Page MenuHomePhabricator

ABF is ignoring wikitext during upload
Closed, ResolvedPublic

Description

T21565: Add more variables to AbuseFilter file uploading evaluation enables bad-faith editors to upload media files with an invalid {{permissionOTRS}} tag without anyone noticing (ABF is ignoring wikitext when uploading files).

background: https://commons.wikimedia.org/w/index.php?title=Commons:Administrators%27_noticeboard&oldid=149782377#OTRS_tickets_added_by_non-OTRS_volunteers
commons AF rule: https://commons.wikimedia.org/wiki/Special:AbuseFilter/69

Event Timeline

Steinsplitter raised the priority of this task from to Lowest.
Steinsplitter updated the task description. (Show Details)
Steinsplitter added a project: OTRS.
Steinsplitter added subscribers: Steinsplitter, Rjd0060, Krd and 5 others.
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptFeb 11 2015, 3:49 PM
Steinsplitter set Security to None.Feb 11 2015, 3:49 PM
Steinsplitter added a subscriber: revi.
Krenair closed this task as Invalid.Feb 11 2015, 6:12 PM
Krenair claimed this task.
Krenair added a subscriber: Krenair.

This does not appear to be an issue with the OTRS software but with the way people use it for the permissions queue, and the need for a specific filter on a specific wiki which depends on an existing open task being fixed.

Steinsplitter reopened this task as Open.EditedFeb 11 2015, 6:22 PM

@Krenair: The other bug is not open for years and not specific enough. If needed a workaround need to be crated. Please not that faked otrs permissions on files are a problem for re-users. Because the ABF fix may take a while (years?) a workaround should be crated.

Steinsplitter removed Krenair as the assignee of this task.Feb 11 2015, 6:22 PM
Krenair closed this task as Invalid.Feb 11 2015, 6:40 PM
Krenair claimed this task.

<Krenair> Steinsplitter, it sounds like any relevant software development would be for https://phabricator.wikimedia.org/T21565
<Krenair> Workarounds etc. would be done by permissions agents or other commons users, i.e. not a task to put in phabricator

Krenair edited projects, added AbuseFilter; removed OTRS.Feb 11 2015, 6:41 PM
Se4598 reopened this task as Open.Feb 11 2015, 10:41 PM
Se4598 added a subscriber: Se4598.

looks like this is a valid bug, based on my assumption that for new upload only onUploadVerifyFile is called, but not filterEdit.

Maybe that's also a core bug, because onUploadVerifyFile maybe doesn't ship all the details we need and onUploadComplete is too late.

Se4598 raised the priority of this task from Lowest to High.Feb 11 2015, 10:43 PM
Se4598 renamed this task from ABF is ignoring wikitext during uplaod to ABF is ignoring wikitext during upload.Feb 11 2015, 10:49 PM
Se4598 updated the task description. (Show Details)

Further research for whoever will fix this w/o T 89302 hook:
there should/will be the hook "PageContentSave" called when the description page is created, but it hasn't a nice error handling;
via UploadBase::performUpload -> LocalFile??::upload -> WikiPage:doEditContent.
AbuseFilter currently doesn't hook in there.

Tgr added a subscriber: Tgr.
Restricted Application added a project: Multimedia. · View Herald TranscriptFeb 27 2015, 12:55 AM
Steinsplitter moved this task from Incoming to Uploading on the Commons board.Mar 12 2015, 3:03 PM
Restricted Application added subscribers: Luke081515, Matanya. · View Herald TranscriptJul 15 2015, 11:35 AM
Jdforrester-WMF moved this task from Untriaged to Backlog on the Multimedia board.Sep 4 2015, 6:45 PM
Josve05a updated the task description. (Show Details)Jan 28 2016, 3:29 PM
Josve05a added a subscriber: Josve05a.
matmarex claimed this task.Apr 18 2016, 9:18 PM
matmarex lowered the priority of this task from High to Normal.
matmarex added a subscriber: matmarex.

I'd like to work on this at some point. No promises as to when it happens (I have a few more pressing things) or how long it'll take me (both uploading and AbuseFilter are a bit hairy), but I'm going to look into it. Remind me if I don't do anything about this for a month. :P

Restricted Application added a subscriber: Poyekhali. · View Herald TranscriptApr 18 2016, 9:18 PM
Denniss removed a subscriber: Denniss.Apr 24 2016, 10:57 AM
Amire80 moved this task from Backlog to Uploading on the AbuseFilter board.May 8 2016, 8:43 AM
matmarex raised the priority of this task from Normal to High.Jun 14 2016, 7:23 PM

Change 295254 had a related patch set uploaded (by Bartosz Dziewoński):
Provide page text and edit summary when filtering file uploads

https://gerrit.wikimedia.org/r/295254

pajz removed a subscriber: pajz.Jul 9 2016, 1:03 PM

Change 295254 merged by jenkins-bot:
Provide page text and edit summary when filtering file uploads

https://gerrit.wikimedia.org/r/295254

matmarex closed this task as Resolved.Jul 12 2016, 2:29 PM

This is now possible. After the patch is deployed to Commons with MediaWiki 1.28.0-wmf.10 (per the roadmap, this Wednesday, 13 July 2016; although there's currently a problem with logins and all wikis were rolled back to wmf.8, so this might be delayed), you will be able to use new_wikitext and similar variables in filters using action='upload'. See https://www.mediawiki.org/wiki/Extension:AbuseFilter/Rules_format#Notes for documentation. If it's unclear, don't hesitate to ask on the talk page there (I'm watching it).