When using the AbuseFilter Special:AbuseFilter/test page, I can compare against the value of protected variables without creating a log entry. This allows me to work out the value of the variable by trial-and-error without logging that I viewed the value of the variable.
Steps to reproduce
- Setup ipoid locally
- Install the AbuseFilter and IPReputation extension on your local mediawiki environment
- Find an IP which your local ipoid knows about and simulate having that IP locally
- Make a few test edits either while logged out or using a temporary account
- Go to Special:AbuseFilter/test while logged in to an account with the checkuser and sysop groups
- In the Rules to test field, enter something like:
ip_reputation_client_count = 1
- Press the "Test" submit button at the bottom of the form
What happened
The Special page tells you which recent actions match against the filter conditions, such that you can know which actions have the client_count of 1 if they match the pattern. For example:
What should have happened
The special page should have allowed this, but should have created a log entry indicating that the performer accessed the value of protected variables for the users in the results.
Acceptance criteria
- The AbuseFilter Special:AbuseFilter/test page creates protected variable value access logs when the test pattern includes a protected variable and the RecentChange entry has the protected variable value defined (i.e. not null) - For example, this should create logs when using an MediaWiki-extensions-IPReputation variable using the steps above.