Page MenuHomePhabricator

IP hard block error message is scrambled
Closed, InvalidPublicSecurity

Description

I'm an admin and checkuser on enwiki. I got an email from somebody who got caught by an IP range hardblock I placed a while ago. They sent me a following screenshot of the error message:

image.png (769×391 px, 201 KB)

I've blacked out the three fields which contain identifying data. The problem is that they've got garbled bits of the log message inserted in the wrong places. The first one ("account") contains the timestamp of when I placed the range block. The second one ("reason") contains an IP address, presumably the IP they were using. And the third ("expire on") contains the CIDR range I blocked.

I've got the original screenshot saved. If need be, I can upload it to checkuser.wikimedia.org.

Event Timeline

Incorrect local customisation of a message?

And why is it a PNG stored in a PDF? :/

MW core:

"blockedtext": "<strong>Your username or IP address has been blocked.</strong>\n\nThe block was made by $1.\nThe reason given is <em>$2</em>.\n\n* Start of block: $8\n* Expiration of block: $6\n* Intended blockee: $7\n\nYou can contact $1 or another [[{{MediaWiki:Grouppage-sysop}}|administrator]] to discuss the block.\nYou can use the \"{{int:emailuser}}\" feature if a valid email address is specified in your [[Special:Preferences|preferences]] and you have not been blocked from using it.\nYour current IP address is $3, and the block ID is #$5.\nPlease include all above details in any queries you make.",

qqq:

"blockedtext": "Default text displayed to blocked users.\n\n\"email this user\" should be consistent with {{msg-mw|Emailuser}}.\n\nParameters:\n* $1 - the blocking sysop (with a link to their user page if they are a local user)\n* $2 - the reason for the block\n* $3 - the current IP address of the blocked user\n* $4 - (Unused) the blocking sysop's username (plain text, without the link)\n* $5 - the unique numeric identifier of the block\n* $6 - the expiry of the block\n* $7 - the intended target of the block (what the blocking user specified in the blocking form)\n* $8 - the timestamp when the block started\nSee also:\n* {{msg-mw|Grouppage-sysop}}\n* {{msg-mw|Autoblockedtext|notext=1}}\n* {{msg-mw|Blockedtext-composite|notext=1}}\n* {{msg-mw|Blockedtext-partial|notext=1}}\n* {{msg-mw|Systemblockedtext|notext=1}}",

I would suspect it's the last edit to that page - https://en.wikipedia.org/w/index.php?title=MediaWiki%3ABlockedtext&type=revision&diff=1073955028&oldid=1072597184

Reedy changed the visibility from "Custom Policy" to "Public (No Login Required)".
Reedy changed the edit policy from "Custom Policy" to "All Users".

As for why it's a png in a pdf, I blocked out the fields using annotations in the MacOS Preview app. The black boxes are undoable in the Preview file, so I did a print-to-pdf to make sure I had securely hidden the data under the black boxes.

Just noting I got mail from a second person caught by this. They noted, "I tried to understand, but could make no sense of the information presented"