As explained in T331749#8830628, we should not store temporary user names in the spoofuser table.
Ensure that temporary user names are not added to the table via:
- SpoofUser class
- BatchAntiSpoof class
- any other means
Description
Description
Details
Details
| Subject | Repo | Branch | Lines +/- | |
|---|---|---|---|---|
| Don't store temporary user names in AntiSpoof's spoofuser table | mediawiki/extensions/AntiSpoof | master | +10 -4 |
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Restricted Task | |||||
| Resolved | kostajh | T294511 2021 Security Team wikireplicas audit | |||
| Declined | None | T284948 Raw IPs of logged-out users disclosed in wiki-replicas | |||
| In Progress | Niharika | T324492 Temporary accounts - MVP | |||
| Open | None | T326816 [Epic] Update features for temporary accounts | |||
| Open | Tchanders | T326869 Update TSP-owned products that may be affected by IP Masking | |||
| Resolved | • TThoabala | T331749 Investigate: Update AntiSpoof for IP Masking | |||
| Resolved | • TThoabala | T336196 Don't store temporary user names in AntiSpoof's spoofuser table |
Event Timeline
Comment Actions
Change 922086 had a related patch set uploaded (by TsepoThoabala; author: TsepoThoabala):
[mediawiki/extensions/AntiSpoof@master] Don't store temporary user names in AntiSpoof's spoofuser table
Comment Actions
Change 922086 merged by jenkins-bot:
[mediawiki/extensions/AntiSpoof@master] Don't store temporary user names in AntiSpoof's spoofuser table
Comment Actions
I tested this by:
- Installing AntiSpoof, following the steps on https://www.mediawiki.org/wiki/Extension:AntiSpoof (including the last step about running composer update)
- I ran the maintenance script batchAntiSpoof.php and confirmed that my named users were added to the spoofuser table, but my temporary users were not
- I created a new temporary user by editing logged-out; the user was not added to spoofuser
- I created a new named user; the user was added to spoofuser
- As a quick regression test, I tried creating a user with a similar name to the one I had just created, and got the following error, as expected:
@GMikesell-WMF I'll leave it with you whether you'd like to move this task on, but it looks good to me
Comment Actions
@Tchanders We got it up and running now as seen in the screenshots below. Looks good to me too, thanks for the assist! I will move this to Done.
Similar name
Temp user
SQL table
