Weblate leaks the IP of project members inviting users to assume reviewer roles in Audit log

@@ -12,6 +12,7 @@ Weblate 5.14.1
 
 .. rubric:: Bug fixes
 
+* Omit admin IP address from audit log.
 * Counting outgoing commits in the repository status.
 * Listing of other translations.
 * SAML configuration in the Docker container.

@@ -0,0 +1,35 @@
+# Copyright © Michal Čihař <michal@weblate.org>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+# Generated by Django 5.2.6 on 2025-11-01 09:36
+
+from django.db import migrations
+
+
+def update_audit_log(apps, schema_editor) -> None:
+    """Remove detailed audit log info for admin actions."""
+    AuditLog = apps.get_model("accounts", "AuditLog")
+    AuditLog.objects.filter(
+        activity__in={
+            "invited",
+            "admin-locked",
+            "autocreated",
+            "blocked",
+            "enabled",
+            "disabled",
+            "disabled-expiry",
+        }
+    ).update(address=None, user_agent="")
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("accounts", "0020_alter_auditlog_activity"),
+    ]
+
+    operations = [
+        migrations.RunPython(
+            update_audit_log, migrations.RunPython.noop, elidable=True
+        ),
+    ]

@@ -400,10 +400,19 @@ def is_new_login(self, user: User, address, user_agent) -> bool:
         return not logins.filter(Q(address=address) | Q(user_agent=user_agent)).exists()
 
     def create(  # type: ignore[override]
-        self, user: User, request: HttpRequest | None, activity, **params
+        self, user: User, request: HttpRequest | None, activity: str, **params
     ):
-        address = get_ip_address(request)
-        user_agent = get_user_agent(request)
+        address: str | None = None
+        user_agent: str = ""
+        # Log only address for own actions (unauthenticated or when the request user matches audit user)
+        if request and (
+            not hasattr(request, "user")
+            or not request.user
+            or not request.user.is_authenticated
+            or request.user == user
+        ):
+            address = get_ip_address(request)
+            user_agent = get_user_agent(request)
         if activity == "login" and self.is_new_login(user, address, user_agent):
             activity = "login-new"
         return super().create(

@@ -113,6 +113,8 @@ def add_user(self) -> None:
         # Ensure user is now listed
         response = self.client.get(self.access_url)
         self.assertContains(response, self.second_user.username)
+        invitation_audit = self.second_user.auditlog_set.get(activity="invited")
+        self.assertIsNone(invitation_audit.address)
 
     def test_invite_invalid(self) -> None:
         """Test inviting invalid form."""