Similar to T120562: on Meta-Wiki anonymous users can see hit counts of those filters that are public. Hidden ones always have a blank field there. Sorting the table by hit count however reveals between what numbers it could be.
Description
Description
Details
Details
| Project | Branch | Lines +/- | Subject | |
|---|---|---|---|---|
| mediawiki/extensions/AbuseFilter | master | +2 -1 | Add a requirement for view-private to allow sorting hit counts |
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Open | None | T194593 Rework AbuseFilterPager to allow more flexible sorting | |||
| Open | None | T120563 Sorting by hit counts may partly reveal the numbers |
Event Timeline
Comment Actions
The hit count is available with a way weaker right (abusefilter-log-detail) for public filters. Hiding the hit count for private filters may actually be useful. Anyway, since we need to stick to TablePager's methods, it should be enough to require abusefilter-log-detail AND abusefilter-view-private to sort the table by hit count. Hopefully in the future we may be able to provide a more selective sorting (for instance leaving private ones at the end), also capable of things like T52839 and sorting non-DB data like (when they will be added there) average execution time and conditions. However, either we abandon tablepager, strongly overwrite its methods or make the change directly in TablePager.
Comment Actions
Change 431093 had a related patch set uploaded (by Daimona Eaytoy; owner: Daimona Eaytoy):
[mediawiki/extensions/AbuseFilter@master] Add a requirement for view-private to allow sorting hit counts
Comment Actions
I don't think this is a good idea; those who cannot see private filters should still be able to sort the table by hit count.
Can you please explain why hiding the hit count for private filters may be useful?
Comment Actions
We can't provide such selective sorting without a major change as explained above. I didn't have a specific situation where it'd be useful, I only thought we may give vandals (especially LTA) some info on how much a private filter is being triggered, although at the moment I can't think of a specific way to use this data. In any case, the right place to decide whether we want to make the hit count public is T21005.
Comment Actions
If we don't have a reason to think the current state is actually harmful, why are we trying to change it? I'd rather wait for T21005 to be decided on.
Comment Actions
Change 431093 abandoned by Daimona Eaytoy:
Add a requirement for view-private to allow sorting hit counts
Reason:
Needs a better strategy