Example
Log line where a temporary user is the target:
Clicking on "Show IP" reveals "(unavailable)":
What's happening
This is because the IP is looked up using rest.php/checkuser/v0/temporaryaccount/{name}/logs/{ids}, which looks for an IP where the performer is the temporary account and the log ID is the log ID from the HTML attribute of the log line. However, the performer in this example is actually Admin, so the lookup finds nothing.
What should happen
The target's IP is not logged (it can't be since they're not actually performing a request). So the button should not appear if the temporary user is the target.
How can we do this
It's not easy to infer whether the temporary userlink refers to the performer or the target based on the log line. Sometimes the temp user is the only user link despite not being the performer, e.g. this example:
However, we do have access to the log action (e.g. block/block, newusers/autocreate for the above examples). There doesn't appear to be much that a temporary account can do that is a loggable action. (On my local instance, the only entry in cu_log_event for a temporary account with a temp user performer is an account creation, which we don't log any more since T364716: Do not show link between named account and temporary account in RecentChanges and Special:Log).
Could we do one of the following?
- Stop adding the reveal IP buttons on Special:Log
- Audit which log actions could be performed by a temporary account and only add the reveal IP buttons for those actions
