Allow privileged users to see deleted edits on Special:AbuseLog
Closed, DuplicatePublic
Actions

Assigned To

Authored By

	Daimona
	Sep 19 2019, 3:58 PM

Description

Access was removed due to T224203, as a safety measure. Copying my relevant comment from there:

In T224203#5209939, @Daimona wrote:

Instead of relying on SpecialAbuseLog::isHidden, we add another function which will return more useful data about what is exactly hidden for a given revision. This way, we can redact only the suppressed data, and if the revision text is not suppressed, we could even show the details of the entry (hiding deleted data). [Note: beware of the edit summary which is shown as a variable]. This change is probably the saner, but it would require several changes throughout the whole AF codebase to handle deleted revision more precisely.

Details

	Subject	Repo	Branch	Lines +/-
	Show AbuseLog entries referring to a deleted revision to privileged users	mediawiki/extensions/AbuseFilter	master	+6 -3
	Replace SpecialAbuseLog::isHidden with a more verbose method	mediawiki/extensions/AbuseFilter	master	+22 -21

Customize query in gerrit

Related Objects
Search...

		Status	Subtype	Assigned	Task
		Resolved		Daimona	T273970 Adjust visibility of AbuseLog entries and related items
		Duplicate		Daimona	T233324 Allow privileged users to see deleted edits on Special:AbuseLog

Event Timeline

Daimona created this task.Sep 19 2019, 3:58 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptSep 19 2019, 3:58 PM

sbassett triaged this task as Medium priority.Sep 19 2019, 4:06 PM

No guarantees, but I'm trying to see what we can do.

I'm also throwing in a random idea: given the past leaks, it'd be cool to have a test to automatically check visibility. It would create a simple filter, make various edits, then try various combinations of deleted/suppressed revision/AbuseLog entry, and try to view it with various levels of permissions (no privileges, abusefilter-view-private only, sysop, oversighter, etc.). That's painful to do manually. I don't know if selenium would be good for that.

Change 538077 had a related patch set uploaded (by Daimona Eaytoy; owner: Daimona Eaytoy):
[mediawiki/extensions/AbuseFilter@master] Replace SpecialAbuseLog::isHidden with a more verbose method

https://gerrit.wikimedia.org/r/538077

gerritbot added a project: Patch-For-Review.Sep 19 2019, 5:37 PM

Change 538079 had a related patch set uploaded (by Daimona Eaytoy; owner: Daimona Eaytoy):
[mediawiki/extensions/AbuseFilter@master] Show AbuseLog entries referring to a deleted revision to privileged users

https://gerrit.wikimedia.org/r/538079

DannyS712 subscribed.Oct 6 2019, 4:14 AM

Daimona added a project: User-Daimona.Aug 28 2020, 10:24 PM

Daimona moved this task from Backlog to Ideas for overhaul on the User-Daimona board.

Daimona mentioned this in T261532: AbuseLog excludes revisions with any type of rev-del from non-oversighters.Aug 28 2020, 10:27 PM

Daimona mentioned this in T262035: Results on /test not shown for deleted edits, but it's shown when examining them.Sep 4 2020, 10:41 AM