Feature summary:
- T290324: Create Oversight-level abuse filters allows restricting access to abuse filters to users with viewsuppressed permissions which also auto-suppresses the abuse log.
- It's currently possible to remove the suppressed flag again – which also removes the abuse log's auto-suppression. This could lead to unintentional disclosure of PII (not just in abuse logs, but also in the filter notes and of course the filter rules itself).
- Therefore removing the checkbox for suppressing abuse filters should be disallowed, just like it's not possible to remove an abuse filter's "protected" flag.
- When using the checkbox to suppress an abuse filter, a warning should be shown that this cannot be reversed, asking oversighters to reconfirm their action (similar to T364485: Alert a filter editor that a filter must be protected if it is saved with a protected variable).
- A different approach to disallowing unsuppression would be to create a warning reminding oversighters that removing suppression also removes auto-suppression of all filter logs.
Use case / benefit :
- The current UI doesn't indicate that removing the suppressed flag makes previously suppressed abuse logs public again -> OS could unintentionally leak PII by removing the flag.
Other information:
- See T290324#11514874 and T414011#11502228 / T414011#11502685 for previous comments on this issue (@MolecularPilot, @Dreamy_Jazz, @Wargo fyi). I created a separate ticket as suggested in T414011#11533675.
- There might be scenarios where oversighters accidentally suppress a filter – in that case (with unsuppression disallowed) a solution via maintenance script similar to T380290: Remove protected flag from accidentally protected filters should be considered.