Page MenuHomePhabricator

Prepare Campaigns extension for IP Masking
Closed, ResolvedPublic

Description

A preliminary investigation (T326759) has found that the Campaigns extension may be affected by IP Masking.

Investigate whether or not checks are needed to ensure that only registered users are able to register for events, and temporary/IP users are NOT able to register for events. If needed, implement the checks.

This is spun out from T326872, in which we were told that the Campaigns Team do not own this. As an un-owned extension, Trust and Safety Product Team will take responsibility.

Event Timeline

Amdrel changed the task status from Open to In Progress.Jul 22 2024, 5:10 PM
Amdrel claimed this task.

Change #1056038 had a related patch set uploaded (by Amdrel; author: Amdrel):

[mediawiki/extensions/Campaigns@master] Don't make temp accounts ineligible for campaign

https://gerrit.wikimedia.org/r/1056038

It looks like the Campaigns extension needs minor changes, though the phrasing of this ticket seems to be referring to CampaignEvents. I've opened a patch that takes care of Campaigns and will prepare one for CampaignEvents soon if needed.

I tested CampaignEvents and it seems to redirect to the signup page for temporary users just fine right now. I didn't see any other cases that should be handled in my search either, so there will just be the one patch.

Campaigns Testing Instructions

A default configuration with EventLogging enabled and primary and secondary schemas installed is required.

Steps
  1. Enable temporary accounts and make an edit on the wiki to get an account.
  2. Navigate to /wiki/Special:CreateAccount?campaign=foo and create an account.
  3. Verify that an event with schema “ServerSideAccountCreation” is emitted with “campaign” set to “foo”.

CampaignEvents Testing Instructions

The following configurations were used for this test.

$wgCampaignEventsProgramsAndEventsDashboardInstance = 'staging';
$wgCampaignEventsProgramsAndEventsDashboardAPISecret = 'api secret';
$wgCampaignEventsEnableWikimediaParticipantQuestions = true;
Steps
  1. Ensure that temporary accounts are enabled.
  2. Create a group named “organizer” with the following permissions and assign the group to "Admin":
    1. campaignevents-delete-registration
    2. campaignevents-email-participants
    3. campaignevents-enable-registration
    4. campaignevents-organize-events
  3. Log into the “Admin” account.
  4. Navigate to /wiki/Event:TestEvent and create a new page when prompted as it doesn't exist yet.
  5. When prompted enable event registration and set the start and end times to future dates.
  6. End the “Admin” session and create a temporary account by making an anonymous edit on any page.
  7. Navigate to /wiki/Event:TestEvent and attempt to register for the event.
  8. Confirm that the browser redirects to the Log in page instead of registering for the event.
Djackson-ctr subscribed.

I have verified the new code has been implemented and is functioning, and displaying as expected (Temporary Accounts will be redirected to the Log In page)...
I greatly appreciated your Testing Instructions @Amdrel, thank you.

The patch attached to this ticket hasn't had a code review or been merged yet. Was this ticket resolved by accident, @Tchanders?

Dreamy_Jazz subscribed.

@Amdrel Thalia is away on sabbatical. I'll reopen the task.

Amdrel changed the task status from Open to In Progress.Aug 28 2024, 8:52 PM

Actually I just realized Tchanders is on sabbatical. I'm going to reopen this ticket. CC: @kostajh

QA notes:

Campaigns Testing Instructions

A default configuration with EventLogging enabled and primary and secondary schemas installed is required.

Steps
  1. Enable temporary accounts and make an edit on the wiki to get an account.
  2. Navigate to /wiki/Special:CreateAccount?campaign=foo and create an account.
  3. Verify that an event with schema “ServerSideAccountCreation” is emitted with “campaign” set to “foo”.

Change #1056038 merged by jenkins-bot:

[mediawiki/extensions/Campaigns@master] Don't make temp accounts ineligible for campaign

https://gerrit.wikimedia.org/r/1056038

Using the QA Notes for Campaigns Testing Instructions, I was able to produce an eventstream for schema ServerSideAccountCreation with campaign set to foo.

image.png (917×285 px, 37 KB)