Page MenuHomePhabricator

IP Info shouldn't be aware of revision if user doesn't have access to it
Closed, ResolvedPublicBUG REPORT

Event Timeline

Tchanders subscribed.

@Prtksxna I was talking with @Cyndymediawiksim about pinning down the requirements for this task, and came across a couple of things I wanted to ask about. (Also @STran may have a bit more context here.)

My understanding is that this task is to fix what was found in the original investigation (the bug is in the final bullet point):

Tested with the following scenario:

  1. Made an edit with an IP that has never contributed to the wiki otherwise
  2. Confirmed that the revision shows up on the Special:Contributions page for the IP
  3. Reverted the edit (so that it's no longer the current revision) and deleted the revision, hiding every piece of information about it but not from admins

Confirmed that:

  • The admin who deleted the revision can still see IPInfo from the Special:Contributions page
  • Another admin could view IPInfo from the Special:Contributions page
  • Calling the API directly successfully returned data from both users
  • The revision is not considered a revision on Special:DeletedContributions
  1. Hid the edit from other admins

Confirmed that:

  • The admin who deleted the revision can still see IPInfo from the Special:Contributions page
  • Another admin could not view IPInfo from the Special:Contributions page
  • Calling the API directly successfully returned data from both users

However, I couldn't reproduce this. Was there any more to this task?

@STran please see if this is reproduce-able and then ping Niharika if needed.

I attempted to reproduce this, performing the same steps as above, and was unable to. I checked which error it was triggering and for the non-suppressing admin it's throwing the ipinfo-rest-revision-no-author, which has been included in the extension for quite some time. I'm not sure if I didn't refresh my cached result from the API or if something changed elsewhere. In any case, this seems to require no additional work. I suppose I'll close this then, sorry!