Page MenuHomePhabricator
Create Task
Maniphest T362339

Log access to IP/temp account relationship via Special:IPContributions
Closed, ResolvedPublic2 Estimated Story Points
Actions

Description

Since T361866, Special:Contributions/IP shows contributions for temp account contributions from that IP, for users who have that permission.

This access should be logged in the following way:

  • The log should contain the target IP address or IP range, the performer of the check, and the associated timestamp
  • The log should be debounced, such that only one log for a unique target and performer is created in a 24 hour period (i.e. the same debouncing used for the log created when a user clicks "Show IP")
  • The log should only occur if a DB query was made - If any of the parameters are invalid and cause the form to give an error, then no data was accessed and no log should be created
  • The log should be created via a job to avoid a write on a read request

Details

Related Changes in Gerrit:
SubjectRepoBranchLines +/-
checkuser-temporary-account-log-header: Update stringmediawiki/extensions/CheckUsermaster+1 -1
Add logging on view of Special:IPContributionsmediawiki/extensions/CheckUsermaster+247 -20
Customize query in gerrit

Related Objects
Search...

Event Timeline

Tchanders created this task.Apr 11 2024, 3:05 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptApr 11 2024, 3:05 PM
Tchanders added subscribers: Madalina, Niharika.Apr 11 2024, 7:41 PM

This will sometimes result in writes from viewing Special:Contributions, accessing ApiFeedContributions, which is tricky. Elsewhere (in CheckUser special pages and IPInfo) we have used POST instead, but those features were narrower in scope.

(My understanding is that discussions about how IP access will be monitored are still ongoing, and I wonder if we actually need to log it on the wiki (same goes for IPInfo usage). Will need further discussion with @Niharika, @Madalina, legal and community representatives.)

Tchanders mentioned this in T361867: Display contributions from temporary accounts on Special:Contributions for IP ranges.Apr 12 2024, 1:20 PM
Tchanders added a parent task: T358852: [Epic] Display temporary account contributions on Special:Contributions for IP addresses and IP ranges.Apr 15 2024, 8:57 AM
kostajh subscribed.Apr 15 2024, 12:16 PM
RP88 subscribed.Apr 21 2024, 7:25 PM
Tchanders edited projects, added Trust and Safety Product Sprint (Sprint Pennywhistle (23rd April - 3rd May)); removed Trust and Safety Product Sprint (Sprint Tabla (1st - 14th April)).Apr 23 2024, 10:55 AM
Tchanders renamed this task from Log access to IP/temp account relationship via Special:Contributions to Log access to IP/temp account relationship via Special:IPContributions.Apr 24 2024, 5:10 PM
Tchanders edited projects, added Trust and Safety Product Sprint (Sprint Shekere (13th May - 24th May)); removed Trust and Safety Product Sprint (Sprint Pennywhistle (23rd April - 3rd May)).May 13 2024, 9:24 AM
Dreamy_Jazz moved this task from Inbox to Temporary account IP reveal on the CheckUser board.May 31 2024, 11:47 AM
kostajh moved this task from Sprint Shekere (13th May - 24th May) to Sprint Melodica (Jun 3 - Jun 14) on the Trust and Safety Product Sprint board.Jun 3 2024, 10:12 AM
kostajh edited projects, added Trust and Safety Product Sprint (Sprint Melodica (Jun 3 - Jun 14)); removed Trust and Safety Product Sprint (Sprint Shekere (13th May - 24th May)).
Tchanders moved this task from Inbox to Create/update essential tools/anti-abuse management on the Temporary accounts board.Jun 4 2024, 12:59 PM
Tchanders edited projects, added Temporary accounts (Create/update essential tools/anti-abuse management); removed Temporary accounts.
Tchanders edited projects, added Trust and Safety Product Sprint (Sprint Cajon (Jun 24 - July 5)); removed Trust and Safety Product Sprint (Sprint Melodica (Jun 3 - Jun 14)).Jun 25 2024, 10:39 AM
Tchanders moved this task from Priority Backlog to Ready on the Trust and Safety Product Sprint (Sprint Cajon (Jun 24 - July 5)) board.
Dreamy_Jazz claimed this task.Jun 26 2024, 6:38 PM
Dreamy_Jazz set the point value for this task to 2.
Dreamy_Jazz moved this task from Ready to In Progress on the Trust and Safety Product Sprint (Sprint Cajon (Jun 24 - July 5)) board.
gerritbot added a comment.Jun 26 2024, 7:24 PM

Change #1050033 had a related patch set uploaded (by Dreamy Jazz; author: Dreamy Jazz):

[mediawiki/extensions/CheckUser@master] [WIP] Add logging on view of Special:IPContributions

https://gerrit.wikimedia.org/r/1050033

gerritbot added a project: Patch-For-Review.Jun 26 2024, 7:24 PM
Dreamy_Jazz updated the task description. (Show Details)Jun 27 2024, 9:14 AM
Dreamy_Jazz moved this task from In Progress to Needs Review on the Trust and Safety Product Sprint (Sprint Cajon (Jun 24 - July 5)) board.
Dreamy_Jazz added a comment.Jun 28 2024, 11:11 AM

Suggested testing steps for either patch demo or local wiki:

  1. If using patch demo, ensure that temporary accounts are enabled on the wiki
  2. Log into an account with the checkuser group
  3. Open Special:Log and filter for the Checkuser temporary account log logs, and keep it open in a separate tab
  4. Open Special:IPContributions, and it open in a separate tab
  5. Go back to Special:Log and verify no new log entries are in the list
  6. Switch back to the Special:IPContributions tab and use the form by entering the IP address 5.6.4.3. This should load the page with the text No changes were found matching these criteria.
  7. Go back to Special:Log and verify a new entry appears in the list that says viewed temporary accounts on 5.6.4.3. If this doesn't appear immediately, then wait for a minute or so and check again (as this is inserted via a job).
  8. Make some testing edits using a temporary account
  9. Find the IP used by the temporary account in step 8
  10. Switch back to the Special:IPContributions tab and use the form by entering the IP address you found in step 9. This should display the contributions made in step 8.
  11. Go back to Special:Log and verify a new entry appears in the list that says viewed temporary accounts on IP where the IP is the one from step 9. If this doesn't appear immediately, then wait for a minute or so and check again (as this is inserted via a job).
  12. Repeat steps 10 and 11, but add /24 after the IP gained from step 9.
Tchanders edited projects, added Temporary accounts (Blockers to testwiki deployment); removed Temporary accounts (Create/update essential tools/anti-abuse management).Jul 3 2024, 3:08 PM
gerritbot added a comment.Jul 4 2024, 7:38 AM

Change #1052043 had a related patch set uploaded (by Kosta Harlan; author: Kosta Harlan):

[mediawiki/extensions/CheckUser@master] checkuser-temporary-account-log-header: Update string

https://gerrit.wikimedia.org/r/1052043

kostajh moved this task from Needs Review to Needs QA on the Trust and Safety Product Sprint (Sprint Cajon (Jun 24 - July 5)) board.Jul 4 2024, 7:40 AM
gerritbot added a comment.Jul 4 2024, 8:05 AM

Change #1050033 merged by jenkins-bot:

[mediawiki/extensions/CheckUser@master] Add logging on view of Special:IPContributions

https://gerrit.wikimedia.org/r/1050033

ReleaseTaggerBot added a project: MW-1.43-notes (1.43.0-wmf.13; 2024-07-09).Jul 4 2024, 9:00 AM
gerritbot added a comment.Jul 5 2024, 10:37 AM

Change #1052043 merged by jenkins-bot:

[mediawiki/extensions/CheckUser@master] checkuser-temporary-account-log-header: Update string

https://gerrit.wikimedia.org/r/1052043

Maintenance_bot removed a project: Patch-For-Review.Jul 9 2024, 8:32 PM
Djackson-ctr moved this task from Needs QA to Done on the Trust and Safety Product Sprint (Sprint Cajon (Jun 24 - July 5)) board.Jul 10 2024, 1:39 AM
Djackson-ctr subscribed.

I have verified the new code has been implemented and is functioning and displaying as expected.

image.png (777×1 px, 61 KB)

kostajh closed this task as Resolved.Jul 10 2024, 4:23 AM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits