Jump to content

Extension:AbuseFilter/Rules format/de

From mediawiki.org
This page is a translated version of the page Extension:AbuseFilter/Rules format and the translation is 43% complete.
Outdated translations are marked like this.

The rules are a custom language. They are formatted similar to conditionals in a C/Java/Perl-like language.

Strings

You can specify a literal by placing it in single or double quotes (for strings), or by typing it in as-is (for numbers, both floating-point and integer). You can get linebreaks with \n, tab characters with \t, and you can also escape the quote character with a backslash.

Use the + (plus) symbol to concatenate two literal strings or the values of two vars with a string value.

Beispiele
"Dies ist eine Zeichenfolge"
'Dies ist auch eine Zeichenfolge'
'Diese Zeichenfolge sollte n\icht fehlschlagen'
"Diese Zeichenkette\nHat einen Zeilenumbruch"
1234
1.234
-123

Benutzerdefinierte Variablen

You can define custom variables for ease of understanding with the assign symbol := in a line (closed by ;) within a condition. Such variables may use letters, underscores, and numbers (apart from the first character) and are case-insensitive. Beispiel (aus w:Special:AbuseFilter/79):

(
	line1:="(\{\{(r|R)eflist|\{\{(r|R)efs|<references\s?/>|</references\s?>)";
	rcount(line1, removed_lines)
) > (
	rcount(line1, added_lines)
)

Arrays

AbuseFilter has support for non-associative arrays, which can be used like in the following examples.

Achtung! Achtung: Expressions like page_namespace in [14, 15] may not work as expected. This one will evaluate to true also if page_namespace is 1, 4, or 5. For more information and possible workarounds, please see T181024.
my_array := [ 5, 6, 7, 10 ];
my_array[0] == 5
length(my_array) == 4
int( my_array ) === 4 // Same as length
float( my_array ) === 4.0 // Counts the elements
string(my_array) == "5\n6\n7\n10\n" // Note: the last linebreak could be removed in the future
5 in my_array == true
'5' in my_array == true
'5\n6' in my_array == true // Note: this is due to how arrays are casted to string, i.e. by imploding them with linebreaks
1 in my_array == true // Note: this happens because 'in' casts arguments to strings, so the 1 is caught in '10' and returns true.
my_array[] := 57; // This appends an element at the end of the array
my_array === [ 5, 6, 7, 10, 57 ]
my_array[2] := 42; // And this is for changing an element in the array
my_array === [ 5, 6, 42, 10, 57 ]

Kommentare

You can specify comments using the following syntax:

/* This is a comment */

Arithmetic

You can use basic arithmetic symbols to do arithmetic on variables and literals with the following syntax:

  • -Subtract the right-hand operand from the left-hand operand.
  • +Add the right-hand operand to the left-hand operand.
  • *Multiply the left-hand operand by the right-hand operand.
  • /Divide the left-hand operand by the right-hand operand.
  • **Raise the left-hand operand to the exponential power specified by the right-hand operand.
  • %Return the remainder given when the left-hand operand is divided by the right-hand operand.

The type of the returned result is the same that would be returned by PHP, for which a lot of documentation may be found online. More exhaustive examples may be found in this AF parser test.

Beispiel Ergebnis
1 + 1 2
2 * 2 4
1 / 2 0.5
9 ** 2 81
6 % 5 1

Boolean operations

You can match if and only if all of a number of conditions are true, one of a number of conditions are true, or one and only one of all conditions are true.

  • x | y — OR – returns true if one or more of the conditions is true.
  • x & y — AND – returns true if both of the conditions are true.
  • x ^ y — XOR – returns true if one, and only one of the two conditions is true.
  • !x — NOT – returns true if the condition is not true.

Beispiele

Code Ergebnis
1 | 1 true
1 | 0 true
0 | 0 false
1 & 1 true
1 & 0 false
0 & 0 false
1 ^ 1 false
1 ^ 0 true
0 ^ 0 false
!1 false
!0 true

Simple comparisons

You can compare variables with other variables and literals with the following syntax:

  • <, >Return true if the left-hand operand is less than/greater than the right-hand operand respectively. Watch out: operands are casted to strings and, like it happens in PHP, null < any number === true and null > any number === false.
  • <=, >=Return true if the left-hand operand is less than or equal to/greater than or equal to the right-hand operand respectively. Watch out: operands are casted to strings and, like it happens in PHP, null <= any number === true and null >= any number === false.
  • == (or =), != – Return true if the left-hand operand is equal to/not equal to the right-hand operand respectively.
  • ===, !==Return true if the left-hand operand is equal to/not equal to the right-hand operand AND the left-hand operand is the same/not the same data type to the right-hand operand respectively.
Beispiel Ergebnis
1 == 2 false
1 <= 2 true
1 >= 2 false
1 != 2 true
1 < 2 true
1 > 2 false
2 = 2 true
'' == false true
'' === false false
1 == true true
1 === true false
['1','2','3'] == ['1','2','3'] true
[1,2,3] === [1,2,3] true
['1','2','3'] == [1,2,3] true
['1','2','3'] === [1,2,3] false
[1,1,''] == [true, true, false] true
[] == false & [] == null true
['1'] == '1' false[1]

Built-in variables

The abuse filter passes various variables by name into the parser. These variables can be accessed by typing their name in, in a place where a literal would work. You can view the variables associated with each request in the abuse log.

Variables from AbuseFilter

Variables always available

Achtung! Achtung: User-related variables are always available, except for one case: account creation when the creator is not logged in. All variables starting with user_ are affected, except user_type.
Beschreibung Name Datentyp Anmerkungen
Action action Zeichenkette One of the following: edit, move, createaccount, autocreateaccount, delete, upload[2], stashupload[3]
Unix timestamp of change timestamp Zeichenkette int(timestamp) gives you a number with which you can calculate the date, time, day of week, etc.
Datenbankname des Wikis ($1) wiki_name Zeichenkette For instance, this is "enwiki" on the English Wikipedia, and "itwikiquote" on the Italian Wikiquote.
Sprachcode des Wikis ($1) wiki_language Zeichenkette For instance, this is "en" on the English Wikipedia, and "it" on the Italian Wikiquote. Multi-lingual wikis like Commons, Meta, and Wikidata will also report as "en".
Beitragszahl des Benutzers ($1) user_editcount Ganzzahl/null Null nur für nicht registrierte Benutzer.
Name des Benutzerkontos ($1) (IP in case the user is not registered) user_name Zeichenkette
For "createaccount" and "autocreateaccount" actions, use accountname if you want the name of the account being created.
Typ des Benutzerkontos ($1) user_type string The type of the user, which will be one of ip, temp (if the user is using a temporary account ), named, external, or unknown.
Zeitpunkt, an dem die E-Mail-Adresse bestätigt wurde ($1) user_emailconfirm Zeichenkette/null Im Format: JJJJMMTTHHMMSS. Null if the email wasn't confirmed.
Alter des Benutzerkontos ($1) user_age Ganzzahl In Sekunden. 0 for unregistered users.
Ob der Benutzer gesperrt ist ($1) user_blocked Wahrheitswert True for blocked registered users. Also true for edits from blocked IP addresses, even if the editor is a registered user who is not blocked. Ansonsten False.
This doesn't differentiate between partial and sitewide blocks.
Gruppen (auch implizite), in denen der Benutzer Mitglied ist ($1) user_groups Array von Strings siehe Special:ListGroupRights
Rechte, die ein Benutzer hat ($1) user_rights Array von Zeichenketten siehe Special:ListGroupRights
Seitenkennnummer ($1) article_articleid Ganzzahl (veraltet) Verwende stattdessen page_id.
Seitenkennnummer ($1) (can be seen via "page information" link in sidebar) page_id Ganzzahl This is 0 for new pages, but it is unreliable when inspecting past hits. If you need an exact result when inspecting past hits, use "page_age == 0" to identify new page creation. (note that it is slower, though.) This issue has been fixed in 9369d08, merged on September 11th 2023.
Namensraum der Seite ($1) article_namespace Ganzzahl (veraltet) Verwende stattdessen page_namespace.
Namensraum der Seite ($1) page_namespace Ganzzahl refers to namespace index . Check for namespace(s) using expressions like "page_namespace == 2" or "equals_to_any(page_namespace, 1, 3)"
Seitenalter in Sekunden ($1) page_age Ganzzahl the number of seconds since the first edit (or 0 for new pages). This is reliable, but it tends to be slow; consider using page_id if you don't need much precision.
Titel der Seite ohne Namensraum ($1) article_text Zeichenkette (veraltet) Verwende stattdessen page_title.
Titel der Seite ohne Namensraum ($1) page_title Zeichenkette
Vollständiger Seitentitel ($1) article_prefixedtext Zeichenkette (veraltet) Verwende stattdessen page_prefixedtitle.
Vollständiger Seitentitel ($1) page_prefixedtitle Zeichenkette
Bearbeiten-Schutzstufe der Seite ($1) article_restrictions_edit Zeichenkette (veraltet) Verwende stattdessen page_restrictions_edit.
Bearbeiten-Schutzstufe der Seite ($1) page_restrictions_edit Array von Strings
Verschieben-Schutzstufe der Seite ($1) article_restrictions_move Zeichenkette (veraltet) Verwende stattdessen page_restrictions_move.
Verschieben-Schutzstufe der Seite ($1) page_restrictions_move Array von Strings
Hochladeschutz der Datei ($1) article_restrictions_upload Zeichenkette (veraltet) Verwende stattdessen page_restrictions_upload.
Hochladeschutz der Datei ($1) page_restrictions_upload Array von Strings
Erstellschutz der Seite ($1) article_restrictions_create Zeichenkette (veraltet) Verwende stattdessen page_restrictions_create.
Erstellschutz der Seite ($1) page_restrictions_create Array von Strings
Die letzten zehn Bearbeiter der Seite ($1) article_recent_contributors array of strings (veraltet) Verwende stattdessen page_recent_contributors.
Die letzten zehn Bearbeiter der Seite ($1) page_recent_contributors Array von Zeichenketten This tends to be slow (see #Performance). Try to put conditions more likely evaluate to false before this one, to avoid unnecessarily running the query. This value is empty if the user is the only contributor to the page(?), and only scans the last 100 revisions
Erster Autor der Seite ($1) article_first_contributor Zeichenkette (veraltet) Verwende stattdessen page_first_contributor.
Erster Autor der Seite ($1) page_first_contributor Zeichenkette This tends to be slow (see #Performance).[4] Try to put conditions more likely evaluate to false before this one, to avoid unnecessarily running the query.

Variables available for some actions

Achtung! Achtung: Always check that the variables you want to use are available for the current action being filtered, e.g. by using the action variable. Failing to do so (for instance using accountname for an edit, or edit_delta for a deletion) will make any code using the variable in question return false.
Edit variables are not available when examining past uploads. (T345896)
Beschreibung Name Datentyp Anmerkungen
Zusammenfassung/Grund ($1) summary Zeichenkette Summaries automatically created by MediaWiki ("New section", "Blanked the page", etc.) are created after the filter checks the edit, so they will never actually catch, even if the debugger shows that they should. The variable contains whatever the user sees in the edit summary window, which may include MediaWiki preloaded section titles.[5]
Ob die Bearbeitung als geringfügig markiert ist oder nicht (nicht mehr in Verwendung) minor_edit Zeichenkette Disabled, and set to false for all entries between 2016 and 2018.[6]
Alter Wikitext der Seite, vor der Bearbeitung ($1) old_wikitext Zeichenkette Diese Variable kann sehr groß sein. Consider using removed_lines if possible to improve performance.
Neuer Wikitext der Seite, nach der Bearbeitung ($1) new_wikitext Zeichenkette Diese Variable kann sehr groß sein. Consider using added_lines if possible to improve performance.
Vereinigter Versionsunterschied der Bearbeitung ($1) edit_diff Zeichenkette
Vereinigter Änderungsunterschied nach Bearbeitung, vor dem Speichern umgewandelt ($1) edit_diff_pst Zeichenkette This tends to be slow (see #Performance). Checking both added_lines and removed_lines is probably more efficient.[7]
Neue Seitengröße ($1) new_size Ganzzahl
Alte Seitengröße ($1) old_size Ganzzahl
Größenänderung der Bearbeitung ($1) edit_delta Ganzzahl
Zeilen in der Bearbeitung hinzugefügt, vor dem Speichern umgewandelt ($1) added_lines_pst Array von Strings Use added_lines if possible, which is more efficient.
Durch die Bearbeitung hinzugefügte Zeilen ($1) added_lines Array von Strings includes all lines in the final diff that begin with +
Durch die Bearbeitung entfernte Zeilen ($1) removed_lines Array von Strings
Alle externen Links im neuen Text ($1) all_links Array von Zeichenketten This tends to be slow (see #Performance).
Links der Seite, vor der Bearbeitung ($1) old_links Array von Strings This tends to be slow (see #Performance).
Alle durch die Bearbeitung hinzugefügten externen Links ($1) added_links Array von Zeichenketten This tends to be slow (see #Performance). Consider checking against added_lines first, then check added_links so that fewer edits are slowed down. This follows MediaWiki's rules for external links . Only unique links are added to the array. Changing a link will count as 1 added and 1 removed link.
Alle durch die Bearbeitung entfernten externen Links ($1) removed_links Array von Strings This tends to be slow (see #Performance). Consider checking against removed_lines first, then check removed_links so that fewer edits are slowed down. This follows MediaWiki's rules for external links . Only unique links are added to the array. Changing a link will count as 1 added and 1 removed link.
Neuer Seitenwikitext, vor dem Speichern umgewandelt ($1) new_pst Zeichenkette This variable can be very large.
HTML-Quelltext der neuen Version ($1) new_html Zeichenkette Diese Variable kann sehr groß sein. Consider using added_lines if possible to improve performance.
Neuer Seitentext, von jeglicher Textauszeichnung befreit ($1) new_text Zeichenkette Diese Variable kann sehr groß sein. Consider using added_lines if possible to improve performance.
HTML-Quelltext der alten Version (nicht mehr in Verwendung) old_html Zeichenkette Disabled for performance reasons.
Alter Seitentext, von jeglicher Textauszeichnung befreit (nicht mehr in Verwendung) old_text Zeichenkette Disabled for performance reasons.
Zeit seit der letzten Seitenbearbeitung in Sekunden ($1) page_last_edit_age integer or null null when the page does not exist
SHA1-Hash von Dateiinhalt ($1) file_sha1 Zeichenkette [2]
Dateigröße in Bytes ($1) file_size Ganzzahl The file size in bytes[2]
Breite der Datei in Pixel ($1) file_width Ganzzahl The width in pixels[2]
Höhe der Datei in Pixel ($1) file_height Ganzzahl The height in pixels[2]
Bits pro Farbkanal der Datei ($1) file_bits_per_channel Ganzzahl The amount of bits per color channel[2]
MIME-Typ der Datei ($1) file_mime Zeichenkette The file MIME type.[2]
Medientyp der Datei ($1) file_mediatype Zeichenkette The file media type.[8][2]
Seiten-ID der Zielseite ($1) moved_to_articleid Ganzzahl (veraltet) Verwende stattdessen moved_to_id.
Seiten-ID der Zielseite ($1) moved_to_id Ganzzahl
Titel der Zielseite ($1) moved_to_text Zeichenkette (veraltet) Verwende stattdessen moved_to_title.
Titel der Zielseite ($1) moved_to_title Zeichenkette
Vollständiger Titel der Zielseite ($1) moved_to_prefixedtext Zeichenkette (veraltet) Verwende stattdessen moved_to_prefixedtitle.
Vollständiger Titel der Zielseite ($1) moved_to_prefixedtitle Zeichenkette
Namensraum der Zielseite ($1) moved_to_namespace Ganzzahl
Verschiebe-Zielseiten-Alter in Sekunden ($1) moved_to_age Ganzzahl
Zeit seit der letzten Änderung der Zielseite in Sekunden ($1) moved_to_last_edit_age integer or null null when the target page does not exist
Bearbeitungs-Schutzstatus der Verschiebe-Zielseite ($1) moved_to_restrictions_edit Array von Zeichenketten Selbes wie page_restrictions_edit, jedoch für das Ziel der Verschiebung.
Verschiebe-Schutzstatus der Verschiebe-Zielseite ($1) moved_to_restrictions_move Array von Zeichenketten Selbes wie page_restrictions_move, jedoch für das Ziel der Verschiebung.
Hochladeschutz der Verschiebe-Zieldatei ($1) moved_to_restrictions_upload Array von Zeichenketten Selbes wie page_restrictions_upload, jedoch für das Ziel der Verschiebung.
Erstellschutz der Verschiebe-Zielseite ($1) moved_to_restrictions_create Array von Zeichenketten Selbes wie page_restrictions_create, jedoch für das Ziel der Verschiebung.
Letzte zehn Benutzer, die zur Verschiebung der Zielseite beitragen ($1) moved_to_recent_contributors Array von Strings Selbes wie page_recent_contributors, jedoch für das Ziel der Verschiebung.
Erster Benutzer, der zur Verschiebung der Zielseite beiträgt ($1) moved_to_first_contributor Zeichenkette Selbes wie page_first_contributor, jedoch für das Ziel der Verschiebung.
Namensraum der Quellseite ($1) moved_from_namespace Ganzzahl
Titel der Quellseite ($1) moved_from_text Zeichenkette (veraltet) Verwende stattdessen moved_from_title.
Titel der Quellseite ($1) moved_from_title Zeichenkette
Vollständiger Titel der Quellseite ($1) moved_from_prefixedtext Zeichenkette (veraltet) Verwende stattdessen moved_from_prefixedtitle.
Vollständiger Titel der Quellseite ($1) moved_from_prefixedtitle Zeichenkette
Seiten-ID der Quellseite ($1) moved_from_articleid Ganzzahl (veraltet) Verwende stattdessen moved_from_id.
Seiten-ID der Quellseite ($1) moved_from_id Ganzzahl
Verschiebe-Quellseiten-Alter in Sekunden ($1) moved_from_age Ganzzahl
Zeit seit der letzten Änderung der Quellseite in Sekunden ($1) moved_from_last_edit_age integer
Bearbeitungs-Schutzstatus der Verschiebe-Quellseite ($1) moved_from_restrictions_edit Array von Zeichenketten Selbes wie page_restrictions_edit, jedoch für die Seite, die verschoben wird.
Verschiebe-Schutzstatus der Verschiebe-Quellseite ($1) moved_from_restrictions_move Array von Zeichenketten Selbes wie page_restrictions_move, jedoch für die Seite, die verschoben wird.
Hochladeschutz der Verschiebe-Quelldatei ($1) moved_from_restrictions_upload Array von Zeichenketten Selbes wie page_restrictions_upload, jedoch für die Seite, die verschoben wird.
Erstellschutz der Verschiebe-Quellseite ($1) moved_from_restrictions_create Array von Zeichenketten Selbes wie page_restrictions_create, jedoch für die Seite, die verschoben wird.
Letzte zehn Benutzer, die zur Verschiebung der Quellseite beitragen ($1) moved_from_recent_contributors Array von Strings Selbes wie page_recent_contributors, jedoch für die Seite, die verschoben wird.
Erster Benutzer, der zur Verschiebung der Quellseite beiträgt ($1) moved_from_first_contributor Zeichenkette Selbes wie page_first_contributor, jedoch für die Seite, die verschoben wird.
Kontoname bei Kontoerstellung ($1) accountname Zeichenkette
Content model of the old revision old_content_model Zeichenkette See Hilfe:ChangeContentModel for information about content model changes
Content model of the new revision new_content_model Zeichenkette See Hilfe:ChangeContentModel for information about content model changes

Protected variables

A variable can be considered protected. For instance, on wikis with temporary accounts enabled, IPs are considered PII and access to them must be restricted. Protected variables and filters that use them are only accessible to maintainers with the abusefilter-access-protected-vars right. Using a protected variable flags the filter as protected as well. The filter subsequently cannot be unprotected, even if it no longer actively uses a protected variable, as its historical logs will remain available.

The default protected variables are defined in AbuseFilterProtectedVariables in extension.json.

Description Name Data type Notes
IP-Adresse des Benutzerkontos (nur für abgemeldete Benutzer und temporäre Konten) ($1) user_unnamed_ip string User IP for anonymous users/temporary accounts
This returns null for registered users.

Variables from other extensions

Most of these variables are always set to false when examinating past edits, and may not reflect their actual value at the time the edit was made. Siehe T102944.
Beschreibung Name Datentyp Werte Added by
Globale Gruppen, in denen der Benutzer ist ($1) global_user_groups Array CentralAuth
Globale Bearbeitungsanzahl des Benutzers ($1) global_user_editcount Ganzzahl CentralAuth
Globale Gruppen, in denen der Benutzer ist bei der Kontoerstellung ($1) global_account_groups array Available only when action is createaccount (then it is always empty) or autocreateaccount. CentralAuth
Globale Bearbeitungsanzahl des Benutzers bei der Kontoerstellung ($1) global_account_editcount integer Available only when action is createaccount (then it is always zero) or autocreateaccount. CentralAuth
OAuth-Konsument, der zur Durchführung dieser Änderung verwendet wird ($1) oauth_consumer Ganzzahl OAuth
Seitenkennung des Strukturierte-Diskussionen-Boards ($1) board_articleid Ganzzahl (veraltet) Verwende stattdessen board_id. StructuredDiscussions
Seitenkennung des Strukturierte-Diskussionen-Boards ($1) board_id Ganzzahl StructuredDiscussions
Namensraum des Strukturierte-Diskussionen-Boards ($1) board_namespace Ganzzahl refers to namespace index StructuredDiscussions
Titel (ohne Namensraum) des Strukturierte-Diskussionen-Boards ($1) board_text Zeichenkette (veraltet) Verwende stattdessen board_title. StructuredDiscussions
Titel (ohne Namensraum) des Strukturierte-Diskussionen-Boards ($1) board_title Zeichenkette StructuredDiscussions
Vollständiger Titel des Strukturierte-Diskussionen-Boards ($1) board_prefixedtext Zeichenkette (veraltet) Verwende stattdessen board_prefixedtitle. StructuredDiscussions
Vollständiger Titel des Strukturierte-Diskussionen-Boards ($1) board_prefixedtitle Zeichenkette StructuredDiscussions
Quelltext der Übersetzungseinheit translate_source_text Zeichenkette Übersetzen
Zielsprache für die Übersetzung translate_target_language Zeichenkette This is the language code, like en for English. Übersetzen
Änderung erfolgte durch einen Torausgangsknoten ($1) tor_exit_node Wahrheitswert true if the action comes from a tor exit node. TorBlock
Ob ein Benutzer über die mobile Oberfläche bearbeitet ($1) user_mobile Wahrheitswert true for mobile users, false otherwise. MobileFrontend
Ob der Benutzer von der mobilen App bearbeitet ($1) user_app Wahrheitswert true if the user is editing from the mobile app, false otherwise. MobileApp
Seitenaufrufe[1] article_views Ganzzahl (veraltet) Verwende stattdessen page_views. HitCounters
Seitenaufrufe[2] page_views Ganzzahl Die Anzahl der Seitenaufrufe HitCounters
Aufrufe der Quellseite[3] moved_from_views Ganzzahl Die Anzahl der Aufrufe der Quellseite HitCounters
Aufrufe der Zielseite[4] moved_to_views Ganzzahl Die Anzahl der Aufrufe der Zielseite HitCounters
Ob die IP-Adresse mittels der Liste von stopforumspam.com gesperrt ist[5] sfs_blocked Wahrheitswert Whether the IP address is blocked using the stopforumspam.com list StopForumSpam

Hinweise

When action='move', only the summary, action, timestamp and user_* variables are available. The page_* variables are also available, but the prefix is replaced by moved_from_ and moved_to_, that represent the values of the original article name and the destination one, respectively. Zum Beispiel moved_from_title und moved_to_title anstelle von page_title.

Since MediaWiki 1.28 (gerrit:295254), action='upload' is only used when publishing an upload, and not for uploads to stash. A new action='stashupload' is introduced, which is used for all uploads, including uploads to stash. This behaves like action='upload' used to, and only provides file metadata variables (file_*). Variables related to the page edit, including summary, new_wikitext and several others, are now available for action='upload'. For every file upload, filters may be called with action='stashupload' (for uploads to stash), and are always called with action='upload'; they are not called with action='edit'.

Filter authors should use action='stashupload' | action='upload' in filter code when a file can be checked based only on the file contents – for example, to reject low-resolution files – and action='upload' only when the wikitext parts of the edit need to be examined too – for example, to reject files with no description. This allows tools that separate uploading the file and publishing the file (e.g. UploadWizard or upload dialog) to inform the user of the failure before they spend the time filling in the upload details.

Leistung

As noted in the table above, some of these variables can be very slow. While writing filters, remember that the condition limit is not a good metric of how heavy filters are. For instance, variables like *_recent_contributors or *_links always need a DB query to be computed, while *_pst variables will have to perform parsing of the text, which again is a heavy operation; all these variables should be used very, very carefully. For instance, on Italian Wikipedia it's been observed that, with 135 active filters and an average of 450 used conditions, filters execution time was around 500ms, with peaks reaching 15 seconds. Removing the added_links variable from a single filter, and halving the cases when another filter would use added_lines_pst brought the average execution time to 50ms. More specifically:

  • Use _links variables when you need high accuracy and checking for "http://..." in other variables (for instance, added_lines) could lead to heavy malfunctioning;
  • Use _pst variables when you're really sure that non-PST variables aren't enough.

You may also conditionally decide which one to check: if, for instance, you want to examine a signature, check first if added_lines contains ~~~;

  • In general, when dealing with these variables, it's always much better to consume further conditions but avoid computing heavy stuff.

In order to achieve this, always put heavy variables as last conditions.

Last but not least, note that whenever a variable is computed for a given filter, it'll be saved and any other filter will immediately retrieve it. This means that one single filter computing this variable counts more or less as dozens of filters using it.

Schlüsselwörter

Where not specifically stated, keywords cast their operands to strings

The following special keywords are included for often-used functionality:

  • like (or matches) returns true if the left-hand operand matches the glob pattern in the right-hand operand.
  • in returns true if the right-hand operand (a string) contains the left-hand operand. Hinweis: empty strings are not contained in, nor contain, any other string (not even the empty string itself).
  • contains works like in, but with the left and right-hand operands switched. Hinweis: empty strings are not contained in, nor contain, any other string (not even the empty string itself).
  • rlike (or regex) and irlike return true if the left-hand operand matches (contains) the regex pattern in the right-hand operand (irlike is case insensitive).
    • The system uses PCRE.
    • The only PCRE option enabled is PCRE_UTF8 (modifier u in PHP); for irlike both PCRE_CASELESS and PCRE_UTF8 are enabled (modifier iu).
  • if ... then ... end
  • if ... then ... else ... end
  • ... ? ... : ...
  • true, false, null

Beispiele

Code Ergebnis Anmerkung
"1234" like "12?4" True
"1234" like "12*" True
"foo" in "foobar" True
"foobar" contains "foo" True
"o" in ["foo", "bar"] True Due to the string cast
"foo" regex "\w+" True
"a\b" regex "a\\\\b" True To look for the escape character backslash using regex you need to use either four backslashes or two \x5C. (Either works fine.)
"a\b" regex "a\x5C\x5Cb" True

Funktionen

A number of built-in functions are included to ease some common issues. They are executed in the general format functionName( arg1, arg2, arg3 ), and can be used in place of any literal or variable. Its arguments can be given as literals, variables, or even other functions.

Name Beschreibung
lcase Returns the argument converted to lower case.
ucase Returns the argument converted to upper case.
length Returns the length of the string given as the argument. If the argument is an array, returns its number of elements.
string Casts to string data type. If the argument is an array, implodes it with linebreaks.
int Casts to integer data type.
float Casts to floating-point data type.
bool Casts to boolean data type.
norm Äquivalent zu rmwhitespace(rmspecials(rmdoubles(ccnorm(arg1)))).
ccnorm Normalises confusable/similar characters in the argument, and returns a canonical form. A list of characters and their replacements can be found on git, e.g. ccnorm( "Eeèéëēĕėęě3ƐƷ" ) === "EEEEEEEEEEEEE".[9] The output of this function is always uppercase. While not expensive, this function isn't cheap either, and could slow a filter down if called many times.
ccnorm_contains_any Normalises confusable/similar characters in all its arguments, and returns true if the first string contains any string from the following arguments (unlimited number of arguments, logic OR mode). A list of characters and their replacements can be found on git. Due to the usage of ccnorm, this function can be slow if passed too many arguments.
ccnorm_contains_all Normalises confusable/similar characters in all its arguments, and returns true if the first string contains every string from the following arguments (unlimited number of arguments, logic AND mode). A list of characters and their replacements can be found on git. Due to the usage of ccnorm, this function can be slow if passed too many arguments.
specialratio Returns the number of non-alphanumeric characters divided by the total number of characters in the argument.
rmspecials Removes any special characters in the argument, and returns the result. Does not remove whitespace. (Equivalent to s/[^\p{L}\p{N}\s]//g.)
rmdoubles Removes repeated characters in the argument, and returns the result.
rmwhitespace Removes whitespace (spaces, tabs, newlines).
count Returns the number of times the needle (first string) appears in the haystack (second string). If only one argument is given, splits it by commas and returns the number of segments.
rcount Similar to count but the needle uses a regular expression instead. Can be made case-insensitive by letting the regular expression start with "(?i)". Please note that, for plain strings, this function can be up to 50 times slower than count[10], so use that one when possible.
get_matches MW 1.31+ Looks for matches of the regex needle (first string) in the haystack (second string). Returns an array where the 0 element is the whole match and every [n] element is the match of the n'th capturing group of the needle. Can be made case-insensitive by letting the regular expression start with "(?i)". If a capturing group didn't match, that array position will take value of false.
ip_in_range Returns true if user's IP (first string) matches the specified IP range (second string, can be in CIDR notation, explicit notation like "1.1.1.1-2.2.2.2", or a single IP). Only works for anonymous users. Supports both IPv4 and IPv6 addresses.
ip_in_ranges Returns true if user's IP (first string) matches any of the specified IP ranges (following strings in logic OR mode, can be in CIDR notation, explicit notation like "1.1.1.1-2.2.2.2", or a single IP). Funktioniert nur für anonyme Benutzer. Supports both IPv4 and IPv6 addresses.
contains_any Returns true if the first string contains any string from the following arguments (unlimited number of arguments in logic OR mode). If the first argument is an array, it gets casted to string.
contains_all Returns true if the first string contains every string from the following arguments (unlimited number of arguments in logic AND mode). If the first argument is an array, it gets casted to string.
equals_to_any Returns true if the first argument is identical (===) to any of the following ones (unlimited number of arguments). Basically, equals_to_any(a, b, c) is the same as a===b | a===c, but more compact and saves conditions.
substr Returns the portion of the first string, by offset from the second argument (starts at 0) and maximum length from the third argument (optional).
strlen Same as length.
strpos Returns the numeric position of the first occurrence of needle (second string) in the haystack (first string), starting from offset from the third argument (optional, default is 0). This function may return 0 when the needle is found at the beginning of the haystack, so it might be misinterpreted as false value by another comparative operator. The better way is to use === or !== for testing whether it is found. Differently from PHP's strpos(), which returns false when the needle is not found, this function returns -1 when the needle is not found.
str_replace Replaces all occurrences of the search string with the replacement string. The function takes 3 arguments in the following order: text to perform the search on, text to find, replacement text.
str_replace_regexp Replaces all occurrences of the search string with the replacement string using regular expressions. The function takes 3 arguments in the following order: text to perform the search on, regular expression to match, replacement expression.
rescape Returns the argument with some characters preceded with the escape character "\", so that the string can be used in a regular expression without those characters having a special meaning.
set Sets a variable (first string) with a given value (second argument) for further use in the filter. Another syntax: name := value.
set_var Same as set.

Beispiele

Code Ergebnis Anmerkung
length( "Wikipedia" ) 9
lcase( "WikiPedia" ) wikipedia
ccnorm( "w1k1p3d14" ) WIKIPEDIA ccnorm output is always uppercase
ccnorm( "ωɨƙɩᑭƐƉ1α" ) WIKIPEDIA
ccnorm_contains_any( "w1k1p3d14", "wiKiP3D1A", "foo", "bar" ) true
ccnorm_contains_any( "w1k1p3d14", "foo", "bar", "baz" ) false
ccnorm_contains_any( "w1k1p3d14 is 4w3s0me", "bar", "baz", "some" ) true
ccnorm( "ìíîïĩїį!ľ₤ĺľḷĿ" ) IIIIIII!LLLLLL
norm( "!!ω..ɨ..ƙ..ɩ..ᑭᑭ..Ɛ.Ɖ@@1%%α!!" ) WIKIPEDAIA
norm( "F00 B@rr" ) FOBAR norm removes whitespace, special characters and duplicates, then uses ccnorm
rmdoubles( "foobybboo" ) fobybo
specialratio( "Wikipedia!" ) 0.1
count( "foo", "foofooboofoo" ) 3
count( "foo,bar,baz" ) 3
rmspecials( "FOOBAR!!1" ) FOOBAR1
rescape( "abc* (def)" ) abc\* \(def\)
str_replace( "foobarbaz", "bar", "-" ) foo-baz
str_replace_regexp( "foobarbaz", "(.)a(.)", "$2a$1" ) foorabzab
ip_in_range( "127.0.10.0", "127.0.0.0/12" ) true
ip_in_ranges( "127.0.10.0", "10.0.0.0/8", "127.0.0.0/12" ) true
contains_any( "foobar", "x", "y", "f" ) true
get_matches( "(foo?ba+r) is (so+ good)", "fobaaar is soooo good to eat" ) ['fobaaar is soooo good', 'fobaaar', 'soooo good']

Order of operations

Operations are generally done left-to-right, but there is an order to which they are resolved. As soon as the filter fails one of the conditions, it will stop checking the rest of them (due to short-circuit evaluation) and move on to the next filter. The evaluation order is:

  1. Anything surrounded by parentheses (( and )) is evaluated as a single unit.
  2. Turning variables/literals into their respective data. (e.g., page_namespace to 0)
  3. Function calls (norm, lcase, etc.)
  4. Unary + and - (defining positive or negative value, e.g. -1234, +1234)
  5. Keywords (in, rlike, etc.)
  6. Boolean inversion (!x)
  7. Exponentiation (2**3 → 8)
  8. Multiplication-related (multiplication, division, modulo)
  9. Addition und Subtraktion (3-2 → 1)
  10. Comparisons (<, >, ==)
  11. Wahrheitswert-Operationen. (&, |, ^)
  12. Ternary operator (... ? ... : ...)
  13. Assignments (:=)

Beispiele

  • A & B | C is equivalent to (A & B) | C, not to A & (B | C). In particular, both false & true | true and false & false | true evaluates to true.
  • A | B & C is equivalent to (A | B) & C, not to A | (B & C). In particular, both true | true & false and true | false & false evaluates to false.
  • added_lines rlike "foo" + "|bar" is wrong, use added_lines rlike ("foo" + "|bar") instead.

Condition counting

The condition limit is (more or less) tracking the number of comparison operators + number of function calls entered.

Further explanation on how to reduce conditions used can be found at Extension:AbuseFilter/Conditions .

Exclusions

Although the AbuseFilter examine function will identify "rollback" actions as edits, the AbuseFilter will not evaluate rollback actions for matching.[11]

Notes

  1. Comparing arrays to other types will always return false, except for the example above
  2. 2.0 2.1 2.2 2.3 2.4 2.5 2.6 2.7 The only variables currently available for file uploads (action='upload') are user_*, page_*, file_sha1, file_size, file_mime, file_mediatype, file_width, file_height, file_bits_per_channel (the last five were only added since the release for MediaWiki 1.27 gerrit:281503). All the file_* variables are unavailable for other actions (including action='edit').
  3. Seit MediaWiki 1.28 (gerrit:295254)
  4. Several filters (12) that use this variable have showed up in the AbuseFilterSlow Grafana dashboard (requires logstash access to view). Moving this variable to towards the end of the filter seemed to help.
  5. Siehe phabricator:T191722
  6. Deprecated with this commit and disabled with this one.
  7. Some filters using this variable have showed up in the AbuseFilterSlow Grafana dashboard (example, requires logstash access). For instance, instead of using "text" in edit_diff_pst (or even edit_diff), consider something like "text" in added_lines & !("text" in removed_lines)
  8. See the source code for a list of types.
  9. Be aware of phab:T27619. You can use Special:AbuseFilter/tools to evaluate ccnorm( "your string" ) to see which characters are transformed.
  10. https://3v4l.org/S6IGP
  11. T24713 - rollback not matched by AF