Page MenuHomePhabricator

REST API requests for temporary account IPs are made multiple times for the same revision IDs on Special:Contributions
Closed, ResolvedPublicBUG REPORT

Description

The CheckUser extension allows lookup of temporary account IP addresses using REST APIs. However, when the same temporary account has made more than one edit the REST API allows specifying more than one revision ID for the lookup of IPs.

When these REST API calls are made on Special:Contributions, the code incorrectly makes the request the number of times equal to the number of edits made by the temporary account.

Steps to replicate the issue
  1. Make a number of edits to a page using a temporary account (at least more than one edit)
  2. Log into an account with the checkuser-temporary-account right
  3. Load Special:Contributions for the temporary account used in step 1
  4. Open the developer console (F12)
  5. Reveal the IP addresses for the temporary account you used to make the edits in step 1

What happens?:
Multiple requests for the same revision ID are shown in the console which all have the same response JSON.

What should have happened instead?:
Either a separate request should be made for each revision ID or only one request should have been made.

Example screenshot

image.png (166×1 px, 34 KB)

Event Timeline

Change #1055892 had a related patch set uploaded (by Tchanders; author: Tchanders):

[mediawiki/extensions/CheckUser@master] WIP Stop performing duplicate IP reveal API requests on Special:Contributions

https://gerrit.wikimedia.org/r/1055892

Change #1055892 merged by jenkins-bot:

[mediawiki/extensions/CheckUser@master] Stop performing duplicate IP reveal API requests on Special:Contributions

https://gerrit.wikimedia.org/r/1055892

I have verified the new code has been implemented and is functioning and displaying as expected.

image.png (55×1 px, 5 KB)