This way, we can specify an action and it'll return only conditions for
that specific action. This is especially thought to make results
filterable by action type.
Change-Id: I2c51b695262b132a5c7cdfab20d56e36f43c7448
Now the required need will be abusefilter-modify OR
abusefilter-view-private for /tools, /test and /examine.
Bug: T193903
Change-Id: I3f1a91a2cc1df2272e5d4099cefd7c649a0683d5
The conversion to OOUI brought some extra whitespace that creates some
problems while viewing the page, especially with specific skins. This
patch compacts four different form fields in a single one, having the
side benefit of reducing the amount of used variables.
Bug: T189425
Change-Id: I75aa83e36d12db65d8b54c76b3ea14c8c797215e
With this patch, filters which are both enabled and throttled have an
"actions automatically disabled" label together with "enabled" and the
row is displayed in red. Plus, some minor changes like removing unused
fields from sortable ones and added a comment to getQueryInfo about used
columns (the idea is that it'll be easy to understand if a given column
is already there, plus if we'll need the missing one we may just replace
it with '*').
Bug: T154206
Change-Id: Iab157d094cbf2d50e9db537535fd48243e74af0b
Most of these are accidential, obsolete from a time when PHP4 required
these & to enforce passing by reference. This is the default since PHP5.
The issue with this & is that is (in theory) allows hook handlers to
replace the object with an entirely different one. Luckily this does
not work in all cases I'm aware of. But it is confusing, semantically.
Change-Id: If1e9e2723ef96308f9b4b27377398a5e497bfe70
This is the default for many years now. Returning true is not different
from returning nothing.
I'm not touching functions that can either return true or false.
Change-Id: I6c70b8ef44f17271201a69a85301a631b32763c0
In If67035991a0835ec3edc13be4543e6b40c76c3ea I changed a couple of links
to OOUI buttons, but forgot to add one of these to the output (and to
enable OOUI as well).
Change-Id: I7dd4b554bae406bc0c8326867298302ee10b47f2
With I5e3764dbec8ac21f20c460181ae78ed73eca92f6 I introduced a function
to check that two blocks with different wordings refer to the same
duration. While that functions works good 99.9% of the time, there's a
highly unlikely but actual problem: if one of the operand is parsed at
time x and the other at time x+1 (in seconds, and this may happen even
if it gets parsed 1 ms later), the 2 durations will be considered
different and this may be annoying. With this patch I introduce another
tiny function which uses strtotime to parse a duration, but uses the
second parameter (=0) to avoid relativeness to the current time. Again,
this isn't likely to occurr, but since the fix is straightforward we'd
better do it. Also, now global durations aren't parsed at every
iteration (previously they were due to the same problem, amplified by
time distance between the first and the last iteration).
Change-Id: I11a078f298aaed9631d7f422c6b9b722d28e73cc
While the change itself is simple, the only problem here is the desing,
since we're adding even more vertical space with this.
Bug: T164108
Change-Id: Ic5373dd4f0b85dc1311d90ac165d4520ac956e68
With I91a9c5cca55e540a6c95b750579c1c369a760b15 we replaced some globals
with Config and, in doing this, we added "$config->has()" to check if a
variable was null. However, "has" will always return true even if the
value is null (it only checks if it exists), and thus we end up showing
a global abusefilter pager even if no central DB is set.
Bug: T195022
Change-Id: I751fdefd29b6af1361021d4343ba67f16c99a037
Use TextContent::normalizeLineEndings instead of manually replacing
carriage returns, plus avoid the if with a simple string cast. This also
fixes some cases where a null edit isn't counted as such due to a "\n"
in new_wikitext which isn't trimmed.
Bug: T168736
Change-Id: Idfafab3fcf7912bf0aec22700d2c0137bdd6c3c8
With the introduction of custom block durations in Ib072433d19dabae48d8514e08be9893135b5d63c, the method which generates action display was enlarged in order to provide a more readable and complete message. However, for throttling we currently have an unreadable message like "Throttle: xx, yy, zzz". This is wrong for two reasons: first, those numbers need to be deciphered; second, the first number is the filter ID which is totally unuseful here.
Change-Id: I0ec6a27ff5f37aae864dfd91161bf44f0a217ef1
They were defaulted to false with
I93ad51ffe7bee597d2d127f4c5d6b2929ffc8f7e, which broke use cases where
the page field is NOT required, nor has a 'required' => false explicitly
declared.
Bug: T194425
Change-Id: I5ab768c02a30b6d053104e590729ef22bb4e0808
Pretty self-explanatory and straightforward, since recentchanges has a
dedicated column for bot edits.
Bug: T193994
Change-Id: I76d41e082aed262640e9fff856eeb97df49633d5
With If16975dd394cfdb3c57ff263366c2fc865de362a I broke flags checkboxes,
i.e. the one for enabling/deleting/etc. a filter. In fact, I
misunderstood the way cbReadOnlyAttribute was used (a dirty way,
actually) and this caused such checkboxes not to be disabled if the user
didn't have rights to edit the filter.
Change-Id: Ibf80b54e0f620734ad7767e4769a93bbf1feccff
Like we do for built-in values. If a blacklisted variable is overridden,
it still works, but there's no reason to allow it.
Bug: T191715
Change-Id: Ia4d42ec56dc4805454b96c52c2eace1924f6536c
Quite self-explanatory. If the talk page is blocked, a sentence is
added, otherwise it remains as it is. Plus, improved the way messages
are generated and reduced their reuse.
Bug: T193692
Change-Id: I01f5113ca586b94c25e1102c73d158ebb01c5a4b
The $deadActions array is populated but never used. At first I thought
it was about actions which aren't available, but this isn't right.
Instead, it's only used to keep track of available actions which aren't
used in the current filter. Which is some data that we don't need, nor
there's nothing we may do with that.
Bug: T188181
Change-Id: Ibdfeb92ccd790c0b1a4d79b382b053b9361459f8
We used to display the checkbox to block talk without checking if
it was defined. This caused a warning and an empty space with
wgBlockAllowsUTEdit set to false.
Change-Id: I97f82633e932de7e325615473c85245a406a55ef
After Id4dc1debf0240d5b336f4d9ab5b363c240f08807, the method has been
moved, and in doing that I forgot to change this line.
Change-Id: I20caf06f2c568605bd6a90c9cf2b425cd51512e7
Like we did for other links in /diff and /histories, there are some
links that we'd better display as OOUI buttons. Also, use the Html
class' specific method to show errorboxes.
Bug: T132284
Change-Id: If67035991a0835ec3edc13be4543e6b40c76c3ea
I'd like to have this reviewed by more than one user before merging, to avoid regressions of annoying typos.
Change-Id: I91a9c5cca55e540a6c95b750579c1c369a760b15
I found these vulnerabilities while trying to setup seccheck. Although
I'm not sure whether seccheck recognised them, I'm sure that they exist
since I did manual tests, and it's possible to inject custom scripts
with these.
Change-Id: I97804be8352a1b784d483195edb29e363a0c616e
'disallow' rules with a missing first parameters are perfectly fine (and
quite common), so don't throw notices when that happens.
This broke Flow's unit tests, and caused exceptions for all api.php
edits that triggered a 'disallow' rule.
Change-Id: Ibebedb566da705e77ffb831ebda6476adba07c93
This seems like the logical way to be sure that multiple mass actions
won't be counted as one, thus reaching the conditions limit. I tried to
test this locally, but I actually had troubles to simply replicate the
issue of the reached limit in a stable manner, so I'm not totally sure.
Anyway, this shouldn't do any harm.
Bug: T193374
Change-Id: Icdc172f76705870ee502339a53e912e15a3bd31d
The variable was declared in the "if" branch but also used in the "else"
one. This caused the rules textarea to not have the readonly attribute
if the user wasn't allowed and CodeEditor wasn't installed.
Change-Id: I2bf69dc0f2d24efac41d1ac6100ed7e286e3afa4
This is taken from I6a57a28f22600aafb2e529587ecce6083e9f7da4 and makes
all the needed changes to make phan pass. Seccheck will instead fail,
but since it's not clear how to fix it (and it is non-voting), for the
moment we may merge this and enable phan on IC.
Bug: T192325
Change-Id: I77648b6f8e146114fd43bb0f4dfccdb36b7ac1ac
Follow-up of Iaeae672dca66ffc745054daabd6f0eae7dfbc648. Some actions
were still marked with red, specifically the ones with block inside. The
reason is that we stored the 'blocktalk' parameter as an emtpy string if
false, which wasn't filtered when loading request. Changing the empty
string to something different is enough to fix the problem, hopefully
without regressions. Note that this isn't retroactive and needs an edit
to become effective.
Bug: T189681
Change-Id: I7d7f0606fc23bad5ba342076066ab0e935680b3f
Introduce a new function which can be used to group multiple comparisons
in a single condition. In particular, equals_to_any(S, A, B) is the
equivalent of S === A || S === B. This is especially useful in checking
for multiple namespaces, as proposed in the Community health initiative.
Change-Id: I9dcfe303eb5e51e1882fe4a65fa876aa93db7686
I left as ToDo the checks between an array and something else. With this
patch, it'll work like PHP: the result will be true iff the comparison
is loose, the array is empty and the other operand is either false or
null.
Change-Id: Idc5cadb697ed4fc7f4856967274169f77495ed9f
I added searchEnabled in I0771fa048d21031ed1e0f8a6909213bdb869a5ed, but
forgot to pass it as parameter when there's an error with the regex.
This means that, if you try to make a search with a wrong regex, when
the page is reloaded the fields for searching aren't shown and you get a
PHP warning. Here I also added warning suppressions as usually done when
checking regex validity to avoid unnecessary PHP warnings.
Change-Id: Ibc3110c30959c99d0825e1e3d7edb1e96dd9d536
Basically, with this we always start with a functioning textarea. If JS
is enabled (and CodeEditor installed), it gets then replaced by the Ace
editor.
Bug: T192241
Change-Id: Id4dc1debf0240d5b336f4d9ab5b363c240f08807
As discussed in the task, wgTitle was used (overridden) since it was null in API
calls. However, the problem has been fixed in api.php in 2009, so we
don't need to deal with it anymore. This also means that we may remove
anything else that was added to restore the original title at the end of
the function. At last, this was the only remaining exception for PHPCS.
Bug: T178007
Change-Id: Id043c74ec8d57c5fb0ab22f54acf6a31fe6b6f06
This should fix every error with excluded rules, leaving only the one
for $wgTitle. A double check would be nice in order to avoid regressions
due to stupid mistakes.
Bug: T178007
Change-Id: I22c179f3a01d652640304b59e43fcb5b5a9abac3
IP::isInRange() can return true for invalid IPs so this can
cause false positives. Instead of letting this happen, don't
allow it in the first place.
See also Ibfe55c2ebac0fccfa8329436
Bug: T124117
Change-Id: Id10552e117ce2b231504e41627b44f8cfb0d4329
Right now we don't have a specific exception for that, plus we don't
really check if they're closed. In fact, we use the result of strpos
without checking if it evaluates to false; if so, in some particular
cases like the one reported on phab, the while loop will never end.
Bug: T134124
Change-Id: I3b6000f197502a4832a53465b6617b4217080739
So that type and value will be identical to PHP's ones.
Bug: T191688
Depends-On: I1140900cdda63eed292d9f20aefd721ef9247fcd
Change-Id: I398c9a972b7e9fcb27d055d23939be2b8bb68244
Right now they're always returned as float values, even stuff like 1+1.
With these patch the results will have the same type as they would with
pure PHP calculation. Added a method to convert numbers to int/float
depending on their type.
Bug: T191688
Change-Id: I1140900cdda63eed292d9f20aefd721ef9247fcd
Otherwise old filters try to use it and return an error. I restored it
at the old version, like in PS1 of Ib23c418ded6ffdae7311809bf5fcbbfb2093e752
Bug: T191696
Change-Id: Ib23c418ded6ffdae7311809bf5fcbbfb2093e752
We already do it for variables and functions, so that any new feature
won't need the ace files to be edited. I originally didn't implement it
for keywords too, but it's actually much better this way.
Change-Id: I1ee81feace2ea90d5dbb2e443f01bc0f6cf74eb7
This feature was never implemented. I'm not sure whether we need a way to compare array and other types of variables (left as ToDo), since e.g. in PHP it's always false.
Bug: T179238
Change-Id: I5d2c33fd117e69cbc84c0b04b6cb82edbdcadf16
It solves a bug and other problems, especially related to permissions.
Tested as much as I could but with an imperfect global filters system,
so there may still be something wrong.
Bug: T191539
Change-Id: I0771fa048d21031ed1e0f8a6909213bdb869a5ed
This is the long-term solution for the problem. The ToDo may be
unnecessary, but leaving it there as a caveat.
Bug: T190602
Change-Id: I5e3764dbec8ac21f20c460181ae78ed73eca92f6
This opens the door to further customization and allows every wiki to
set its own value.
Bug: T132925
Change-Id: I63985f2809c3253b07b33caef30fcd8d4c62dfd4
Otherwise ContentTranslation will break. Also, that way the order was
wrong (mandatory parameter after optional ones).
Bug: T191468
Change-Id: I4558aba48782e83b73023061e8f213bf6a785a18
Yes, this is a sniff bug - however, ideally every variable should
be on its own line with documentation anyway.
Change-Id: Ic8a96d9ea4dd20d8f689aac0a7dece01a4208929
Currently, due to a tiny math error, the cap is variable (although
limited). This way it's really fixed and produces uniform results.
Bug: T191222
Change-Id: I8102db7894e5481a77e1a5771d9981258000731e
Hopefully this is really the last one: the tiny form at the bottom of
Special:AbuseLog/# to access private details.
Bug: T132284
Change-Id: I3f91beb482b3b85e12b65464914b0ac57ec983df
Currently, strict comparisons aren't listed. This way they don't appear
in the dropdown and users may not be aware of their existence.
Change-Id: I93185781de3b698096130c673156a67823375c6b
Currently users can save filters without title or pattern. This
shouldn't be allowed since it leads to lack of clarity. The check is
only performed server-side, since when implementing Ace editor we won't
be able to (easily) add a pure HTML requirement for the pattern field.
Bug: T173947
Change-Id: I1a0418b87cdb1ff423238fcdf1c743930500e605
Otherwise it will return wrong stats and waste resources. This seems to
fix the problem, while a more long-term solution isn't that clear. I
hope that this won't introduce regressions, which as far as I could see
shouldn't happen.
Bug: T191032
Change-Id: I243605b26fe310488dc7419edf31f652ccda0094
Standardized Special:AbuseFilter/test and /examine/# to OOUI. They need
to be updated together, since they share the same load filter button
(now centralized) which needs to be handled in a different way.
Bug: T132284
Bug: T58367
Bug: T58368
Depends-On: If3d6a994142e34686bb7fc9f09093f751b599485
Change-Id: Ib935e8c9706e987468e52ec2ad1c7219b35fb9d5
Conversion of the builder dropdown, the syntax checker button and also
the button for switching editor coming from ace.
Bug: T132284
Depends-On: If3d6a994142e34686bb7fc9f09093f751b599485
Change-Id: Ic7f17437f4f0dcc0ea0edbab24eb976e2f76bdbd
This one was left out, probably because it's not well documented.
Together with the simple conversion, I also added a cap to time
selectors (otherwise users may create huge breaking queries) and wrapped
in a class=success P the success message, like we do when saving
filters.
Bug: T132284
Change-Id: I2ba0a54e27608949cd28b9ac0447d1f2157b0ea2
Since it'll always be a subtraction of integer numbers. Otherwise, if
calculated as float, values won't triple-compare.
Bug: T190652
Change-Id: Ia58a4e3429a012a94a43ffadb190154fcdb9bcaa
Replace the conditions textarea with Ace editor for editing and testing
filter. This uses a soft dependency on CodeEditor; if the latter isn't
installed, the classic textarea is used. The user is still able to
switch between the editors on the go; the new buttons may look a bit
ugly now, but after switching to OOUI they should get much better.
Finally, added a custom syntax highlight for AbuseFilter rules.
Bug: T39192
Change-Id: If3d6a994142e34686bb7fc9f09093f751b599485
Adds an option for searching filters with a
specific pattern in the main page, together with already existing options.
Plain search and regex are available, only for users with the
view-private right. The search is performed directly on the database.
If the user actually searched for something, it is also added a column to
Special:AbuseFilter showing a snippet of the pattern from each filter, with the query match highlighted.
Depends on: I8144062b1f273d0d8932203ffcb7a71aca60bba9
Bug: T87455
Change-Id: Ibcd84ff84edca481328210ee857b0ab723028632
Public comments are parsed in some places and they are
shown as plain text in others. Always show them as
plain text instead of parse them.
Bug: T173249
Bug: T141670
Change-Id: I173ffab1a99c1536cca260b76be0d95a4966b139
With https://gerrit.wikimedia.org/r/#/c/412892/ I introduced an error
with action display in history: every action except for block would have
been displayed without parameters.
Change-Id: I273cd908b698c49056c176de9ead5a78d818c7be
I had unwillingly substed a variable with a string in the wrong case. It
needs to be fixed before .25 is deployed, otherwise in history there
might be actions != block which'll be displayed as 'block'.
Change-Id: I6d251fa011238509a8fdf264e865573140e7a20d
Core change I8d825eb0 begins the process of changing core database
tables from using xx_user and xx_user_text fields to using xx_actor.
This updates the extension to continue to function during and after the
transition.
Bug: T167246
Change-Id: I4065716022aa60c0fa1a258659db22be2b7f43de
This is part of a project to enchance blocking in AF. With this patch,
users are allowed to specify two block durations for each filter, one
for anonymous and one for registered users. For backward compatibility,
default values are set to the global variables.
Bug: T32024
Change-Id: Ib072433d19dabae48d8514e08be9893135b5d63c
Blocks preventing edit of own talk currently don't show "cannot edit own
talk page". Added it to the flags to make it display properly.
Bug: T188970
Change-Id: Ia8d1c2b93038c3c43bb224a8cae073b694d74cbe
The IP is currently displayed as plain text. Add instead userLinks in
the usual way to provide some handy links for CUs.
Bug: T188600
Change-Id: I47ee007f450f06a1a19b4c7598373a952efbe06a
Currently, array_diff is only performed in one direction. This way, some
edits to tags (and, in future, to custom block durations) aren't catched
and the filter isn't saved.
Bug: T180194
Change-Id: I22fb9368208380c1a8205a566ac5ff07bbb6e05b
So that users have no longer to modify the URL.
Links like "Special:AbuseFilter/history/1" will still
work but request parameters have higher priority.
Bug: T27897
Change-Id: I2d8c26d3350fdd4052b68c7bced10e3fae859d18
Adds option to stop logging IPs in afl_ip in the abuse_filter_log table.
Introduces a new global variable: $wgAbuseFilterLogIP
Bug: T187169
Change-Id: I1615ba6949c9f8bcdd6ee6aef580c87a05f43e6a
Users can choose whether they want to see entries
that changed the wiki or didn't (or they can apply
no filter).
Bug: T159061
Change-Id: I6cee9b001c26c4bbc837131781deef27d5e3ef1a
Currently, the message informing that some actions have been disabled is
quite impossible to notice at a first glance, since it's a bit confused
with other form elements. However it actually is a warning and needs to
be treated as that.
Change-Id: I0d851333f8da200fb0b9b0c7d05ccd1f63e9e948
Change I758795f01eaf3ff56c5720d660cd989ef95764a7, first released
in 1.20, added columns to AbuseFilter tables for MySQL, but not for
PostgreSQL.
This adds those columns for PostgreSQL, both for the installer and
for the updater.
Combined with already-merged change 192002, this change closes
bug T89514.
Bug: T89514
Change-Id: Ie33a5a932ffd85fa8a4111b949bd0a4d07a2af91
When an action reaches the limit, the remaining filters are not executed.
But there is no way find out which one it was.
Bug: T71492
Change-Id: I28fac76d4e9ca341bed25cd35e1249b19586b773
Added the contains_all function, with basically the same role as
contains_any but using logic AND instead of OR. Also added
ccnorm_contains_all, that is the same of ccnorm_contains_any but with
AND mode. Finally, fixed three wrong task IDs.
Co-authored with Valerio Bozzolan.
Bug: T21176
Change-Id: Ib0a8b783db6ce0d5db64771c8e0c70f0f8d13d36
