Extension:AbuseFilter

From MediaWiki.org

Manual on MediaWiki Extensions
List of MediaWiki Extensions

AbuseFilter Release status: stable
Implementation	User activity, Special page
Description	Allows specific behaviour-based restrictions to be placed on wiki activity.
Author(s)	Andrew Garrett (WerdnaTalk)
License	GPL
Download	Download snapshot Subversion [Help] Browse source code
Parameters $wgAbuseFilterAvailableActions $wgAbuseFilterConditionLimit $wgAbuseFilterEmergencyDisableThreshold $wgAbuseFilterEmergencyDisableCount $wgAbuseFilterEmergencyDisableAge $wgAbuseFilterParserClass $wgAbuseFilterStyleVersion $wgAbuseFilterRestrictedActions $wgAbuseFilterUDPPrefix $wgAbuseFilterUDPAddress $wgAbuseFilterUDPPort $wgAbuseFilterCentralDB $wgAbuseFilterIsCentral $wgAbuseFilterBlockDuration
Added rights abusefilter-view abusefilter-modify abusefilter-modify-restricted abusefilter-log abusefilter-log-detail abusefilter-private abusefilter-revert abusefilter-view-private
Hooks used EditFilter GetAutoPromoteGroups AbortMove AbortNewAccount ArticleDelete LoadExtensionSchemaUpdates RecentChange_save ListDefinedTags
check usage (experimental)

AbuseFilter allows privileged users to set specific controls on user activity and create automated reactions for certain behaviors.

[edit] Installation

Note: Requires Extension:AntiSpoof

As is standard with other MediaWiki extensions, you may install this extension by extracting the extension in the extensions folder and adding

require_once( "$IP/extensions/AbuseFilter/AbuseFilter.php" );

to LocalSettings.php, and creating the tables (or running install.php or update.php).

[edit] User rights

Once you installed the extension, you'll have to set up the user rights in LocalSettings.php. For example, the following sample configuration would allow sysops to do everything they want with AbuseFilter, and everyone to view the log and see public filter settings.

$wgGroupPermissions['sysop']['abusefilter-modify'] = true;
$wgGroupPermissions['*']['abusefilter-log-detail'] = true;
$wgGroupPermissions['*']['abusefilter-view'] = true;
$wgGroupPermissions['*']['abusefilter-log'] = true;
$wgGroupPermissions['sysop']['abusefilter-private'] = true;
$wgGroupPermissions['sysop']['abusefilter-modify-restricted'] = true;
$wgGroupPermissions['sysop']['abusefilter-revert'] = true;

Note that filters marked as private can only be viewed by users with either the abusefilter-modify or abusefilter-view-private permission.

[edit] Abuse filter management

Once the extension has been installed, filters can be created/tested/changed/deleted and the logs can be accessed from the Abuse filter management page Special:AbuseFilter.

• The rules format
• Actions
• To Import filters from Wikipedia: When you have installed the extension, go to w:Special:AbuseFilter, choose a filter (say w:Special:AbuseFilter/3), then click "Export this filter to another wiki", copy the text, go to Special:AbuseFilter/import on your wiki, paste the text.

[edit] Configuration

[edit] API

AbuseFilter adds two API list modules, one for details of abuse filters ("abusefilters") and one for the abuse log, since it is separate from other MediaWiki logs ("abuselog"). It is not possible to create or modify abuse filters using the API.

[edit] list = abusefilters

List information about filters

Parameters

• abfstartid: The filter id to start enumerating from
• abfendid: The filter id to stop enumerating at
• abfdir: The direction in which to enumerate (older, newer)
• abfshow: Show only filters which meet these criteria (enabled|!enabled|deleted|!deleted|private|!private)
• abflimit: The maximum number of filters to list
• abfprop: Which properties to get (id|description|pattern|actions|hits|comments|lasteditor|lastedittime|status|private)

When filters are private, some of the properties specified with abfprop will be missing unless you have the appropriate user rights.

Examples

List non-private abuse filters

<api>
  <query>
    <abusefilters>
      <filter id="1" hits="867" />
      <filter id="3" hits="66110" />
      <filter id="5" hits="464" />
      <filter id="6" hits="19" />
      <filter id="8" hits="7" />
      <filter id="9" hits="24869" />
      <filter id="11" hits="10033" />
      <filter id="14" hits="63" />
      <filter id="15" hits="15" />
      <filter id="16" hits="44" />
    </abusefilters>
  </query>
  <query-continue>
    <abusefilters abfstartid="18" />
  </query-continue>
</api>

[edit] list = abuselog

List instances where actions triggered an abuse filter.

Parameters

• aflstart: The timestamp to start enumerating from
• aflend: The timestamp to stop enumerating at
• afldir: The direction in which to enumerate (older, newer)
• afluser: Show only entries where the action was attempted by a given user or IP address.
• afltitle: Show only entries where the action involved a given page.
• aflfilter: Show only entries that triggered a given filter ID
• afllimit: The maximum number of entries to list
• aflprop: Which properties to get (ids|user|title|action|result|timestamp|details)

Example

List instances where the abuse filter was triggered in response to actions from the user "SineBot"

<api>
  <query>
    <abuselog>
      <item id="900937" filter_id="211" user="SineBot" result="" />
      <item id="888404" filter_id="211" user="SineBot" result="" />
      <item id="862751" filter_id="211" user="SineBot" result="" />
      <item id="855649" filter_id="211" user="SineBot" result="" />
      <item id="842429" filter_id="211" user="SineBot" result="" />
      <item id="840958" filter_id="1" user="SineBot" result="" />
      <item id="824151" filter_id="211" user="SineBot" result="" />
      <item id="804892" filter_id="211" user="SineBot" result="" />
      <item id="205254" filter_id="58" user="SineBot" result="disallow" />
      <item id="205252" filter_id="58" user="SineBot" result="disallow" />
    </abuselog>
  </query>
  <query-continue>
    <abuselog aflstart="2009-04-19T02:07:55Z" />
  </query-continue>
</api>

[edit] See also

• Latest code changes
• Several WMF wikis where it's enabled (and with which configuration)

This extension is being used on one or more of Wikimedia's wikis. It means that the extension is stable and works well enough to be used by such high traffic websites. A full list of the extensions installed on a particular wiki is produced by Special:Version on that wiki.