Extension:AbuseFilter

---

MediaWiki extensions manualManual:Extensions

AbuseFilter Release status:Extension status stable
ImplementationTemplate:Extension#type	User activity, Special page, API
DescriptionTemplate:Extension#description	Allows specific behavior-based restrictions to be placed on wiki activity
Author(s)Template:Extension#username	Andrew Garrett, River Tarnell Victor Vasiliev Marius Hoch
MediaWikiTemplate:Extension#mediawiki	1.25+
PHPTemplate:Extension#php	5.3.4+ recommended
Database changesTemplate:Extension#needs-updatephp	Yes
TablesTemplate:Extension#table1	abuse_filterExtension:AbuseFilter/abuse_filter table abuse_filter_actionExtension:AbuseFilter/abuse_filter_action table abuse_filter_historyExtension:AbuseFilter/abuse_filter_history table abuse_filter_logExtension:AbuseFilter/abuse_filter_log table
LicenseTemplate:Extension#license	GNU General Public License 2.0 or later
Download	Download snapshot (Git master) Git [?]: repo summary browse file tree (GitHub) commit history code review
ParametersTemplate:Extension#parameters $wgAbuseFilterActions $wgAbuseFilterConditionLimit $wgAbuseFilterEmergencyDisableThreshold $wgAbuseFilterEmergencyDisableCount $wgAbuseFilterEmergencyDisableAge $wgAbuseFilterParserClass $wgAbuseFilterRestrictions $wgAbuseFilterNotifications $wgAbuseFilterNotificationsPrivate $wgAbuseFilterCentralDB $wgAbuseFilterIsCentral $wgAbuseFilterDisallowGlobalLocalBlocks $wgAbuseFilterBlockDuration $wgAbuseFilterAnonBlockDuration $wgAbuseFilterCustomActionsHandler $wgAbuseFilterValidGroups $wgAbuseFilterDefaultWarningMessage $wgAbuseFilterIPMaxAge $wgAbuseFilterProfile
Added rightsTemplate:Extension#rights abusefilter-view abusefilter-log abusefilter-log-detail abusefilter-revert abusefilter-private abusefilter-view-private abusefilter-log-private abusefilter-hidden-log abusefilter-hide-log abusefilter-modify abusefilter-modify-restricted abusefilter-modify-global
Hooks usedTemplate:Extension#hook EditFilterMergedManual:Hooks/EditFilterMerged GetAutoPromoteGroupsManual:Hooks/GetAutoPromoteGroups AbortMoveManual:Hooks/AbortMove MovePageCheckPermissionsManual:Hooks/MovePageCheckPermissions ArticleDeleteManual:Hooks/ArticleDelete RecentChange_saveManual:Hooks/RecentChange_save ListDefinedTagsManual:Hooks/ListDefinedTags ChangeTagsListActiveManual:Hooks/ChangeTagsListActive LoadExtensionSchemaUpdatesManual:Hooks/LoadExtensionSchemaUpdates ContributionsToolLinksManual:Hooks/ContributionsToolLinks UploadVerifyFileManual:Hooks/UploadVerifyFile UploadVerifyUpload UploadStashFile MakeGlobalVariablesScriptManual:Hooks/MakeGlobalVariablesScript PageContentSaveCompleteManual:Hooks/PageContentSaveComplete UserMergeAccountFields ParserOutputStashForEdit
Translate the AbuseFilter extension if it is available at translatewiki.net
Check usage and version matrix.
IssuesPhabricator	Open tasks · Report a bug

The AbuseFilter extension allows privileged users to set specific actions to be taken when actions by users, such as edits, match certain criteria. (e.g. A filter could be created so that when a user removes more than 2000 characters, they are blocked.)

Requirements

There are no required dependencies for this extension, but it is reccomended you install Extension:AntiSpoof to use string normalization features.

Installation

• Download and place the file(s) in a directory called AbuseFilter in your extensions/ folder.
• Add the following code at the bottom of your LocalSettings.php:

wfLoadExtension( 'AbuseFilter' );

• Run the update script which will automatically create the necessary database tables that this extension needs.
• Y Done - Navigate to Special:Version on your wiki to verify that the extension is successfully installed.

To users running MediaWiki 1.26 or earlier:

The instructions above describe the new way of installing this extension using wfLoadExtension() If you need to install this extension on these earlier versions (MediaWiki 1.26 and earlier), instead of wfLoadExtension( 'AbuseFilter' );, you need to use:

require_once "$IP/extensions/AbuseFilter/AbuseFilter.php";

User rights

Once you installed the extension, you'll have to set up the user rights in LocalSettings.php.

Right	Description
abusefilter-modify	Modify abuse filters
abusefilter-view	View abuse filters
abusefilter-log	View the abuse log
abusefilter-log-detail	View detailed abuse log entries
abusefilter-private	View private data in the abuse log
abusefilter-modify-restricted	Modify abuse filters with restricted actions
abusefilter-modify-global	Create or modify global abuse filters
abusefilter-revert	Revert all changes by a given abuse filter
abusefilter-view-private	View abuse filters marked as private
abusefilter-log-private	View log entries of abuse filters marked as private
abusefilter-hide-log	Hide entries in the abuse log
abusefilter-hidden-log	View hidden abuse log entries

For example, the following sample configuration would allow sysops to do everything they want with AbuseFilter, and everyone to view the log and see public filter settings:

$wgGroupPermissions['sysop']['abusefilter-modify'] = true;
$wgGroupPermissions['*']['abusefilter-log-detail'] = true;
$wgGroupPermissions['*']['abusefilter-view'] = true;
$wgGroupPermissions['*']['abusefilter-log'] = true;
$wgGroupPermissions['sysop']['abusefilter-private'] = true;
$wgGroupPermissions['sysop']['abusefilter-modify-restricted'] = true;
$wgGroupPermissions['sysop']['abusefilter-revert'] = true;

 Note: Filters marked as private can only be viewed by users with either the abusefilter-modify or abusefilter-view-private permission.

Creating and managing filters

Once the extension has been installed, filters can be created/tested/changed/deleted and the logs can be accessed from the Abuse filter management page Special:AbuseFilter.

• Rules format - The basics of how to write a filter
• Actions
• Global Rules
• Guide to optimizing condition limit usage
• To import filters from Wikipedia: When you have installed the extension, go to w:Special:AbuseFilter, choose a filter (say w:Special:AbuseFilter/3), then click "Export this filter to another wiki", copy the text, go to "Special:AbuseFilter/import" on your wiki, paste the text.

Configuration

Variable name	Default value	Description
$wgAbuseFilterAvailableActions	array( 'flag', 'throttle', 'warn', 'disallow', 'blockautopromote', 'block', 'degroup', 'tag' )	The possible actions that can be taken by abuse filters. Additional possible actions: 'rangeblock'
$wgAbuseFilterConditionLimit	1000	The maximum number of 'conditions' that can be used each time the filters are run against a change. (More complex filters require more 'conditions').
$wgAbuseFilterValidGroups	'default'	The list of "groups" filters can be divided into. By default there is only one group.
$wgAbuseFilterEmergencyDisableThreshold	array( 'default' => 0.05 )	Disable a filter if it matched more than 2 edits, constituting more than 5 % of the actions which were checked against the filter's group in the "observed" period (at most one day), unless the filter has been changed in the last 86400 seconds (one day)
$wgAbuseFilterEmergencyDisableCount	array( 'default' => 2 )
$wgAbuseFilterEmergencyDisableAge	array( 'default' => 86400 )
$wgAbuseFilterParserClass	'AbuseFilterParser'	Name of AbuseFilter's parser class.
$wgAbuseFilterRestrictedActions	array( 'block', 'degroup', 'blockautopromote', 'rangeblock' )	Users must have the "abusefilter-modify-restricted" user right as well as "abusefilter-modify" in order to create or modify filters which carry out these actions.
$wgAbuseFilterNotifications	false	Allows to configure the extension to send hit notifications to Special:RecentChanges or UDP. Available options: rc, udp, rcandudp
$wgAbuseFilterNotificationsPrivate	false	Enable notifications for private filters.
$wgAbuseFilterCentralDB	null	Name of a database where global abuse filters will be stored in (only supported in the latest, development version).
$wgAbuseFilterIsCentral	false	Set this variable to true for the wiki where global AbuseFilters are stored in (only supported in the latest, development version).
$wgAbuseFilterDisallowGlobalLocalBlocks	false	Disallow Centralised filters from taking actions that locally block, remove from groups, or revoke permissions.
$wgAbuseFilterBlockDuration	'indefinite'	Duration of blocks made by AbuseFilter
$wgAbuseFilterAnonBlockDuration	null	Duration of blocks made by AbuseFilter on users who are not logged in. The value of $wgAbuseFilterBlockDuration will be used if this is not set.
$wgAbuseFilterCustomActionsHandlers	array()	Callback functions for custom actions.
$wgAbuseFilterValidGroups	array('default')	Valid "filter groups" – used for applying edit filters to certain types of actions
$wgAbuseFilterDefaultWarningMessage	array( 'default' => 'abusefilter-warning' )	Default warning messages, per filter group
$wgAbuseFilterLogIPMaxAge	3 * 30 * 24 * 3600	Age used as cutoff when purging old IP log data. Defaults to 3 months. Used by maintenance script purgeOldLogIPData.php.
$wgAbuseFilterProfile	false	MediaWiki version: ≥ 1.27 Whether to record data about the performance of filters – the average number of conditions used and the time consumed by every filter. (This was always enabled in MediaWiki up to 1.25, then entirely removed from 1.26 for performance reasons, then restored in 1.27.)

API

AbuseFilter adds two API list modules, one for details of abuse filters ("abusefilters") and one for the abuse log, since it is separate from other MediaWiki logs ("abuselog"). It is not possible to create or modify abuse filters using the API.

list = abusefilters

List information about filters

Parameters

• abfstartid: The filter id to start enumerating from
• abfendid: The filter id to stop enumerating at
• abfdir: The direction in which to enumerate (older, newer)
• abfshow: Show only filters which meet these criteria (enabled|!enabled|deleted|!deleted|private|!private)
• abflimit: The maximum number of filters to list
• abfprop: Which properties to get (id|description|pattern|actions|hits|comments|lasteditor|lastedittime|status|private)

When filters are private, some of the properties specified with abfprop will be missing unless you have the appropriate user rights.

Examples

List non-private abuse filters

api.php?action=query&list=abusefilters&abfshow=!private&abfprop=id|hits [try in ApiSandbox]

list = abuselog

List instances where actions triggered an abuse filter.

Parameters

• aflstart: The timestamp to start enumerating from
• aflend: The timestamp to stop enumerating at
• afldir: The direction in which to enumerate (older, newer)
• afluser: Show only entries where the action was attempted by a given user or IP address.
• afltitle: Show only entries where the action involved a given page.
• aflfilter: Show only entries that triggered a given filter ID
• afllimit: The maximum number of entries to list
• aflprop: Which properties to get (ids|user|title|action|result|timestamp|details)

Example

List instances where the abuse filter was triggered in response to actions from the user "SineBot"

api.php?action=query&list=abuselog&afluser=SineBot&aflprop=ids [try in ApiSandbox]

Possible errors

• Some users might experience that creating new filters or modifying old filters fail and the user just gets redirected to the original page. If the Wiki is using SSL certificates, this error could possibly be because of the $wgServer value, which might be using "http://" instead of "https://". An indication of this error will be, the browser giving https warning for Special:AbuseFilter pages. (Topic:T23dyyih0ofjada5)

See also

• Several WMF wikis where it's enabled (and with which configuration)