Maniphest T385546

When too many revisions are revealed at once using the IP reveal APIs, the request fails because the URL is too long
Closed, ResolvedPublic
Actions

Description

Steps to reproduce

Go to https://sh.wikipedia.org/wiki/Posebno:Doprinosi/~2024-7890
Click "500" to show 500 revisions
Click "Show IP"

What happens?

"Show IP" is replaced by "(error)" without any other detail or information.

What should have happened instead?

Either "Show IP" should result in the underlying IP becoming visible OR
A helpful explanation of what happened appears

Note

I could not reproduce this issue with other temp accounts on the same wiki

Details

Related Changes in Gerrit:

	Subject	Repo	Branch	Lines +/-
	ipreveal: Pass revision IDs using POST	mediawiki/extensions/CheckUser	master	+150 -45

Customize query in gerrit

Related Objects

Mentioned In: T399713: IPReveal: Remove the revision endpoint and use the batch mechanism instead
T399712: IPReveal: Remove the log endpoint and use the batch mechanism instead
T333185: Monitor the number of revisions requested via temporary account revision API
Mentioned Here: rMWa10c31d4fdb7: Parsoid/Config/SiteConfig: Allow Parsoid to use core's deprecation mechanism
T369688: Batch the requests to reveal temp account IP addresses

Event Timeline

Niharika created this task.Feb 4 2025, 4:43 AM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptFeb 4 2025, 4:43 AM

Niharika triaged this task as High priority.Feb 4 2025, 4:44 AM

The issue is a 414 (URI too long). @Niharika's pager is configured to show 1,000 rows, and the URL generated ends up looking something like:

https://sh.wikipedia.org/w/rest.php/checkuser/v0/temporaryaccount/~2024-7890/revisions/42420867%7C42420865%7C42420864%7C42420854%7C42420847%7C42420846%7C42420818%7C42420816%7C42420815%7C42420814%7C42420809%7C42420689%7C42420685%7C42420684%7C42420683%7C42420682%7C42420681%7C42420680%7C42420679%7C42420677%7C42420676%7C42420675%7C42420674%7C42420673%7C42420672%7C42420671%7C42420670%7C42420669%7C42420668%7C42420667%7C42420666%7C42420665%7C42420664%7C42420661%7C42420597%7C42420595%7C42420594%7C42420593%7C42420577%7C42420574%7C42420572%7C42420569%7C42420567%7C42420566%7C42420563%7C42420562%7C42420561%7C42420559%7C42420558%7C42420534

We recently did some work to facilitate batch reveals of IP addresses for multiple users on a page (T369688: Batch the requests to reveal temp account IP addresses); we probably need to reuse that infrastructure for batch reveals on the Special:Contributions page.

We should consider how this interacts with other pages where we might see a request that exceeds the URL limit. Perhaps we should make the code use the batch-temporaryaccount API if the generated URL is too long.

This is a good bug to fix, but probably not super urgent either.

In T385546#10590960, @kostajh wrote:

This is a good bug to fix, but probably not super urgent either.

Should re-triage as no longer "High" given this?

kostajh lowered the priority of this task from High to Medium.Feb 28 2025, 1:55 PM

(Just to note, this is still happening).

Tchanders mentioned this in T333185: Monitor the number of revisions requested via temporary account revision API.Jun 9 2025, 11:41 AM

Tchanders edited projects, added Temporary accounts (Global wiki rollout); removed Temporary accounts.Jun 10 2025, 5:42 PM

Tchanders moved this task from To triage to Ready on the Temporary accounts (Global wiki rollout) board.

Tchanders added a project: Trust and Safety Product Sprint (Sprint Cannoli (July 7 - July 25)).Jul 7 2025, 11:21 AM

hector.arroyo changed the task status from Open to In Progress.Jul 7 2025, 2:21 PM

hector.arroyo claimed this task.

hector.arroyo moved this task from Priority Backlog to In Progress on the Trust and Safety Product Sprint (Sprint Cannoli (July 7 - July 25)) board.

Change #1167909 had a related patch set uploaded (by Harroyo-wmf; author: Harroyo-wmf):

[mediawiki/extensions/CheckUser@master] WiP

https://gerrit.wikimedia.org/r/1167909

gerritbot added a project: Patch-For-Review.Jul 10 2025, 5:06 PM

I've filed a patch to send the IDs using POST, and it is now ready for review: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CheckUser/+/1167909

hector.arroyo moved this task from Ready to In progress on the Temporary accounts (Global wiki rollout) board.Jul 14 2025, 8:14 AM

Some tests are failing after yesterday's rework of the patch, moving back to "In Progress"

hector.arroyo mentioned this in T399712: IPReveal: Remove the log endpoint and use the batch mechanism instead .Jul 16 2025, 11:43 AM

hector.arroyo mentioned this in T399713: IPReveal: Remove the revision endpoint and use the batch mechanism instead.Jul 16 2025, 11:46 AM

hector.arroyo moved this task from In Progress to Needs Review on the Trust and Safety Product Sprint (Sprint Cannoli (July 7 - July 25)) board.Jul 16 2025, 1:38 PM

hector.arroyo moved this task from Needs Review to In Progress on the Trust and Safety Product Sprint (Sprint Cannoli (July 7 - July 25)) board.Jul 17 2025, 11:07 AM

hector.arroyo moved this task from In Progress to Needs Review on the Trust and Safety Product Sprint (Sprint Cannoli (July 7 - July 25)) board.Jul 17 2025, 4:00 PM

Change #1167909 merged by jenkins-bot:

[mediawiki/extensions/CheckUser@master] ipreveal: Pass revision IDs using POST

https://gerrit.wikimedia.org/r/1167909

hector.arroyo moved this task from Needs Review to Needs QA on the Trust and Safety Product Sprint (Sprint Cannoli (July 7 - July 25)) board.Jul 18 2025, 4:29 PM

Maintenance_bot removed a project: Patch-For-Review.Jul 18 2025, 4:31 PM

ReleaseTaggerBot added a project: MW-1.45-notes (1.45.0-wmf.11; 2025-07-22).Jul 18 2025, 5:00 PM

The new code has been implemented and is functioning as expected (Selecting Show IP on the Special:Contributions page, will reveal the IP Address instead of the error message).
QA was completed for this ticket using LocalHost: Mediawiki 1.45.0-alpha (a10c31d)

hector.arroyo closed this task as Resolved.Jul 23 2025, 9:53 AM

OKryva-WMF added a project: OKR-Work.Oct 3 2025, 3:51 PM

	F58352062: image.png
	Feb 4 2025, 4:43 AM

When too many revisions are revealed at once using the IP reveal APIs, the request fails because the URL is too longClosed, ResolvedPublicActions