Page MenuHomePhabricator

IP Masking: Special:Block- ShowIP appears when "*" only has been entered
Closed, ResolvedPublic3 Estimated Story PointsBUG REPORT

Description

Steps to replicate the issue (include links if applicable):

  • Log in as an Admin into your Local environment
  • Go to Special: Block
  • In the text box for Username, IP address, or IP range, enter "*"

What happens?:
ShowIP appears

What should have happened instead?:
ShowIP should not appear

Other information (browser name/version, screenshots, etc.):

T333367_IPMasking_ShowIP_Star_Newticket.png (328×1 px, 74 KB)

Event Timeline

AGueyte set the point value for this task to 3.Jun 6 2023, 1:10 PM

From what I'm seeing, in /temporaryaccount/SpecialBlock.js, the "mw.util.isTemporaryUser" returns true with blockTarget being: *, *Un, *Unr etc.

Therefore the script proceeds with the function onTargetChange( blockTarget ), revealing the ShowIP button in its div container.
But returning lastRequest null because of the unknown blockTarget...

Ideally, mw.util.isTemporaryUser shouldn't be returning true for usernames that aren't existing users.

In onTargetChange( blockTarget ) we could be verifying that the "mw.util.isTemporaryUser" is also an existing user.

I have tried a few things without success.
I am now wondering if it's really a bug or if we wanted this behavior in the first place.

As for now, the ShowIP button shows when the username is typed in just because the beginning of the username matches with the Temp user names pattern.

The issue is the Javascript function only checks if the username matches the pattern but not if the user exists, and "*Unregister" matches the pattern but isn't an actual temp user.

At the moment the ShowIP button shows but will return an error if clicked.

Leaving it as is for now.

Change 931942 had a related patch set uploaded (by Tchanders; author: Tchanders):

[mediawiki/extensions/CheckUser@master] Check temp user exists before adding IP lookup button to Special:Block

https://gerrit.wikimedia.org/r/931942

I think it's fine to do another lookup from the CheckUser script, in addition to the widget's lookup. It doubles the number of API requests, but I don't think this is a problem (it's equivalent to typing a name twice as long). If it becomes a problem for some reason, we can add debouncing.

The attached patch should solve the issue!

I think it's fine to do another lookup from the CheckUser script, in addition to the widget's lookup. It doubles the number of API requests, but I don't think this is a problem (it's equivalent to typing a name twice as long). If it becomes a problem for some reason, we can add debouncing.

The attached patch should solve the issue!

Thanks for this, I'm finding a funny bug: when I type in a temp user name, the ShowIP button shows correctly, but if I change the username, a second ShowIP button shows and etc.
Looking into how to prevent this from happening.

Screenshot 2023-06-21 at 12.41.46 PM.png (618×542 px, 61 KB)

@AGueyte That should be fixed by the latest patch set - thanks

Change 931942 merged by jenkins-bot:

[mediawiki/extensions/CheckUser@master] Check temp user exists before adding IP lookup button to Special:Block

https://gerrit.wikimedia.org/r/931942

@AGueyte Looks like I'm not getting any Show IP anymore when I enter "*" as seen in the screenshots. The only thing is that in the URL when entering "*", I get a "There is no user by the name "*". Check your Spelling." warning. When entering it in the free text username, Show IP does not display but I also don't get a warning too. I'll move this to Done if that's fine. Thanks again!

Free Text in Username "*"

T338154_IPMasking_ShowIP_StarFreeText.png (556×3 px, 213 KB)

URL "*"

T338154_IPMasking_ShowIP_StarURL.png (614×3 px, 228 KB)

This looks good to me. Thalia and I went over it in our 1:1.