Limit the number of blocks that can be performed in a single use of Special:InvestigateBlock to wgCheckUserMaxBlocks
Closed, ResolvedPublic1 Estimated Story Points
Actions

Assigned To

Authored By

	Dreamy_Jazz
	May 30 2024, 10:59 AM

Description

The Special:CheckUser 'Get users' block form limits the number of users which can be blocked on one submission of the form to the number in wgCheckUserMaxBlocks. Special:InvestigateBlock does not currently limit the number of users which can be blocked in one use of the form.

Special:InvestigateBlock should be limited to block no more than wgCheckUserMaxBlocks users in one use of the form to provide feature parity with the 'Get users' form. The default value of the config is 200, which means that this limit is very unlikely to be reached and therefore should not affect CUs who are using the form in a legitimate way. The risk of allowing any number of users to be blocked is that a compromised CU account could mass block thousands of accounts in one use of the form.

Acceptance criteria

Special:InvestigateBlock does not allow more than wgCheckUserMaxBlocks (by default 200) users in the user input

Details

Subject	Repo	Branch	Lines +/-
[DNM] Set wgCheckUserMaxBlocks to 3	mediawiki/extensions/CheckUser	master	+1 -1
Fix InvestigateBlock truncated targets warning to use PLURAL	mediawiki/extensions/CheckUser	master	+1 -1
Limit the number of users blocked in InvestigateBlock via config	mediawiki/extensions/CheckUser	master	+45 -0

Customize query in gerrit

Related Objects
Search...

Status	Subtype	Assigned	Task
Open		None	T139810 RFC: Overhaul the CheckUser extension
Open		None	T132892 CheckUser UI revamp
Open		None	T69811 CheckUsers "Get users" design needs improvements
Open	Feature	None	T18306 Allow user to specify block settings from CU form
Resolved	Feature	Dreamy_Jazz	T311375 Instead of not showing any results on too many results show the results to the truncation point with a pager that allows generation of more results
Resolved	Feature	Dreamy_Jazz	T314700 Restore the bottom paging links on 'Get users'
Resolved	Feature	Dreamy_Jazz	T313446 Make non-CUs linking users and IPs when CUs use block forms in CheckUser harder
Open		None	T364943 InvestigateBlock does not allow many custom options
Resolved	Feature	Dreamy_Jazz	T329493 Replace Special:CheckUser's 'get users' block form with a usage of Special:InvestigateBlock
Resolved		Dreamy_Jazz	T366265 Limit the number of blocks that can be performed in a single use of Special:InvestigateBlock to wgCheckUserMaxBlocks

Event Timeline

Dreamy_Jazz created this task.May 30 2024, 10:59 AM

Restricted Application removed a project: Patch-For-Review. · View Herald TranscriptMay 30 2024, 10:59 AM

Dreamy_Jazz set the point value for this task to 1.May 30 2024, 11:00 AM

Dreamy_Jazz moved this task from Priority Backlog to In Progress on the Trust and Safety Product Sprint (Sprint Shekere (13th May - 24th May)) board.

Aklapper removed a project: MW-1.43-notes (1.43.0-wmf.7; 2024-05-28).Thu, May 30, 1:56 PM

Change #1037552 had a related patch set uploaded (by Dreamy Jazz; author: Dreamy Jazz):

[mediawiki/extensions/CheckUser@master] Limit the number of users blocked in InvestigateBlock via config

https://gerrit.wikimedia.org/r/1037552

gerritbot added a project: Patch-For-Review.Thu, May 30, 2:54 PM

Dreamy_Jazz moved this task from In Progress to Needs Review on the Trust and Safety Product Sprint (Sprint Shekere (13th May - 24th May)) board.Thu, May 30, 3:07 PM

Dreamy_Jazz added a project: Trust and Safety Product Team.Thu, May 30, 3:22 PM

Change #1037552 merged by jenkins-bot:

[mediawiki/extensions/CheckUser@master] Limit the number of users blocked in InvestigateBlock via config

https://gerrit.wikimedia.org/r/1037552

ReleaseTaggerBot added a project: MW-1.43-notes (1.43.0-wmf.8; 2024-06-04).Thu, May 30, 8:00 PM

Dreamy_Jazz moved this task from Needs Review to Needs QA on the Trust and Safety Product Sprint (Sprint Shekere (13th May - 24th May)) board.Thu, May 30, 10:32 PM

Change #1037740 had a related patch set uploaded (by Dreamy Jazz; author: Dreamy Jazz):

[mediawiki/extensions/CheckUser@master] Fix InvestigateBlock truncated targets warning to use PLURAL

https://gerrit.wikimedia.org/r/1037740

Dreamy_Jazz moved this task from Needs QA to Needs Review on the Trust and Safety Product Sprint (Sprint Shekere (13th May - 24th May)) board.Fri, May 31, 9:43 AM

Change #1037740 merged by jenkins-bot:

[mediawiki/extensions/CheckUser@master] Fix InvestigateBlock truncated targets warning to use PLURAL

https://gerrit.wikimedia.org/r/1037740

Dreamy_Jazz moved this task from Needs Review to Needs QA on the Trust and Safety Product Sprint (Sprint Shekere (13th May - 24th May)) board.Fri, May 31, 10:47 AM

Change #1037824 had a related patch set uploaded (by Dreamy Jazz; author: Dreamy Jazz):

[mediawiki/extensions/CheckUser@master] [DNM] Set wgCheckUserMaxBlocks to 3

https://gerrit.wikimedia.org/r/1037824

Suggested QA steps for either patch demo or local wiki:

If on a local wiki, add $wgCheckUserMaxBlocks = 3; to your LocalSettings.php. If using patch demo, make your wiki with the patch 1037824 applied
Make some testing edits using at least 4 different accounts
Log into an account with the checkuser and sysop group (on patch demo this should be the Patch Demo user).
Load Special:InvestigateBlock
Attempt to enter more than 3 usernames or IP addresses in the Usernames and IP addresses field, verifying that you cannot enter more than 3 usernames / IPs.
Load Special:Investigate and run a check that includes all of the 4 accounts used in step 5
Click the Block accounts button and then press Continue
Verify that in the Special:InvestigateBlock page that was opened, a warning is shown that looks like the following:

Check that only 3 users are listed in the Usernames and IP addresses field

I have verified the new code has been implemented and is functioning and displaying as expected... Thank You @Dreamy_Jazz!!!

Screenshots of the accounts I used for (Test Step 6) on different devices/browsers:

Screenshots of the warning message (Test Step 8), and the listing of the first 3 users (Test Step 9) on different devices/browsers:

Djackson-ctr moved this task from Needs QA to Done on the Trust and Safety Product Sprint (Sprint Shekere (13th May - 24th May)) board.Sat, Jun 1, 5:03 AM

Dreamy_Jazz closed this task as Resolved.Mon, Jun 3, 10:07 AM

Dreamy_Jazz moved this task from Sprint Shekere (13th May - 24th May) to Sprint Melodica (Jun 3 - Jun 14) on the Trust and Safety Product Sprint board.

Dreamy_Jazz edited projects, added Trust and Safety Product Sprint (Sprint Melodica (Jun 3 - Jun 14)); removed Trust and Safety Product Sprint (Sprint Shekere (13th May - 24th May)).

Dreamy_Jazz edited projects, added Trust and Safety Product Sprint (Sprint Shekere (13th May - 24th May)); removed Trust and Safety Product Sprint (Sprint Melodica (Jun 3 - Jun 14)).

Change #1037824 abandoned by Dreamy Jazz:

[mediawiki/extensions/CheckUser@master] [DNM] Set wgCheckUserMaxBlocks to 3

Reason:

No longer needed.