@Madalina @JSengupta-WMF

In MediaWiki, we have three email states for user accounts:

• no email: We do not require an email address from users in order to create accounts
• unverified: For users who set an email address, we send them a link asking them to verify their email address
• verified: If a user clicks the link we've sent to their inbox, the user has a verified email

Users can set their email address upon account creation or later on, in Special:Preferences, which directs the user to Special:ChangeEmail.

One security / abuse scenario with allowing a user to specify an arbitrary email address in this form: a malicious user could submit a bogus harassment report using an email address of the target of their harassment. This would have two consequences:

• the response team would follow up with the person being harassed, causing them more stress and wasting the response team's time
• if we send a copy of the report to the email address when the user submits the form ("Send me a copy", fairly standard practice) then the target of the harassment would get spammed

For this reason, I'd propose we make use of MediaWiki's built-in functionality for using the email address associated with the user account that is filing the report. If we do that, there are some questions:

• Should we require that users have a verified email address?
  • What is the UX for users who want to file a report but haven't verified their email address yet?
• What is the UX for users who want to file a report but haven't supplied any email address for their account?

It would be possible to provide a link to the user in the incident report form that would take them to Special:ChangeEmail with a returnTo query parameter that would bring them back to the page they are on, and we can add some more query parameters to the URL so that we can open up the form and allow them to continue where they left off. I don't think we would be able to (or necessarily want to) set the returnTo query parameter in the email verification link.

@kostajh can we leverage any of the existing user flow from mediawiki that prompts user to provide an email and verify it if it's missing? Say when someone becomes an admin or requests for admin rights? I am not sure under what all circumstances providing an email address is mandatory.

In T339276#9144895, @JSengupta-WMF wrote:

@kostajh can we leverage any of the existing user flow from mediawiki that prompts user to provide an email and verify it if it's missing? Say when someone becomes an admin or requests for admin rights?

As far as I know, we have very few places outside of the "User profile" tab of Special:Preferences where we prompt the user to think about their email address. Looking at this codesearch, we have:

1. The notifications tab, which provides a link to change or remove an email address. (Note that this doesn't inform the user if their email address is unverified, so the user could change the email address, but until they've verified it, they wouldn't see any email arrive there)

2. GrowthExperiements Special:Homepage feature

No email
Unverified
Verified

3. GrowthExperiments Help panel feature, after posting a question to a mentor's talk page:

No email
Unverified
Verified

I am not sure under what all circumstances providing an email address is mandatory.

AFAIK, MediaWiki will not send emails unless the user has a confirmed email address. If you change your email address, you'll see this message:

A confirmation email has been sent to the specified email address. Before any other email is sent to the account, you will have to follow the instructions in the email, to confirm that the account is actually yours.

We discussed this in our BXT meeting on Sept 20 and agreed on the following:

• We will eliminate the email field from the form
• In the case of reporting users with a verified email address: The report received by the responder will include a link to Special:EmailUser so that they can follow-up privately with the reporting user.
• Design will create flows for setting and verifying an email address for reporting users who haven’t provided them

Change 959840 had a related patch set uploaded (by Kosta Harlan; author: Kosta Harlan):

[mediawiki/extensions/ReportIncident@master] form: Remove email field

https://gerrit.wikimedia.org/r/959840

Change 959851 had a related patch set uploaded (by Kosta Harlan; author: Kosta Harlan):

[mediawiki/extensions/ReportIncident@master] emailer: Provide a link to Special:EmailUser/{user}

https://gerrit.wikimedia.org/r/959851

Change 959840 merged by jenkins-bot:

[mediawiki/extensions/ReportIncident@master] form: Remove email field

https://gerrit.wikimedia.org/r/959840

In T339276#9186463, @Madalina wrote:

• Design will create flows for setting and verifying an email address for reporting users who haven’t provided them

@JSengupta-WMF when designs for this are ready, I would propose we create it as a new task, to keep this task more narrowly focused.

Change 959851 merged by jenkins-bot:

[mediawiki/extensions/ReportIncident@master] emailer: Provide a link to Special:EmailUser/{user}

https://gerrit.wikimedia.org/r/959851

Test wiki created on Patch demo by DJacksonA using patch(es) linked to this task:
https://patchdemo.wmflabs.org/wikis/3a25c09a67/w

I will need to put this ticket into the Hold / Blocked column until the email group is created...
For more information see comments regarding the creation of an email group for incident-report-system-beta (ticket https://phabricator.wikimedia.org/T339275)

Email group has been created, we're now using: incident-report-system-beta@wikimedia.org

Here is the generic message when user has a missing or unverified email address

Title: Please update your email address

Message: We need your verified email address to provide update on the report or follow up if necessary. Please add or verify your email address from your user account settings before filing a report.

In T339276#9214299, @JSengupta-WMF wrote:

Here is the generic message when user has a missing or unverified email address

@JSengupta-WMF it doesn't look like the file is attached, could you please try that again?

In T339276#9214415, @kostajh wrote:

In T339276#9214299, @JSengupta-WMF wrote:

Here is the generic message when user has a missing or unverified email address

@JSengupta-WMF it doesn't look like the file is attached, could you please try that again?

@JSengupta-WMF @Madalina Could "Please update your email address" be misinterpreted by the user (e.g. "Does the form want me to set a different email address?")? I would suggest something like "Verified email address required" as the title.

Makes sense. Here is the updated UI

Change 964002 had a related patch set uploaded (by Kosta Harlan; author: Kosta Harlan):

[mediawiki/extensions/ReportIncident@master] [WIP] form: Show dialog to visit Special:ChangeEmail

https://gerrit.wikimedia.org/r/964002

@JSengupta-WMF @Madalina this was flagged by @Tchanders in review of the patch above: should we allow users who have unchecked the box for "Allow other users to email me" to submit the form?

If we allow users who have unchecked this box to submit an incident report, it means the admin will have the report, and a link to Special:Emailuser/{user who submitted report}, but would be unable to contact the user for follow-up.

On enwiki, there are 664,760 users with disablemail set, out of 46,331,541 accounts, or 1.43% of accounts.

In T339276#9264694, @kostajh wrote:

@JSengupta-WMF @Madalina this was flagged by @Tchanders in review of the patch above: should we allow users who have unchecked the box for "Allow other users to email me" to submit the form?

If we allow users who have unchecked this box to submit an incident report, it means the admin will have the report, and a link to Special:Emailuser/{user who submitted report}, but would be unable to contact the user for follow-up.

On enwiki, there are 664,760 users with disablemail set, out of 46,331,541 accounts, or 1.43% of accounts.

Some options:

• Warn the user that they have disablemail set, and ask them to change it, before or after they submit the incident report
• Don't allow users to submit a report with disablemail set, and explain to the user why

In T339276#9264698, @kostajh wrote:

In T339276#9264694, @kostajh wrote:

@JSengupta-WMF @Madalina this was flagged by @Tchanders in review of the patch above: should we allow users who have unchecked the box for "Allow other users to email me" to submit the form?

If we allow users who have unchecked this box to submit an incident report, it means the admin will have the report, and a link to Special:Emailuser/{user who submitted report}, but would be unable to contact the user for follow-up.

On enwiki, there are 664,760 users with disablemail set, out of 46,331,541 accounts, or 1.43% of accounts.

Some options:

• Warn the user that they have disablemail set, and ask them to change it, before or after they submit the incident report
• Don't allow users to submit a report with disablemail set, and explain to the user why

Another option (already done by Special:EmailUser):

• Warn the user that their email address would be shared with the administrators and include the email address as the "reply-to".

To expand on my idea, the English Wikipedia uses Special:EmailUser for private reports to the oversighters. An example scenario:

1. A user finds content they want to report for suppression on the English Wikipedia
2. This needs to be sent privately
3. The user loads https://en.wikipedia.org/wiki/Special:EmailUser/Oversight, which is linked to from https://en.wikipedia.org/wiki/Wikipedia:Oversight
4. They send an email and their email is added to the "Reply-to" such that the oversighter can email the user who sent the report.
5. The oversighter dealing with the report addresses the report and sends back an email confirming what action was taken.

The Incident-Reporting-System could follow this in a similar way and allow the administrators dealing with the request to email the user who reported the abuse directly without needing to use on-wiki methods or Special:EmailUser. However, a user reporting abuse by an administrator or someone they believe to be an administrator (new users often mistake non-admins who are regular users as administrators) may not feel comfortable sending the report as the user who they are reporting may then get their email address (or at least seems like they would).

Change 964002 merged by jenkins-bot:

[mediawiki/extensions/ReportIncident@master] form: Show dialog to visit Special:ChangeEmail

https://gerrit.wikimedia.org/r/964002

Change 967237 had a related patch set uploaded (by Dreamy Jazz; author: Dreamy Jazz):

[mediawiki/extensions/ReportIncident@master] Add jest tests for EmailAlertDialog.vue

https://gerrit.wikimedia.org/r/967237

Change 967237 merged by jenkins-bot:

[mediawiki/extensions/ReportIncident@master] Add jest tests for EmailAlertDialog.vue

https://gerrit.wikimedia.org/r/967237

Suggested QA steps specific to Patch Demo (let me know if you would like steps specific to wikis other than patch demo wikis):

1. Create a Patch Demo wiki with the Inbox and ReportIncident extension installed
2. Log into an account
3. Go to Special:Preferences#mw-prefsection-personal-email
4. Click Change or remove email address
5. Re-login to verify your identity if prompted to do so
6. Use the form to change the email address for the Patch Demo account to a@example.com
7. Open a user talk page
8. Create the user talk page if it does not exist
9. Click on Report in the Tools menu
10. Verification step 1: A dialog should appear asking you to confirm your email address
11. Load Special:Inbox
12. Click on the email with the subject similar to Patch demo ... email address confirmation
13. Find link with that includes the text Special:ConfirmEmail and copy the entire URL
14. Paste the URL in a new tab
15. Open the user talk page again
16. Click on Report in the Tools menu
17. Verification step 2: Verify that the step 1 of the dialog is shown (and not the dialog asking you to confirm your email address).
18. Navigate to step 2 (the form step)
19. Verification step 3: Verify that there is no email field in the form
20. Fill in the form with valid data
21. Submit the form
22. Load Special:Inbox
23. Click on the email from b@example.com (by clicking the link on the subject text)
24. Verification step 4: The body of the email contains a link to Special:EmailUser for the user who submitted the form (for example Special:EmailUser/Account where Account is replaced with the username of the account you are using with spaces replaced with underscores (_)).

Test wiki created on Patch demo by DJacksonA using patch(es) linked to this task:
https://patchdemo.wmflabs.org/wikis/c45087b29b/w

I have verified the following items have been implemented, and are displaying and functioning as expected at url https://patchdemo.wmflabs.org/wikis/c45087b29b/wiki/User_talk:Bob#Topic_Header_for_Report_Incident_for_English_Beta_Wiki
Good Work as always @Dreamy_Jazz, and thank you for the QA Steps!!!!

• No email text field is displayed on page 2 of the Incident Report

• A link to Special:EmailUser at the bottom of the email body is displaying

Test wiki created on Patch demo by DJacksonA using patch(es) linked to this task:
https://patchdemo.wmflabs.org/wikis/716b4d9ced/w

Test wiki created on Patch demo by DJacksonA using patch(es) linked to this task:
https://patchdemo.wmflabs.org/wikis/c6508c125e/w

Test wiki on Patch demo by DJacksonA using patch(es) linked to this task was deleted:

https://patchdemo.wmflabs.org/wikis/3a25c09a67/w/

Test wiki on Patch demo by DJacksonA using patch(es) linked to this task was deleted:

https://patchdemo.wmflabs.org/wikis/c45087b29b/w/

Test wiki on Patch demo by DJacksonA using patch(es) linked to this task was deleted:

https://patchdemo.wmflabs.org/wikis/716b4d9ced/w/

Test wiki on Patch demo by DJacksonA using patch(es) linked to this task was deleted:

https://patchdemo.wmflabs.org/wikis/c6508c125e/w/