AbuseFilter for Wikidata actions leaks IP address
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	Lucas_Werkmeister_WMDE
	Jul 26 2024, 9:44 AM

Description

Steps to reproduce:

Open https://wikidata.beta.wmflabs.org/wiki/Special:SetLabel/Q557413/en in a private window
Enter the label “the abuse filter will block this”
Submit

Actual result: abuse log contains IP address as user_name even though IP masking is enabled

Expected result: temporary account is used

	Subject	Repo	Branch	Lines +/-
	Create temp user before checking edit filters	mediawiki/extensions/Wikibase	master	+15 -15

Mentioned In: T371086: Wikidata edits blocked by AbuseFilter do not log visitor into temporary account
T358632: CannotCreateActorException when creating a temporary account on an edit which causes an abuse filter log
Mentioned Here: T371086: Wikidata edits blocked by AbuseFilter do not log visitor into temporary account
T356148: Adjust EntitySchema Special Pages to not leak IPs when editing and IP masking is enabled

Change #1056949 had a related patch set uploaded (by Lucas Werkmeister (WMDE); author: Lucas Werkmeister (WMDE)):

[mediawiki/extensions/Wikibase@master] Create temp user before checking edit filters

Noticed while working on T356148, see especially T356148#10014039 and the following comments by @kostajh and me.

Should we also have this task cover the issue of the user not being logged-in after attempting the edit?

Nah, let’s make a separate one IMHO (but thanks for reminding me): T371086

Change #1056949 merged by jenkins-bot:

[mediawiki/extensions/Wikibase@master] Create temp user before checking edit filters

Works AFAICT, now the temp account is logged \o/