IP Masking will affect lots of our products, features, tools, gadgets, etc. This task is for tracking work to update those that are owned by Security-Team, ahead of IP Masking being enabled on WMF sites.
See T326816: [Epic] Update features for temporary accounts, particularly What will be affected.
A preliminary investigation (T326759) has found that the following may be affected:
| Subject | Repo | Branch | Lines +/- | |
|---|---|---|---|---|
| Remove IP assignment via User::getName() for anonymous users | mediawiki/extensions/StopForumSpam | master | +1 -5 |
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Restricted Task | |||||
| Resolved | kostajh | T294511 2021 Security Team wikireplicas audit | |||
| Declined | None | T284948 Raw IPs of logged-out users disclosed in wiki-replicas | |||
| In Progress | Niharika | T324492 Temporary accounts - MVP | |||
| Open | None | T326816 [Epic] Update features for temporary accounts | |||
| Resolved | sbassett | T326871 Update Security Team-owned products that may be affected by IP Masking |
Hey @Tchanders - Thanks for the notification. ext:StopForumSpam, while enforcing on the beta cluster, is still only in "report-only mode" on a handful of wikis right now (https://gerrit.wikimedia.org/r/823789). It seems like, according to T326759, that there might be two things needed here:
ext:StopForumSpam also echos back a user's IP address via the following error message (if they're disallowed access by the extension): https://github.com/wikimedia/mediawiki-extensions-StopForumSpam/blob/master/i18n/en.json#L13. It is unclear to me if this sort of thing will be disallowed under the new IP Masking policies.
A similar question was asked on T350116#9358739, and I suspect it's fine. (If not we'll have to audit where else we display a user their own IP address.)
@Niharika Could you confirm whether this is the case?
Ok, so that just leaves the small code updates/questions from T326871#8521975 then, for ext:StopForumSpam.
Change 979952 had a related patch set uploaded (by SBassett; author: SBassett):
[mediawiki/extensions/StopForumSpam@master] Remove IP assignment via User::getName() for anonymous users
I agree this looks fine. We included those terms in the search to flag up affected extensions just as indicators that the extension did something with IP addresses. Once it's getting the IP from the context, that should be fine. Thanks!
Change 979952 merged by jenkins-bot:
[mediawiki/extensions/StopForumSpam@master] Remove IP assignment via User::getName() for anonymous users