A preliminary investigation (T326759) has found that the TemplateSandbox extension may be affected by IP Masking
Description
Details
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Restricted Task | |||||
| Resolved | kostajh | T294511 2021 Security Team wikireplicas audit | |||
| Declined | None | T284948 Raw IPs of logged-out users disclosed in wiki-replicas | |||
| Resolved | Niharika | T324492 Temporary accounts - MVP | |||
| Resolved | Madalina | T326816 [Epic] Update features for temporary accounts | |||
| Resolved | Amdrel | T326928 Prepare TemplateSandbox extension for IP Masking |
Event Timeline
The only functional difference that I see between anonymous and signed-in users is that JS and CSS preview are disabled for anonymous users as their edit tokens are predictable. To my knowledge, this is not an issue with temporary accounts, so aligning this functionality between temporary accounts and anonymous editors shouldn't be necessary.
When I load Special:TemplateSandbox when logged out, the default value in the Sandbox prefix: field contains the IP address of the user:
I think we should not display the IP address of the user in that field. As such, we should probably have the default value of the field as an empty string if the user is logged out (i.e. has not made an edit to get a temporary account yet).
@Amdrel what do you think of my suggestion?
An empty string default should be fine as that field is not required. Should we make this conditional by checking if temporary users are also known or enabled so this change only takes effect when temporary accounts start being used?
I think that would be a good plan to make the default empty for logged out users when temporary accounts are enabled, as without temporary accounts an IP could still be using the page in this way.
I think we should leave it untouched when the feature is known as when the feature is known someone can still make edits while logged out and therefore potentially use the form in the same way as if the feature had never been enabled.
However, I personally don't mind if you disagree with my last point so feel free to choose enabled vs enabled or known.
Change #1063907 had a related patch set uploaded (by Amdrel; author: Amdrel):
[mediawiki/extensions/TemplateSandbox@master] Don't prefill IP address in sandbox prefix for anonymous users
We could also use acquireAndStashName on TempUserCreator, but probably more trouble than it's worth. Just wanted to note it in case you all think it would be useful.
The one concern with that is that the prefix is used to find existing pages, so using this would give a prefix that will never have any subpages (as the username is created when the user loads the page).
Change #1063907 merged by jenkins-bot:
[mediawiki/extensions/TemplateSandbox@master] Don't prefill IP address in sandbox prefix for anonymous users
I tested Special:TemplateSandbox for a named, temporary and anonymous user, on a wiki with and without temporary accounts.
Test environment: TemplateSandbox 1.1.0 (f9c2d44) 14:31, 20 August 2024.
