Page MenuHomePhabricator

IPReputation: Create the initial IPReputation AbuseFilter variables
Closed, ResolvedPublic

Description

Summary

We can add a few of the proposed MediaWiki-extensions-IPReputation AbuseFilter variables now limited use for editors who are logged out and using their IP address.

Background

  • Now that we have merged patches for T380920, we can create the following AbuseFilter IPReputation variables
    • ip_reputation_tunnel_operators - A list of tunnel operators associated with the IP
    • ip_reputation_risk_types - The list of risks associated with the IP
    • ip_reputation_client_proxies - The list of proxies associated with the IP
    • ip_reputation_client_behaviors - The list of behaviours associated with the IP
    • ip_reputation_client_count - The number of clients detected on an IP
    • ip_reputation_ipoid_known - Whether the IP is known to iPoid-Service
  • These variables listed above can already be got from the IPoid data obtained by the MediaWiki-extensions-IPReputation IPoid data service
  • These variables need to be limited initially just to IP addresses.

Acceptance criteria

  • MediaWiki-extensions-IPReputation variables specified above exist and are usable for actions performed while using their IP address (i.e. logged out and not a temporary account)
  • These variables are always considered protected variables and require the abusefilter-access-protected-vars right to view their values or filters they are used in
  • The value of these variables is taken from the associated data points in an iPoid-Service API response

Event Timeline

Change #1133248 had a related patch set uploaded (by Dreamy Jazz; author: Dreamy Jazz):

[mediawiki/extensions/IPReputation@master] [WIP] Add several IPReputation AbuseFilter variables

https://gerrit.wikimedia.org/r/1133248

Change #1133248 merged by jenkins-bot:

[mediawiki/extensions/IPReputation@master] Add several IPReputation AbuseFilter variables

https://gerrit.wikimedia.org/r/1133248

To QA this ticket you will need MediaWiki-extensions-IPReputation and AbuseFilter installed. The variables should appear in the builder dropdown list (see F59753762 for an example).

Additionally, I would suggest checking that these variables work. This will be hard to do on a local wiki, unless you have iPoid-Service installed locally. If using the local wiki route, then you would set your IP to an IP stored in your local testing iPoid-Service install and check that the data in the variables matches what is stored in the service.

If you do not have a local install, then it will be hard to test. This is because https://test.wikipedia.org has Temporary accounts enabled and we do not support these variables for these users until we have been able to work on T390873. If this is the case, then I might suggest waiting to test these variables until T390873 is completed and at which point it would be possible to test on testwiki using a temporary account to edit (while using a VPN or not, and then checking that a VPN IP has IPoid data that appears in the logs).

dom_walden subscribed.

Triggering various local and global AbuseFilters with IP Reputation variables on wikis with and without temp accounts enabled:

  • I checked that the variables had the correct data from ipoid
  • that only users with the abusefilter-access-protected-vars right could see them in Special:AbuseLog/<id>, Special:AbuseFilter/examine/log/<id> or action=query&list=abuselog
  • the IP Reputation variables only appear for temporary users or for named user account creations
  • the IP Reputation variables only match the actions of temporary users or named user account creations

I checked that filters with the IP Rep variables catch various actions (edit, move, delete) and enforce a few consequences (block, disallow, tag) correctly.

I checked I could use IP Rep variables with a few different comparison operators like in to check array membership, array equality and numeric (in)equality (for client count).

I briefly checked that after accessing IP Rep variables a log is created with log_type=abusefilter-protected-vars. If the filter also includes user_unnamed_ip it will go to log_type=checkuser-temporary-account instead.