Extension:AbuseFilter

MediaWiki extensions manual - list

AbuseFilter Release status: stable
Implementation	User activity, Special page, API
Description	Allows specific behaviour-based restrictions to be placed on wiki activity.
Author(s)	Andrew Garrett (Werdnatalk)
MediaWiki	1.13+
Database changes	yes
License	GPL v2 or later
Download	Download snapshot (Git master) Git [?]: repo summary tree code changes CHANGELOG
Parameters $wgAbuseFilterAvailableActions $wgAbuseFilterConditionLimit $wgAbuseFilterEmergencyDisableThreshold $wgAbuseFilterEmergencyDisableCount $wgAbuseFilterEmergencyDisableAge $wgAbuseFilterParserClass $wgAbuseFilterStyleVersion $wgAbuseFilterRestrictedActions $wgAbuseFilterUDPPrefix $wgAbuseFilterUDPAddress $wgAbuseFilterUDPPort $wgAbuseFilterCentralDB $wgAbuseFilterIsCentral $wgAbuseFilterBlockDuration
Added rights abusefilter-view abusefilter-modify abusefilter-modify-restricted abusefilter-log abusefilter-log-detail abusefilter-private abusefilter-revert abusefilter-view-private abusefilter-hidden-log abusefilter-hide-log
Hooks used EditFilterMerged GetAutoPromoteGroups AbortMove AbortNewAccount ArticleDelete LoadExtensionSchemaUpdates RecentChange_save ListDefinedTags ContributionsToolLinks UploadVerification MakeGlobalVariablesScript
Check usage (experimental) Bugs: list open list all report

The AbuseFilter extension allows privileged users to set specific controls on actions by users, such as edits, and create automated reactions for certain behaviors.

Requirements

This extension requires Extension:AntiSpoof to be installed on your wiki.

Installation

1. Download the files from Git or download a snapshot. Choose the version that matches your version of MediaWiki.
2. Create a directory AbuseFilter in your $IP/extensions directory.
3. Extract the files to this $IP/extensions/AbuseFilter directory.
4. Add
   require_once( "$IP/extensions/AbuseFilter/AbuseFilter.php" );
   to the bottom of LocalSettings.php.
5. Add the required tables to the database; on the command line, enter:
   
   php maintenance/update.php
   (Note: Your designated database user needs to have CREATE rights on your MediaWiki database.)
6. Installation can now be verified through Special:Version of your wiki.

Installing without command prompt access

If you are using a remote server and do not have command prompt access, but do have access through phpMyAdmin, substitute these steps for step #5 above:

1. Download abusefilter.tables.sql.
2. In phpMyAdmin, click the database you're using for mediawiki along the left side
3. On the next screen, click the "SQL" tab at the top.
4. At "Location of the text file", choose one of the files, select compression "None", and click the bottom "Go" button.

   If your phpMyAdmin screen has only a text field and no text file chooser, click the "SQL" button in the left-side column, under the phpMyAdmin logo, and click the "import files" tab in the new window that opens.

User rights

Once you installed the extension, you'll have to set up the user rights in LocalSettings.php.

Right	Description
abusefilter-modify	Modify abuse filters
abusefilter-view	View abuse filters
abusefilter-log	View the abuse log
abusefilter-log-detail	View detailed abuse log entries
abusefilter-private	View private data in the abuse log
abusefilter-modify-restricted	Modify abuse filters with restricted actions
abusefilter-revert	Revert all changes by a given abuse filter
abusefilter-view-private	View abuse filters marked as private
abusefilter-log-private	View log entries of abuse filters marked as private
abusefilter-hide-log	Hide entries in the abuse log
abusefilter-hidden-log	View hidden abuse log entries

For example, the following sample configuration would allow sysops to do everything they want with AbuseFilter, and everyone to view the log and see public filter settings:

$wgGroupPermissions['sysop']['abusefilter-modify'] = true;
$wgGroupPermissions['*']['abusefilter-log-detail'] = true;
$wgGroupPermissions['*']['abusefilter-view'] = true;
$wgGroupPermissions['*']['abusefilter-log'] = true;
$wgGroupPermissions['sysop']['abusefilter-private'] = true;
$wgGroupPermissions['sysop']['abusefilter-modify-restricted'] = true;
$wgGroupPermissions['sysop']['abusefilter-revert'] = true;

Filters marked as private can only be viewed by users with either the abusefilter-modify or abusefilter-view-private permission.

Abuse filter management

Once the extension has been installed, filters can be created/tested/changed/deleted and the logs can be accessed from the Abuse filter management page Special:AbuseFilter.

• The rules format
• Actions
• To Import filters from Wikipedia: When you have installed the extension, go to w:Special:AbuseFilter, choose a filter (say w:Special:AbuseFilter/3), then click "Export this filter to another wiki", copy the text, go to Special:AbuseFilter/import on your wiki, paste the text.

Configuration

Variable name	Default value	Description
$wgAbuseFilterAvailableActions	array( 'flag', 'throttle', 'warn', 'disallow', 'blockautopromote', 'block', 'degroup', 'tag', 'rangeblock' )	The possible actions that can be taken by abuse filters.
$wgAbuseFilterConditionLimit	1000	The maximum number of 'conditions' that can be used each time the filters are run against a change. (More complex filters require more 'conditions').
$wgAbuseFilterEmergencyDisableThreshold	0.05	Disable filters if they match more than X edits, constituting more than Y% of the last Z edits, if they have been changed in the last S seconds
$wgAbuseFilterEmergencyDisableCount	2
$wgAbuseFilterEmergencyDisableAge	86400
$wgAbuseFilterParserClass	'AbuseFilterParser'	Name of AbuseFilter's parser class.
$wgAbuseFilterStyleVersion		Like $wgStyleVersion, but only for this extension. Developers should bump this number every time time they change any of the .css/.js files.
$wgAbuseFilterRestrictedActions	array( 'block', 'degroup' )	Users must have the "abusefilter-modify-restricted" user right as well as "abusefilter-modify" in order to create or modify filters which carry out these actions.
$wgAbuseFilterUDPPrefix	'abusefilter:'	Like $wgRC2UDPPrefix, but only for AbuseFilter?
$wgAbuseFilterUDPAddress	null	Like $wgRC2UDPAddress, but only for AbuseFilter?
$wgAbuseFilterUDPPort	null	Like $wgRC2UDPPort, but only for AbuseFilter?
$wgAbuseFilterCentralDB	null	Name of a database where global abuse filters will be stored in (this is not yet supported).
$wgAbuseFilterIsCentral	false	Set this variable to true for the wiki where global AbuseFilters are stored in (not yet supported).
$wgAbuseFilterBlockDuration	'indefinite'	Duration of blocks made by AbuseFilter

API

AbuseFilter adds two API list modules, one for details of abuse filters ("abusefilters") and one for the abuse log, since it is separate from other MediaWiki logs ("abuselog"). It is not possible to create or modify abuse filters using the API.

list = abusefilters

List information about filters

Parameters

• abfstartid: The filter id to start enumerating from
• abfendid: The filter id to stop enumerating at
• abfdir: The direction in which to enumerate (older, newer)
• abfshow: Show only filters which meet these criteria (enabled|!enabled|deleted|!deleted|private|!private)
• abflimit: The maximum number of filters to list
• abfprop: Which properties to get (id|description|pattern|actions|hits|comments|lasteditor|lastedittime|status|private)

When filters are private, some of the properties specified with abfprop will be missing unless you have the appropriate user rights.

Examples

List non-private abuse filters

api.php ? action=query & list=abusefilters & abfshow=!private & abfprop=id|hits

<api>
  <query>
    <abusefilters>
      <filter id="1" hits="867" />
      <filter id="3" hits="66110" />
      <filter id="5" hits="464" />
      <filter id="6" hits="19" />
      <filter id="8" hits="7" />
      <filter id="9" hits="24869" />
      <filter id="11" hits="10033" />
      <filter id="14" hits="63" />
      <filter id="15" hits="15" />
      <filter id="16" hits="44" />
    </abusefilters>
  </query>
  <query-continue>
    <abusefilters abfstartid="18" />
  </query-continue>
</api>

list = abuselog

List instances where actions triggered an abuse filter.

Parameters

• aflstart: The timestamp to start enumerating from
• aflend: The timestamp to stop enumerating at
• afldir: The direction in which to enumerate (older, newer)
• afluser: Show only entries where the action was attempted by a given user or IP address.
• afltitle: Show only entries where the action involved a given page.
• aflfilter: Show only entries that triggered a given filter ID
• afllimit: The maximum number of entries to list
• aflprop: Which properties to get (ids|user|title|action|result|timestamp|details)

Example

List instances where the abuse filter was triggered in response to actions from the user "SineBot"

api.php ? action=query & list=abuselog & afluser=SineBot & aflprop=ids

<api>
  <query>
    <abuselog>
      <item id="900937" filter_id="211" user="SineBot" result="" />
      <item id="888404" filter_id="211" user="SineBot" result="" />
      <item id="862751" filter_id="211" user="SineBot" result="" />
      <item id="855649" filter_id="211" user="SineBot" result="" />
      <item id="842429" filter_id="211" user="SineBot" result="" />
      <item id="840958" filter_id="1" user="SineBot" result="" />
      <item id="824151" filter_id="211" user="SineBot" result="" />
      <item id="804892" filter_id="211" user="SineBot" result="" />
      <item id="205254" filter_id="58" user="SineBot" result="disallow" />
      <item id="205252" filter_id="58" user="SineBot" result="disallow" />
    </abuselog>
  </query>
  <query-continue>
    <abuselog aflstart="2009-04-19T02:07:55Z" />
  </query-continue>
</api>

See also

• Several WMF wikis where it's enabled (and with which configuration)