Page MenuHomePhabricator

Email defaults for Temporary account should match those for anon users
Closed, ResolvedPublic

Description

Motivation

For IP Masking MVP we want to keep the experience for temporary users as consistent as possible with the current experience of unregistered editors (with the exception of Notifications). This is so that we don't introduce too many major changes all at once. In the post-IP Masking MVP future these changes can be re-evaluated.

Spec
  • Email defaults/limits for temporary accounts should be the same as those for anon users currently.
Notes

Event Timeline

Change 922919 had a related patch set uploaded (by Tchanders; author: Tchanders):

[mediawiki/core@master] WIP Disable email for temporary users

https://gerrit.wikimedia.org/r/922919

Email credentials are saved in the user table, so in theory a temporary user can be given email. However, as per the task description we're disabling this for the MVP.

Classes related to email that were flagged up by the code search:

ClassChange needed?Notes
maintenance/deleteUserEmail.phpNoWould currently work on a temporary user, but would only populate the table with the correct defaults, so no change needed
maintenance/resetUserEmail.phpNoThrows error if user has no valid email, so will throw an error for a temp user
includes/mail/EmailNotification.phpYesNotifications about messages to/from a temporary user need some customisations
includes/specials/SpecialConfirmEmail.phpYesCurrently prompts temporary users to set an email address in their preferences; however clicking through to preferences prompts them to log in (since preferences aren't available to temporary users). Should send a temporary user straight to the login page, as it does for IP users.
includes/specials/SpecialEmailInvalidate.phpNoAs with the maintenance script there doesn't seem to be any harm in leaving this here
includes/specials/SpecialChangeEmail.phpNoAlready requires a named user, meaning that it prompts temporary users to log in
includes/specials/SpecialEmailUser.phpNoThis already behaves the same for any user with no email, whether anon, temporary or named but with no email address

I also looked into these public methods:

  • User::setEmail
  • User::setEmailWithConfirmation
  • User::sendConfirmationMail
  • User::sendMail
  • User::confirmEmail
  • User::invalidateEmail
  • User::setEmailAuthenticationTimestamp
  • User::canSendEmail
  • User::canReceiveEmail
  • User::isEmailConfirmed
  • User::isEmailConfirmationPending
  • EmailUser::validateTarget
  • EmailUser::getPermissionsError

Most of these work fine for temporary users, and just treat them as a user with no email.

Setters

However it is possible to save email attributes on a temporary user by calling the setters (setEmail, setEmailWithConfirmation, setEmailAuthenticationTimestamp), then User::saveSettings. After this, all the other methods treat them as regular named users with email.

These setters shouldn't be called on users that can't have email. I confirmed that core isn't doing this, but I didn't go through every extension. We could act defensively and throw errors/return early for temp users from these setters, but it shouldn't be possible for a temporary user to reach a workflow that allows them to set an email since they can't fill in a registration form or access Special:Preferences or ApiOptions. So I think we can leave this as is.

Change 922919 merged by jenkins-bot:

[mediawiki/core@master] Update email for temporary users

https://gerrit.wikimedia.org/r/922919

Testing notes

The only one that needs testing here is Special:ConfirmEmail - just check that you get the same login redirect when accessing the page as a temporary user as you do when accessing as an anon.

Thanks @GMikesell-WMF

@Tchanders For anonymous, it redirected me to the login screen but as a temp user, it went to you do not have a valid email address as seen in the screenshots below.

Anonymous

T331579_IPMasking_SpecialConfirmEmail_Anon.png (877ร—3 px, 247 KB)

Temp User

T331579_IPMasking_SpecialConfirmEmail_Temp1.png (733ร—3 px, 236 KB)

T331579_IPMasking_SpecialConfirmEmail_Temp2.png (502ร—3 px, 157 KB)

@GMikesell-WMF Hmm, I'm not quite sure what's going on here - I just tried it again locally (downloaded the latest master branch) and was redirected to login when I tried to access the page as a temp user. What's the commit hash of the latest commit if you do git log in core? And what's the exact URL you visited?

@Tchanders Thanks, the npm i was the issue. After, that I was able to get core back up to date again. As seen in the screenshot below, temp user is now the same as anonymous. I will move this to Done now. Thanks again!

Browsers: Chrome 114, FireFox 114, Safari 16.5
Skins: Vector, Timeless, Monobook

T331579_IPMasking_SpecialConfirmEmail_TempOK.png (500ร—3 px, 166 KB)