Filter 6 is marked private, but it's still visible.
This is a problem because one of the most common reasons for an admin to be blocked (at least on enwiki) is that the account is compromised. It often takes time to find a steward to lock the account, and we don't want people exploring the private filters during the gap.
| Subject | Repo | Branch | Lines +/- | |
|---|---|---|---|---|
| AbuseFilterPermissionManager: Add sitewide block check | mediawiki/extensions/AbuseFilter | master | +7 -3 |
Seems reasonable. Code-wise, we need to change AbuseFilterPermissionManager::canViewPrivateFilters() to check user blocks, like ::canEdit() does (and the check in canEdit() should stay).
@sbassett Can this be made public? (or, if not, can you advise what to do about my public patch, which I created based on T320678...)
I mean, it was already disclosed in multiple ways, so yes. And it's likely low-risk enough that making it into production next week (the change set looks pretty close to mergeable) should be fairly low-risk.
Change 842009 merged by jenkins-bot:
[mediawiki/extensions/AbuseFilter@master] AbuseFilterPermissionManager: Add sitewide block check