Page MenuHomePhabricator

Limit the number of blocks that can be performed in a single use of Special:InvestigateBlock to wgCheckUserMaxBlocks
Closed, ResolvedPublic1 Estimated Story Points

Assigned To
Authored By
Dreamy_Jazz
Thu, May 30, 10:59 AM
Referenced Files
F54805771: image.png
Sat, Jun 1, 4:59 AM
F54805710: image.png
Sat, Jun 1, 4:59 AM
F54802722: image.png
Sat, Jun 1, 4:59 AM
F54805301: image.png
Sat, Jun 1, 4:59 AM
F54805266: image.png
Sat, Jun 1, 4:59 AM
F54805544: image.png
Sat, Jun 1, 4:59 AM
F54805236: image.png
Sat, Jun 1, 4:59 AM
F54805651: image.png
Sat, Jun 1, 4:59 AM

Description

The Special:CheckUser 'Get users' block form limits the number of users which can be blocked on one submission of the form to the number in wgCheckUserMaxBlocks. Special:InvestigateBlock does not currently limit the number of users which can be blocked in one use of the form.

Special:InvestigateBlock should be limited to block no more than wgCheckUserMaxBlocks users in one use of the form to provide feature parity with the 'Get users' form. The default value of the config is 200, which means that this limit is very unlikely to be reached and therefore should not affect CUs who are using the form in a legitimate way. The risk of allowing any number of users to be blocked is that a compromised CU account could mass block thousands of accounts in one use of the form.

Acceptance criteria
  • Special:InvestigateBlock does not allow more than wgCheckUserMaxBlocks (by default 200) users in the user input

Event Timeline

Change #1037552 had a related patch set uploaded (by Dreamy Jazz; author: Dreamy Jazz):

[mediawiki/extensions/CheckUser@master] Limit the number of users blocked in InvestigateBlock via config

https://gerrit.wikimedia.org/r/1037552

Change #1037552 merged by jenkins-bot:

[mediawiki/extensions/CheckUser@master] Limit the number of users blocked in InvestigateBlock via config

https://gerrit.wikimedia.org/r/1037552

Change #1037740 had a related patch set uploaded (by Dreamy Jazz; author: Dreamy Jazz):

[mediawiki/extensions/CheckUser@master] Fix InvestigateBlock truncated targets warning to use PLURAL

https://gerrit.wikimedia.org/r/1037740

Change #1037740 merged by jenkins-bot:

[mediawiki/extensions/CheckUser@master] Fix InvestigateBlock truncated targets warning to use PLURAL

https://gerrit.wikimedia.org/r/1037740

Change #1037824 had a related patch set uploaded (by Dreamy Jazz; author: Dreamy Jazz):

[mediawiki/extensions/CheckUser@master] [DNM] Set wgCheckUserMaxBlocks to 3

https://gerrit.wikimedia.org/r/1037824

Suggested QA steps for either patch demo or local wiki:

  1. If on a local wiki, add $wgCheckUserMaxBlocks = 3; to your LocalSettings.php. If using patch demo, make your wiki with the patch 1037824 applied
  2. Make some testing edits using at least 4 different accounts
  3. Log into an account with the checkuser and sysop group (on patch demo this should be the Patch Demo user).
  4. Load Special:InvestigateBlock
  5. Attempt to enter more than 3 usernames or IP addresses in the Usernames and IP addresses field, verifying that you cannot enter more than 3 usernames / IPs.
  6. Load Special:Investigate and run a check that includes all of the 4 accounts used in step 5
  7. Click the Block accounts button and then press Continue
  8. Verify that in the Special:InvestigateBlock page that was opened, a warning is shown that looks like the following:

image.png (71×724 px, 5 KB)

  1. Check that only 3 users are listed in the Usernames and IP addresses field

I have verified the new code has been implemented and is functioning and displaying as expected... Thank You @Dreamy_Jazz!!!

Screenshots of the accounts I used for (Test Step 6) on different devices/browsers:

image.png (601×913 px, 200 KB)

image.png (880×511 px, 194 KB)

image.png (300×1 px, 30 KB)

image.png (389×1 px, 270 KB)


Screenshots of the warning message (Test Step 8), and the listing of the first 3 users (Test Step 9) on different devices/browsers:

image.png (627×910 px, 170 KB)

image.png (901×658 px, 155 KB)

image.png (885×469 px, 178 KB)

image.png (900×479 px, 190 KB)

image.png (277×1 px, 25 KB)

image.png (412×1 px, 297 KB)

image.png (461×1 px, 246 KB)

Change #1037824 abandoned by Dreamy Jazz:

[mediawiki/extensions/CheckUser@master] [DNM] Set wgCheckUserMaxBlocks to 3

Reason:

No longer needed.

https://gerrit.wikimedia.org/r/1037824