Page MenuHomePhabricator

Add option to block the user from editing their talk page when blocked by AbuseFilter
Closed, ResolvedPublic3 Estimated Story Points

Description

Otherwise, like T169165, the user can continue editing in their talk page, and use trial and error to find a way to evade the AbuseFilter.

Event Timeline

Huji triaged this task as High priority.Jul 7 2017, 8:33 PM

Marking as high priority due to potential for abuse (potential is a weak word, it is actually being abused as we speak).

Okay this is getting out of hand. We have a troll actively abusing the lack of this feature. I am going to work on a patch shortly.

Between 05:55, 21 August 2017 and 05:56, 21 August 2017 Ip has done these try and errors:

05:56, 21 August 2017: 5.45.100.46 (talk | block) triggered filter 160, performing the action "edit" on User talk:5.45.100.46. Actions taken: Tag; Filter description: User is blocked (details | examine)
05:56, 21 August 2017: 5.45.100.46 (talk | block) triggered filter 160, performing the action "edit" on User talk:5.45.100.46. Actions taken: Tag; Filter description: User is blocked (details | examine)
05:56, 21 August 2017: 5.45.100.46 (talk | block) triggered filter 160, performing the action "edit" on User talk:5.45.100.46. Actions taken: Tag; Filter description: User is blocked (details | examine)
05:56, 21 August 2017: 5.45.100.46 (talk | block) triggered filter 160, performing the action "edit" on User talk:5.45.100.46. Actions taken: Tag; Filter description: User is blocked (details | examine)
05:56, 21 August 2017: 5.45.100.46 (talk | block) triggered filter 160, performing the action "edit" on User talk:5.45.100.46. Actions taken: Tag; Filter description: User is blocked (details | examine)
05:55, 21 August 2017: 5.45.100.46 (talk | block) triggered filter 160, performing the action "edit" on User talk:5.45.100.46. Actions taken: Tag; Filter description: User is blocked (details | examine)
05:55, 21 August 2017: 5.45.100.46 (talk | block) triggered filter 160, performing the action "edit" on User talk:5.45.100.46. Actions taken: Tag; Filter description: User is blocked (details | examine)
05:55, 21 August 2017: 5.45.100.46 (talk | block) triggered filter 160, performing the action "edit" on User talk:5.45.100.46. Actions taken: Tag; Filter description: User is blocked (details | examine)

Change 372844 had a related patch set uploaded (by Huji; owner: Huji):
[mediawiki/extensions/AbuseFilter@master] Add option to block user/IP from editing their talk page

https://gerrit.wikimedia.org/r/372844

This might be a short term solution, but I prefer this to be build with its parent T32024 in mind.

Fully aware, and completely agree. But the amount of vandalism and AbuseFilter evasion occurring in this one project justifies it (at least for me) to ask for an interim solution to be implemented quickly.

Wouldn't it be possible to disallow the edits to his own talk page by another abuse filter as an interim solution?

We are not talking about one user, but about a very active sock-master. Without specifying the user, an AbuseFilter cannot specifically block certain blocked users from editing their pages.

Change 372844 abandoned by Huji:
Add option to block user/IP from editing their talk page

Reason:
I have a much better idea. Will submit a new patch.

https://gerrit.wikimedia.org/r/372844

Change 373119 had a related patch set uploaded (by Huji; owner: Huji):
[mediawiki/extensions/AbuseFilter@master] Add option to block a user from editing their own talk page

https://gerrit.wikimedia.org/r/373119

Are users who are blocked already prevented from editing their own user page, the sandbox, and any other talk page? It seems odd that after being blocked by AbuseFilter the only page they can edit is their own talk page.

It seems odd that after being blocked by AbuseFilter the only page they can edit is their own talk page.

Why? A normal block (done by hand using default options) also have the same effect.

It seems odd that after being blocked by AbuseFilter the only page they can edit is their own talk page.

Why? A normal block (done by hand using default options) also have the same effect.

Interesting, well I didn't know that. :)

@dbarratt — This functionality exists to let users discuss/debate their block on their own talk page. However, not all blocked users will use this ability productively (spammers, blatant trolls, etc.) so admins have the option to disable it.

@dbarratt — This functionality exists to let users discuss/debate their block on their own talk page. However, not all blocked users will use this ability productively (spammers, blatant trolls, etc.) so admins have the option to disable it.

Ah that makes a lot of sense. Well the patch looks good to me, I tested it locally and it all works as expected. I gave it a +1, I'll let someone else review it as well.

I already have a patch for it, and you have reviewed it :) Will submit a new PS soon.

I already have a patch for it, and you have reviewed it :) Will submit a new PS soon.

Do you mind if I update the patch for you?

@Huji — If you want to own the task then we'll remove it from our sprint board. We're happy to help Code Review though!

I don't mind relinquishing the ownership to anyone else if that makes the issue get fixed faster!

I also don't mind if someone updates my patch; if anything it helps me learn more.

@dbarratt there is an obvious change that needs to be done to the code, I just have not had the time to set down and focus on it. Feel free to address that. I would be nothing but happy.

@dbarratt the necessary change is now taken care of.

@dmaza Can you review the patch when you have a moment?

As I have explained in gerrit imho the patch have to check $wgBlockAllowsUTEdit. If it's set to false you don't have to show the checkbox as in Special:Block

As I have explained in gerrit imho the patch have to check $wgBlockAllowsUTEdit. If it's set to false you don't have to show the checkbox as in Special:Block

Done.

Change 373119 merged by jenkins-bot:
[mediawiki/extensions/AbuseFilter@master] Add option to block a user from editing their own talk page

https://gerrit.wikimedia.org/r/373119

Huji removed a project: Patch-For-Review.