Create a temporary user from ApiSetClaim
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	Tchanders
	Oct 17 2023, 6:24 PM

Description

Background

Using ApiSetClaim as an (anonymous) IP user causes the creation of an actor with an IP address as their user name, which is then visible in Special:RecentChanges. This happens even with temporary accounts enabled, because temporary accounts are only currently created for workflows that go via EditPage.

After T345578: Ensure that an IP address cannot be saved permanently if IP Masking is enabled, this would throw an error.

Instead, we should create a temporary user actor, similar to EditPage.

Details

Related Changes in Gerrit:

	Subject	Repo	Branch	Lines +/-
	beta: Don’t prevent * from editing if IP masking enabled	operations/mediawiki-config	master	+1 -4
	Add temporary user support to most API modules	mediawiki/extensions/Wikibase	master	+204 -1

Customize query in gerrit

Related Objects
Search...

Status	Assigned	Task
		Restricted Task
Resolved	kostajh	T294511 2021 Security Team wikireplicas audit
Declined	None	T284948 Raw IPs of logged-out users disclosed in wiki-replicas
Resolved	Niharika	T324492 Temporary accounts - MVP
Resolved	kostajh	T349129 [Epic] Workflows that create an IP (anon) actor should create a temporary user actor instead
Resolved	kostajh	T349130 Create a temporary user from ApiSetClaim

Event Timeline

Tchanders created this task.Oct 17 2023, 6:24 PM

This is a problem that will likely affect many workflows (see parent task). We're using this particular workflow to provide an example of what to do, mainly because @Cparle first raised it to me while investigating T340540: Update WikibaseMediaInfo for IP Masking.

The draft example patch takes the approach outlined by @matmarex in T340540#9201679.

Change 966585 had a related patch set uploaded (by Tchanders; author: Tchanders):

[mediawiki/extensions/Wikibase@master] WIP example: Create a temporary user from ApiSetClaim

https://gerrit.wikimedia.org/r/966585

gerritbot added a project: Patch-For-Review.Oct 17 2023, 6:27 PM

Maintenance_bot added a project: Wikidata.Oct 17 2023, 6:29 PM

Michael subscribed.Oct 18 2023, 8:49 AM

The draft example patch takes the approach outlined by @matmarex in T340540#9201679.

I don't have a good understanding of this API, but here's how I tested the patch:

Create a new property from Special:NewProperty
Log out (or end the temp user session)
As an anon user, make an API call to ApiSetClaim. I used Special:APISandbox, with the following claim (which might well be nonsense!):

{
    "type": "statement",
    "mainsnak": {
      "snaktype": "novalue",
      "property": <ID of my new property prefixed with P, e.g. P13>
    },
    "id": <something in a valid format, though it was meaningless to my wiki, e.g. Q1$5627445f-43cb-ed6d-3adb-760e85bd17ep>
}

On success, I am now a temporary user and the API returns a redirect URL, where the token encodes any returnto (etc) parameters:

{
    "pageinfo": {
        "lastrevid": 1613
    },
    "success": 1,
    "claim": {
        "mainsnak": {
            "snaktype": "novalue",
            "property": "P13",
            "hash": "e7d6827df23a6077c04b3b03a87a028e620b3583",
            "datatype": "wikibase-property"
        },
        "type": "statement",
        "id": "Q1$5627445f-43cb-ed6d-3adb-760e85bd17ep",
        "rank": "normal"
    },
    "tempusercreated": true,
    "tempusercreatedredirect": "http://localhost/mediawiki/core/index.php/Special:CentralLogin/start?token=cb3f1d49726e38d06f56fd5472caf5be"
}

Config:

CentralAuth loaded and configured
$wgAutoCreateTempUser['enabled'] = true;
$wgAutoCreateTempUser['actions'] contains 'edit' (i.e. I didn't override the default)

ItamarWMDE subscribed.Oct 18 2023, 1:19 PM

WMDE-leszek subscribed.Oct 24 2023, 8:14 PM

ItamarWMDE moved this task from Incoming to Radar on the wmde-wikidata-tech board.Oct 26 2023, 5:06 PM

ArthurTaylor mentioned this in T354730: Support creating items as not-logged-in user when TempAccounts is enabled .Jan 15 2024, 7:19 AM

Change 966585 merged by jenkins-bot:

[mediawiki/extensions/Wikibase@master] Add temporary user support to most API modules

https://gerrit.wikimedia.org/r/966585

Maintenance_bot removed a project: Patch-For-Review.Jan 22 2024, 4:31 PM

Change 992400 had a related patch set uploaded (by Lucas Werkmeister (WMDE); author: Lucas Werkmeister (WMDE)):

[operations/mediawiki-config@master] beta: Don’t prevent * from editing if IP masking enabled

https://gerrit.wikimedia.org/r/992400

gerritbot added a project: Patch-For-Review.Jan 23 2024, 11:42 AM