Page MenuHomePhabricator

Add granular query restrictions for AbuseFilter filter search
Closed, ResolvedPublic

Description

On Special:AbuseFilter, I can do a Search within rules and put something like user_unnamed_ip. This will then show the filter's rules in the table, even to users who don't have permission to see the filter.

For example: Special:AbuseFilter/?querypattern=user_unnamed_ip&searchoption=LIKE

abuse_filter_search_pattern.png (648×1 px, 82 KB)

Search is restricted to users who have private filter viewing rights. Trying to do a similar update with protected variable viewing rights would lock everyone out of this feature, as no one has the right yet. Instead, update the query to only return filters that the user has the right to see.

Event Timeline

Change #1051349 had a related patch set uploaded (by STran; author: STran):

[mediawiki/extensions/AbuseFilter@master] Only return filters visible to user in search

https://gerrit.wikimedia.org/r/1051349

Change #1051349 merged by jenkins-bot:

[mediawiki/extensions/AbuseFilter@master] Only return filters visible to user in search

https://gerrit.wikimedia.org/r/1051349

Djackson-ctr subscribed.

Per the ticket Description, I have verified the new code has been implemented and is functioning and displaying as expected.