Page MenuHomePhabricator

The testing interface can only be used with abusefilter-modify right
Closed, ResolvedPublic

Description

As the title says, the testing interface (/tools and /test) can only be accessed by people with abusefilter-modify right. The question is: why? This should also be available with abusefilter-view-private right, if not with abusefilter-view: that page is like a sandbox, whatever the user will do it won't bring any change to existing filters.

Event Timeline

Daimona created this task.May 4 2018, 6:59 PM
Restricted Application added subscribers: Scoopfinder, Aklapper. · View Herald TranscriptMay 4 2018, 6:59 PM
Huji added a subscriber: Huji.May 4 2018, 7:18 PM

Could it be out of the fear that someone might use it to test what would pass or fail a particular filter, for abuse purposes?

May be better to extend to abusefilter-private instead of abusefilter-view, would like a clearer explanation of what may be able to be accessed from here that needed it to be restricted in the first place.

@Huji This is true, but what would they test? Without seeing the rule which is blocking them (thing that should happen), there's not much they could do. As for what a filter can do, I think docs on mediawiki provide lots of info. Anyway, for the moment I'm writing this to restrict to users with view-private right.

👍 to abusefitler-view-private. Seems uncontroversial and it will be helpful

Daimona claimed this task.May 4 2018, 7:38 PM

Doing, I hope to get it ready soon.

Change 430964 had a related patch set uploaded (by Daimona Eaytoy; owner: Daimona Eaytoy):
[mediawiki/extensions/AbuseFilter@master] [WIP] Allow users with abusefilter-view-private to use testing interface

https://gerrit.wikimedia.org/r/430964

Huji added a comment.May 4 2018, 9:14 PM

@Huji This is true, but what would they test? Without seeing the rule which is blocking them (thing that should happen), there's not much they could do.

I said that could have been the fear. I didn't say that fear is a reasonable fear :) Anyways, I agree with adding abusefilter-view-private to the list of folks who can do that.

In looking how it is out there on various projects, targeting this as an "(abusefilter-view-private) or (abusefilter-modify)" gate should be done, as the ..view-private is not always explicitly assigned.

@Xaosflux that is how I implemented it: abusefilter-modify OR abusefilter-view-private. Probably the best we can do if we don't want to make controversial changes. I need to make sure my patch works (although, as usual, I already tested it while coding) and it should be ready tomorrow morning.

Change 430964 merged by jenkins-bot:
[mediawiki/extensions/AbuseFilter@master] Allow users with abusefilter-view-private to use testing interface

https://gerrit.wikimedia.org/r/430964

Daimona closed this task as Resolved.Jun 24 2018, 5:44 PM
Daimona removed a project: Patch-For-Review.
Vvjjkkii renamed this task from The testing interface can only be used with abusefilter-modify right to 4kdaaaaaaa.Jul 1 2018, 1:12 AM
Vvjjkkii reopened this task as Open.
Vvjjkkii triaged this task as High priority.
Vvjjkkii removed Daimona as the assignee of this task.
Vvjjkkii updated the task description. (Show Details)
Vvjjkkii removed subscribers: gerritbot, Huji, Aklapper.
Daimona renamed this task from 4kdaaaaaaa to The testing interface can only be used with abusefilter-modify right.Jul 1 2018, 9:35 AM
Daimona closed this task as Resolved.
Daimona raised the priority of this task from High to Needs Triage.
Daimona claimed this task.
Daimona updated the task description. (Show Details)