Page MenuHomePhabricator

User who had autoconfirmed and extended confirmed rights withdrawn received the "temporary account IP viewer" right
Closed, ResolvedPublicBUG REPORT

Description

After enabling temporary accounts, a user who had autoconfirmed and extended confirmed rights withdrawn received the "temporary account IP viewer" right. See https://ro.wikipedia.org/wiki/Special:Jurnal/rights

Event Timeline

@Strainu have you seen someone who doesn't meet the requirements gaining the right?

The rules are:

// Allow users to be auto-promoted to the checkuser-temporary-account-viewer group based on criteria
	// listed at https://w.wiki/BESb#Patrollers_and_other_users (T369187).
	$wgAutopromoteOnce['onEdit']['checkuser-temporary-account-viewer'] = [ '&',
		[ APCOND_EDITCOUNT, 300 ],
		[ APCOND_AGE, 6 * 30 * 86400 ], // 6 * 30 * seconds in a day, which makes 6 months
		// Exclude auto-promoting when the user already has the right through another group that has access
		[ '!', [ APCOND_INGROUPS, 'sysop' ] ],
		[ '!', [ APCOND_INGROUPS, 'checkuser' ] ],
		[ '!', [ APCOND_INGROUPS, 'suppress' ] ],
		[ '!', [ APCOND_INGROUPS, 'bureaucrat' ] ],
		// Exclude bots from the autopromotion, as the group should be granted manually to these users.
		[ '!', [ APCOND_INGROUPS, 'bot' ] ],
	];

from rOMWC39d155498344: Autopromote users into checkuser-temporary-account-viewer.

Spot checking some of the entries on https://ro.wikipedia.org/wiki/Special:Jurnal/rights, the users I saw meet the criteria.

All the users meet these requirements. However:

  • Shouldn't the users also accept the agreement?
  • I understand these are the wmf requirements, butnthey are waaay to lax.

The issue was observed because a user who's autoconfirmed and extended confirmed rights have been withdrawn received this right, which is extemely confusing from a patroller's pov.

kostajh renamed this task from All users receive the "temporary account IP viewer" rights to User who had autoconfirmed and extended confirmed rights withdrawn received the "temporary account IP viewer" right.Nov 5 2024, 2:49 PM
kostajh updated the task description. (Show Details)

All the users meet these requirements. However:

  • Shouldn't the users also accept the agreement?

Users will have to accept the agreement before they can actually view IP information for a temporary account.

I understand you don't want to give and take the right when a preference is changed, but maybe then rename the right to "eligible for vieweing IPs"?

I understand you don't want to give and take the right when a preference is changed, but maybe then rename the right to "eligible for vieweing IPs"?

@sgrabarczuk @Niharika what do you think?

I understand you don't want to give and take the right when a preference is changed, but maybe then rename the right to "eligible for vieweing IPs"?

@sgrabarczuk @Niharika what do you think?

This problem seems to be linked to the one @Urbanecm filed a solution for : T380468: Improve how we log who has access to IP reveal feature.
I'm a bit confused about the right though. Task T380468 talks about checkuser-temporary-account-viewer whereas this task mentioned the temporary account IP viewer right instead. Can someone help explain the discrepancy?

kostajh claimed this task.

Stalled on the access thresholds conversation.

No longer an issue, as we are removing autopromote per T325451: [Epic] Users with right privileges are able to view IP addresses