Page MenuHomePhabricator

Don't log mere reads in titleblacklistlog
Open, Needs TriagePublic

Description

Discussion in T155967 indicates that in its current state, the titleblacklistlog records whenever someone clicks on a redlink that is subject to the titleblacklist e.g when someone hits https://en.wikipedia.org/w/index.php?title=Draft:Meepsheep&action=edit.

There has been discussion in the above task that logging this kind of not-action isn't useful as we are mainly concerned with actions that result in actual saves (attempts) such as e.g trying to move a page to a vandal title. Plus it is potentially privacy sensitive to record mere clicks like that that don't attempt to save anything. Thus I am spinning this off to its own task.

(Perhaps it could be some kind of configuration setting)

Event Timeline

Doesn't the titleblacklistlog already only include account creations (which are POST requests)? At least when I originally implemented it, I'm pretty sure that's the only hook that I added logging to. I don't know if it's been changed since then.

@PiRSquared17: T155967#2963144 implies that the titleblacklist triggers even from mere reads. A titleblacklistlog that only logs account creation isn't really useful or justified, anyhow.

@PiRSquared17: T155967#2963144 implies that the titleblacklist triggers even from mere reads.

That says the titleblacklist is hit by mere reads, not that those hits are logged. See T23206 for the discussion where we decided to only log account creation attempts. I also checked the codebase, and it looks like it still only logs account creation attempts: https://github.com/wikimedia/mediawiki-extensions-TitleBlacklist/search?q=wgTitleBlacklistLogHits

A titleblacklistlog that only logs account creation isn't really useful or justified, anyhow.

I disagree. There are a lot of LTAs that will try to create accounts with abusive usernames. Plus it's useful to see if any username filters have too many false positives.