Page MenuHomePhabricator

Display changes to protected status and flags on AbuseFilter history and diff pages
Closed, ResolvedPublic

Description

See the parent task for more context.

  • Store the changes to af_hidden in ahf_changed_fields
  • Store the different privacy levels in afh_flags
  • Display these changes on Special:AbuseFilter/history and Special:AbuseFilter/history/n/diff

Event Timeline

Change #1029162 had a related patch set uploaded (by Tchanders; author: Tchanders):

[mediawiki/extensions/AbuseFilter@master] Ensure that changes to af_hidden are correctly set in afh_changed_fields

https://gerrit.wikimedia.org/r/1029162

Tchanders renamed this task from Display changes to protected status and flags on AbuseFilter history pages to Display changes to protected status and flags on AbuseFilter history and diff pages.May 8 2024, 6:54 PM
Tchanders updated the task description. (Show Details)

Change #1026560 had a related patch set uploaded (by STran; author: Tchanders):

[mediawiki/extensions/AbuseFilter@master] Allow variables to be restricted by user right

https://gerrit.wikimedia.org/r/1026560

Re-assigning to @STran, who has taken this over.

Change #1029162 abandoned by STran:

[mediawiki/extensions/AbuseFilter@master] Display changes to filter privacy levels on history and diff pages

Reason:

This work was merged into 1032420 (utility functions) and 1026560 (UI/X updates)

https://gerrit.wikimedia.org/r/1029162

Change #1026560 merged by jenkins-bot:

[mediawiki/extensions/AbuseFilter@master] Allow variables to be restricted by user right

https://gerrit.wikimedia.org/r/1026560

Change #1039214 had a related patch set uploaded (by STran; author: STran):

[mediawiki/extensions/AbuseFilter@master] Add error message for unprivileged access of filter history

https://gerrit.wikimedia.org/r/1039214

Change #1039232 had a related patch set uploaded (by Tchanders; author: Tchanders):

[mediawiki/extensions/AbuseFilter@master] Fix permission error shown on history page for protected filter

https://gerrit.wikimedia.org/r/1039232

Change #1039214 merged by jenkins-bot:

[mediawiki/extensions/AbuseFilter@master] Add error message for unprivileged access of filter history

https://gerrit.wikimedia.org/r/1039214

Change #1039232 merged by jenkins-bot:

[mediawiki/extensions/AbuseFilter@master] Fix permission error shown on history page for protected filter

https://gerrit.wikimedia.org/r/1039232

dom_walden subscribed.

For a user without abusefilter-access-protected-vars (but all other AbuseFilter rights), I was not able to see any information about protected filters on:

  • Special:AbuseFilter/history
    • Including when searching for a specific filter ID (Special:AbuseFilter/history/<filter id>)
  • Special:AbuseFilter/history/<filter id>/item/<change id>
    • If you edit an unprotected filter and add the user_unnamed_ip variable, changing it to a protected filter, all previous changes of the filter are not visible to the user, even if they were able to see them when the filter was unprotected.
  • Special:AbuseFilter/history/<filter id>/diff/<prev change id>/<change id>
    • Unlike with .../item/..., if a previously unprotected filter becomes protected the user can still see diffs of filter changes from before it was protected. i.e. if both <prev change id> and <change id> were made when the filter was still unprotected. I don't think you can use this to find any sensitive information. You see the same information you would have seen before the filter was protected.

I did try to change a protected filter to an unprotected filter, to see what happens to its history. But I could not find a way of doing this.

Test environment: local docker Abuse Filter – (92e1335) 13:45, 13 June 2024.