Someone ask me to rename his/her username to "127.0.0.1", is there any potential dangers?
Topic on Project:Support desk
Help!!!
MediaWiki internally stores the information whether a user, who was logged in, did an action, or if the user had not been logged in. With this criterion it should still be possible to differentiate whether an edit was done by that according user account or by an IP user.
Anyway, IP addresses are not considered acceptable user names for MediaWiki. It will be possible to confuse a username, which is an IP address, with a user with the actual IP address. For example the links pointing to the contribution pages of a user/IP address will look the same for both the IP address and the user account, which has the name of that IP address.
A username of 127.0.0.1 also is misleading as it points to the actual server, not a user, doing an action.
en:Wikipedia:Naming_conventions_(technical_restrictions)#Restrictions_on_usernames makes me think that it is technically impossible to give user accounts such names. Even if it was technically possible, I would not give users user names, which also are IP addresses (among them 127.0.0.1).
I finally have this conclusion:
It should technically be impossible to rename user accounts to IP address names. We already see that e.g. the contribution page cannot differentiate properly between both, if an account had an IP address name. Since the developers have spent time in making it impossible to rename accounts that way, I think it is currently not possible to say whether there additionally to other issues, whether there will also be security problems arising from such a renaming. Until now the "solution" for that was to forbid the according renaming, not to solve the security issue. So if not even the often-used contribs page cannot handle IP user names properly, then we definitely cannot say that it would by secure to use those. We just don't know.
So you can do the following: See, if you can rename the user accordingly and if that is possible report it as a bug with unknown security implication to the bugtracker!
The first question is: How do you want to rename the name of the user? MediaWiki doesn't support this functions out of the box, so if it's possible or not is a question of the way you want to do it. Technically it shouldn't be possible to rename a user to an IP-adress.
After testing on a localhost, with MediaWiki 1.21, it shows an error message.