When IPInfo extension is present, PageTriage should add the "Show IP" button next to temporary account usernames for users with the permissions to be able to use the feature, in the same way that IPInfo adds this to logs in the ?action=history view of an article.
Description
Description
Details
Details
| Subject | Repo | Branch | Lines +/- | |
|---|---|---|---|---|
| Enable "Show IP" button on Special:NewPagesFeed | mediawiki/extensions/PageTriage | master | +426 -6 |
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Restricted Task | |||||
| Resolved | kostajh | T294511 2021 Security Team wikireplicas audit | |||
| Declined | None | T284948 Raw IPs of logged-out users disclosed in wiki-replicas | |||
| In Progress | Niharika | T324492 Temporary accounts - MVP | |||
| Open | None | T326816 [Epic] Update features for temporary accounts | |||
| Open | None | T339244 Update Moderator Tools-owned products that may be affected by IP Masking | |||
| Resolved | jsn.sherman | T339252 Investigate impact of IP Masking on PageTriage | |||
| Resolved | Kgraessle | T381654 Enable "Show IP" button on Special:NewPagesFeed |
Event Timeline
Comment Actions
See screenshot for the Show IP button:
The relevant message is checkuser-tempaccount-reveal-ip-button-label.
Comment Actions
@Kgraessle here's an example patch where I added this lookup to the existing nuke form; the ui is different, but the permission & preference checks will work the same way:
rENUK98aa8d99429c: Enable temp account lookup by IP address
Comment Actions
rECHUffa446821f9f: SpecialBlock: add UseCodexSpecialBlock integration for 'Show IP' button is also a useful reference for implementing the "Show IP" button in Vue.
Comment Actions
Change #1119750 had a related patch set uploaded (by Kgraessle; author: Kgraessle):
[mediawiki/extensions/PageTriage@master] Enable "Show IP" button on Special:NewPagesFeed
Comment Actions
Test wiki created on Patch demo by SCardenas (WMF) using patch(es) linked to this task:
http://patchdemo.wmcloud.org/wikis/64e68a844e/w/
Comment Actions
Question:
The check user API can return multiple ip addresses as documented here:
https://www.mediawiki.org/wiki/Help:Extension:CheckUser
But, do we only want to show the first one, or all of them?
Also, should this be a button or a link?
Right now it's just a simple codex link, but I see the check user extension is creating a button.
What it looks like now:
What it looks like in other places with the button:
Comment Actions
After following up with temp accounts folks (thanks Sam!), I realized I wasn't looking at the correct API documentation.
We have the option to do the following:
- Get the most recent IP used by that temp account (no additional work on the ticket- it's what we're already doing).
- Get the IP that is associated with the revision that created the new page. (this would require some additional work to make the call for a specific revision).
- Display all IP addresses associated with a temp account. (minimal additional work).
Moving to engineering review to get @Samwalton9-WMF eyes on it.
Comment Actions
In my (unasked for) opinion, option 1 is the least desirable. I think option 3 would be the most useful, and is most closely aligned with how we handle this with mass delete queries. Option 2 would be the most accurate / least permissive or leaky and is what I think we should do if option 3 is undesirable.
Comment Actions
Your opinion is always welcomed!
Sam thought Option 2 as well, but unfortunately we don't retrieve the revision ids anywhere on the New Pages Feed.
TBD on the feasibility of this.
I'm spiking out making another API request to get the first revision id for a page title.
I'm just trying to find a not terrible way to retrieve the page title from the item row.
Option 3 is out because the API only ever returns the most recent IP despite being an array.
Let's chat more about this in engineering tomorrow.
Comment Actions
Apologies for the lack of docs for the Temporary account APIs. They are not intended to be used by anything other than the software, so documentation is currently thin. We (Trust and Safety Product Team) should look at adding this on a page focused more for developers.
If you wanted, you could fetch all the revision IDs performed by the Temporary Account on the page, and then the REST API would be able to return the IP for each revision ID. However, I would recommend option 2 given that the "Show IP" button is next to text that describes the page creation.
Comment Actions
@Dreamy_Jazz no problem at all, thanks for the suggestion!
Ok, option 2 it is.
I will make these changes and re-upload a patch.
Comment Actions
Test wiki created on Patch demo by SCardenas (WMF) using patch(es) linked to this task:
http://patchdemo.wmcloud.org/wikis/24801c2304/w/
Comment Actions
Change #1119750 merged by jenkins-bot:
[mediawiki/extensions/PageTriage@master] Enable "Show IP" button on Special:NewPagesFeed
Comment Actions
Test wiki on Patch demo by SCardenas (WMF) using patch(es) linked to this task was deleted:
Comment Actions
Test wiki on Patch demo by SCardenas (WMF) using patch(es) linked to this task was deleted: