Page MenuHomePhabricator
Create Task
Maniphest T379495

Special:BlockList reveals an arbitrary Temporary user IP
Closed, ResolvedPublic1 Estimated Story PointsBUG REPORT
Actions

Assigned To
Dreamy_Jazz
Authored By
Urbanecm
Sun, Nov 10, 3:13 PM
Tags
Referenced Files
F57696734: image.png
Wed, Nov 13, 6:08 AM
F57696714: image.png
Wed, Nov 13, 6:08 AM
F57696718: image.png
Wed, Nov 13, 6:08 AM
Subscribers
Aklapper
Djackson-ctr
Dreamy_Jazz
kostajh
mdaniels5757
Urbanecm
XXBlackburnXx

Description

Steps to replicate the issue (include links if applicable):

What happens?:

The latest IP used by the Temporary account is showed, regardless of timestamp or when the IP was used.

What should have happened instead?:

Since the entry is not associated to a single action by the Temporary account, I expect this to either:

  1. Show all IPs used by that Temporary account (similar to Special:Block)
  2. Show no Show IP button at all.

Software version (on Special:Version page; skip for WMF-hosted wikis like Wikipedia):

Other information (browser name/version, screenshots, etc.):

Originally reported as T379468: Unable to reveal IP for a block action at cs.wikiversity.

Closely related to T379493: Show IP button shows for block entries on Special:RecentChanges where a Temporary account is referenced.

Details

SubjectRepoBranchLines +/-
Add wgCheckUserSpecialPagesWithoutIPRevealButtons configmediawiki/extensions/CheckUsermaster+15 -6
Customize query in gerrit

Related Objects

Event Timeline

Urbanecm created this task.Sun, Nov 10, 3:13 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptSun, Nov 10, 3:13 PM
Urbanecm mentioned this in T379493: Show IP button shows for block entries on Special:RecentChanges where a Temporary account is referenced.Sun, Nov 10, 3:13 PM
Urbanecm mentioned this in T379468: Unable to reveal IP for a block action at cs.wikiversity.
XXBlackburnXx subscribed.Sun, Nov 10, 8:21 PM
mdaniels5757 subscribed.Mon, Nov 11, 3:00 AM
kostajh added projects: CheckUser, Trust and Safety Product Sprint (Sprint Accordion October 28 - November 15).Mon, Nov 11, 8:50 AM
Dreamy_Jazz moved this task from General / Unsorted to Temporary account IP reveal on the CheckUser board.Mon, Nov 11, 10:48 AM
Dreamy_Jazz subscribed.EditedMon, Nov 11, 10:52 AM

Similar problems were discussed in T370083: On Special:Log, IP reveal fails if the temp user is the not the performer of the log. In that task the short term was to hide the 'Show IP' button until we could decide what to display there. We could do similar here and then decide if we should show all IPs (or a link to get all IPs).

Dreamy_Jazz set the point value for this task to 1.Mon, Nov 11, 5:56 PM
Dreamy_Jazz moved this task from Priority Backlog to In Progress on the Trust and Safety Product Sprint (Sprint Accordion October 28 - November 15) board.

To reduce confusion, we should remove the 'Show IP' button from Special:BlockList for at least the short term. We can then decide whether to show all IPs or keep the button hidden. This will do similar to T370083 for the same reasons.

gerritbot added a comment.Mon, Nov 11, 6:29 PM

Change #1089843 had a related patch set uploaded (by Dreamy Jazz; author: Dreamy Jazz):

[mediawiki/extensions/CheckUser@master] Add wgCheckUserSpecialPagesWithoutIPRevealButtons

https://gerrit.wikimedia.org/r/1089843

gerritbot added a project: Patch-For-Review.Mon, Nov 11, 6:29 PM
gerritbot added a comment.Mon, Nov 11, 7:26 PM

Change #1089843 merged by jenkins-bot:

[mediawiki/extensions/CheckUser@master] Add wgCheckUserSpecialPagesWithoutIPRevealButtons config

https://gerrit.wikimedia.org/r/1089843

Maintenance_bot removed a project: Patch-For-Review.Mon, Nov 11, 7:30 PM
ReleaseTaggerBot added a project: MW-1.44-notes (1.44.0-wmf.3; 2024-11-12).Mon, Nov 11, 8:00 PM
Dreamy_Jazz moved this task from In Progress to Needs QA on the Trust and Safety Product Sprint (Sprint Accordion October 28 - November 15) board.Mon, Nov 11, 8:57 PM

QA is to check that Special:BlockList does not show the 'Show IP' buttons for temporary accounts.

Dreamy_Jazz mentioned this in T379583: Find and exclude special pages where temporary account IP reveal is not necessary.Mon, Nov 11, 9:00 PM
Djackson-ctr moved this task from Needs QA to Done on the Trust and Safety Product Sprint (Sprint Accordion October 28 - November 15) board.Wed, Nov 13, 6:08 AM
Djackson-ctr subscribed.

QA has been completed, and the new code change(s) are functioning as expected ("Special:BlockList does not display the 'Show IP' button for temporary accounts.").

Before disabling Show IP button for Temporary Accounts:

image.png (652×1 px, 67 KB)

After disabling Show IP button for Temporary Accounts:

image.png (817×1 px, 75 KB)

image.png (819×1 px, 72 KB)

kostajh closed this task as Resolved.Wed, Nov 13, 11:35 AM
kostajh claimed this task.
Dreamy_Jazz claimed this task.Wed, Nov 13, 1:20 PM
Dreamy_Jazz added a subscriber: kostajh.
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits