Page MenuHomePhabricator

"Block" doesn't work if vandal logs out before being blocked
Closed, ResolvedPublic

Description

Author: wikipedista

Description:

You might want to skip the intro and read what happen first.

The block system doesn't work if a vandal logs out before being
blocked and then logs in with another username - see below.

Today on the portuguese Wikipedia, a vandal registered a
account (Didimocó) and started moving some admin user pages -
and later some pages in wich some admins where editing - to
titles with insults, see http://pt.wikipedia.org/wiki/Especial:
Contributions/Didimocó for examples. But then after he was
blocked he would register another account and start moving more
pages and the block didn't have any afect on him.

Me and another admin (Nuno Tavares) made a test [1] and we got
to the conclusion that the vandal before being blocked simply
just logged out and then simply logged-in with another account.
The vandal finally ran out of luck and I got the chance to
block him before he could log out of the account, blocking this
way the ip he was using.

Well, I'm not sure if this is a bug, and if so, please change
the Severity field to enhancement.

Best regards,

[1] Nuno Tavares logged out of his account, and then I blocked
him, after the block he edited a page using another account
(PCM) - http://pt.wikipedia.org/w/index.php?
title=Hordaland&diff=0&oldid=829140


Version: 1.6.x
Severity: normal
URL: http://pt.wikipedia.org/wiki/Especial:Ipblocklist

Details

Reference
bz3590

Event Timeline

bzimport raised the priority of this task from to Medium.Nov 21 2014, 8:50 PM
bzimport set Reference to bz3590.
bzimport added a subscriber: Unknown Object (MLST).

What do you mean by "the block system doesn't work"?

You can block:

  1. IP addresses
  2. IP address ranges
  3. User accounts

If a blocked user account gets used for editing while the block is in place, an
automatic temporary block on the IP address is also added by the system.

nunotavares wrote:

Can it be based on ''last IP used'' for that account for a specific time? It
could set and auto-expire... that would prevent this issue.

Probably could; originally we didn't record the IP in the database at all, but
for recent edits this can be extracted from rc_ip.

robchur wrote:

I'm duping this up to bug 5149, which describes a similar thing, but has more
discussion.

*** This bug has been marked as a duplicate of 5149 ***