IP Masking- Special:Block w/ Different Browsers; Partial Site
Closed, ResolvedPublic1 Estimated Story PointsBUG REPORT
Actions

Assigned To

Authored By

	GMikesell-WMF
	Jun 20 2023, 4:58 PM

Description

Steps to replicate the issue (include links if applicable):

Open two separate browsers in Local (my example, Chrome 114 & Safari 16.4 Incognito) with two different IP addresses. One as an Admin account and the other as Not logged in
Admin- Go to Special:Block and do a partial block on a site page of the IP address of the Not logged in.
Once blocked as Not logged in, go to a site page that was not included in the site block and edit the page.
This will create a temp user. Now go to the page where you are supposed to be blocked and try to edit.
Full video instructions below

What happens?:
You are able to edit the page even though you are supposed to be blocked

What should have happened instead?:
You should not be able to edit the page that you are blocked on

Other information (browser name/version, screenshots, etc.):

QA Results - Local

AC	Status	Details
1	✅	https://phabricator.wikimedia.org/T339947 here

Related Objects
Search...

Status	Subtype	Assigned	Task
			Restricted Task
Resolved		kostajh	T294511 2021 Security Team wikireplicas audit
Declined		None	T284948 Raw IPs of logged-out users disclosed in wiki-replicas
In Progress		Niharika	T324492 Temporary accounts - MVP
Open		None	T326816 Update features for temporary accounts
Open		None	T331637 Update features in MediaWiki core for IP Masking
Open		Tchanders	T338836 How should blocks treat temporary users?
Resolved	BUG REPORT	Dreamy_Jazz	T339947 IP Masking- Special:Block w/ Different Browsers; Partial Site

Event Timeline

GMikesell-WMF created this task.Jun 20 2023, 4:58 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJun 20 2023, 4:58 PM

GMikesell-WMF mentioned this in T335062: Update AbuseFilter with the right user verification.Jun 20 2023, 4:59 PM

JJMC89 added a project: MediaWiki-Blocks.Jun 20 2023, 4:59 PM

JJMC89 moved this task from Backlog to Partial blocks on the MediaWiki-Blocks board.

Niharika moved this task from AHaT Sprint 31 - The Fez to AHaT Sprint 32 - Baseball Cap on the Anti-Harassment board.Jun 20 2023, 5:55 PM

Niharika edited projects, added Anti-Harassment (AHaT Sprint 32 - Baseball Cap); removed Anti-Harassment (AHaT Sprint 31 - The Fez).

• TThoabala claimed this task.Jun 21 2023, 11:07 AM

• TThoabala moved this task from Ready 🎬 (ONLY IF YOU HAVE NO MORE CODE TO REVIEW) to In Progress 💪 on the Anti-Harassment (AHaT Sprint 32 - Baseball Cap) board.

@GMikesell-WMF This looks like may be the expected behaviour, I think for we will need to tick Apply block to logged-in users from this IP address for the block to affect temporary users as well?

I am not sure how this is supposed to work, tagging @Tchanders and @Niharika for clarity

@GMikesell-WMF Thanks for filing this and providing the very helpful video!

@TThoabala That's correct that there's no bug as such, since the behaviour of this feature has not yet been defined, and this is how it works automatically.

@Niharika is figuring all of this out in T338836: How should blocks treat temporary users?. I'll make this a subtask of that task.

Tchanders edited projects, added Anti-Harassment; removed Anti-Harassment (AHaT Sprint 32 - Baseball Cap).Jun 26 2023, 3:20 PM

Tchanders added a parent task: T338836: How should blocks treat temporary users?.

Removing inactive task assignee (please do so as part of offboarding steps).

kostajh subscribed.Jan 24 2024, 6:47 PM

Tchanders edited projects, added Trust and Safety Product Sprint (Sprint Piano (Feb 19th - 1st March)); removed Anti-Harassment.Feb 20 2024, 8:34 PM

Tchanders moved this task from Priority Backlog to Ready on the Trust and Safety Product Sprint (Sprint Piano (Feb 19th - 1st March)) board.Feb 21 2024, 10:21 AM

Tchanders edited projects, added Trust and Safety Product Sprint; removed Trust and Safety Product Sprint (Sprint Piano (Feb 19th - 1st March)).Feb 21 2024, 2:45 PM

Tchanders edited projects, added Trust and Safety Product Sprint (Sprint Gangan (11th - 22nd March)); removed Trust and Safety Product Sprint.Feb 21 2024, 3:54 PM

Tchanders edited subscribers, added: Dreamy_Jazz; removed: • TThoabala, ARamirez_WMF, • AGueyte.

Tchanders edited projects, added Trust and Safety Product Sprint (Sprint Piano (Feb 19th - 1st March)); removed Trust and Safety Product Sprint (Sprint Gangan (11th - 22nd March)).Feb 22 2024, 1:39 PM

Dreamy_Jazz claimed this task.Feb 22 2024, 1:40 PM

This is no longer re-producable for me. Screenshots below:

Relevant block list entry	Error that appears when trying to edit

Moving to 'Needs QA' for QA to double check.

My understanding is that this was fixed by T343714: Soft blocks against an IP address should block temporary accounts using that IP address.

Dreamy_Jazz set the point value for this task to 1.Feb 22 2024, 1:59 PM

@Dreamy_Jazz This is no longer reproducible as seen in the .webm below. Like you said it's probably fixed in T343714: Soft blocks against an IP address should block temporary accounts using that IP address. I will move this to Done. Thanks for checking!

Status: ✅PASS
Environment: Local: 1.42.0-alpha (0ea2c78) 15:22, 22 February 2024
OS: macOS Sonoma 14.2.1
Browser: Chrome 121, Safari 17.3
Skins. Vector 2022
Device: MBA M2
Emulated Device:: n/a
Test Links:
Special:Block
Special:BlockList
https://en.m.wikipedia.beta.wmflabs.org/wiki/Cat#

✅AC1: https://phabricator.wikimedia.org/T339947

Chrome- Left/Safari Incog- Right

GMikesell-WMF updated the task description. (Show Details)Feb 22 2024, 9:50 PM

GMikesell-WMF moved this task from Needs QA to Done on the Trust and Safety Product Sprint (Sprint Piano (Feb 19th - 1st March)) board.

Thanks for the QA. Marking this as resolved.

	F42049833: T339947_Block_Incog_ChromeSafari.webm
	Feb 22 2024, 9:49 PM

	F37107377: T335062_AbuseFilter_IPMasking_PartialBlock.webm
	Jun 20 2023, 4:58 PM

	F42042591: image.png
	Feb 22 2024, 1:46 PM

	F42042605: image.png
	Feb 22 2024, 1:46 PM

IP Masking- Special:Block w/ Different Browsers; Partial SiteClosed, ResolvedPublic1 Estimated Story PointsBUG REPORTActions

Description

QA Results - Local

Related ObjectsSearch...

Event Timeline

IP Masking- Special:Block w/ Different Browsers; Partial Site
Closed, ResolvedPublic1 Estimated Story PointsBUG REPORT
Actions

Related Objects
Search...