Page MenuHomePhabricator

Support generation of IPReputation AbuseFilter variable data for previous actions
Closed, ResolvedPublic

Description

Summary

The MediaWiki-extensions-IPReputation AbuseFilter variables work for actions being currently filtered. However, they do not use the correct IP when inspecting past edits. We should support this by getting the IP from the RecentChange object.

Background

  • AbuseFilter allows generating variables for both actions currently being filtered (i.e. at the same time as the action is being performed) and for historical actions
  • The MediaWiki-extensions-IPReputation AbuseFilter variables currently are generated for both types of actions
    • However, when generating the values for previous actions the IP used is the IP address used by the request that asked for the variables to be generated (which would be the viewing users' IP address)
  • Generating the variables for historical actions should present no additional privacy concerns because the variables could have been generated when the action was being filtered and also the variables cannot be accessed once the IP address is purged from recentchanges table (which is the same amount of time as purging the protected variable values on WMF wikis)

Acceptance criteria

  • When generating MediaWiki-extensions-IPReputation AbuseFilter variables for a historical action, the IP address used is the IP address for the action in the recentchanges table

Event Timeline

Change #1153372 had a related patch set uploaded (by Dreamy Jazz; author: Dreamy Jazz):

[mediawiki/extensions/IPReputation@master] [WIP] AbuseFilter variable: Get IP from RecentChanges object if set

https://gerrit.wikimedia.org/r/1153372

Change #1153372 merged by jenkins-bot:

[mediawiki/extensions/IPReputation@master] AbuseFilter variables: Get IP from RecentChanges object if set

https://gerrit.wikimedia.org/r/1153372

dom_walden subscribed.

I made requests to Special:AbuseFilter/examine/<rc id> for various recent changes on my local wiki. I observed that a request is made to my ipoid instance for any recent change made by a temporary account or for named accounts when it is an account creation recent change.

Test environment: local docker IPReputation – (5ab7fa0) 11:20, 7 June 2025.