Page MenuHomePhabricator

Temp Accounts: Special:Log/newusers is flooded with temp accounts making it harder to monitor abuse
Closed, ResolvedPublic1.5 Estimated Story Points

Description

Motivation:

From @Johannnes89 (link to initial feedback):

Consider adding new filter options to Special:Log/newusers / hide temp accounts per default
As an admin I want to monitor Special:Log/newusers for abusive user names
https://de.wikipedia.org/wiki/Special:Log/newusers is now crowded with temporary accounts
It’s possible to use the existing filter options to work around the problem a bit (e.g. selecting “created by anonymous user” but that doesn’t solve the problem if I want to spot LTA which sometimes intentional register in another wiki -> therefore only appear using the “autocrate”-filter, which is the same one used for temporary accounts
Proposal 1: Offer a new filter option to only view non-temporary account creations
Proposal 2: Create a new filter option for only viewing temporary account creations and hide temp accounts from default view in Special:Log/newusers and from the current autocreate filter option -> admins will rarely want to look at the temp account creation log

Acceptance criteria
  • Introduce a new checkbox to the form: "Exclude temporary account creations".
  • In the checked state: Temporary account creations are not shown in the list.
  • In the unchecked state: Temporary account creations are shown in the list.
  • This checkbox is checked by default for all viewers.
  • State of this checkbox (checked/unchecked) persists even if the user changes the "Type of account creation" they are viewing.
  • State of the checkbox (checked/unchecked) is remembered if the user leaves the page and comes back to it at a future point. (Optional, nice-to-have)

Event Timeline

Restricted Application added a subscriber: Aklapper. · View Herald Transcript

By default, log/newusers should list manual registration only and might expand to include or filter temp accounts.

The current filtering options on Special:Log/newsuers are:

image.png (1×1 px, 386 KB)

  • All
  • Creation by anonymous user
  • Creation by registered user
  • Automatic creation
  • Creation with password sent by email
  • Forced local account creation

My understanding is that temporary account creation will always be automatic.

I can see a couple of different options for addressing this:

Option 1
  • Introduce a new checkbox to the form: "Exclude temporary account creations". This option is checked by default.
  • User can uncheck the box to view temporary account creations in the list.
Option 2
  • Update the default "All" to "All manual account creations" and filter out all automatic account creations from the default view
  • Automatic account creations can be seen by accessing the "Automatic creation" filter

Note: The caveat with this option is that non-temp-account automatic account creations are also removed from the default view. This doesn't fulfill the use-case mentioned in the original report (see task description). Although this might be useful for wikis like enwiki where automatic account creation rate is quite high (see log).

Thoughts? Ping @Johannnes89 @PerfektesChaos @NicoScribe @MGChecker @WikiBayer @DerHexer

Logically, option 1 makes more sense to me. Limiting “all” could be confusing. Furthermore, automatic creation of temp accounts cannot be displayed separately (= the more granular the log, the better ;P).

+1. Option 1 leads to an uncluttered view of Special:Log/newusers with both manual and automatic non-temporary account creations which admins and patrollers need in order to spot abusive user names.

Would the checkbox just affect the default view of Special:Log/newusers or also the filter options? I‘m hoping for the latter because patrollers sometimes want to specifically browse auto-created accounts to spot LTA, so ideally temporary accounts would be hidden using the checkbox when filtering for autocreations.

Is it possible to create an additional filter option to only show temporary accounts? While patrollers usually want to check auto-creations of registered accounts, I can imagine use cases where specifically checking temporary account creations via the log might be desired as well (e.g. when an LTA quickly creates lots of temporary accounts by deleting their cookies and switching to new proxy IPs)

Would the checkbox just affect the default view of Special:Log/newusers or also the filter options? I‘m hoping for the latter because patrollers sometimes want to specifically browse auto-created accounts to spot LTA, so ideally temporary accounts would be hidden using the checkbox when filtering for autocreations.

I think it should. I will double check with my engineering peers on this.

Is it possible to create an additional filter option to only show temporary accounts? While patrollers usually want to check auto-creations of registered accounts, I can imagine use cases where specifically checking temporary account creations via the log might be desired as well (e.g. when an LTA quickly creates lots of temporary accounts by deleting their cookies and switching to new proxy IPs)

Would filtering for automatic creations be sufficient? Looking at the dewiki log for automatic creations it seems like temp accounts are in the majority.

Would the checkbox just affect the default view of Special:Log/newusers or also the filter options? I‘m hoping for the latter because patrollers sometimes want to specifically browse auto-created accounts to spot LTA, so ideally temporary accounts would be hidden using the checkbox when filtering for autocreations.

I think it should. I will double check with my engineering peers on this.

Thanks!

Is it possible to create an additional filter option to only show temporary accounts? While patrollers usually want to check auto-creations of registered accounts, I can imagine use cases where specifically checking temporary account creations via the log might be desired as well (e.g. when an LTA quickly creates lots of temporary accounts by deleting their cookies and switching to new proxy IPs)

Would filtering for automatic creations be sufficient? Looking at the dewiki log for automatic creations it seems like temp accounts are in the majority.

Not sure what other users think, but I guess my wish for an additional filter option for temp accounts only is more of a nice to have, it should be ok to look at those via the auto-creation filter.

Change #1170366 had a related patch set uploaded (by STran; author: STran):

[mediawiki/core@master] Allow Special:Log/newusers to filter out temporary account creations

https://gerrit.wikimedia.org/r/1170366

Tchanders set the point value for this task to 1.Jul 29 2025, 6:41 AM

Change #1170366 merged by jenkins-bot:

[mediawiki/core@master] Allow Special:Log to filter out temporary account creations

https://gerrit.wikimedia.org/r/1170366

Tchanders subscribed.

Moving this to QA, as agreed. Note there is one case that we know is an issue and have decided to address later: https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1170366/17/includes/logging/LogEventsList.php#327

@STran Would it be possible to add setup/testing steps?

Setup:

  • If you don't see Special:Log/newusers, you may need to enable it via $wgNewUserLog = true;
  • temporary accounts should be at least known ($wgAutoCreateTempUser['known'] = true;) and some temporary accounts should be created already

QA notes:
On first load, 1. Special:Log and Special:Log/newusers should show the new input ("Exclude temporary accounts") 2. the input should be checked by default, and 3. no temporary account creation logs should be shown:

image.png (636×750 px, 72 KB)

When unchecked, those logs should now be visible:

image.png (638×763 px, 73 KB)

Other Special:Log/types should not show this input:

image.png (525×735 px, 32 KB)

but navigating from one (eg. Special:Log/block) back to Special:Log or Special:Log/newusers should show logs as expected - the checkbox will be unchecked and temporary account creations will be shown.

STran changed the point value for this task from 1 to 1.5.Jul 30 2025, 10:57 AM

Change #1174439 had a related patch set uploaded (by STran; author: STran):

[mediawiki/core@master] Ensure the `issubmitted` hidden input is always available for Special:Log

https://gerrit.wikimedia.org/r/1174439

Change #1174439 merged by jenkins-bot:

[mediawiki/core@master] Ensure the `issubmitted` hidden input is always available for Special:Log

https://gerrit.wikimedia.org/r/1174439

Djackson-ctr subscribed.

New Code Changes have been implemented (excluding the Acceptance Criteria for State of the checkbox (checked/unchecked) is remembered if the user leaves the page and comes back to it at a future point. (Optional, nice-to-have), this specific criteria will not be apart of this ticket):

QA was completed for this ticket using Mediawiki 1.45.0-wmf.13 (29d540e).

Testing was performed on various: Skins, Desktop View/MobileView, Chrome/Edge/Firefox/Safari, Windows/Mac/Android/iOS, RTL languages

Thank You @STran.

Thanks for implementing this! Some feedback:

While navigating from https://test.wikipedia.org/wiki/Special:Log to the user creation log works as expected (selecting "user creation log" in the menu opens https://test.wikipedia.org/wiki/Special:Log?type=newusers&user=&page=&excludetempacct=1&wpdate=&tagfilter=&wpfilters%5B%5D=newusers&wpFormIdentifier=logeventslist&issubmitted=1), navigating from any other log (e.g. https://test.wikipedia.org/wiki/Special:Log/block) to "user creation log" opens a different link (https://test.wikipedia.org/wiki/Special:Log?type=newusers&user=&page=&wpdate=&tagfilter=&subtype=&wpFormIdentifier=logeventslist&issubmitted=1) without the excludetempacct parameter.

Additional (minor) issue: The new checkbox option is placed a bit weird, I suggest moving it below "Type of account creation" in https://test.wikipedia.org/wiki/Special:Log/newusers because it's related to that.

Screenshot 2025-08-10 at 15.08.43.png (1×1 px, 133 KB)

Moving it down might also be useful for https://test.wikipedia.org/wiki/Special:Log which already has some checkbox options (including the default for showing account creations).

Screenshot 2025-08-10 at 15.08.50.png (1×1 px, 164 KB)

Another issue with the new checkbox: If you notice a temporary account without edits (e.g. https://test.wikipedia.org/wiki/Special:Contributions/~2025-34552-3) and click "Logs" in the tools menu, the link https://test.wikipedia.org/wiki/Special:Log/~2025-34552-3 doesn't show any log entries, because "Exclude temporary account creations" is checked by default – this shouldn't be the case when visiting logs of temporary accounts.

Screenshot 2025-08-13 at 13.07.17.png (1×1 px, 237 KB)

Thanks for implementing this! Some feedback:

While navigating from https://test.wikipedia.org/wiki/Special:Log to the user creation log works as expected (selecting "user creation log" in the menu opens https://test.wikipedia.org/wiki/Special:Log?type=newusers&user=&page=&excludetempacct=1&wpdate=&tagfilter=&wpfilters%5B%5D=newusers&wpFormIdentifier=logeventslist&issubmitted=1), navigating from any other log (e.g. https://test.wikipedia.org/wiki/Special:Log/block) to "user creation log" opens a different link (https://test.wikipedia.org/wiki/Special:Log?type=newusers&user=&page=&wpdate=&tagfilter=&subtype=&wpFormIdentifier=logeventslist&issubmitted=1) without the excludetempacct parameter.

Filed as T402896: Fix links to user creation log to include the excludetempacct parameter except when specifically accessing temp account log

Additional (minor) issue: The new checkbox option is placed a bit weird, I suggest moving it below "Type of account creation" in https://test.wikipedia.org/wiki/Special:Log/newusers because it's related to that.

Screenshot 2025-08-10 at 15.08.43.png (1×1 px, 133 KB)

Moving it down might also be useful for https://test.wikipedia.org/wiki/Special:Log which already has some checkbox options (including the default for showing account creations).

Screenshot 2025-08-10 at 15.08.50.png (1×1 px, 164 KB)

@STran Can you make this change as part of this ticket?

@STran can this be closed now or does it need to be moved into the next sprint for more work?