Page MenuHomePhabricator

Add variables in Abusefilter to detect/block thanks
Open, Stalled, LowPublicFeature

Description

Hi. To fight harassment, is it possible to add variables to Special:Abusefilter regarding "thanks"? One could be "thanks sender username", another "thanks recipient username". The goal would be to avoid abuses of thanks functionality by some banned users.

Example: in a fr-wiki case, it would prevent users with a name ending by -ah from thanking a sysop in order to harass him. (The sysop had to disable the thanks functionality.)

Regards.

Event Timeline

Restricted Application added subscribers: MGChecker, Aklapper. · View Herald Transcript

Somewhat related to T177780. I've just found an incomplete comment on that task where I was saying that filtering thank actions in AF would be technically difficult, but didn't say why :(

Please implement this. One WMF banned editor has a habit of abusing thanks using his socks and I am tired of being harassed by him.

Xaosflux changed the subtype of this task from "Task" to "Feature Request".Dec 26 2019, 7:22 PM

Thanks creates an echo notification using EchoEvent::create, which runs the BeforeEchoEventInsert hook before inserting the EchoEvent. AbuseFilter should process this hook:

  • If type = edit-thank
  • Extract User sending the thanks from agent
  • Extract target user id from extra['thanked-user-id']
  • Since thanks is generally private (in terms of what edit/log entry the thanks is for), don't process the title or other event properties

Change 560807 had a related patch set uploaded (by DannyS712; owner: DannyS712):
[integration/config@master] Add Echo extension as a dependency for AbuseFilter

https://gerrit.wikimedia.org/r/560807

In progress (it'll take a while), but noticed that, even if the thanks are prevented, it'll still act like they went through (just that the recipient doesn't get the eventual notification). Filed T241474

This requires designing how to present warnings / disallow messages, or setting it to not show a message, not allow warnings, and fail silently on disallow

This requires designing how to present warnings / disallow messages, or setting it to not show a message, not allow warnings, and fail silently on disallow

This may be one of the reasons which led me to write T235873#5586905.

This requires designing how to present warnings / disallow messages, or setting it to not show a message, not allow warnings, and fail silently on disallow

This may be one of the reasons which led me to write T235873#5586905.

Filed as T241550

DannyS712 changed the task status from Open to Stalled.Dec 31 2019, 11:24 PM

Stalling on subtasks - until there is a way to show a message, and until the thanks api recognizes that it shouldn't assume the thanks we successfully delivered, progress can't really be made

Change 560807 merged by jenkins-bot:
[integration/config@master] Add Echo and Thanks extensions as dependencies for AbuseFilter

https://gerrit.wikimedia.org/r/560807

I want to listen to the thanks of some specific users. I want to tag these thanks. Can I do this?

@IN: Please ask general support questions in support channels instead of unrelated ancient Phab tasks. Thanks.

I'm sorry that I haven't handled this task. I recently returned from a long bout of unexpected inactivity, and while I plan to resume my contributions here on Phabricator its unfair to claim tasks that I might not work on when others may be interested in handling them. I'm removing myself as the assignee in a batch-action, but if someone feels that I really should be the one to handle this task feel free to re-assign me and I'll take a look.

This has recently again become an attack vector for abuse, so I'm reviving this task.

Thanks creates an echo notification using EchoEvent::create, which runs the BeforeEchoEventInsert hook before inserting the EchoEvent. AbuseFilter should process this hook:

Why involve Echo when we deal with thanks? And is it really necessary to add a handler to abuse filter? What about going the same way as Flow (StructuredDiscussions) and including the code for running abuse filters in Thanks? Is T241550 really a concern when thanks are already throttled (ping limiter)?