A preliminary investigation (T326759) has found that the WikimediaMaintenance extension may be affected by IP Masking
Description
Description
Details
Details
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Restricted Task | |||||
| Resolved | kostajh | T294511 2021 Security Team wikireplicas audit | |||
| Declined | None | T284948 Raw IPs of logged-out users disclosed in wiki-replicas | |||
| In Progress | Niharika | T324492 Temporary accounts - MVP | |||
| Open | None | T326816 [Epic] Update features for temporary accounts | |||
| Resolved | Amdrel | T326932 Prepare WikimediaMaintenance extension for IP Masking |
Event Timeline
Comment Actions
After analyzing the code search results I have made the following observations:
- blockDisabledAccounts.php: This maintenance script's query will block all temporary accounts when run in its current state. Is this script still in use?
- sendBulkEmails.php: This script only processes users passed in via an option (file) and should not need to be updated.
- unsuppressCrossWiki.php: This script only processes a user passed via option and should not need to be updated.
If blockDisabledAccounts.php is still in use, I can submit a patch for it.
Comment Actions
blockDisabledAccounts.php: This maintenance script's query will block all temporary accounts when run in its current state. Is this script still in use?
It appears that this script may still need to be used on wikis as detailed in T106068#9922135. I would recommend updating the script just in case the migration in T106068 takes longer than we do to deploy temporary accounts to all wikis.
Comment Actions
Change #1064819 had a related patch set uploaded (by Amdrel; author: Amdrel):
[mediawiki/extensions/WikimediaMaintenance@master] blockDisabledAccounts.php: Don't block temporary accounts
https://gerrit.wikimedia.org/r/1064819
Comment Actions
Change #1068705 had a related patch set uploaded (by Dreamy Jazz; author: Dreamy Jazz):
[mediawiki/extensions/WikimediaMaintenance@master] Start on tests for blockDisabledAccounts.php
https://gerrit.wikimedia.org/r/1068705
Comment Actions
Change #1064819 merged by jenkins-bot:
[mediawiki/extensions/WikimediaMaintenance@master] blockDisabledAccounts.php: Don't block temporary accounts
https://gerrit.wikimedia.org/r/1064819
Comment Actions
Change #1068705 merged by jenkins-bot:
[mediawiki/extensions/WikimediaMaintenance@master] Start on tests for blockDisabledAccounts.php
https://gerrit.wikimedia.org/r/1068705
Comment Actions
I ran the blockDisabledAccounts.php script before this change and it blocked temporary users. After this change it did not.
Test environment: local docker WikimediaMaintenance – (3d7627b) 22:04, 29 August 2024.