A preliminary investigation (T326759) has found that the DismissableSiteNotice extension may be affected by IP Masking
Description
Description
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Restricted Task | |||||
| Resolved | kostajh | T294511 2021 Security Team wikireplicas audit | |||
| Declined | None | T284948 Raw IPs of logged-out users disclosed in wiki-replicas | |||
| Resolved | • Niharika | T324492 Temporary accounts - MVP | |||
| Resolved | Madalina | T326816 [Epic] Update features for temporary accounts | |||
| Invalid | None | T326918 Prepare DismissableSiteNotice extension for IP Masking | |||
| Open | None | T262120 Deprecate $wgDismissableSiteNoticeForAnons |
Event Timeline
Comment Actions
There are two search results in DismissableSiteNotice:
- rEDSN /includes/Hooks.php:32 (at 3d4ba4372c36) – this should be deprecated in T262120: Deprecate $wgDismissableSiteNoticeForAnons
- rEDSN /includes/Hooks.php:58 (at 3d4ba4372c36) – I think this will be removed once T11209: DismissableSiteNotice relies on JavaScript to render site notice is properly resolved? It’s fine to continue using ->isAnon() anyway, as search engines will never be temp users.
Comment Actions
…but if it doesn’t get deprecated soon enough, it should probably use the same condition that core uses to decide whether to display sitenotice or anonnotice (currently rMW includes/skins/Skin.php:1878 (at b829fa0fd225) uses isRegistered).
Comment Actions
Closing per above and per discussion. The linked improvement tasks could eventually allow these conditions to be removed; however, this is not part of nor a blocker for temporary accounts work.