Page MenuHomePhabricator

Protected variable access log debouncing should take into account the variable names
Closed, ResolvedPublic

Description

Now, after T389614: Update protected variable view log copy to reflect what protected variable(s) are being viewed has been done, the protected variable access log shows names of the variables that were viewed. However, since this log is debounced, only the first access to variables in 24 hours is logged. The next accesses, regardless of the variables seen will not be logged in the grace period.

For example, suppose there are two protected vars, named var1 and var2.

In the following scenario:

  • User views log entry details where var1 was used.
  • User views log entry details where var1 was used.
  • User views (other) log entry details where var2 was used.

only the first access will be logged.

However, the third access should be logged as well, even if 24 hours period hasn't elapsed yet.

The log debouncer should take into account, access to which variables has been logged in the last 24 hours. If the user accesses avariable that is not present in the logs, the access should be logged.

This is not a problem yet, as currently there is only a single protected variable.

Event Timeline

This is not a problem yet, as currently there is only a single protected variable.

On WMF wikis we have IPReputation AbuseFilter variables which are all protected variables. Therefore, in the base install only one exists but with MediaWiki-extensions-IPReputation installed (and on WMF wikis) there is more than one protected variable.

Should this update be done in the same patch as I06fbfe, which introduces the change? It's a direct response to the proposed update.

Should this update be done in the same patch as I06fbfe, which introduces the change? It's a direct response to the proposed update.

I've filed this as a separate task as I thought that there are no other protected vars. As it turned the opposite, I also think that it should be in a single patch. I'll work on it further.

Change #1170273 had a related patch set uploaded (by Mszwarc; author: Mszwarc):

[mediawiki/extensions/AbuseFilter@master] Display names of protected variables accessed

https://gerrit.wikimedia.org/r/1170273

Change #1170273 merged by jenkins-bot:

[mediawiki/extensions/AbuseFilter@master] Display names of protected variables accessed

https://gerrit.wikimedia.org/r/1170273

Seems to have not been included in the sprint board. Adding the sprint board so we can decide to either QA, work on this more, or close this.

This has sat in QA for too long, so moving to done