Totally exclude 'abusefilterprivatedetails' from 'logging' in public replicas
Closed, InvalidPublic
Actions

Assigned To

None

Authored By

	MarcoAurelio
	Feb 15 2018, 3:29 PM

Description

The log (Special:Log/abusefilterprivatedetails) will contain data analogous to the Special:CheckUserLog or Special:Log/suppress. Looking at maintain-views.yaml it's not clear to me if it is totally excluded or not. If it has been not, please do so. Thanks.

Details

	Subject	Repo	Branch	Lines +/-
	maintain-views: Explicitly exclude 'abusefilterprivatedetails'	operations/puppet	production	+4 -3

Customize query in gerrit

Related Objects
Search...

		Status	Subtype	Assigned	Task
		Resolved		Jalexander	T160357 Allow those with CheckUser right to access AbuseLog private information on WMF projects
		Invalid		None	T187455 Totally exclude 'abusefilterprivatedetails' from 'logging' in public replicas

Event Timeline

MarcoAurelio created this task.Feb 15 2018, 3:29 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptFeb 15 2018, 3:29 PM

MarcoAurelio mentioned this in T160357: Allow those with CheckUser right to access AbuseLog private information on WMF projects.Feb 15 2018, 3:29 PM

Based on AbuseFilter's extension.json, abusefilterprivatedetails is a distinct log type. The views related to the logging table in the Wiki Replicas are built using an explicit list of allowed log types. This list does not contain abusefilterprivatedetails therefore any rows marked as abusefilterprivatedetails will not be queryable from the Wiki Replicas.

Change 410992 had a related patch set uploaded (by MarcoAurelio; owner: MarcoAurelio):
[operations/puppet@production] maintain-views: Explicitly exclude 'abusefilterprivatedetails'

https://gerrit.wikimedia.org/r/410992

gerritbot added a project: Patch-For-Review.Feb 15 2018, 4:04 PM

Sorry to edit-conflict. Added a patch to mark the table explicitly excluded in the script as it's done with other sensitive logs.

Also, this won't be avalaible via data dumps, etc? Sorry to be paranoid, but better to be safe.

Change 410992 merged by Andrew Bogott:
[operations/puppet@production] maintain-views: Explicitly exclude 'abusefilterprivatedetails'

https://gerrit.wikimedia.org/r/410992

In T187455#3975903, @MarcoAurelio wrote:

Also, this won't be avalaible via data dumps, etc? Sorry to be paranoid, but better to be safe.

See prior task:

In T160357#3959716, @ArielGlenn wrote:

We grab entries from the logging table by requesting them as an anonymous user and asking MediaWiki to export them. Anything we aren't permitted to see, won't show up.