[{reqId}] {exception_url} InvalidArgumentException: Invalid username: 80.246.136.0/24Seen after rollout of wmf.23 to groups 0 and 1. Affects multiple wikis, probably a majority of them since it's the CentralAuth extension.
It seems IP address ranges are being interpreted as usernames. Other examples:
The log entries I am seeing are triggered by ContentTranslation\PreferenceHelper->isCXEntrypointDisabled(MediaWiki\User\User). That is invoked from onSpecialContributionsBeforeMainOutput( $id, $user, $page ) where $user is the user what Special:Contributions is displaying contributions for. If you access Special:Contributions, that's you, the logged-in user. If you're accessing Special:Contributions/{name or ip}, then $user is potentially someone else from the logged-in user viewing Special:Contributions. So we should check isCXEntrypointDisabled using the request user, and we should also verify that the user is named (not temp or anon).
As for why this broke just now, I am not sure. The ContentTranslation code has been there for a couple of years already. It's possible that some refactoring that Trust and Safety Product Team has been doing to tighten up validation of IPs has surfaced this.
Change #1073745 had a related patch set uploaded (by Kosta Harlan; author: Kosta Harlan):
[mediawiki/extensions/ContentTranslation@master] Hooks: Re-order checks to verify that request user is same as Special:Contributions user
Change #1073755 had a related patch set uploaded (by Dreamy Jazz; author: Kosta Harlan):
[mediawiki/extensions/ContentTranslation@wmf/1.43.0-wmf.23] Hooks: Re-order checks to verify that request user is same as Special:Contributions user
Change #1073745 merged by jenkins-bot:
[mediawiki/extensions/ContentTranslation@master] Hooks: Re-order checks to verify that request user is same as Special:Contributions user
Change #1073759 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):
[mediawiki/extensions/CentralAuth@master] Allow IP ranges in CentralAuth::getInstanceByName()
The SpecialContributionsBeforeMainOutput hook can pass a user object that represents an IP or IP range (since one can list the contributions of those). ContentTranslation forces a permission check on that user object. rECAU8c8e144381e8: CentralAuthIdLookup: Treat central users without local accounts as owned / rEGPR7482d88ba54d: Allow lookup of global preferences for users without local accounts modified the CentralAuth handler for permission checks (to look up global rights when the user does not exist locally) so it doesn't fail early for non-existent users. The handler involves getting a CentralAuthUser from the User, which throws on invalid usernames. It had an exemption for IPs but not for IP ranges.
Change #1073755 merged by jenkins-bot:
[mediawiki/extensions/ContentTranslation@wmf/1.43.0-wmf.23] Hooks: Re-order checks to verify that request user is same as Special:Contributions user
Mentioned in SAL (#wikimedia-operations) [2024-09-18T11:46:18Z] <dreamyjazz@deploy1003> Started scap sync-world: Backport for [[gerrit:1073755|Hooks: Re-order checks to verify that request user is same as Special:Contributions user (T375061)]]
Mentioned in SAL (#wikimedia-operations) [2024-09-18T11:48:28Z] <dreamyjazz@deploy1003> dreamyjazz: Backport for [[gerrit:1073755|Hooks: Re-order checks to verify that request user is same as Special:Contributions user (T375061)]] synced to the testservers (https://wikitech.wikimedia.org/wiki/Mwdebug)
@daniel food for thought - maybe we should have a dedicated class (UserFilter?) to express (user or IP or IP range), instead of using user objects and then putting an IP or IP range in the username.
Change #1073771 had a related patch set uploaded (by Dreamy Jazz; author: Gergő Tisza):
[mediawiki/extensions/CentralAuth@wmf/1.43.0-wmf.23] Allow IP ranges in CentralAuth::getInstanceByName()
Change #1073772 had a related patch set uploaded (by Dreamy Jazz; author: Gergő Tisza):
[mediawiki/extensions/CentralAuth@wmf/1.43.0-wmf.22] Allow IP ranges in CentralAuth::getInstanceByName()
Mentioned in SAL (#wikimedia-operations) [2024-09-18T11:55:21Z] <dreamyjazz@deploy1003> Finished scap sync-world: Backport for [[gerrit:1073755|Hooks: Re-order checks to verify that request user is same as Special:Contributions user (T375061)]] (duration: 09m 03s)
Change #1073759 merged by jenkins-bot:
[mediawiki/extensions/CentralAuth@master] Allow IP ranges in CentralAuth::getInstanceByName()
Change #1073771 merged by jenkins-bot:
[mediawiki/extensions/CentralAuth@wmf/1.43.0-wmf.23] Allow IP ranges in CentralAuth::getInstanceByName()
Change #1073772 merged by jenkins-bot:
[mediawiki/extensions/CentralAuth@wmf/1.43.0-wmf.22] Allow IP ranges in CentralAuth::getInstanceByName()
Mentioned in SAL (#wikimedia-operations) [2024-09-18T12:05:18Z] <dreamyjazz@deploy1003> Started scap sync-world: Backport for [[gerrit:1073772|Allow IP ranges in CentralAuth::getInstanceByName() (T375061)]], [[gerrit:1073771|Allow IP ranges in CentralAuth::getInstanceByName() (T375061)]]
Mentioned in SAL (#wikimedia-operations) [2024-09-18T12:07:35Z] <dreamyjazz@deploy1003> dreamyjazz: Backport for [[gerrit:1073772|Allow IP ranges in CentralAuth::getInstanceByName() (T375061)]], [[gerrit:1073771|Allow IP ranges in CentralAuth::getInstanceByName() (T375061)]] synced to the testservers (https://wikitech.wikimedia.org/wiki/Mwdebug)
Mentioned in SAL (#wikimedia-operations) [2024-09-18T12:12:19Z] <dreamyjazz@deploy1003> Finished scap sync-world: Backport for [[gerrit:1073772|Allow IP ranges in CentralAuth::getInstanceByName() (T375061)]], [[gerrit:1073771|Allow IP ranges in CentralAuth::getInstanceByName() (T375061)]] (duration: 07m 00s)
Deployed the fixes and https://test.wikipedia.org/wiki/Special:Contributions/1.2.3.4/24 loads without erroring, so should be resolved.
Change #1073831 had a related patch set uploaded (by Kosta Harlan; author: Kosta Harlan):
[mediawiki/extensions/ContentTranslation@master] Hooks: Return early if user is not named
Change #1073831 merged by jenkins-bot:
[mediawiki/extensions/ContentTranslation@master] Hooks: Return early if user is not named