Page MenuHomePhabricator

Non Wikimedia wikis users report dark mode issues on mediawiki.org and causing IP leaks.
Closed, DuplicatePublicBUG REPORT

Description

What happens?:
Non Wikimedia wikis, for example, bulbapedia.bulbagarden.net, their setting "MediaWiki:Vector-night-mode-issue-reporting-notice-url" is link to mediawiki.org. Since these external users generally do not have the Wikimedia account, they will edit the page on mediawiki.org as IP users and cause IP leak. It seems that "MediaWiki:Vector-night-mode-issue-reporting-notice-url" default to a link to mediawiki.org (?).

Here is the list of wikis which have this issue:

  1. bulbapedia.bulbagarden.net
  2. crdg.miraheze.org
  3. ddowiki.com
  4. ief.wiki
  5. palelights.miraheze.org
  6. realishreborn.miraheze.org
  7. sona.pona.la
  8. wiki.pyoiyume.com
  9. www.qiuwenbaike.cn

What should have happened instead?:
Ideally, mediawiki.org is only for the Wikimedia users. Furthermore, it is recommended that these reporting pages on mediawiki.org should be suppressed.

Details

Risk Rating
Low
Author Affiliation
Wikimedia Communities

Event Timeline

Restricted Application added a subscriber: Aklapper. · View Herald Transcript

There is already a task for this. I don't think it's a security issue or there's need to suppress IPs.

Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

is shown when editing any wikimedia wiki logged out

There is already a task for this. I don't think it's a security issue or there's need to suppress IPs.

Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

is shown when editing any wikimedia wiki logged out

I see. Thank you for your help!

sbassett edited projects, added: SecTeam-Processed; removed: Security, Security-Team.
sbassett changed the visibility from "Custom Policy" to "Public (No Login Required)".
sbassett changed the edit policy from "Custom Policy" to "All Users".
sbassett changed Risk Rating from N/A to Low.
sbassett changed the subtype of this task from "Security Issue" to "Bug Report".Jun 24 2025, 2:06 PM