Requesting the deployment of the StopForumSpam extension to the Beta Cluster.
The extension has passed security review at T155725 with some issues that need to be fixed first if we were to use it on production, but according to @Bawolff they should not prevent beta cluster deployment provided that IP data is not sent to StopForumSpam.
This is a good oportunity to test its effectiveness in countering the massive spamming the beta cluster projects do suffer.
| Subject | Repo | Branch | Lines +/- | |
|---|---|---|---|---|
| Enable StopForumSpam on beta | operations/mediawiki-config | master | +11 -0 | |
| Start branching StopForumSpam | mediawiki/tools/release | master | +1 -0 |
| rESFS extension-StopForumSpam | |||
| rESFS33e31c3de080 Use HTTPS rather than HTTP | |||
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Open | None | T273220 Deploy StopForumSpam extension to production | |||
| Resolved | sbassett | T181217 Deploy StopForumSpam to the Beta Cluster | |||
| Resolved | Legoktm | T155725 Security review for StopForumSpam | |||
| Resolved | sbassett | T227454 Allow $wgSFSIPListLocation to be a url and have proxy support |
$fh = fopen( $wgSFSIPListLocation, 'rb' );
is a little scary.. Should really be looking if it's file or URL.. And if it's a URL, using the MW wrappers so it can respect $wgHTTPProxy
@Bawolff did a security review of the extension at T155725#3074438. Unfortunately I have no idea how to fix those issues.
On the other hand the extension has changed since then so it might be good that a new security review is done.
Change 521233 had a related patch set uploaded (by Reedy; owner: Reedy):
[operations/mediawiki-config@master] Enable StopForumSpam on beta
Change 650167 had a related patch set uploaded (by Reedy; owner: Reedy):
[mediawiki/tools/release@master] Start branching StopForumSpam
Change 650167 merged by jenkins-bot:
[mediawiki/tools/release@master] Start branching StopForumSpam
Change 521233 merged by jenkins-bot:
[operations/mediawiki-config@master] Enable StopForumSpam on beta
Mentioned in SAL (#wikimedia-operations) [2021-01-11T17:57:52Z] <reedy@deploy1001> Synchronized wmf-config/extension-list: T181217 (duration: 00m 56s)
Mentioned in SAL (#wikimedia-operations) [2021-01-11T18:00:03Z] <reedy@deploy1001> Synchronized wmf-config/InitialiseSettings-labs.php: T181217 (duration: 00m 57s)
Mentioned in SAL (#wikimedia-operations) [2021-01-11T18:01:10Z] <reedy@deploy1001> Synchronized wmf-config/CommonSettings-labs.php: T181217 (duration: 00m 56s)
I'm going to resolve this for now. The extension is on beta, but disabled for now, pending a few fixes from T271756 being completed and merged.