from a temp user account
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	matmarex
	Aug 8 2023, 6:56 PM

Description

This feature is intended to prevent you from accidentally editing using the wrong account, or accidentally revealing your IP address by editing while logged out – for example:

in a pre-IP-masking world, as a "normal" user, if you log out in another browser tab (or clear your cookies, or they expire, etc.), you'll get a warning message before saving, so that you don't accidentally edit as an IP user
as a WMF employee with a work account and a personal account, if you log in into another account in one browser tab while having the editor open in another tab, you'll get a warning message before saving

For IP masking, we'll just consider switching temp accounts to be the same as logging in/out.

Details

Related Changes in Gerrit:

	Subject	Repo	Branch	Lines +/-
	Update messages when becoming logged-in/logged-out for IP masking	mediawiki/extensions/VisualEditor	master	+25 -29

Customize query in gerrit

Related Objects
Search...

Status	Assigned	Task
		Restricted Task
Resolved	kostajh	T294511 2021 Security Team wikireplicas audit
Declined	None	T284948 Raw IPs of logged-out users disclosed in wiki-replicas
Resolved	Niharika	T324492 Temporary accounts - MVP
Open	None	T326816 [Epic] Update features for temporary accounts
Resolved	ppelberg	T326876 Update Editing Team-owned products that may be affected by temporary users
Resolved	matmarex	T332435 Update VisualEditor for IP masking
Resolved	matmarex	T343848 Update code that deals with refreshing session info when the user logs in / log out in another tab while editing, to also handle transitioning to/from a temp user account

Event Timeline

matmarex created this task.Aug 8 2023, 6:56 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptAug 8 2023, 6:56 PM

matmarex claimed this task.Aug 8 2023, 6:57 PM

matmarex mentioned this in T332435: Update VisualEditor for IP masking.

matmarex added a project: Editing-team (Kanban Board).

VPuffetMichel moved this task from To Triage to Triaged on the VisualEditor board.Aug 10 2023, 3:49 PM

matmarex mentioned this in T344173: Error message text is treated as message code for some VisualEditor errors.Aug 14 2023, 4:12 PM

matmarex mentioned this in T50656: VisualEditor: Check for and warn user on unexpected badtoken event says they're now logged out.Aug 14 2023, 9:04 PM

Change 948664 had a related patch set uploaded (by Bartosz Dziewoński; author: Bartosz Dziewoński):

[mediawiki/extensions/VisualEditor@master] Update messages when becoming logged-in/logged-out for IP masking

https://gerrit.wikimedia.org/r/948664

gerritbot added a project: Patch-For-Review.Aug 14 2023, 9:32 PM

For reference, this is how the error messages currently appear in the save dialog:

I'd appreciate suggestions on how to phrase the messages. My first proposal (in the patch) is:

	Before	After
Logged out	We could not save your edit because the session was no longer valid. Do you want to save this page as an anonymous user instead? Your IP address will be recorded in this page's edit history.	You are no longer logged in. If you continue, <strong>your IP address will be recorded</strong> in this page's edit history.
Temp user	(same as logged in)	You are now using the temporary username <strong>$1</strong>. If you continue, your edit will be associated with this username.
Logged in	We could not save your edit because the session was no longer valid. You are now logged in as [[User:$1\|$1]]. Your edit will be associated with this account if you save this edit.	You are now logged in as <strong>[[User:$1\|$1]]</strong>. If you continue, your edit will be associated with this account.

Changes:

Remove "We could not save your edit" – it should be obvious from the big red error message
Remove "because the session was no longer valid" – this is meaningless to the average user, scary, and not even necessarily true
Replace "anonymous user" with "no longer logged in" – as our treatment of logged-out users does not really make them anonymous
Add "continue" to the message, because that's the label of the button, and we can't easily change it (suggested in T190406#8507974)
Add bold (marked by <strong> tags) to the new username and to the words "IP address" (suggested in T190406#8511569)