Page MenuHomePhabricator

Log access to IP/temp account relationship via Special:IPContributions
Closed, ResolvedPublic2 Estimated Story Points

Description

Since T361866, Special:Contributions/IP shows contributions for temp account contributions from that IP, for users who have that permission.

This access should be logged in the following way:

  • The log should contain the target IP address or IP range, the performer of the check, and the associated timestamp
  • The log should be debounced, such that only one log for a unique target and performer is created in a 24 hour period (i.e. the same debouncing used for the log created when a user clicks "Show IP")
  • The log should only occur if a DB query was made - If any of the parameters are invalid and cause the form to give an error, then no data was accessed and no log should be created
  • The log should be created via a job to avoid a write on a read request

Event Timeline

This will sometimes result in writes from viewing Special:Contributions, accessing ApiFeedContributions, which is tricky. Elsewhere (in CheckUser special pages and IPInfo) we have used POST instead, but those features were narrower in scope.

(My understanding is that discussions about how IP access will be monitored are still ongoing, and I wonder if we actually need to log it on the wiki (same goes for IPInfo usage). Will need further discussion with @Niharika, @Madalina, legal and community representatives.)

Tchanders renamed this task from Log access to IP/temp account relationship via Special:Contributions to Log access to IP/temp account relationship via Special:IPContributions.Apr 24 2024, 5:10 PM

Change #1050033 had a related patch set uploaded (by Dreamy Jazz; author: Dreamy Jazz):

[mediawiki/extensions/CheckUser@master] [WIP] Add logging on view of Special:IPContributions

https://gerrit.wikimedia.org/r/1050033

Suggested testing steps for either patch demo or local wiki:

  1. If using patch demo, ensure that temporary accounts are enabled on the wiki
  2. Log into an account with the checkuser group
  3. Open Special:Log and filter for the Checkuser temporary account log logs, and keep it open in a separate tab
  4. Open Special:IPContributions, and it open in a separate tab
  5. Go back to Special:Log and verify no new log entries are in the list
  6. Switch back to the Special:IPContributions tab and use the form by entering the IP address 5.6.4.3. This should load the page with the text No changes were found matching these criteria.
  7. Go back to Special:Log and verify a new entry appears in the list that says viewed temporary accounts on 5.6.4.3. If this doesn't appear immediately, then wait for a minute or so and check again (as this is inserted via a job).
  8. Make some testing edits using a temporary account
  9. Find the IP used by the temporary account in step 8
  10. Switch back to the Special:IPContributions tab and use the form by entering the IP address you found in step 9. This should display the contributions made in step 8.
  11. Go back to Special:Log and verify a new entry appears in the list that says viewed temporary accounts on IP where the IP is the one from step 9. If this doesn't appear immediately, then wait for a minute or so and check again (as this is inserted via a job).
  12. Repeat steps 10 and 11, but add /24 after the IP gained from step 9.

Change #1052043 had a related patch set uploaded (by Kosta Harlan; author: Kosta Harlan):

[mediawiki/extensions/CheckUser@master] checkuser-temporary-account-log-header: Update string

https://gerrit.wikimedia.org/r/1052043

Change #1050033 merged by jenkins-bot:

[mediawiki/extensions/CheckUser@master] Add logging on view of Special:IPContributions

https://gerrit.wikimedia.org/r/1050033

Change #1052043 merged by jenkins-bot:

[mediawiki/extensions/CheckUser@master] checkuser-temporary-account-log-header: Update string

https://gerrit.wikimedia.org/r/1052043

Djackson-ctr subscribed.

I have verified the new code has been implemented and is functioning and displaying as expected.

image.png (777×1 px, 61 KB)