Page MenuHomePhabricator

Allow any user with the global IP reveal preference to access Special:GlobalContributions
Closed, ResolvedPublic

Assigned To
Authored By
Tchanders
Nov 21 2024, 5:45 PM
Referenced Files
F58162461: none_cta_none_none.png
Jan 10 2025, 4:23 PM
F58162424: none_none_none_none.png
Jan 10 2025, 4:23 PM
F57762268: System messages.png
Nov 29 2024, 11:22 PM
F57733563: image.png
Nov 22 2024, 8:03 PM
F57733568: image.png
Nov 22 2024, 8:03 PM
F57733558: image.png
Nov 22 2024, 8:03 PM
F57733556: image.png
Nov 22 2024, 8:03 PM
F57733551: image.png
Nov 22 2024, 8:03 PM

Description

Background

During discussions on T379066, some bugs were raised regarding how Special:GlobalContributions works for a user who does not have the right to reveal temporary account IPs on all wikis. Such a user should be able to use Special:GlobalContributions and see results from any wikis where they do have the right to reveal IPs.

The bugs were related to the fact that accessing Special:GlobalContributions redirects to a central GlobclContributions wiki, defined in the configuration. (On WMF production, this is metawiki.)

The bugs:

  • Accessing Special:GlobalContributions on a wiki where you don't have the right to reveal IP will show you a permission error, even if you have the right somewhere else.
  • If you don't have global IP reveal rights, don't have local IP reveal rights at the GlobalContributions central wiki, but do have local IP reveal rights at another wiki, you can't access Special:GlobalContributions at all.
Solution

Since we can't check permissions at all wikis, one way we can solve this is to remove the check for the IP reveal permission from Special:GlobalContributions, as suggested in T379066#10306705.

Instead we can leave checking for the right (and the global preference) until we query for the results. The right is already checked at this point for at each wiki.

Notes

The experience for users with rights only at some wikis should also be improved by T378641: Update copy on Special:GlobalContributions.

Event Timeline

Having thought about this more, we can't show a global preference error if the user hasn't accepted the global preference. This is because they might not need it. Details below.

The 4 situations a user could be in, and whether they need the global preference

Has checkuser-temporary-account-no-preference right globally: doesn't need the global preference
Has checkuser-temporary-account right globally: needs the global preference
Has checkuser-temporary-account-no-preference right at one wiki: doesn't need the global preference for that wiki
Has checkuser-temporary-account right at one wiki: needs the global preference for that wiki

The restrictions we are working with

  • We can't check whether a user has a particular right globally; we can only check wiki-by-wiki.
  • We can't check all wikis (it would be too slow).
  • We can check wikis where the searched-for IP was recently active. We only do this after the user has entered an IP.

Conclusions based on the above

Because the user might not actually need the global preference, and we can't know whether they need it until after they have entered an IP, we should not show the global preference error when the user first visits the page.

Instead, we will need to inform them that they need to enable a global preference after searching for the results.

Change #1094514 had a related patch set uploaded (by Tchanders; author: Tchanders):

[mediawiki/extensions/CheckUser@master] Fix Special:GlobalContributions for local-only permissions

https://gerrit.wikimedia.org/r/1094514

@KColeman-WMF I'd appreciate some design feedback on this if possible? I've explained below how it's currently working for different users (in the work-in-progress patch, not yet live).

Type of userBefore form submissionAfter form submission
A user who does not have the right to reveal IP anywhere
image.png (638×972 px, 53 KB)
image.png (449×954 px, 42 KB)
A user with the right to reveal IP on all wikis, who has either checked the global preference or doesn't need to
image.png (638×972 px, 53 KB)
image.png (449×954 px, 121 KB)
A user with the right to reveal IPs on one wiki, but not on another wiki
image.png (638×972 px, 53 KB)
image.png (469×957 px, 128 KB)
A user with the right to reveal IP on all wikis, who needs the global preference on all wikis, and has not enabled it
image.png (638×972 px, 53 KB)
image.png (426×936 px, 57 KB)
A user with the right to reveal IPs without enabling the global preference on one wiki, and with the right to reveal IP but needing the global preference on the other wiki, who has not enabled the global preference
image.png (638×972 px, 53 KB)
image.png (504×970 px, 138 KB)

Things to note:

  • The form before sumbission is the same for all users - I've just added the screenshots to emphasize that they can all see it
  • It may seem a little odd to allow any user to see and submit the form even if they don't have IP reveal access anywhere, but we can't know ahead of time what permissions the user has on other wikis. (See task description and T380518#10348602 for more context.)

Thank you for the clear explanation @Tchanders :)

I agree it would be helpful to explain to users why they cannot see any results, or at least hint at the reason behind it. We could use the message component so the feedback message doesn't get lost. I've explored how this might look (note: this is Codex layout but we can use OOUI message component):

System messages.png (3×3 px, 545 KB)

ScenarioMessage after form submissionType of message
A user who does not have the right to reveal IP at any of the queried wikisNo results matching the query. You may not meet the minimum requirements to view IP addresses used by temporary accounts.Notice
A user with the right to reveal IPs on one wiki, but not on another wikiShowing results from the last 90 days, for 1 wiki where you have the right to view IP addresses for temporary accounts.Page copy
A user with the right to reveal IP on all wikis, who needs the global preference on all wikis, and has not enabled itNo results matching the query. These results may be incomplete until you accept the IP reveal agreement in your global preferences.Notice
A user with the right to reveal IPs without enabling the global preference on one wiki, and with the right to reveal IP but needing the global preference on the other wiki, who has not enabled the global preferenceThese results may be incomplete until you accept the IP reveal agreement in your global preferences.Notice
API errors (T379107)Error loading data. Please try again.Error

Change #1099708 had a related patch set uploaded (by Tchanders; author: Tchanders):

[mediawiki/core@master] Remove unused parameter from `nocontribs` message

https://gerrit.wikimedia.org/r/1099708

Change #1099709 had a related patch set uploaded (by Tchanders; author: Tchanders):

[mediawiki/core@master] ContributionsSpecialPage: Call IndexPager::getBody if no results

https://gerrit.wikimedia.org/r/1099709

Change #1099710 had a related patch set uploaded (by Tchanders; author: Tchanders):

[mediawiki/extensions/CheckUser@master] WIP Show the number of wikis queried in Special:GlobalContributions

https://gerrit.wikimedia.org/r/1099710

Thanks @KColeman-WMF . I've updated the patch to do most of this.

Showing results from the last 90 days, for 1 wiki where you have the right to view IP addresses for temporary accounts.

I'm wondering again about whether this is a good idea... If a user knows they have the rights on 4 wikis, but they aren't all queried because they aren't all recently active, they may see the message "...for 2 wikis..." or "...for 1 wiki..." which might be more confusing than "...for all wikis...". I might also seem confusing to see "...for 0 wikis..." if you have the rights somewhere that was not queried, or even if you don't have the rights.

I've made this change in a separate patch so we can decide separately whether to go ahead with it.

Thanks @KColeman-WMF . I've updated the patch to do most of this.

Showing results from the last 90 days, for 1 wiki where you have the right to view IP addresses for temporary accounts.

I'm wondering again about whether this is a good idea... If a user knows they have the rights on 4 wikis, but they aren't all queried because they aren't all recently active, they may see the message "...for 2 wikis..." or "...for 1 wiki..." which might be more confusing than "...for all wikis...". I might also seem confusing to see "...for 0 wikis..." if you have the rights somewhere that was not queried, or even if you don't have the rights.

I've made this change in a separate patch so we can decide separately whether to go ahead with it.

This is a good point. I am inclined to remove it and revert to saying for all wikis where you have the right to view IP addresses for temporary accounts.

Change #1100157 had a related patch set uploaded (by Tchanders; author: Tchanders):

[mediawiki/extensions/CheckUser@master] SpecialGlobalContributionsTest: Fix tests for successful execution

https://gerrit.wikimedia.org/r/1100157

Change #1099710 abandoned by Tchanders:

[mediawiki/extensions/CheckUser@master] WIP Show the number of wikis queried in Special:GlobalContributions

Reason:

Abandoned, as discussed in T380518#10372254

https://gerrit.wikimedia.org/r/1099710

Change #1099708 merged by jenkins-bot:

[mediawiki/core@master] Remove unused parameter from `nocontribs` message

https://gerrit.wikimedia.org/r/1099708

Change #1100157 merged by jenkins-bot:

[mediawiki/extensions/CheckUser@master] SpecialGlobalContributionsTest: Fix tests for successful execution

https://gerrit.wikimedia.org/r/1100157

Change #1100435 had a related patch set uploaded (by Tchanders; author: Tchanders):

[mediawiki/extensions/WikimediaMessages@master] Add override for permissions message in Special:GlobalContributions

https://gerrit.wikimedia.org/r/1100435

Change #1099709 merged by jenkins-bot:

[mediawiki/core@master] ContributionsSpecialPage: Call IndexPager::getBody if no results

https://gerrit.wikimedia.org/r/1099709

Change #1094514 merged by jenkins-bot:

[mediawiki/extensions/CheckUser@master] Fix Special:GlobalContributions for local-only permissions

https://gerrit.wikimedia.org/r/1094514

dom_walden subscribed.

Testing different combinations of local and global user rights and preferences (as suggested in T380518#10348602 and T380518#10349760). (Local meaning the wiki I am accessing Special:GlobalContributions from.)

Error cases

With no user rights and "Temporary account IP reveal" preference not set (after submit):

none_none_none_none.png (289×916 px, 38 KB)

With checkuser-temporary-account set locally but not globally and "Temporary account IP reveal" preference only set locally or not set at all (after submit):

none_cta_none_none.png (317×1 px, 40 KB)

Success cases
#Local rightsGlobal rightsLocal preferencesGlobal preferencesLocal overrideOutcome
1checkuser-temporary-account-no-preferencenonenonenonenoneShows results only for local wiki
2nonecheckuser-temporary-account-no-preferencenonenonenoneShows results for all wikis
3checkuser-temporary-accountnonenonetemp acc IP revealnoneResults only for local wiki
4nonecheckuser-temporary-accountnonetemp acc IP revealnoneResults from all wikis
5nonecheckuser-temporary-accountnonetemp acc IP revealtemp acc IP reveal disabled locallyResults from all wikis

I am not sure about the case in row 5 of the above table. You have the "Temporary account IP reveal" preference set globally but you have unset it locally with a local override. Should we exclude results from the local wiki?

I also repeated some of the above experiments but setting the local rights and preferences on a second wiki (not the wiki I am accessing Special:GC from), and got similar results.

Test environment: local docker CheckUser 2.5 (d37a859) 07:30, 10 January 2025.

I am not sure about the case in row 5 of the above table. You have the "Temporary account IP reveal" preference set globally but you have unset it locally with a local override. Should we exclude results from the local wiki?

I think this is fine. I would assume a user using the global tool wants to see results from everywhere, and that any local overrides to unset the preference are to do with keeping the interface simple when browsing locally. I also imagine that it would be annoying to need to need to unset all your local overrides to use the global tool, then reset them again afterwards.

Change #1100435 merged by jenkins-bot:

[mediawiki/extensions/WikimediaMessages@master] Add override for permissions message in Special:GlobalContributions

https://gerrit.wikimedia.org/r/1100435

Change #1224767 had a related patch set uploaded (by Reedy; author: Tchanders):

[mediawiki/core@REL1_43] ContributionsSpecialPage: Call IndexPager::getBody if no results

https://gerrit.wikimedia.org/r/1224767

Change #1224767 merged by jenkins-bot:

[mediawiki/core@REL1_43] ContributionsSpecialPage: Call IndexPager::getBody if no results

https://gerrit.wikimedia.org/r/1224767

Change #1224818 had a related patch set uploaded (by Reedy; author: Tchanders):

[mediawiki/extensions/CheckUser@REL1_43] SpecialGlobalContributionsTest: Fix tests for successful execution

https://gerrit.wikimedia.org/r/1224818

Change #1224818 merged by jenkins-bot:

[mediawiki/extensions/CheckUser@REL1_43] SpecialGlobalContributionsTest: Fix tests for successful execution

https://gerrit.wikimedia.org/r/1224818