The CheckUser extension allows lookup of temporary account IP addresses using REST APIs. However, when the same temporary account has made more than one edit the REST API allows specifying more than one revision ID for the lookup of IPs.
When these REST API calls are made, the code incorrectly makes the request the number of times equal to the number of edits made by the temporary account.
Steps to replicate the issue
- Make a number of edits to a page using a temporary account (at least more than one edit)
- Log into an account with the checkuser-temporary-account right
- Open the developer console (F12)
- Reveal the IP addresses for the temporary account you used to make the edits in step 1
What happens?:
Multiple requests for the same revision ID are shown in the console which all have the same response JSON.
What should have happened instead?:
Either a separate request should be made for each revision ID or only one request should have been made.
Example screenshot
