Summary
Log the use of IP auto-reveal mode, as specified in T385823.
Acceptance criteria
- Enabling and disabling the mode is logged to the checkuser-temporary-account log
- Revealing specific IPs is captured in logstash
Description
Description
Details
Details
Customize query in gerrit
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Restricted Task | |||||
| Resolved | kostajh | T294511 2021 Security Team wikireplicas audit | |||
| Declined | None | T284948 Raw IPs of logged-out users disclosed in wiki-replicas | |||
| In Progress | Niharika | T324492 Temporary accounts - MVP | |||
| Resolved | Niharika | T325238 [Epic] IP Address Reveal for Privileged Users | |||
| Open | None | T358853 Temporary accounts: Automatically resolve temporary account names to IP addresses on displaying (auto reveal feature) | |||
| Resolved | Tchanders | T386492 IP auto-reveal: Assign the IP auto-reveal right to user groups | |||
| Resolved | Tchanders | T386494 IP auto-reveal: Log when mode is switched and when IPs are revealed | |||
| Resolved | Tchanders | T386500 IP auto-reveal: Allow managing IP auto-reveal from sidebar tools menu |
Event Timeline
Comment Actions
Change #1133490 had a related patch set uploaded (by Tchanders; author: Tchanders):
[mediawiki/extensions/CheckUser@master] WIP IP auto-reveal: Implement correct logging in auto-reveal mode
Comment Actions
Change #1134242 had a related patch set uploaded (by Tchanders; author: Tchanders):
[mediawiki/extensions/CheckUser@master] IP auto-reveal: Log IP lookups temporarily in auto-reveal mode
Comment Actions
Change #1133490 merged by jenkins-bot:
[mediawiki/extensions/CheckUser@master] IP auto-reveal: Log when auto-reveal is enabled or disabled
Comment Actions
Change #1139561 had a related patch set uploaded (by Dreamy Jazz; author: Dreamy Jazz):
[mediawiki/extensions/CheckUser@master] Fix IP auto-reveal log entry i18n message format
Comment Actions
Change #1139561 merged by jenkins-bot:
[mediawiki/extensions/CheckUser@master] Fix IP auto-reveal log entry i18n message format
Comment Actions
Testing notes
See T386500#10708399 for general testing steps for IP auto-reveal.
Enabling and disabling the mode is logged to the checkuser-temporary-account log:
- Log in as a user with the right to auto-reveal IPs (checkuser-temporary-account-auto-reveal right), and the right to see the IP-reveal log (checkuser-temporary-account-log right)
- Switch the mode on and off using the tool in the sidebar menu
- Also try switching on the mode and extending the expiry
- The activity should be logged at Special:Log?type=checkuser-temporary-account, with the correct performer and expiry times
Revealing specific IPs is captured in logstash:
- If testing locally, set up the CheckUser log channel to log somewhere, if this isn't already set up. I set $wgDebugLogGroups['CheckUser'] to a particular file path.
- Log in as a user who has the right to auto-reveal IPs
- Switch on auto-reveal mode using the tool in the sidebar menu
- Navigate to a page that shows temp account IPs, e.g. a history page where a temp account has edited
- Check that there is a log entry for your user viewing IPs for each user whose IPs were viewed
Comment Actions
Change #1134242 merged by jenkins-bot:
[mediawiki/extensions/CheckUser@master] IP auto-reveal: Log IP lookups temporarily in auto-reveal mode
Comment Actions
QA is completed, I have verified the new code has been implemented and is functioning as expected (Enabling and Disabling of the IP Auto-reveal mode will be logged to the checkuser-temporary-account log... Revealing of the IPs will be captured in logstash ). Great Testing Notes @Tchanders, Thank You.
NOTE: the checkuser-temporary-account log has been renamed to IP Reveal log (see ticket https://phabricator.wikimedia.org/T381874).