Change Details

The #checkuser extension provides the ability for users with the `checkuser-temporary-account` right to view the IP address associated with temporary accounts. This REST API does not check the deleted status of the performer on log actions and edits that are looked up. The risk with this is somewhat limited because you must already know the temporary account username. However, these are auto-generated in a serial manner which means that guessing the username is not difficult if you make multiple requests or look at `Special:ListUsers` for missing usernames. The risk with this is that users who log out of their account by accident and then make an edit have the IP address that made the edit suppressed on WMF wikis. However, if the wiki uses temporary accounts then suppressing the performer of the edit and/or blocking the temporary account with `hideuser` enabled does not prevent a user from using the REST API to find the IP address used to make the edit. This would allow an attacker to get the IP address associated with a registered user who forgot to log in to make their edit, even if the users with the ability to suppress information had attempted to hide the data. ====Steps to reproduce # Make an edit on a wiki with temporary account creation enabled # Log into an account with the ability to suppress information # Suppress the temporary account username on the edit made in step 1 # Log out and into an account with just the `checkuser-temporary-account` right # Go to `Special:Preferences` and make sure to check the `checkuser-temporary-account-enable` preference # Make a GET request to the REST API with the URL `/checkuser/v0/temporaryaccount/{name}/revisions/{ids}` where `{name}` is replaced with the temporary account username used to make the edit in step 1 and the `{ids}` is replaced with the revision ID of the edit made in step 1 **What happens** The IP address associated with the edit made in step 1 is returned **What should have happened** The IP address was not returned as the performer of the edit was suppressed

The #checkuser extension provides the ability for users with the `checkuser-temporary-account` right to view the IP address associated with temporary accounts. This REST API does not check the deleted status of the performer on log actions and edits that are looked up. The risk with this is somewhat limited because you must already know the temporary account username. However, these are auto-generated in a serial manner which means that guessing the username is not difficult if you make multiple requests or look at `Special:ListUsers` for missing usernames. The risk with this is that users who log out of their account by accident and then make an edit have the IP address that made the edit suppressed on WMF wikis. However, if the wiki uses temporary accounts then suppressing the performer of the edit and/or blocking the temporary account with `hideuser` enabled does not prevent a user from using the REST API to find the IP address used to make the edit. This would allow an attacker to get the IP address associated with a registered user who forgot to log in to make their edit, even if the users with the ability to suppress information had attempted to hide the data. **Note:** This code is currently unusable on production as temporary accounts are not enabled there. This does affect betawikis and any third-party wiki that uses #checkuser with temporary account autocreation enabled. ====Steps to reproduce # Make an edit on a wiki with temporary account creation enabled # Log into an account with the ability to suppress information # Suppress the temporary account username on the edit made in step 1 # Log out and into an account with just the `checkuser-temporary-account` right # Go to `Special:Preferences` and make sure to check the `checkuser-temporary-account-enable` preference # Make a GET request to the REST API with the URL `/checkuser/v0/temporaryaccount/{name}/revisions/{ids}` where `{name}` is replaced with the temporary account username used to make the edit in step 1 and the `{ids}` is replaced with the revision ID of the edit made in step 1 **What happens** The IP address associated with the edit made in step 1 is returned **What should have happened** The IP address was not returned as the performer of the edit was suppressed

The #checkuser extension provides the ability for users with the `checkuser-temporary-account` right to view the IP address associated with temporary accounts. This REST API does not check the deleted status of the performer on log actions and edits that are looked up. The risk with this is somewhat limited because you must already know the temporary account username. However, these are auto-generated in a serial manner which means that guessing the username is not difficult if you make multiple requests or look at `Special:ListUsers` for missing usernames. The risk with this is that users who log out of their account by accident and then make an edit have the IP address that made the edit suppressed on WMF wikis. However, if the wiki uses temporary accounts then suppressing the performer of the edit and/or blocking the temporary account with `hideuser` enabled does not prevent a user from using the REST API to find the IP address used to make the edit. This would allow an attacker to get the IP address associated with a registered user who forgot to log in to make their edit, even if the users with the ability to suppress information had attempted to hide the data. **Note:** This code is currently unusable on production as temporary accounts are not enabled there. This does affect betawikis and any third-party wiki that uses #checkuser with temporary account autocreation enabled. ====Steps to reproduce # Make an edit on a wiki with temporary account creation enabled # Log into an account with the ability to suppress information # Suppress the temporary account username on the edit made in step 1 # Log out and into an account with just the `checkuser-temporary-account` right # Go to `Special:Preferences` and make sure to check the `checkuser-temporary-account-enable` preference # Make a GET request to the REST API with the URL `/checkuser/v0/temporaryaccount/{name}/revisions/{ids}` where `{name}` is replaced with the temporary account username used to make the edit in step 1 and the `{ids}` is replaced with the revision ID of the edit made in step 1 **What happens** The IP address associated with the edit made in step 1 is returned **What should have happened** The IP address was not returned as the performer of the edit was suppressed