Page MenuHomePhabricator

[Ruwiki] Error message displayed while accessing Special:Contributions for an IP using an account with CU rights
Closed, ResolvedPublicSecurity

Description

Description
If a CheckUser tries to access the "Special:Contributions" page to see contribution of an IP on the Russian Wikipedia, an error message is displayed.

How to reproduce
For example, if a CheckUser clicks on the following link: https://ru.wikipedia.org/wiki/Special:Contributions/212.74.203.83 an error message e.g. "[446c004b-6c34-4901-89da-84c3b5ecd4bd] 2025-12-18 22:24:43: Неустранимое исключение типа «BadMethodCallException»" will be displayed (see the first screenshot).

1_error_message_from_a_CU_account.png (1,268×843 px, 106 KB)

Using an account without CheckUser right (or without logging in at all) will get the following correctly displayed page with the IP's contribution (see the second screenshot).

2_correct_display_from_an_account_without_CU_right.png (1,270×862 px, 143 KB)

Additional information
This issue is quite new - it has appeared just a couple of hours ago.

It looks like only the accounts of CheckUsers are affected by this issue. Perhaps the issue is somehow tied to the "global-temporary-account-viewer" right.
I was able to reproduce the issue from my main account User:Q-bit array on the Russian Wikipedia using different browsers (Chrome, Firefox) and from different devices (desktop + mobile). Also tried to clean the browser's cache and delete all cookies. Another CheckUsers of the Russian Wikipedia are also affected.

I've decided to create a security task because it is a blocking issue for all CheckUsers of the Russian Wikipedia and we don't want that our LTAs know that the CUs can't work properly because of it!

BadMethodCallException: MediaWiki\User\TempUser\RealTempUserConfig::getMatchCondition is disabled

from /srv/mediawiki/php-1.46.0-wmf.7/includes/User/TempUser/RealTempUserConfig.php(197)
#0 /srv/mediawiki/php-1.46.0-wmf.7/extensions/CheckUser/src/Services/CheckUserTemporaryAccountsByIPLookup.php(146): MediaWiki\User\TempUser\RealTempUserConfig->getMatchCondition(Wikimedia\Rdbms\DBConnRef, string, string)
#1 /srv/mediawiki/php-1.46.0-wmf.7/extensions/CheckUser/src/Services/CheckUserTemporaryAccountsByIPLookup.php(94): MediaWiki\CheckUser\Services\CheckUserTemporaryAccountsByIPLookup->getTempAccountsFromIPAddress(string, int)
#2 /srv/mediawiki/php-1.46.0-wmf.7/extensions/CheckUser/src/HookHandler/SpecialContributionsBeforeMainOutputHandler.php(102): MediaWiki\CheckUser\Services\CheckUserTemporaryAccountsByIPLookup->get(string, MediaWiki\User\User, bool, int)
#3 /srv/mediawiki/php-1.46.0-wmf.7/extensions/CheckUser/src/HookHandler/SpecialContributionsBeforeMainOutputHandler.php(40): MediaWiki\CheckUser\HookHandler\SpecialContributionsBeforeMainOutputHandler->addCountFromThisIPSubtitle(string, MediaWiki\Specials\SpecialContributions)
#4 /srv/mediawiki/php-1.46.0-wmf.7/includes/HookContainer/HookContainer.php(134): MediaWiki\CheckUser\HookHandler\SpecialContributionsBeforeMainOutputHandler->onSpecialContributionsBeforeMainOutput(int, MediaWiki\User\User, MediaWiki\Specials\SpecialContributions)
#5 /srv/mediawiki/php-1.46.0-wmf.7/includes/HookContainer/HookRunner.php(4114): MediaWiki\HookContainer\HookContainer->run(string, array)
#6 /srv/mediawiki/php-1.46.0-wmf.7/includes/SpecialPage/ContributionsSpecialPage.php(327): MediaWiki\HookContainer\HookRunner->onSpecialContributionsBeforeMainOutput(int, MediaWiki\User\User, MediaWiki\Specials\SpecialContributions)
#7 /srv/mediawiki/php-1.46.0-wmf.7/includes/SpecialPage/SpecialPage.php(711): MediaWiki\SpecialPage\ContributionsSpecialPage->execute(string)
#8 /srv/mediawiki/php-1.46.0-wmf.7/includes/SpecialPage/SpecialPageFactory.php(1744): MediaWiki\SpecialPage\SpecialPage->run(string)
#9 /srv/mediawiki/php-1.46.0-wmf.7/includes/Actions/ActionEntryPoint.php(504): MediaWiki\SpecialPage\SpecialPageFactory->executePath(string, MediaWiki\Context\RequestContext)
#10 /srv/mediawiki/php-1.46.0-wmf.7/includes/Actions/ActionEntryPoint.php(144): MediaWiki\Actions\ActionEntryPoint->performRequest()
#11 /srv/mediawiki/php-1.46.0-wmf.7/includes/MediaWikiEntryPoint.php(181): MediaWiki\Actions\ActionEntryPoint->execute()
#12 /srv/mediawiki/php-1.46.0-wmf.7/index.php(44): MediaWiki\MediaWikiEntryPoint->run()
#13 /srv/mediawiki/w/index.php(3): require(string)
#14 {main}

Event Timeline

This comment was removed by Mykola7.

This fix has been backported and should be resolved now

It works now.

Thank you very much!

sbassett changed the task status from Open to In Progress.Dec 19 2025, 3:54 PM
sbassett triaged this task as Low priority.
sbassett moved this task from Incoming to Watching on the Security-Team board.
sbassett added a project: SecTeam-Processed.
sbassett subscribed.

Ok, I see this just went out publicly via gerrit. Any reason to keep this task security-protected?

Not afaict, I just wasn't sure what the policy was. The security risk was the window in which the feature was broken existing and that's been resolved.

sbassett changed Author Affiliation from N/A to Wikimedia Communities.Dec 19 2025, 4:20 PM
sbassett changed the visibility from "Custom Policy" to "Public (No Login Required)".
sbassett changed the edit policy from "Custom Policy" to "All Users".
sbassett changed Risk Rating from N/A to Low.