Page MenuHomePhabricator

Prevent temporary users from being able to submit incident reports
Closed, ResolvedPublic1 Estimated Story Points

Description

When Temporary accounts rolls out, making an edit as an anonymous user will grant you a temporary user account, which you can then use to make more edits. Temporary users can be harassed just like full account users, so it might make sense to allow temporary user accounts to submit reports as well.

But for now, we do not want to enable temporary accounts to submit reports, to limit potential for abusing the system. We currently deny temporary accounts at the end of ReportHandler::validateUserCanSubmitReport by checking ot see if the user has a confirmed email. But we should change the !$user->isRegistered() check at the beginning to look for !$user->isNamed()

Event Timeline

See also T346680: Determine if users can report IP editors and temporary users, which is about the opposite situation: if registered users can report and reference comments made by temporary user accounts.

kostajh renamed this task from Validate if temporary users should be able to submit incident reports to Prevent temporary users from being able to submit incident reports.Nov 6 2024, 2:20 PM
kostajh updated the task description. (Show Details)
kostajh set the point value for this task to 1.
kostajh removed a subscriber: JKieserman.

For the December MVP we do not want temporary accounts to submit reports. We should revisit this after pilot wiki releases.

Let's go ahead with this.

hector.arroyo changed the task status from Open to In Progress.Nov 13 2024, 11:00 AM
hector.arroyo triaged this task as Medium priority.
hector.arroyo raised the priority of this task from Medium to Needs Triage.

Change #1090833 had a related patch set uploaded (by Harroyo-wmf; author: Harroyo-wmf):

[mediawiki/extensions/ReportIncident@master] Precondition to check if the user initating a report is a temp user in ReportHandler

https://gerrit.wikimedia.org/r/1090833

Change #1090833 merged by jenkins-bot:

[mediawiki/extensions/ReportIncident@master] Precondition to check if the user initating a report is a temp user

https://gerrit.wikimedia.org/r/1090833

In the interests of reducing the QA backlog, I think this can skip QA. There's no functional change in behavior from how things were before.