu) board.Mar 7 2022, 7:40 PM

Change 766882 merged by jenkins-bot:

[operations/mediawiki-config@master] Add IPInfo viewing rights for certain groups

https://gerrit.wikimedia.org/r/766882

Mentioned in SAL (#wikimedia-operations) [2022-03-09T14:27:26Z] <taavi@deploy1002> Synchronized wmf-config/CommonSettings.php: Config: [[gerrit:766882|Add IPInfo viewing rights for certain groups (T296499)]] (no-op on prod) (duration: 00m 50s)

Tchanders moved this task from Code Review 🔍 to QA/Testing 🐞 on the Anti-Harassment (AHaT Sprint 3: Lady Dimitrescu) board.Mar 9 2022, 3:02 PM

Maintenance_bot removed a project: Patch-For-Review.Mar 9 2022, 3:10 PM

I cannot really test this as IPInfo has not been enabled on testwiki yet. I can check this once T260598 is deployed.

The code looks good to me, as far as I can tell. We have assigned the rights ipinfo, ipinfo-view-full and ipinfo-view-log to the groups sysop and checkuser.

Apparently, the staffand steward groups have their permissions managed globally on-wiki. I don't know who we need to coordinate with to make it happen after the testwiki deploy. I guess the global stewards.

dom_walden mentioned this in T260598: Deploy IP Info extension to test.wikipedia.org.Mar 17 2022, 8:24 AM

Apparently, the staff and steward groups have their permissions managed globally on-wiki. I don't know who we need to coordinate with to make it happen after the testwiki deploy. I guess the global stewards.

@Niharika @STei-WMF Is there a plan to co-ordinate with the community on this?

@Tchanders I will be giving the user rights.

Niharika closed this task as Resolved.Apr 8 2022, 10:41 PM

Niharika closed subtask T260598: Deploy IP Info extension to test.wikipedia.org as Resolved.Apr 12 2022, 12:45 AM

Tchanders mentioned this in T307164: IP Info log access to staff, stewards, checkusers, ombudsmen.May 3 2022, 6:13 PM

TheresNoTime subscribed.May 26 2022, 2:18 PM

It looks like the global group modifications never happened. I have granted ipinfo, ipinfo-view-full, and ipinfo-view-log to staff and steward. T309318 has been created to clarify that global sysops should also be given access.