Page MenuHomePhabricator

Abuse filter log reveals user's IP address
Closed, InvalidPublic

Description

Abuse filter log for 115.166.47.100: https://en.wikipedia.org/w/index.php?title=Special:AbuseLog&wpSearchUser=115.166.47.100

Example edit history of page mentioned on log: https://en.wikipedia.org/w/index.php?title=Template:Israel-footy-bio-stub&action=history

That IP address does not appear in the edit history, so it is possibly a user's IP address.

Event Timeline

Maniphest changed the visibility from "Public (No Login Required)" to "Custom Policy".May 11 2015, 5:53 PM
Maniphest changed the edit policy from "All Users" to "Custom Policy".
Harej updated the task description. (Show Details)
Harej added projects: AbuseFilter, acl*security.
Harej changed Security from None to Software security bug.
Harej edited subscribers, added: Harej; removed: Aklapper.

I may have misinterpreted the log output, that these are edits which have been *prevented*, which is why it's not in the edit history. Stay tuned.

At a glance, the database queries do not appear to search for the supplied username in the afl_ip database field. The actions in the linked log appear to be edits that a logged-out user attempted to make but was prevented due to AbuseFilter.

I don't think there's a bug here. It looks to me like the user tried to make the edit logged out, the filter stopped them, and they then logged in and successfully made the edit.

That's what we eventually figured out. We can probably close this as Invalid.

Legoktm claimed this task.
Legoktm removed Legoktm as the assignee of this task.
Legoktm removed a project: acl*security.
Legoktm changed the visibility from "Custom Policy" to "Public (No Login Required)".
Legoktm changed the edit policy from "Custom Policy" to "All Users".
Legoktm changed Security from Software security bug to None.