See the parent task for more context.
- Store the changes to af_hidden in ahf_changed_fields
- Store the different privacy levels in afh_flags
- Display these changes on Special:AbuseFilter/history and Special:AbuseFilter/history/n/diff
Description
Description
Details
Details
Related Changes in Gerrit:
Customize query in gerrit
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Restricted Task | |||||
| Resolved | kostajh | T294511 2021 Security Team wikireplicas audit | |||
| Declined | None | T284948 Raw IPs of logged-out users disclosed in wiki-replicas | |||
| Resolved | Niharika | T324492 Temporary accounts - MVP | |||
| Open | None | T326816 [Epic] Update features for temporary accounts | |||
| Resolved | Tchanders | T326869 Update TSP-owned products that may be affected by IP Masking | |||
| Resolved | • lbowmaker | T262321 IP Masking | |||
| Resolved | tstarling | T300263 [IP Masking] Create temporary account on first edit | |||
| Open | None | T307060 [Epic] Temporary account AbuseFilter support | |||
| Resolved | STran | T357772 Investigate: How will `ip_in_range` and `ip_in_ranges` function when temporary accounts are enabled | |||
| Resolved | STran | T363906 [Epic] Ensure filters that use PII-sensitive variables are protected | |||
| Resolved | STran | T364465 Display changes to protected status and flags on AbuseFilter history and diff pages |
Event Timeline
Comment Actions
Change #1029162 had a related patch set uploaded (by Tchanders; author: Tchanders):
[mediawiki/extensions/AbuseFilter@master] Ensure that changes to af_hidden are correctly set in afh_changed_fields
Comment Actions
Change #1026560 had a related patch set uploaded (by STran; author: Tchanders):
[mediawiki/extensions/AbuseFilter@master] Allow variables to be restricted by user right
Comment Actions
Change #1029162 abandoned by STran:
[mediawiki/extensions/AbuseFilter@master] Display changes to filter privacy levels on history and diff pages
Reason:
This work was merged into 1032420 (utility functions) and 1026560 (UI/X updates)
Comment Actions
Change #1026560 merged by jenkins-bot:
[mediawiki/extensions/AbuseFilter@master] Allow variables to be restricted by user right
Comment Actions
Change #1039214 had a related patch set uploaded (by STran; author: STran):
[mediawiki/extensions/AbuseFilter@master] Add error message for unprivileged access of filter history
Comment Actions
Change #1039232 had a related patch set uploaded (by Tchanders; author: Tchanders):
[mediawiki/extensions/AbuseFilter@master] Fix permission error shown on history page for protected filter
Comment Actions
Change #1039214 merged by jenkins-bot:
[mediawiki/extensions/AbuseFilter@master] Add error message for unprivileged access of filter history
Comment Actions
Change #1039232 merged by jenkins-bot:
[mediawiki/extensions/AbuseFilter@master] Fix permission error shown on history page for protected filter
Comment Actions
For a user without abusefilter-access-protected-vars (but all other AbuseFilter rights), I was not able to see any information about protected filters on:
- Special:AbuseFilter/history
- Including when searching for a specific filter ID (Special:AbuseFilter/history/<filter id>)
- Special:AbuseFilter/history/<filter id>/item/<change id>
- If you edit an unprotected filter and add the user_unnamed_ip variable, changing it to a protected filter, all previous changes of the filter are not visible to the user, even if they were able to see them when the filter was unprotected.
- Special:AbuseFilter/history/<filter id>/diff/<prev change id>/<change id>
- Unlike with .../item/..., if a previously unprotected filter becomes protected the user can still see diffs of filter changes from before it was protected. i.e. if both <prev change id> and <change id> were made when the filter was still unprotected. I don't think you can use this to find any sensitive information. You see the same information you would have seen before the filter was protected.
I did try to change a protected filter to an unprotected filter, to see what happens to its history. But I could not find a way of doing this.
Test environment: local docker Abuse Filter – (92e1335) 13:45, 13 June 2024.