Page MenuHomePhabricator

Account creation through API leaks account creator's IP address
Closed, ResolvedPublic

Description

When creating an account through the API from an anonymous user, its IP address is publicly accessible the new users log as action performer. In such case, it contains entries like this:

User account TestApiCreate (Talk | contribs | block) was created by ::1 (Talk | block)

It should be instead:

User account TestApiCreate (Talk | contribs | block) was created

and the user itself should be logged as action performer.

A patch will come soon to fix this.


Version: 1.21.x
Severity: major
See Also:
https://bugzilla.wikimedia.org/show_bug.cgi?id=56944

Details

Reference
bz44202