Page MenuHomePhabricator

Wishlist: Use EditFilterMergedContent hook to remove dependency on AbuseFilter
Open, LowPublic3 Estimated Story Points

Description

https://meta.wikimedia.org/wiki/Special:AbuseFilter/355 is currently used to enforce that only Wishlist managers have the ability to change the status, proposer and created fields. This should be migrated to a EditFilterMergedContent hook handler so that there's no dependency on AbuseFilter.

Event Timeline

MusikAnimal changed the task status from Open to In Progress.
Restricted Application added a subscriber: Aklapper. · View Herald Transcript

Change #1211242 had a related patch set uploaded (by MusikAnimal; author: MusikAnimal):

[mediawiki/extensions/CommunityRequests@master] EntityChangesProcessor: service for comparing two entities

https://gerrit.wikimedia.org/r/1211242

Change #1211242 merged by jenkins-bot:

[mediawiki/extensions/CommunityRequests@master] AbstractChangesProcessor: service for comparing two entities

https://gerrit.wikimedia.org/r/1211242

I don't know that this is done yet. r1211242 was the preliminary work, and now we need to actually make use of it in the EditFilterMergedContent hook. Then once that is live, the AbuseFilter on Meta needs to be disabled.

Change #1248092 had a related patch set uploaded (by MusikAnimal; author: MusikAnimal):

[mediawiki/extensions/CommunityRequests@master] EditFilterHooks: check permissions when changing restricted fields

https://gerrit.wikimedia.org/r/1248092

MusikAnimal triaged this task as Low priority.EditedMar 4 2026, 8:38 PM

This should be fixed at some point, but it is not a priority on our cluster so long as sysop has both manage-wishlist and manually-edit-wishlist rights, which is currently the case on Meta. I had some code already written that I've just submitted, to be revisited later as needed or time allows.