Jump to content

Help:Extension:CheckUser

From mediawiki.org
Translate this page
Languages:

This is a help page for usage of the CheckUser extension. For installation instructions, please see the CheckUser page.

Special:CheckUser usage

[edit]

Special:CheckUser is an interface used to look up CheckUser data about accounts and anonymous users. The tool can only be used by users with the checkuser right. The data shown in the tool has an expiry which is set by default to 90 days.

Search form

[edit]
Search form shown before running a check
  1. Open Special:CheckUser.
  2. Type in the username (without the User: prefix), IP address, or CIDR range into the Usernames and IP addresses: field.
    • This field accepts any IPv4 or IPv6 address
    • CIDR - you can check a range of IP addresses by appending the CIDR prefix. The CIDR prefix value by default is between 16-32 for IPv4 and 19-128 for IPv6. For notation, see Help:Range blocks .
    • XFF - you can check a client IP address provided by X-Forwarded-For headers by appending /xff (for example, 127.0.0.1/xff).
  3. Select the information you want to retrieve:
    • Get IP addresses - returns IP addresses used by a registered user.
    • Get actions - returns all edits and logged actions made by users using an IP address or range specified in the target field, or if the target is a user all edits and logged actions by that user.
    • Get users - returns user accounts that have edited from an IP or range.
  4. In the Reason: field, type in the reason you are running the check. A shorter reason is generally better but you should still include enough context for auditing of checks. This will be logged in a log visible only to users with the checkuser-log permission.

Information returned

[edit]

Get IP addresses

[edit]
Example check to get IP addresses used by a user

The Get IP addresses results returns the last IP addresses used by a given user account. An example check is shown on the right in the screenshot.

The format of the results is designed to the results list compact and easy to skim over. The information is laid out as follows:

  • IP address (user links for the IP address) (time period when they used the IP) [number of actions performed by this user on the IP] (The number actions performed by all users on the IP)
Tools defined in MediaWiki:Checkuser-cidr-tool-links

Get actions

[edit]
Example Get edits check

The Get actions results returns a list of actions performed by all users on the given IP address or range, or if the target is a user all edits and logged actions by that user. An example result is shown to the right in the screenshot.

Actions shown in these results includes any action sent to Special:RecentChanges , but also additionally includes log events only shown in Special:CheckUser such as logging in and logging out of an account.

Get users

[edit]
Example check to get users on an IP address

The Get users results returns the last IP addresses used by a given user account. An example result is shown to the right in the screenshot.

This is formatted to fit a lot of information into a format that can very easily be listed and skimmed, but is difficult to read unless you know what the information provided is. The information is laid out as follows:

username (user links) (time period when they edited from the given IP or range) [number of edits from the IP or range]

Each IP/XFF combination used to edit is listed, in order of use. After the IP addresses, the last ten user agents (browser, operating system, system language, and versions) and last ten used user agent client hints (since MW 1.41) are shown.

XFF Format

[edit]

XFF (X-Forwarded-For) headers indicate the series of IP addresses used from the user's computer (first) to the last proxy server. The XFF header is assumed untrustworthy as it can be set to a fake value by the user's computer. The XFF header is considered trusted if all IP addresses are trusted proxies, which causes the XFF to have a green background.

[edit]

When you get results from Special:CheckUser you can add personal user tool links via the following interface messages:

Special:Investigate usage

[edit]
See also: Special:MyLanguage/Help:Special Investigate


Special:Investigate is an alternative interface used to lookup CheckUser data for accounts and anonymous users. The tool uses a single-page design which helps avoid opening too many tabs when running checks. However, it lacks several features present in Special:CheckUser such as the display of Client Hints data. The tool can only be used by users with the investigate right. The data shown in the tool has an expiry which is set by default to 90 days.

Basic usage

[edit]
  1. Open Special:Investigate.
  2. In the Usernames and IP addresses: field, type in up to 10 targets, which may be usernames (without the User: prefix), IP addresses, or CIDR ranges.
  3. In the Reason field, enter the reason for the check. A shorter reason is generally better but you should still include enough context for auditing of checks. This will be logged in a log visible only to users with the checkuser-log permission.
  • Screenshots
  • Input form
    Input form
  • Account information tab
    Account information tab
  • IPs and user agents tab
    IPs and user agents tab
  • Timeline tab
    Timeline tab

For advanced feature usage, see Help:Special Investigate .

[edit]

Like with Special:CheckUser, it is possible to customise the links shown near IP addresses.

The links are defined in the checkuser-investigate-compare-toollinks message. This message is parsed to find links, which are added to the menu in the IPs & User agents tab.

Special:InvestigateBlock usage

[edit]

Special:InvestigateBlock is interface used mass block users and IP addresses after a CheckUser check. The tool allows you to block multiple targets with the same reason and also add content to their talk page / user page. The tool can only be used by users with the checkuser and block rights.

Basic usage

[edit]
  1. Open Special:InvestigateBlock.
  2. In the Usernames and IP addresses field, enter targets to block (which can be usernames, IP addresses, or CIDR ranges).
  3. Fill out the block details, including whether you want to add content to their user pages and/or user talk pages.
  4. Submit the blocks.

The tool will prevent the user from blocking usernames and IP addresses in the same use of the form to avoid accidentally publicly exposing CheckUser data. Pre-filled links from Special:Investigate and Special:CheckUser are configured so that there are two links where one contains the accounts and the other contains the IP addresses, so that the user will not see this warning when using the form.

Showing IPs for temporary accounts

[edit]
MediaWiki version:
≥ 1.40
Screenshot showing the Show IP button used to reveal the IP of a temporary account

Since MediaWiki 1.40, a button is displayed next to temporary account user links which allows the revealing of their IP address.

This functionality is can be used by users with the checkuser-temporary-account or checkuser-temporary-account-no-preference rights. Additionally the Enable revealing IP addresses for temporary accounts preference must be enabled for users with either user right to use the tool. Users that are sitewide blocked cannot use the functionality.

These buttons will appear next to temporary account usernames for actions that they have performed, such as on their edits in the history page or on Special:Contributions.

Administrators can see a list of IP addresses used by a temporary account by visiting Special:Block and entering the temporary account into the username field. This is to allow administrators to see whether an IP address block would be more appropriate for preventing abuse by the user.

These will not be shown on the following pages: Special:CheckUser, Special:Investigate, Special:InvestigateBlock, Special:ListUsers, Special:BlockList, Special:ActiveUsers

Special:IPContributions usage

[edit]
MediaWiki version:
≥ 1.43

This page is used to find all the edits performed by temporary accounts on a given IP address or CIDR range within the CheckUser data retention period (by default 90 days). This page is only available if temporary accounts are known on a wiki.

To use this page, you must have the ability to reveal the IP addresses of temporary accounts (as described in the Showing IPs for temporary accounts section).

Basic usage

[edit]
  1. Open Special:IPContributions.
  2. In the IP address or range: field, input an IP (IPv4 or IPv6) or CIDR range.
  3. Adjust parameters as necessary and submit a search. This action will be logged to the checkuser-temporary-account log which will be visible to users with the checkuser-temporary-account-log right.
  • Screenshots
  • Input form
    Input form
  • Example results
    Example results

Special:GlobalContributions usage

[edit]
MediaWiki version:
≥ 1.43

This special page is only available if the Extension:GlobalPreferences and Extension:CentralAuth extensions are installed. The tool allows users to see edits performed by a given target across all wikis performed within the CheckUser data retention period (by default 90 days).

The tool can search for the following types of targets:

  • A username (named or temporary). This shows the recent revisions across all wikis from that user.
  • An IP address or CIDR range. This shows recent revisions performed by temporary accounts on that IP address or range. The user can only see results on wikis where they have the ability to reveal the IP addresses of temporary accounts (as described in the Showing IPs for temporary accounts section).

The page does not show contributions from anonymous users whose name is their IP address. This is due to technical limitations with current the database table structure.

Basic usage

[edit]
  1. Open Special:GlobalContributions.
  2. In the Username, IP address or range: field, input a user name, an IP (IPv4 or IPv6) or CIDR range.
  3. Adjust parameters as necessary and submit a search. If searching with a target as an IP address or CIDR range, this action will be logged to the checkuser-temporary-account log which will be visible to users with the checkuser-temporary-account-log right.
  4. Alongside local results, results will be returned from other wikis. If searching using an IP address as an IP address or CIDR range, then the results will be limited to the wikis where you have the ability to reveal temporary account IP addresses (as described in the Showing IPs for temporary accounts section).
  • Screenshots
  • Input form
    Input form
  • Example results
    Example results

Special:CheckUserLog usage

[edit]
Example CheckUserLog page

The Special:CheckUserLog page gives a list of all checks performed in Special:CheckUser, Special:Investigate, and the CheckUser query API. The interface is similar to Special:Log but has some additional features. The page can only be accessed by users with the checkuser-log right, which by default is given to users in the checkuser group. The page is intended to allow users to audit checks performed by others, to ensure that abuse is not being performed.

In addition to the Special:Log features:

  • The page allows filtering for logs which have a given reason (this does not perform a wildcard search, so the reason needs to be exactly the same except for any wikitext included in the reason).
  • When filters are applied, the timestamp of the check is a link to an unfiltered list where with an offset to include all checks performed around the same time. This can be used to find checks which were performed as a result of other checks, to assist with auditing checks.

APIs

[edit]

CheckUser provides APIs that allow access to the information shown on Special:CheckUser and Special:CheckUserLog. These APIs work similarly to the special pages but return their data in a structured format. The reason for a check using the checkuser API is prefixed with "API:" to assist with auditing checks. More documentation on these APIs is provided below.


list=checkuser (cu)

(main | query | checkuser)
  • This module requires read rights.
  • This module requires write rights.
  • This module only accepts POST requests.
  • Source: CheckUser
  • License: GPL-2.0-or-later

Check which IP addresses are used by a given username or which usernames are used by a given IP address.

Specific parameters:
Other general parameters are available.
curequest

Type of CheckUser request:

userips
Get IP address of target user.
edits
Deprecated. Get actions performed by target IP address or range.
actions
Get actions performed by target IP address or range.
ipusers
Get users from target IP address or range.
This parameter is required.
One of the following values: actions, ipusers, userips, edits
cutarget

Username, IP address, or CIDR range to check.

This parameter is required.
Type: user, by any of username, IP, Temporary user and IP range
cureason

Reason to check.

This parameter is required.
Default: (empty)
culimit

Limit of rows.

Type: integer or max
The value must be between 1 and 500.
Default: 500
cutimecond

Time limit of user data (like "-2 weeks" or "2 weeks ago").

Default: -2 weeks
cuxff

Use XFF data instead of IP address.

cutoken

A "csrf" token retrieved from action=query&meta=tokens

This parameter is required.
Examples:
Get IP addresses for User:Example
api.php?action=query&list=checkuser&curequest=userips&cutarget=Jimbo_Wales [open in sandbox]
Get actions performed by 192.0.2.0/24
api.php?action=query&list=checkuser&curequest=actions&cutarget=127.0.0.1/16&xff=1&cureason=Some_check [open in sandbox]



list=checkuserlog (cul)

(main | query | checkuserlog)

Get entries from the CheckUser log.

Specific parameters:
Other general parameters are available.
culuser

Username of the CheckUser.

cultarget

Checked user, IP address, or CIDR range.

culreason

Reason given for the check.

cullimit

Limit of rows.

Type: integer or max
The value must be between 1 and 500.
Default: 10
culdir

In which direction to enumerate:

newer
List oldest first. Note: culfrom has to be before culto.
older
List newest first (default). Note: culfrom has to be later than culto.
One of the following values: newer, older
Default: older
culfrom

The timestamp to start enumerating from.

Type: timestamp (allowed formats)
culto

The timestamp to end enumerating.

Type: timestamp (allowed formats)
culcontinue

When more results are available, use this to continue. More detailed information on how to continue queries can be found on mediawiki.org.

Examples:
Show checks of User:Example
api.php?action=query&list=checkuserlog&culuser=Example&cullimit=25 [open in sandbox]
Show checks of 192.0.2.0/24 after 2011-10-15T23:00:00Z
api.php?action=query&list=checkuserlog&cultarget=192.0.2.0/24&culfrom=2011-10-15T23:00:00Z [open in sandbox]


Retrieved from "https://www.mediawiki.org/w/index.php?title=Help:Extension:CheckUser&oldid=7013758"