Page MenuHomePhabricator

UserInfoCard: Show disallowed edits / AbuseFilter trips for the user
Open, Needs TriagePublic

Description

Summary

AbuseFilter trips can be a useful signal in judging what to do with a new account. For example, a temporary account may have one edit, but 10 failed attempts in trying to get past AbuseFilters.

TBD

  • Which user right should have access to view this? It should not be open to everyone, as not all AbuseFilter trips are publicly visible
  • Should surfacing this data point be restricted only to temporary accounts and non-confirmed accounts?

Mockup

image.png (465×259 px, 37 KB)

Acceptance criteria

  • Count of AbuseFilter trips for a user are shown in the User Info Card (details TBD on which users this applies to, and which users can view this data point)

Event Timeline

Restricted Application added a subscriber: Aklapper. · View Herald Transcript

Are there AbuseFilter trips whose very existence is nonpublic? I thought it was only that with some the filter information (other than its name) is nonpublic. If so, I would think it's fine to show the disallow tally to anyone.

Are there AbuseFilter trips whose very existence is nonpublic? I thought it was only that with some the filter information (other than its name) is nonpublic. If so, I would think it's fine to show the disallow tally to anyone.

The number of AF hits is indeed public information. But I still believe it's better to limit this feature to admins. Similar to to the number of blocks users might feel stigmatized if their UserInfoCard publicly shows x disallowed edits (those might be false positives or there were other legitimate reasons for hitting the filter).

If number of AF trips is public information then I believe it is okay to show the information to everyone but limit showing this information only for temporary accounts and non-confirmed accounts. For auto confirmed accounts this will probably not be as useful a signal.

I think visible to everyone, but only for TAs & non-confirmed accounts, makes sense. Showing other accounts' disallow tallies specifically to admins wouldn't be much of a stigma problem, but I agree with Niharika that it's just not very useful, especially because at least on enwiki, most of our disallow filters affecting (auto)confirmed users are actually for very boring things like using an institutional-only URL.

kostajh renamed this task from UserInfoCard: Show disallowed edits for the user to UserInfoCard: Show disallowed edits / AbuseFilter trips for the user.Nov 12 2025, 8:33 AM
kostajh updated the task description. (Show Details)

If the IP has been revealed, then should the count be of AbuseFilter trips associated with the IP / IPv6 /64 range?

The link could go to Special:AbuseLog filtered to either the username or the IP

If the IP has been revealed, then should the count be of AbuseFilter trips associated with the IP / IPv6 /64 range?

Why not, certainly a nice service saving patrollers / admins with TAIV enabled some clicks.

The link could go to Special:AbuseLog filtered to either the username or the IP

If the number of disallowed edits is given per IP or /64 range, the abuse log link should point to the IP or /64 range.

But it might also be confusing to users: I'm clicking on the user info card -> spotting something suspicious -> clicking "IP reveal" (which hides the info card at the same time) -> if I open the info card again the number of disallowed edits has changed (and the abuse log link as well)

Are there AbuseFilter trips whose very existence is nonpublic? I thought it was only that with some the filter information (other than its name) is nonpublic. If so, I would think it's fine to show the disallow tally to anyone.

The number of AF hits is indeed public information. But I still believe it's better to limit this feature to admins. Similar to to the number of blocks users might feel stigmatized if their UserInfoCard publicly shows x disallowed edits (those might be false positives or there were other legitimate reasons for hitting the filter).

I think it might be useful to note that on some wikis (not necessarily just enwiki) there are other groups that regularly interact with AbuseFilter to which visibility might be helpful. Certainly not necessary for every TAIV-enabled account, but not necessarily just admins, either.

Are there AbuseFilter trips whose very existence is nonpublic? I thought it was only that with some the filter information (other than its name) is nonpublic. If so, I would think it's fine to show the disallow tally to anyone.

The number of AF hits is indeed public information. But I still believe it's better to limit this feature to admins. Similar to to the number of blocks users might feel stigmatized if their UserInfoCard publicly shows x disallowed edits (those might be false positives or there were other legitimate reasons for hitting the filter).

I think it might be useful to note that on some wikis (not necessarily just enwiki) there are other groups that regularly interact with AbuseFilter to which visibility might be helpful. Certainly not necessary for every TAIV-enabled account, but not necessarily just admins, either.

I believe the solution proposed by Niharika in T409396#11352749 makes sense: Show the information to everyone but only show it for temporary and non-confirmed accounts -> avoids any issues with regular editors.