new_text is described incorrectly here (though not in Special:AbuseFilter). It's not the wikitext; it seems like
Extension talk:AbuseFilter/Rules format
@Erutuon You are correct, thanks for reporting this! I have fixed the error, which was caused by a message with a deceiving name.
Is there a concise list of canonical group names for use with the user_groups test? The documentation links to the list of group rights, but that table does not give a specific name to each group. For example, in existing filters I see "autopatrolled" used in testing user_groups, but in the linked page's list it is called "Autopatrollers", and refers to a code symbol "autopatrol". Clicking on the Autopatrollers link goes to the project "Autopatrolled users" page (via a redirect). That page refers to the "autopatrol group", which links to user list, wherein I can select "Autopatrollers" in a drop-down, showing a list of users with the group name "autopatroller"---the latter being the same syntax I can see on when looking at an individual user's rights.
So, how does one find the actual names usable in a user_group test? Is the best way to look at the sub-page name of Special:ListUsers? That seems quite awkward and indirect, so I'm hoping I just missed a more obvious list.
BTW, I also noted that "sysop" is sometimes used in filters, and it is a group according to the manual but it is not listed as a group in Special:ListGroupRights.
Also look at the abuselog reports (test or real ) themselves for a spam filter will show what applies and where. Often easier than digging through the API.
Oh, and the other cheat that I use is the gadget navigation popups will show a user's rights when you hover over a username, and it shows them at the underlying name.
Thanks, I hadn't enabled that gadget before, but it's quite useful.
All the group names at Special:ListGroupRights are localized, which is why you see "Autopatrollers" instead of "autopatrolled" (as specified by MediaWiki:Group-autopatrolled), and "Administrators" instead of "sysop" (MediaWiki:Group-sysop). The API can give you the full list with the raw system names: https://www.mediawiki.org/w/api.php?action=query&meta=siteinfo&siprop=usergroups (look for the
"name": keys). It also lists the rights that each group has, which is what the
user_rights variable would contain.
Look at commons:Special:AbuseFilter/14. Are single equality signs near
article_namespace a valid representation of the comparison operator in this context? Or it is a regrettable misspell by Commons sysops?