Allow temporary accounts to be blocked with 'hideuser'
Closed, ResolvedPublic1 Estimated Story PointsSecurity
Actions

Assigned To

Authored By

	Dreamy_Jazz
	Jan 19 2024, 2:57 PM

Description

In T343705: Ensure temporary accounts cannot be suppressed via "hideuser", changes were made so that temporary accounts could not be blocked with hideuser enabled. This was done so that they would be similar to IP addresses (which cannot be blocked with hideuser).

However, if a user was to accidentally log out they could make edits using a temporary account. While this does not immediately display their IP address, the CheckUser extension allows users to reveal the IP used by a given temporary account. Therefore, by allowing temporary accounts to be blocked with hideuser enabled the IP address associated with the temporary account can be hidden from all but users with the ability to see suppressed information.

Investigation

Should the ability to block a temporary account with hideuser enabled be dependent on a configuration setting or be allowed in all situations.

Acceptance criteria

It should be possible to block temporary users with the hideuser option enabled, either by allowing in all cases or when a configuration setting is set.

QA Results - Local

AC	Status	Details
1	✅	https://phabricator.wikimedia.org/T355430 here

Details

Related Changes in Gerrit:

	Subject	Repo	Branch	Lines +/-
	Allow temporary accounts to be blocked with 'hideuser' enabled	mediawiki/core	master	+2 -59

Customize query in gerrit

Related Objects

Mentioned In: T343705: Ensure temporary accounts cannot be suppressed via "hideuser"
Mentioned Here: rMW148bfa0b39e2: Merge "SpecialVersion: Minor cleanup"
T355434: CVE-2024-34505: Temporary account IP reveal does not check the deleted status of the performer before revealing the IP address associated with an edit/log event
T343705: Ensure temporary accounts cannot be suppressed via "hideuser"

Event Timeline

Dreamy_Jazz created this task.Jan 19 2024, 2:57 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJan 19 2024, 2:57 PM

Dreamy_Jazz mentioned this in T343705: Ensure temporary accounts cannot be suppressed via "hideuser".Jan 19 2024, 2:57 PM

Marked as a security issue because it discusses what is filed in T355434. This ticket in itself does not need to have a security fix or have a security fix be backported.

Dreamy_Jazz added subscribers: Tchanders, STran, kostajh, Urbanecm_WMF.Jan 19 2024, 3:18 PM

Tchanders added a subscriber: Madalina.Jan 19 2024, 6:40 PM

Tchanders added a project: Trust and Safety Product Sprint (Sprint Northumbrian smallpipes (8th Jan.‘24 - 19th Jan.'24)).Jan 19 2024, 7:03 PM

sbassett edited projects, added SecTeam-Processed; removed Security-Team.Jan 22 2024, 5:13 PM

I've uploaded a public patch for this as the task of this ticket isn't security protectable, but some of the description here is.

I went with allowing suppression in all cases because the extra complication added by configuration seemed to be unnecessary.

Dreamy_Jazz set the point value for this task to 1.Jan 22 2024, 6:18 PM

Dreamy_Jazz moved this task from Priority Backlog to Needs review on the Trust and Safety Product Sprint (Sprint Northumbrian smallpipes (8th Jan.‘24 - 19th Jan.'24)) board.

Dreamy_Jazz claimed this task.Jan 23 2024, 12:42 AM

Dreamy_Jazz moved this task from Needs review to Needs QA on the Trust and Safety Product Sprint (Sprint Northumbrian smallpipes (8th Jan.‘24 - 19th Jan.'24)) board.Jan 23 2024, 12:53 PM

Dreamy_Jazz added subscribers: GMikesell-WMF, dom_walden, Djackson-ctr.

Suggested QA steps (can be performed on patchdemo or a local wiki):

Enable temporary account creation
1. On Patch Demo this is done by checking the IP Masking checkbox when creating the wiki for the test
2. On a local wiki add $wgAutoCreateTempUser['enabled'] = true; to your LocalSettings.php (if this is not already enabled).
Make a few testing edits using a temporary account, and note down the username for later use
Log into an account with suppressor group
1. If you do not have these rights, then log into an account with the bureaucrat group (patch demo user Patch Demo has this right)
  1. If you do not have the bureaucrat group on an account, then use run the following maintenance script: createAndPromote.php <username> --force --bureaucrat where <username> is replaced with the username of an existing account that you want to give this group to
2. After granting logging into an account with the bureaucrat group, then go to Special:UserRights and use the form to add the suppressor group to the account to be used for the test
Go to Special:Block and enter the username for the temporary account used in step 2
Set the block duration to infinite.
Verify that you can see a checkbox with the label Hide username from edits and lists and that it is not disabled.
Check the Hide username from edits and lists checkbox.
Click Block this user
If asked to confirm, check the Confirm block checkbox and click Block this user again
Go to Special:BlockList and verify that the temporary account username from step 2 is listed there with the block parameters including username hidden

Jdforrester-WMF added a project: MW-1.42-notes (1.42.0-wmf.16; 2024-01-30).Jan 23 2024, 2:09 PM

Dreamy_Jazz moved this task from Inbox to Ready on the Temporary accounts board.Jan 24 2024, 4:19 PM

@Dreamy_Jazz I was able to block temporary users with the hideuser option enabled as seen below and works as designed. I will move this to Done. Thanks for all your work and QA steps!

Status: ✅PASS
Environment: Local: 1.42.0-alpha (148bfa0) 17:17, 24 January 2024
OS: macOS Sonoma 14.2.1
Browser: Chrome 120, Firefox 121, Safari 17.2, Edge 120
Skins. Vector 2022, 2010, Minerva, Monobook, Timeless
Device: MBA M2
Emulated Device:: n/a
Test Links:
http://localhost:8080/w/index.php?title=Special:Block