A preliminary investigation (T326759) has found that the GlobalCssJs extension may be affected by IP Masking
Description
Details
| Subject | Author | Repo | Branch | Lines +/- | |
|---|---|---|---|---|---|
| Do not show help links for temp accounts | Amdrel | mediawiki/extensions/GlobalCssJs | master | +2 -2 |
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Restricted Task | |||||
| Resolved | kostajh | T294511 2021 Security Team wikireplicas audit | |||
| Declined | None | T284948 Raw IPs of logged-out users disclosed in wiki-replicas | |||
| Resolved | • Niharika | T324492 Temporary accounts - MVP | |||
| Resolved | Madalina | T326816 [Epic] Update features for temporary accounts | |||
| Resolved | Amdrel | T326919 Prepare GlobalCssJs extension for IP Masking |
Event Timeline
It looks like this extension already disallows editing user CSS and JS pages for temporary accounts. The only possible oddity I see is the help link for editing those pages shows up if you try to visit them with a temporary account, while an anonymous user does not get this help link.
Thanks @Amdrel! Sounds like it might be worth removing those help links for temp accounts to avoid confusion.
Change #1055978 had a related patch set uploaded (by Amdrel; author: Amdrel):
[mediawiki/extensions/GlobalCssJs@master] Do not show help links for temp accounts
Change #1055978 merged by jenkins-bot:
[mediawiki/extensions/GlobalCssJs@master] Do not show help links for temp accounts
Testing Instructions
The following configurations were used for this test.
$wgResourceLoaderSources = [ 'my_wiki' => [ 'apiScript' => $wgServer . '/w/api.php', 'loadScript' => $wgServer . '/w/load.php', ], ]; $wgUseGlobalSiteCssJs = true; $wgAllowUserCss = true; $wgAllowUserJs = true; $wgGlobalCssJsConfig = [ 'wiki' => 'my_wiki', 'source' => 'my_wiki', ];
Steps
- Enable temporary accounts and make an edit on the wiki to get an account.
- Navigate to /wiki/User:<username>/global.css and confirm there is no help link and no permission to create the page.
- Navigate to /wiki/User:<username>/global.js and confirm there is no help link and no permission to create the page.
I have verified the new code has been implemented and is functioning, and displaying as expected (Help link is not displaying, and No Permission to create the page)...
Thank you for the Testing Instructions @Amdrel.