Commit graph

1706 commits

Author SHA1 Message Date
jenkins-bot 595b0a9969 Merge "Ensure IP, XFF and UA are valid for abuse filter user actions in CheckUser" 2023-01-06 20:51:17 +00:00
jenkins-bot 1ff0e96e38 Merge "Replace VariableHolder::$forFilter" 2023-01-05 21:23:24 +00:00
jenkins-bot 24d797e6cc Merge "Create real integration test for variables" 2022-12-22 02:07:02 +00:00
Matěj Suchánek 3e0d1b0d38 Set old_content_model & new_content_model for past changes
We might consider adding an in-process cache because there
will be a duplicate database lookup for content model and
wikitext of the same revision.

Bug: T230295
Change-Id: I9723f21069e03a49fa7131bd8f79c6e7e442104b
2022-12-18 16:01:45 +00:00
Matěj Suchánek 396d892c60 Use ActionSpecifier to load the IP address
To avoid access to the global request context.

Change-Id: I4d97dbe8b693f1fcd5a4e84f2376752d8e954c18
2022-12-17 22:52:24 +01:00
Matěj Suchánek 52dcd4624f Use ActionSpecifier throughout the code
The motivation is to have a single immutable object providing
information about the action. It can represent the current
action being filtered, but also a past action stored in the
abuse log. It will hopefully help us get rid of passing
User(Identity) and Title/LinkTarget objects around together.

Change-Id: I52fa3a7ea14c98d33607d4260acfed3d3ba60f65
2022-12-16 22:52:03 +00:00
Umherirrender 4139e5ef05 pager: Avoid unneeded database connection
Change-Id: Id548d1adab39c4a9b4e7ead4c87510b2fed39ff1
2022-12-11 13:06:08 +01:00
Umherirrender 6d65684a34 Replace deprecated Linker::commentBlock
Bug: T324906
Change-Id: I3b8f9b1295315d3a3cae6bbda2c5553129d2ba13
2022-12-10 22:32:53 +01:00
Matěj Suchánek dc59cad0a5 Replace VariableHolder::$forFilter
Each generator knows in which situation it is executed, and it
can pass this information to the computer. VariableHolder should
just hold the variables.

Change-Id: I0fb2e01e3e9457cd63948afe2a20439a1c800790
2022-12-02 08:10:15 +01:00
Matěj Suchánek 702d77e3ce Create real integration test for variables
For fixing bugs like T65632, T105325, or T264104, we will need
to update code in more than one place at once. To prevent
regressions, create an integration test which tests the whole
pipeline, from the request submission to variable evaluation.
Edits are simulated using action=edit API call because the hook
AbuseFilter uses is run from EditPage.

To increase confidence in test coverage, remove some annotations
from AbuseFilterConsequencesTest or make them less greedy.
Ideally, it would only test consequences.

This patch includes refactoring of AbuseFilterCreateAccountTestTrait
which now only inserts the user into the database if it really
should be created.
It also restores test coverage of some other classes.

Change-Id: I661f4e0e2bcac4770e499708fca4e4e153f31fed
2022-11-26 18:51:38 +01:00
Jon Robson 62e96a46a8 Register AbuseFilter menu as standard tabs
Core now supports special pages registering sub menus
natively in skins. The menu is rendered when the skin
supports it, so at current time of writing this will
only work in Vector 2022 and MinervaNeue.

The existing menu that appears under the abuse filter
page title is converted into the new format. For other skins
no difference.

Bug: T315553
Change-Id: Ief51a9c60125c11e3b735fabee2a4544b7955f64
2022-11-17 16:35:34 +00:00
Reedy 4f4f01f96d EchoNotifierTest: Use namespaced Event class
Re-enables test

Depends-On: Ib57ea2db947285946f31fa9912b37181044df9d3
Change-Id: I082868f4759a5da14235803ebd8a80e794cfe41c
2022-11-12 06:28:33 +00:00
dreamyjazz 627a73ec5e Ensure IP, XFF and UA are valid for abuse filter user actions in CheckUser
Change the IP to 127.0.0.1 (to indicate an internal IP), and blank
the XFF and UA when the performer of an action being logged by
CheckUser is the abuse filter user. Actions performed by the abuse
filter user can only be initated by the software, and as such should
not use the request's IP, XFF and UA. Also test the newly added
code.

Bug: T44345
Depends-On: I28acaaebd2d0067b700da0930e7b7ba924fa5c1c
Change-Id: Idd77545af94f9f9930d9ff38ab6423a72e680df9
2022-11-11 23:19:22 +00:00
thiemowmde 8f50f2a1a6 Fix missing null check for deprecated configuration
$wgAbuseFilterAnonBlockDuration is documented to be deprecated and
fall back to $wgAbuseFilterBlockDuration. This was just missing here.
This makes code fail in PHP 8.x where null is not allowed any more in
functions that expect a string.

Change-Id: I0edb0f14630aed88635aa564a11d6f42e470c29f
2022-11-04 15:36:13 +00:00
samtar e9e45cd225 AbuseFilterPermissionManager: Add sitewide block check
Add sitewide block check to `canViewPrivateFilters`

Bug: T296137
Change-Id: I2e4bceb8e35424d5c0c5ea902ed8f682bd33b6dc
2022-10-21 17:34:01 +00:00
Daimona Eaytoy 6a48423861 Avoid phan suppression
Document the parameter as non-empty instead.

Change-Id: Ia0f6b231fd05da82c1967e6b4e22bdd258435bba
2022-10-09 13:57:39 +02:00
libraryupgrader 380f7b010a
build: Updating dependencies
composer:
* mediawiki/mediawiki-phan-config: 0.11.1 → 0.12.0

npm:
* stylelint-config-wikimedia: 0.13.0 → 0.13.1

Change-Id: I424244de96b2da894d781047a1e336514cb7707c
2022-10-07 21:05:41 +03:00
Brian Wolff c6d3e6638c Explicitly cast mod (%) operhands to ints.
PHP does this automatically, however in PHP8 this causes an
E_DEPRECATED warning.

This fixes a phpunit test

Change-Id: Ie2b2dbf4a1c0ff500ba251ee43a37823432e3047
2022-10-03 08:30:45 -07:00
Timo Tijhof d2fc2ff8bb maintenance,includes: Clean up file headers
Follows-up Iaa1b4683c5c856.

* Match $IP pattern verbatim from most other WMF extensions.

* Improve descriptions a bit, and move/merge any meaningful
  information from file docblock into class docblock. The file blocks
  are visually ignored and identical in each file, and often out of
  date or duplicated when given text separately from the class block.

  See also similar changes in core:
  https://gerrit.wikimedia.org/r/q/message:ingroup+owner:Krinkle

* Use `@internal` instead of `@private` as per Stable interface
  policy.

Change-Id: I8bed9a625af003446c7e25f6b794931164767b5a
2022-09-29 17:56:49 +01:00
jenkins-bot 415a958cf1 Merge "Use DISTINCT on LazyVariableComputer::getLinksFromDB" 2022-08-06 22:57:46 +00:00
Umherirrender 9c3fc24f85 Use DISTINCT on LazyVariableComputer::getLinksFromDB
A protocol-relative URL has two entries for el_to in externallinks table,
the different is on the el_index colum

Bug: T314373
Change-Id: I3d6229aaa10a089baf15d5ba3407f6a8870429e3
2022-08-02 11:27:31 +00:00
Matěj Suchánek 86c2695557 Treat consequences params less aggressively and consistently
In theory, it's possible that some consequences could use "0"
as one of their parameters. At least change tags, see T296642.
But PHP treats "0" as false.
Also make the code on all places consistent.

Change-Id: I5255dfb26878ceb4f78c4d8277521edbb4821d7d
2022-08-02 11:57:48 +02:00
Matěj Suchánek 08f42494d3 Send CheckUser the IP address on account creation
We mask the IP address on purpose, so that it is not
leaked to the abuse log. This breaks CheckUser because
it attempts to assign an actor id to the "fake"
(uncreated) user account. So unmask the IP address
when we send the data to CheckUser.

Bug: T233004
Change-Id: Ib58193927bc8254d36a8de0fd1b5f9fba68a0cb0
2022-08-01 09:17:35 +02:00
Umherirrender 4fca77068c Clean up line indent with mixed tabs and whitespaces
Change-Id: Icc418130ad34e5f169bfc51bb13b58a7806bd636
2022-07-31 16:34:07 +02:00
jenkins-bot a017d73509 Merge "Make a separate method for ManualLogEntry construction" 2022-07-31 12:57:46 +00:00
Matěj Suchánek f142fee102 Make a separate method for ManualLogEntry construction
This step is a simple copy-paste. In the next step,
we will change the code a bit.

Change-Id: Id303a5da33ce0bbc0b58656a3f935f6f4c02d84c
2022-07-31 12:39:43 +00:00
jenkins-bot 2cff210d31 Merge "Use UserIdentity in VariableGenerator::addEditVars" 2022-07-30 13:55:24 +00:00
Umherirrender 7e8162c705 Special:AbuseFilter: Include primary key for unique pagination
A unique column is needed in the order to ensure the next offset is
correct and does not skip items

As mention in the doc for IndexPager::getExtraSortFields the extra
columns are not for pagination, only to help the optimizer building a
better query plan by mention denormalized columns.

Bug: T191694
Change-Id: I9fb9f848a0b165dbaa0a2b31d9504324f43578de
2022-07-29 17:38:13 +02:00
Umherirrender 081a8e3c3c Add LinkBatch to Special:AbuseFilter/home and /history
Combine the check for red/blue user/talk links into one database query
This can improve the performance of the page view when many filters
from many different users are linked

Change-Id: I0b87ee15ecee4cecd5d5d6164e8c18e1b788ecd1
2022-07-29 13:56:03 +02:00
Umherirrender da4bc8643a Use UserIdentity in VariableGenerator::addEditVars
Change-Id: If0a65d7a86de776e6499d43949bfb217f20d9b07
2022-07-29 12:55:52 +02:00
jenkins-bot f13f3dcd2c Merge "Call IContextSource::getAuthority instead of IContextSource::getUser" 2022-07-29 10:25:23 +00:00
Matěj Suchánek 3914c913e3 Remove deprecated static methods
They are unused in Wikimedia code (finally).

Change-Id: I74c81d950d992552d3edf184b5eecc46e5e2c567
Depends-On: I62533e21d2bc1a22c3fcba4c7c650ca9d95700ef
Depends-On: I95ce9897d89213e358c436135278b729f0adc3a2
2022-07-27 13:01:10 +02:00
Umherirrender 11386c312d postgres: Fix changeNullableField calls
Follow-Up: I97cb12e6aa25d75ea24e187174db2fe88e5ce790
Change-Id: I61b8e102fd5041685941d89995f54a23ff5509c8
2022-07-13 22:13:48 +02:00
jenkins-bot eb20298739 Merge "Convert to abstract schema" 2022-07-13 16:47:22 +00:00
jenkins-bot 4329c21ba7 Merge "Delimit namespace and title text in warning keys" 2022-07-07 18:40:24 +00:00
dreamyjazz 0bb914c482 Add a space between the checkbox and timestamp in Special:AbuseLog
Add a space between the checkbox (shown for users who can hide abuse
filter entries) and the timestamp so that it looks nicer.

Change-Id: I6e495f8cb56ad8f0b53f06d2aecb8ac34b16ff25
2022-07-07 15:51:34 +01:00
jenkins-bot c3c70f7fa0 Merge "FilterProfiler: use WRStats" 2022-07-06 00:05:15 +00:00
Tim Starling cdf2f474e8 FilterProfiler: use WRStats
A new core facility written for this use case.

Bug: T310662
Depends-On: I26b1cdba0a06ad16ad8bb71b455e1b6180924d17
Change-Id: I2b902d034a8c3308c0ba9878b69e873ca8fbda52
2022-07-06 09:35:08 +10:00
dreamyjazz 13e6c1c06a Add the ListToggle to Special:AbuseLog for users who can hide entries
Add the ListToggle provided in core's ListToggle.php to
Special:AbuseLog when a list of abuse filter entries are being
shown and the user can hide abuse filter entries. This will allow
them to select multiple checkboxes to hide at once (without having
to shift and selecting the first and last).

Bug: T311954
Change-Id: I1aa4fa3fa7016a5d9ae4a904c151011743d2c8ed
2022-07-03 16:56:03 +01:00
Umherirrender dc4dd928b7 Call IContextSource::getAuthority instead of IContextSource::getUser
Change to use Authority object where possible
to use the interface instead of implementation

Change-Id: I90ef126b3d799c3fc27467a4ffe671785c446d3e
2022-07-03 16:37:18 +02:00
jenkins-bot 2709583b52 Merge "Clean up AbuseFilterViewExamine and AbuseFilterExaminePager" 2022-07-03 14:16:57 +00:00
Matěj Suchánek be247401bb Clean up AbuseFilterViewExamine and AbuseFilterExaminePager
Move most stuff from the pager to the view class to untangle
circular dependency. Declare class properties as private.
Leave input validation to the form.

Change-Id: Ia8b1a9d08af9c0cac23b34f6bbbe2c44d01f6c8c
2022-07-03 11:29:43 +02:00
Matěj Suchánek e7492a230f Replace unnecessary use of User
In action=abusefilterunblockautopromote, leave UserIdentity
instantiation to the parent. Note that this changes the "code"
in the response from "baduser_user" to "baduser".

Change-Id: I97d2bf3fa3c5486e461823f840cad2763e1bcfea
2022-07-02 23:58:08 +00:00
Matěj Suchánek 799e1db093 Convert remaining permissions checks to use Authority
Change-Id: I5e996cac37bc806db6c3d7ad5c666a606cd79236
2022-07-02 14:49:47 +02:00
DannyS712 139ca18efe Migrate AbuseFilterPermissionManager to authority
Almost all callers already provide an Authority in the form
of a User object, so mostly just need to change the typehints

Depends-On: I58661943c7e1acb6ff09798ee1a30be0fde3f459
Change-Id: I2ad86859c8194c14d7331f58db62b7cff4698085
2022-07-01 06:58:17 +00:00
Matěj Suchánek 3b5b3cbae7 Show syntax error message in an error box on Special:AbuseFilter/test
Otherwise it's barely noticable.

Change-Id: Iff10036996c9e190c850d0b24f3ea0817624b95f
2022-06-30 20:23:22 +00:00
Matěj Suchánek 93acf0d80b Delimit namespace and title text in warning keys
Bug: T311543
Change-Id: I20f42d27d35390dcba96cc26bcc245cbeeff59f5
2022-06-29 19:39:24 +02:00
Matěj Suchánek 60e03c965e Fix form input normalization
Prevent invalid assignments to properties. On
Special:AbuseFilter/test/123, handle when id of
a non-existing filter was provided. Allow '0'
as user and title on Special:AbuseLog and
Special:AbuseFilter/test.

Change-Id: I196ae62b165d1a60babaf4fe6bd733aa52be1726
2022-06-29 12:19:24 +02:00
jenkins-bot 8d4c5d4d33 Merge "Use LinkTarget in ConsequencesExecutor" 2022-06-29 08:52:37 +00:00
Reedy 60cb198e81 SpecialAbuseLog: Don't call explode() on null
Bug: T311579
Change-Id: I2481beb2344a57242795a722e255e119ea29ac18
2022-06-29 01:14:07 +01:00
jenkins-bot 8ee28b2373 Merge "pager: Declare Title only for local filters" 2022-06-28 21:40:48 +00:00
Matěj Suchánek 4beca85154 Compute user and page age relative to recent change timestamp
These are apparently the only two variables for which we can
quickly determine their value in such simple way.

Later, we can also try it for recent contributions.

Bug: T102944
Change-Id: Iecfa9e5c5ba8c078691334b676cc6f289790cb74
2022-06-28 20:53:33 +00:00
jenkins-bot e6c61b94f3 Merge "Replace deprecated HTMLForm methods" 2022-06-28 19:47:11 +00:00
jenkins-bot 5f7e69757c Merge "pager: Fix LinkBatch for user name" 2022-06-28 19:33:19 +00:00
jenkins-bot c8dacb59d9 Merge "Use UserIdentity/Authority in SpecialAbuseLog" 2022-06-28 19:33:10 +00:00
Matěj Suchánek 5dca456535 Replace deprecated HTMLForm methods
Change-Id: Ic9ba981b94541b181acf88c3c40c205ab81962a8
2022-06-28 19:01:54 +00:00
Matěj Suchánek 7ae2060b27 Avoid array to object cast in filterToDatabaseRow
Both callers immediately call get_object_vars
to cast it back to array. Avoid this roundtrip.

Change-Id: I6525d76f8a03a4d28c2b50b580c539affe98064f
2022-06-28 18:46:28 +00:00
Umherirrender 1f8e6f5737 pager: Fix LinkBatch for user name
Adding the user id to the LinkBatch does not preload the correct page

Change-Id: Iacc852fe1f3ee74849af6146218aecaff70363d9
2022-06-28 20:37:41 +02:00
Umherirrender 5c8296393c pager: Declare Title only for local filters
No need to get the Title for the global filter

Change-Id: I9d282f0112e7e380615ea3760c17f02792694113
2022-06-28 20:33:46 +02:00
Umherirrender 20fd8f7b07 Use LinkTarget in ConsequencesExecutor
The Parameters class already only needs a LinkTarget

Change-Id: I4e8e1d7c92f41502a084be3359b97e0d434f08c0
2022-06-28 19:46:50 +02:00
Umherirrender 9abc464e3d Use UserIdentity/Authority in SpecialAbuseLog
Change-Id: I5b3b2b758e17c94298e7217d755dd8c7b08cb1ac
2022-06-28 19:30:37 +02:00
jenkins-bot f9a2d4cf6c Merge "Use UserIdentity in FilterStore::doSaveFilter" 2022-06-27 21:56:57 +00:00
Umherirrender 5f979bcf16 Use UserIdentity in FilterStore::doSaveFilter
Change-Id: I8cbdaff1bd049a893b69f2ce13f0ba30b96f93b4
2022-06-27 22:39:37 +02:00
Umherirrender 30fefb75bf Use UserIdentity in ConsequencesExecutor
Change-Id: I281a30610595ed3e984f43aa747eff37abe72939
2022-06-27 22:05:18 +02:00
Daimona Eaytoy f33bc5868c Set the 'timestamp' var in addGenericVars
This was most definitely my intention when I introduced the concept of
"generic vars", so it's a bit surprising to discover, 3.5 years later,
that the timestamp isn't computed there.

Also make the timestamp always be a string for consistency, since that's
the type documented on mw.org. I've manually checked all filters on
Wikimedia wikis using the timestamp variable, and added explicit int
casts where needed (although I think they'd still work due to implicit
casts).

Change-Id: Ib6e15225dd95c2eead7e48c200d203d6918e0c18
2022-06-26 14:49:40 +02:00
Matěj Suchánek 40c5712311 Pass RecentChange to addGenericVars
Change-Id: Ia843c23b46ecf8e9fe987a538a09e69f845f4488
2022-06-25 13:03:03 +02:00
jenkins-bot f78a92cb2e Merge "Remove $info argument from ReversibleConsequence::revert" 2022-06-24 02:07:31 +00:00
Umherirrender e18136f269 Convert to abstract schema
Rename index on postgres and fix nullable fields

Bug: T259377
Change-Id: I97cb12e6aa25d75ea24e187174db2fe88e5ce790
2022-06-20 17:19:57 +00:00
Tim Starling 855347b4a4 Configure FilterProfiler cache separately
Since it seems to be the bulk of the traffic to the mainstash in
production.

Bug: T212129
Change-Id: Id20223ac03ada16b3ad4bd47744dea5e415cf160
2022-06-14 15:30:02 +10:00
Matěj Suchánek 40564ca635 Remove $info argument from ReversibleConsequence::revert
It was a temporary catch-all variable, but we can replace it
(and probably won't need it).

Change-Id: Ie1a64455c47445050bd83c853b3cafd283d5d020
2022-06-08 11:59:18 +02:00
jenkins-bot 6fe7cd9648 Merge "Add class to AF log contribs link" 2022-06-07 08:11:46 +00:00
jenkins-bot 1a6985469b Merge "Inline/simplify smaller pieces of duplicate/complex PHP code" 2022-06-03 20:38:22 +00:00
Thiemo Kreuz bbded6231c Inline/simplify smaller pieces of duplicate/complex PHP code
Change-Id: I59d0f17b77c8c3d47bc532bdefd9d8c0883f180b
2022-06-03 21:04:38 +02:00
TerraCodes 2c0e61a030 Add class to AF log contribs link
Continuation of MW core change 603941

Change-Id: I16ade657179fdce40b8acb7f8be8cde8b9a64949
2022-06-02 09:34:38 +00:00
jenkins-bot bb94c0914c Merge "Add support for regex string replacements." 2022-05-31 14:54:33 +00:00
jenkins-bot f0ae0ec101 Merge "Optimize loop in 'diff-split' case" 2022-05-21 18:32:31 +00:00
Matěj Suchánek d4b15cb7ee Optimize loop in 'diff-split' case
The "substr( $line, 0, 1 )" expression has already assumed
the prefix has length 1. Therefore, it's pointless
to compute its length later. The assumption does hold,
the only two prefixes the code works with are '+' and '-'.

Not changing the check to use str_starts_with now, because
it was suggested in I113a8d052b6845852c15969a2f0e6fbbe3e9f8d9
that this shouldn't be done for performance-sensitive code
at least until we are on PHP 8.

Change-Id: I00cb2fc50ed534bb2bbef3ee1e5f6f466afeeb27
2022-05-21 18:07:21 +00:00
jenkins-bot 00ad47bab3 Merge "Fix validation for ip_in_ranges" 2022-05-21 15:24:20 +00:00
jenkins-bot 2779c92cf7 Merge "Add ip_in_ranges function" 2022-05-21 15:15:17 +00:00
Daimona Eaytoy a46db47bd5 Fix validation for ip_in_ranges
We want to make sure that all parameters are valid regardless of whether
there's a match.

Also make the minimum number of parameters = 2, so it's easier to switch
between this function and ip_in_range.

Change-Id: I141558a7ef4533485e315b3d93ea9b64f0959db7
2022-05-21 15:39:21 +02:00
jenkins-bot f1ccb60272 Merge "AbuseFilterViewDiff: simplifications to prepare for refactor" 2022-05-15 23:05:32 +00:00
fossifer b1739a588f Add ip_in_ranges function
Added support for ip_in_ranges which allow multiple ranges to be
checked at the same time. If the IP is in any of the ranges, the
function returns true.

Bug: T305017
Change-Id: Ic75c87ecd4cacf47ce2ff1b04173405230ff81d0
2022-05-11 12:27:16 +08:00
DannyS712 9de0b19ba4 AbuseFilterViewDiff: simplifications to prepare for refactor
Clean up the existing code a bit before refactoring to be reusable
for a diff button in the edit form.

Includes:
* use the Html class rather than the Xml class for building the display html, and avoid manual
html strings

* replace formatVersionLink() with getVersionHeading() to reduce duplication in the handling of
the headings for the old and new versions, and in the process fix the name used as a parameter to
the old version heading (should be the old version editor, not the new version editor)

* rename some parameters for clarity

* organization and other cleanup

Bug: T180954
Change-Id: I1c02f407e72789a871a23b0d4a279a5c341b1e93
2022-04-30 19:31:21 +00:00
Thiemo Kreuz be3af66876 Simplify code dealing with filter ids in FilterStore
Before the information if a filter was new was stored in 2 places:
In the bool $isNew and in the two variables $filter and $newID.
$newID was especially confusing because it was used for both old and
new ids.

Change-Id: I15bdf36c96c8d86a37f305aab2647f7d57bc2bf1
2022-04-27 19:29:55 +02:00
jenkins-bot b1ea4f2d69 Merge "FilterStore: Use upsert instead of replace" 2022-04-27 11:58:24 +00:00
Thiemo Kreuz a25e2c784a Fix capitalization of method calls accross the codebase
Change-Id: Icbbad4858735c24611daee693c53af479c75d1fb
2022-04-26 17:42:34 +02:00
Amir Sarabadani c1d8037815 FilterStore: Use upsert instead of replace
You should never write to auto_increment value.

Bug: T306692
Change-Id: I363711336658a24a0dedf42643296185dfa4a024
2022-04-26 17:10:03 +02:00
Umherirrender 89df7dfddb Remove index detection 'rev_page_timestamp'
Rename in 1.37

Change-Id: Ia9a7682f9f9751de3071b0a644d945dbbd3ed824
2022-04-22 19:26:36 +02:00
proc 1d1215bafb
Add support for regex string replacements.
Bug: T285468
Change-Id: I25f8ad1b58cc10f4c6f6ef5ebab99fe58ec71b1e
2022-04-20 18:38:24 +01:00
Daimona Eaytoy 59eb3b70fb Inject dependencies into the authentication provider
- Define it with the extension.json key, instead of using the
  registration callback
- Inject the services it needs
- Replace direct User instantiation with UserFactory
- Move log subtypes to extension.json as well

Change-Id: I86a761c7fa844b1f417b974798373622a15f6411
2022-04-09 18:44:25 +02:00
jenkins-bot c7903f9a7c Merge "Fix check for null Content in getEditTextForFiltering" 2022-04-06 17:40:31 +00:00
gerritbot 8e55018613 Fix usage of ApiBase::PARAM_* deprecated constants
The ones that are replaced with ParamValidator

Bug: T275455
Change-Id: If1fbef4707eecd7a6bfa5947614fe46d70c62dd6
2022-04-04 00:49:37 +00:00
gerritbot a617a846f0 Replace deprecated ApiBase::PARAM_ with IntegerDef ones
The rest of ApiBase::PARAM_  will be done in separate patches

Bug: T275455
Change-Id: I1c836d2d85e3004e8b6b1a53e11770910acc0616
2022-04-03 22:13:20 +02:00
Matěj Suchánek 58dfab4aeb Fix check for null Content in getEditTextForFiltering
The check was not consistent and the code could still crash
when $oldContent was null. RevisionRecord:getContent only
returns null when audience check fails, but we don't ask
for that.

Change-Id: Id64646a6762167f552e104f623130bedc6b2dd18
2022-04-03 13:06:24 +02:00
jenkins-bot 59def97891 Merge "Use RestrictionStore instead of deprecated method" 2022-03-30 09:59:35 +00:00
Matěj Suchánek 686d7ea88c Use RestrictionStore instead of deprecated method
Also restructure the unit test a bit.

Change-Id: If5ce26f1bc4efdb29653aed3fc47335dddc1e44c
2022-03-29 16:11:55 +02:00
jenkins-bot 50311e750d Merge "Remove SpecialAbuseLog::isHidden" 2022-03-27 18:27:05 +00:00
Func 24f5ca6e2d Use setTitle() instead of setAction() where posible
The getLocalURL() method can return url with query string when
wgArticlePath is configured to do so, and query string of GET form
would be ignored by browsers.
The setAction() method is problematic (T285464 and above) and hard to
warn the wrong usage. I'm going to go through and fix every use case,
and finally deprecate it.

Change-Id: I66b634f0cc996be3d7048d410b46fe77c88f9879
2022-03-27 21:06:38 +08:00
Daimona Eaytoy 773d553c8e Remove SpecialAbuseLog::isHidden
This is a breaking change for the API: 'hidden' is now either true or
false, depending on afl_deleted. 'implicit' is no longer a possible
value, the caller should compute it instead if necessary.

Then simplify the remaining usage of isHidden, using a temporary private
method.

Bug: T291718
Change-Id: I97b5195d306c35ddca3f071d9ff4d896f9fd5c8d
2022-03-25 21:22:59 +00:00
jenkins-bot def507f6d3 Merge "Refactor ConsequencesExecutor to process consequences in more steps" 2022-03-23 09:06:55 +00:00
Func 3ff1a7f34d ViewRevert: Adjust use cases of HTMLForm
Use setTitle() instead of setAction(), T285464.

HTMLForm would set edit token for post form, use setTokenSalt() to amend.

HTMLForm would fetch user input value from the request itself, since
the two form shared the same field name, the 'default' params assigned
are unfunctional.

HTMLForm would prefix descriptor keys with 'wp' as the default name
of generated input fields, make use of this feature.

Bug: T285464
Change-Id: I2cc3c1d042998b65df5ee51f0715fe25a5e18e72
2022-03-20 23:28:06 +08:00
Daimona Eaytoy 2de5fce177 Refactor ConsequencesExecutor to process consequences in more steps
Introduce shorter methods, one for each steps, so that it's easier to
understand what the code is doing and figure out if the order makes
sense. The ConsequencesExecutor test is now a proper unit test. Also
simplify AbuseFilterConsequencesTest, removing old/wrong logic and
fixing two expected values that were actually wrong (but worked because
of the aforementioned wrong logic).

The only functional changes should be:
 - We pick the longest block *after* checking the ConsequenceDisabler
   consequences, so e.g. if a filter has a long block + warn and another
   filter has a shorter block, we still keep the second one if warn will
   disable the block.
 - Remove disallow in presence of dangerous actions after checking
   ConsequenceDisabler's and deduplicating blocks. Otherwise we may
   remove disallow for filters where block (etc.) doesn't end up being
   disabled. We may also want to consider not removing disallow at all,
   now that messages are customizable.

Bug: T303059
Change-Id: If00adbf2056758222eaaea70b16d3b4f89502c20
2022-03-19 15:49:36 +00:00
jenkins-bot 1e105c8821 Merge "Cast filter id to integer in AbuseLogPrivateDetails output" 2022-03-12 17:22:55 +00:00
Matěj Suchánek 7232bfc647 Cast filter id to integer in AbuseLogPrivateDetails output
Change-Id: If4a1bf4181e3a84281299bf4aa66fd314100f3dc
2022-03-12 12:37:47 +01:00
Matěj Suchánek 222aebab91 QueryAbuseLog: Cast revision id to integer
Change-Id: Id670a1cd7e3695211b202dba45b60c9f9c69649e
2022-03-12 01:19:56 +00:00
Alexander Vorwerk 4aedfe8d91 Use updated ObjectFactory namespace
Change-Id: I99c5e5664d2401c36a9890f148eba7c25e6e8324
2022-03-09 22:17:07 +00:00
Daimona Eaytoy d5bb976f51 Fix logging for parser exceptions
This was likely a rebase artefact or something: the 'implode' was meant
to be called with two parameters as usual. Currently, the parameters are
simply concatenated which makes the logs quite hard to read.

Change-Id: I84f9a7cb05e210f60a791d513dfb5b74fa7dfb8a
2022-03-07 13:32:54 +01:00
jenkins-bot 894b94bf7d Merge "Add logging when the 'block' action fails" 2022-03-07 09:26:42 +00:00
jenkins-bot 3da40866f8 Merge "Move throttle range sizes to class constants" 2022-03-06 20:22:13 +00:00
Alexander Vorwerk 9bc01b4986 Use namespaced Renameuser classes
Change-Id: Ibac446d50a34a26182b801fa15c8a8ddffd2eea0
2022-03-06 17:10:41 +00:00
Daimona Eaytoy 4b6fff36e1 Move throttle range sizes to class constants
Change-Id: Iac436578f94022762b7f67959af894261c59fc66
2022-03-06 16:37:11 +01:00
Daimona Eaytoy a0fd0bae01 Overhaul throttle identifiers
- Use a /64 range for IPv6 instead of /16.
- Fix a curious and serious bug for IPv6, where grouping by range
  would only use the first (!) number of the IP address, due to the
  'v6-' prefix returned by IP::toHex.
- Fail hard if the identifier is unknown -- it's not something that's
  supposed to happen.
- Include the type name in each identifier, instead of prefixing all
  type names to all identifiers. This makes it easier to understand the
  parts of the key.
- Test the whole lot.

Bug: T211101
Change-Id: I54c4209f2f0d5a4c5e7b81bed240ca3e28a2ded7
2022-03-06 13:31:06 +00:00
Daimona Eaytoy 496c2ee370 Add logging when the 'block' action fails
Also avoid using User, use Authority instead.

Bug: T303059
Change-Id: I419ab3726d95ef600e2aa14dca5fa14066d245e3
2022-03-05 19:12:53 +00:00
russ-rogovetz 3505fa63f6 Change comment for TextExtractor getNativeData to getText
Update TextExtractor comment, change Content::getNativeData to TextContent::getText.
Code got already updated.

Bug: T283667
Change-Id: I09e3c537c7e55737d79e69abdd3b7faf693e58cc
2022-03-04 11:01:13 +02:00
Umherirrender 533e3dc5da Use new namespace for MediaWiki\Revision\RevisionLookup
MediaWiki\Storage is alias since 1.35

Change-Id: I1688cb27847b9154c5133b157ac9c18bd4859a47
2022-02-26 20:39:01 +01:00
jenkins-bot 829009b8d9 Merge "Normalize logged parser error messages" 2022-02-26 16:45:40 +00:00
jenkins-bot ac0ed20e4f Merge "Improve debug messages of loading ext. links" 2022-02-26 14:26:13 +00:00
Daimona Eaytoy 2f5a587b1d Normalize logged parser error messages
Change-Id: I31cf73533a46ab5e452c2870fccb8603bb54d3df
2022-02-26 12:57:42 +01:00
Daimona Eaytoy b5c22f2b77 Improve wording for throttled filter warnings
List which actions were disabled, or explicitly say that no actions were
disabled if that's the case. Also avoid the word "throttle" in messages
as it may be hard to translate. Also don't suggest optimizations to the
filter conditions -- unoptimized rules have nothing to do with a filter
being throttled.

Bug: T200036
Change-Id: Id989fb185453d068b7685241ee49189a2df67b5f
2022-02-22 11:10:19 +00:00
Daimona Eaytoy 167f6cb642 Introduce ActionSpecifier
This is a plain value object that represents the action being filtered,
replacing associative arrays that were being used up to this point.

We should now check whether it's possible to make it not require an
accountname (which complicates things), and then use it in related
classes as well, e.g. Parameters.

Change-Id: I9550c14819b600c97c46b632cc1c2d447972d69c
2022-02-18 11:30:56 +00:00
Matěj Suchánek 95c0978dc6 Clean up AbuseLogPager
- Make $mConds private and rename it.
- Use the injected permission manager.

Change-Id: Ie92b63da50264226bde5b3b361916bb31fd9448e
2022-02-11 11:21:12 +01:00
jenkins-bot 6b9098eae1 Merge "Replace use of deprecated OutputPage::enableClientCache( false )" 2022-02-10 07:01:54 +00:00
Reedy 62380ccb9a Drop non namespaced back compat aliases
Change-Id: I013959b13e233b6ee577d2b959c2f222687b0c7b
2022-02-06 14:16:10 +00:00
jenkins-bot 59e2bfcaff Merge "Make rmspecials preserve whitespace" 2022-02-06 06:22:38 +00:00
Huji 52827acbab Make rmspecials preserve whitespace
The existing filters on WMF wikis has been changes such that calls
to rmspecials() are now rmspecials(rmwhitespace()) to ensure no change
is made in behaviour. Filter admins can change this back if filter is
not meant to trigger when part of the input is contains spaces.

Bug: T263024
Change-Id: Idde09b50fb8eda357afbedc1199a5483fa8217c1
2022-02-06 06:07:46 +00:00
C. Scott Ananian aecfc7e62e Replace use of deprecated OutputPage::enableClientCache( false )
Replaced with the more readable ::disableClientCache() method, added
in 1.38.  Minimum MW version bumped to match.

Depends-On: I7c89e20528a0d91173f0edcb997dcae631935ee5
Change-Id: I91d0b8e8f69a2d309b6fc61e13bfb5d86dc0218d
2022-02-04 14:29:43 -05:00
Matěj Suchánek 238649ebc1 Declare AbuseFilterView::$mParams as protected
It is not supposed to be read or written to by other classes.

Change-Id: I02fe2861a6102ddf1a587cdd7e7423a62d8e0c57
2022-02-02 12:32:09 +01:00
Matěj Suchánek 2694751355 Don't implode and explode links
old_links and all_links are an array. Casting
them to string and then splitting by newlines
is a no-op.

Change-Id: I05c69f14e981ac2842032e7db888f4841d6b48b7
2022-01-24 12:58:56 +00:00
Amir Sarabadani d1ce258a9b Use MainStash instead of db-replicated
We should avoid using ObjectCache directly and use services instead. On
top of that, db-replicated writes to objectcache table that should be
avoided and it's now blocking schema changes.

This should go to MainStash.

Bug: T272512
Change-Id: I9c76399ec4c0ea6644f9ca1b4536428052e5ac38
2022-01-19 18:51:19 +01:00
Alexander Vorwerk d22ea2b57e Don't use array keys for OOUI in AbuseFilterViewDiff
Bug: T299463
Change-Id: I3d02e18566532e9e4824a089c9504ec13b6ad33e
2022-01-18 22:57:02 +00:00
Alexander Vorwerk edcefa729c Don't use array keys for OOUI
Bug: T299463
Change-Id: Id1f6e0c43db38003c1b198ab86c37b1c37412124
2022-01-18 23:20:32 +01:00
Thiemo Kreuz 489cfa4f3d Don't use array keys for OOUI GroupElement items
Change-Id: Id120e49c7e6d62c1ad30a3109afbe9bf77c4d81d
Required-For: I7a19fba8bce65640bdb69b3a63812537e1d29af3
2022-01-13 16:37:04 +01:00
Matěj Suchánek 1d31c86ee4 Improve debug messages of loading ext. links
These are not necessarily old links, the new links
can also be retrieved using this code path.
Also print debug messages before the code execution.

Change-Id: I1a85bb7b5a2af4fe514625d2236cf92f15daf304
2021-12-19 14:19:16 +01:00
Alexander Vorwerk e0b781e32e build: Upgrade mediawiki-phan-config to 0.11.1
Somehow LibUp-Bot is not doing this. The last run for Abusefilter was a
month ago.

Change-Id: Id9ee5a73f403d8391937d699727470cb78e959aa
2021-12-05 11:29:54 +00:00
jenkins-bot 3cb985ad7e Merge "Update docs after PP limit report core change" 2021-12-04 12:46:46 +00:00
Umherirrender 1b2551701e Avoid SpecialPage::getContext in SpecialAbuseLog::__construct
The special page itself is a MessageLocalizer
SpecialPage::getContext on constructor results in global state

Change-Id: I6a3dd263dbe02111aea65a087ce69a5a191f63fc
2021-11-09 22:09:49 +00:00
Daimona Eaytoy 4344d4e438 Update docs after PP limit report core change
The report is now generated in ParserOutput, not Parser, meaning we can
simply avoid passing the `enableLimitReport` option (off by default) if
we don't want the report to be there.

Depends-On: I154c0a77a5b0287b5572614d56339fb57ac56c33
Change-Id: I8cdab35c475f10433234ddb55b5e6a0cc8109498
2021-11-09 13:33:42 +00:00
Daimona Eaytoy 5e95676e99 Rename filter_timestamp index in a different file
Otherwise there might be interferences with the remove-afl_filter patch.

Bug: T291725
Change-Id: If339663d491e1da4a118c13cd667d228365b4864
2021-10-20 15:22:04 +02:00
Daimona Eaytoy f2e2f5ae48 Move renaming of the afl_wiki_timestamp index to its own file
Note that this doesn't have to be applied in WMF prod, since the indexes
are already correct there.

Bug: T291725
Change-Id: I7fcee0581f469e0d7ada43d1f30f31061c5bf5c0
2021-10-16 16:55:52 +00:00
jenkins-bot 0dae59616c Merge "Replace custom regex with TextContent::normalizeLineEndings()" 2021-10-01 14:04:36 +00:00
Thiemo Kreuz 0e8a08ebca Replace custom regex with TextContent::normalizeLineEndings()
This does the same as before, replacing \r\n as well as \r with \n.
Additionally the new method applies an rtrim() on both strings. I
believe this is even a good thing. It possibly removes irrelevant
noise from the diff.

Change-Id: I584740a24e6b25bbcbc928c2369f09b785a485c8
2021-10-01 08:49:49 +02:00
Thiemo Kreuz 8db314612d Update incomplete type hints in TablePager subclasses
Change-Id: Ia19a2507282f7973adb312428d04561cbd25035e
2021-10-01 08:46:54 +02:00
Matěj Suchánek 632b39f8ca Stop requiring the Skin interface in AbuseFilterChangesList
IContextSource is now enough for ChangesList.

Change-Id: Iebb525227efe841a17c799d460d352017a2cfc4f
2021-09-25 10:28:50 +02:00
Daimona Eaytoy 020f8a09b4 Remove leftovers of AbuseFilterAflFilterMigrationStage
On second thought, no need to keep the migration script now, since it's
unusable anyway.

Also remove an usage in SpecialAbuseLog, likely a rebase artefact.

Change-Id: I938924b3617ef30046d8317e68a101ed2c1883d3
2021-09-25 03:48:37 +02:00
jenkins-bot a332b3ff0f Merge "Remove afl_filter entirely" 2021-09-25 01:39:08 +00:00
Daimona Eaytoy e8471a717c Add method to properly check visibility of AbuseLog entries
This replaces the previous pattern of callers having to use
RevisionLookup if the result was 'implicit'. Also, in some cases where
we were just hiding things if the visibility was !== true, properly
handle the implicit case by using the new method. Make the new method
return string constants rather than bool|string.

The new method also fixes some potential info leaks which happened when
the row was hidden, the user could view suppressed AbuseLog entries, but
the associated revision was also deleted and the user couldn't see it
(this shouldn't be relevant for WMF wikis since AF deletion is
oversight-level).

Also add a bunch of tests for the various cases to ensure we don't
regress again.

Bug: T261532
Change-Id: I929f865acf5d207b739cb3af043f70cb59243ee0
2021-09-25 00:08:33 +00:00
jenkins-bot 72d03778d0 Merge "Refactor ParserStatus" 2021-09-24 09:34:20 +00:00
Umherirrender 2deea7bb01 Avoid non-namespaced aliases for Wikimedia\Rdbms namespace
Change-Id: Iadc147ff96649253a4b83709f8ebe291305e4bf8
2021-09-18 20:06:16 +02:00
Daimona Eaytoy dae374aec2 Remove afl_filter entirely
As per T220791, the old schema and the flag can be removed in 1.38.

Bug: T220791
Change-Id: Ic6b1c8a22d17a301faf32d2e23778d90c41c39de
2021-09-18 11:06:10 +00:00
Daimona Eaytoy b2dc2c4dd8 Refactor ParserStatus
ParserStatus is now more lightweight, and doesn't know about "result"
and "from cache". Instead, it has an isValid() method which is merely a
shorthand for checking whether getException() is null.

Introduce a child class, RuleCheckerStatus, which knows about result and
cache and can be (un)serialized.

This removes the ambiguity of the $result field, and helps the
transition to a new RuleChecker class.

Change-Id: I0dac7ab4febbfdabe72596631db630411d967ab5
2021-09-17 11:25:54 +00:00