Closed Bug 463120 (WH-1628147) Opened 17 years ago Closed 17 years ago

tiki-pagehistory.php displays IP addresses of editors to any logged-in user

Categories

(support.mozilla.org :: Knowledge Base Software, task)

Product:
support.mozilla.org
Component:
Knowledge Base Software
Type:
task
Priority:
Not set
Severity:
major

Tracking

(Not tracked)

Status:
VERIFIED FIXED

People

(Reporter: reed, Assigned: ecooper)

References

(
URL
)

Details

(Whiteboard: tiki_fixed)

https://support.mozilla.com/tiki-pagehistory.php?page=Clearing+Location+bar+history The IP addresses of the editors should not be displayed to anybody except admins. Thankfully, the IP shown is just what the NetScaler is using for proxying rather than people's real IP. However, that shouldn't make this any less real.
We need to get the fix for it upstream to Tiki: marking private for their benefit.
Assignee: nobody → laura
Group: websites-security
Target Milestone: --- → 0.7.3
Group: websites-security
Group: websites-security
Target Milestone: 0.7.3 → 0.9
Target Milestone: 0.9 → 0.8.2
Nelson mentioned there is a way to turn this off administratively. Nelson?
In tiki, you have the option of turning off the IP address column. Admin (general) -> Wiki and it's under the "Wiki History" section.
Just as a follow-up note, the setting wasn't saving properly in my local dev instance. To change it, I was required to edit /lib/setup/prefs.php and change it manually. This might just be a local quark. Once it is changed, the IP column is no longer displayed in tiki-pagehistory. IP addresses are still stored in the table `tiki_history`.
Target Milestone: 0.8.2 → 0.9
Assignee: laura → smirkingsisyphus
The logic used by template for the admin page made it impossible to set this correctly. A two line fix was introduced to allow the hiding of user's IP addresses in wiki history. Fix is in r22179/r22180 After the push for 0.9, we'll need to change the setting on prod.
Status: NEW → RESOLVED
Closed: 17 years ago
Resolution: --- → FIXED
Verified FIXED on: https://support-stage.mozilla.org/tiki-admin.php?locale=en-US&page=wiki I unchecked "Display user IP in history:" under "Wiki History" and clicked "Change preferences". That page reloaded and I saw, "feature_wiki_history_ip disabled" at the top. I then went to https://support-stage.mozilla.org/tiki-pagehistory.php?locale=en-US&page=Clearing+private+data while logged in and saw no IP addresses.
Status: RESOLVED → VERIFIED
Whiteboard: tiki_bug
Whiteboard: tiki_bug → tiki_fixed
These bugs are all resolved, so I'm removing the security flag from them.
Group: websites-security
You need to log in before you can comment on or make changes to this bug.