Page MenuHomePhabricator
Create Task
Maniphest T390197

IPReputation: Support showing a CAPTCHA on Special:UserLogin
Closed, ResolvedPublic
Actions

Description

Summary

It's useful to show CAPTCHA to IPs known to iPoid-Service for improved security.

Technical notes

Implement the ConfirmEdit hook and check if the action is a login type event, and if the IP is in IPoid.

Acceptance criteria

  • IPs known to IPoid are shown a CAPTCHA on Special:UserLogin

Details

Related Changes in Gerrit:
SubjectRepoBranchLines +/-
ConfirmEditTriggersCaptcha: Support showing a CAPTCHA on Special:UserLoginmediawiki/extensions/IPReputationmaster+149 -1
ConfirmEditTriggersCaptcha: Support showing a CAPTCHA on Special:UserLoginmediawiki/extensions/IPReputationwmf/1.44.0-wmf.22+149 -1
zuul: Add dependency on ConfirmEdit to IPReputationintegration/configmaster+2 -0
Customize query in gerrit

Related Objects

Event Timeline

kostajh created this task.Mar 27 2025, 1:42 PM
Restricted Application added a project: Trust and Safety Product Team. · View Herald TranscriptMar 27 2025, 1:42 PM
Restricted Application added a subscriber: Aklapper. · View Herald Transcript
gerritbot added a comment.Mar 27 2025, 1:42 PM

Change #1131704 had a related patch set uploaded (by Kosta Harlan; author: Kosta Harlan):

[mediawiki/extensions/IPReputation@master] ConfirmEditTriggersCaptcha: Support showing a CAPTCHA on Special:UserLogin

https://gerrit.wikimedia.org/r/1131704

gerritbot added a project: Patch-For-Review.Mar 27 2025, 1:42 PM
kostajh claimed this task.Mar 27 2025, 1:42 PM
kostajh moved this task from Priority Backlog to Needs Review on the Trust and Safety Product Sprint (Sprint Chocolate Cake (March 24 - April 11)) board.
gerritbot added a comment.Mar 27 2025, 1:47 PM

Change #1131712 had a related patch set uploaded (by Kosta Harlan; author: Kosta Harlan):

[integration/config@master] zuul: Add dependency on ConfirmEdit to IPReputation

https://gerrit.wikimedia.org/r/1131712

gerritbot added a comment.Mar 27 2025, 1:50 PM

Change #1131712 merged by jenkins-bot:

[integration/config@master] zuul: Add dependency on ConfirmEdit to IPReputation

https://gerrit.wikimedia.org/r/1131712

gerritbot added a comment.Mar 27 2025, 4:45 PM

Change #1131779 had a related patch set uploaded (by Dreamy Jazz; author: Kosta Harlan):

[mediawiki/extensions/IPReputation@wmf/1.44.0-wmf.22] ConfirmEditTriggersCaptcha: Support showing a CAPTCHA on Special:UserLogin

https://gerrit.wikimedia.org/r/1131779

gerritbot added a comment.Mar 27 2025, 4:56 PM

Change #1131779 merged by jenkins-bot:

[mediawiki/extensions/IPReputation@wmf/1.44.0-wmf.22] ConfirmEditTriggersCaptcha: Support showing a CAPTCHA on Special:UserLogin

https://gerrit.wikimedia.org/r/1131779

gerritbot added a comment.Mar 27 2025, 4:56 PM

Change #1131704 merged by jenkins-bot:

[mediawiki/extensions/IPReputation@master] ConfirmEditTriggersCaptcha: Support showing a CAPTCHA on Special:UserLogin

https://gerrit.wikimedia.org/r/1131704

Dreamy_Jazz mentioned this in rEIPR1d7d891590fb: ConfirmEditTriggersCaptcha: Support showing a CAPTCHA on Special:UserLogin.Mar 27 2025, 4:56 PM
Reedy mentioned this in rEIPRcaba399ecb4c: ConfirmEditTriggersCaptcha: Support showing a CAPTCHA on Special:UserLogin.Mar 27 2025, 4:56 PM
ReleaseTaggerBot added a project: MW-1.44-notes (1.44.0-wmf.22; 2025-03-25).Mar 27 2025, 5:00 PM
Stashbot added a comment.Mar 27 2025, 5:02 PM

Mentioned in SAL (#wikimedia-operations) [2025-03-27T17:02:52Z] <ladsgroup@deploy1003> Started scap sync-world: Backport for [[gerrit:1131774|CaptchaPreAuthenticationProvider: Run triggerCaptcha for login attempts (T379178)]], [[gerrit:1131779|ConfirmEditTriggersCaptcha: Support showing a CAPTCHA on Special:UserLogin (T390197)]]

Stashbot mentioned this in T379178: Support captcha as part of login flow (not just on "badlogin").Mar 27 2025, 5:02 PM
Stashbot added a comment.Mar 27 2025, 5:07 PM

Mentioned in SAL (#wikimedia-operations) [2025-03-27T17:07:57Z] <ladsgroup@deploy1003> dreamyjazz, ladsgroup: Backport for [[gerrit:1131774|CaptchaPreAuthenticationProvider: Run triggerCaptcha for login attempts (T379178)]], [[gerrit:1131779|ConfirmEditTriggersCaptcha: Support showing a CAPTCHA on Special:UserLogin (T390197)]] synced to the testservers (https://wikitech.wikimedia.org/wiki/Mwdebug)

Stashbot added a comment.Mar 27 2025, 5:20 PM

Mentioned in SAL (#wikimedia-operations) [2025-03-27T17:20:56Z] <ladsgroup@deploy1003> Finished scap sync-world: Backport for [[gerrit:1131774|CaptchaPreAuthenticationProvider: Run triggerCaptcha for login attempts (T379178)]], [[gerrit:1131779|ConfirmEditTriggersCaptcha: Support showing a CAPTCHA on Special:UserLogin (T390197)]] (duration: 18m 03s)

Maintenance_bot removed a project: Patch-For-Review.Mar 27 2025, 5:30 PM
Johannnes89 subscribed.Mar 27 2025, 9:07 PM
Dreamy_Jazz moved this task from Needs Review to Needs QA on the Trust and Safety Product Sprint (Sprint Chocolate Cake (March 24 - April 11)) board.Mar 31 2025, 4:10 PM
dom_walden moved this task from Needs QA to Done on the Trust and Safety Product Sprint (Sprint Chocolate Cake (March 24 - April 11)) board.Apr 3 2025, 12:16 PM
dom_walden subscribed.

Going to Special:UserLogin as an IP in my local ipoid instance, I see a captcha. Filling in the captcha I can login.

I also see the captcha when making an API request to action=query&meta=authmanagerinfo&amirequestsfor=login. I confirmed this for all the IPs in the ipoid instance.

Test environment: local docker IPReputation – (caba399) 16:42, 27 March 2025.

kostajh closed this task as Resolved.Apr 14 2025, 8:08 AM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits