විකිපොත්:Edit filter

The edit filter is a tool used to allow trusted users to set specific controls on user activity and create automated reactions for certain behaviors.

The Abuse Filter extension was developed by Werdna with support from the Wikimedia Foundation, and went live on the English Wikibooks in August 2010. Nearly all user-facing elements of the filter refer to it as the "Edit filter" as not all the edits it flags are abusive. In the software and special pages, it retains its original name.

The extension allows automatic filters/heuristics to be applied to all edits. Specific rules can be developed, such as "users with fewer than 500 edits are blocked from moving pages to titles which match this regular expression: /poop/". Of course, the rules can get quite a bit more complicated.

Log entries and filters are viewable by autoconfirmed users. For all filters, including those hidden from public view, a brief, general summary of what the rule targets will be available, and displayed in the log, the list of active filters, and in any error messages generated by the filter.

Implementation of AbuseFilter on Wikibooks is being done with due caution—most edit filters should be tested for a few days (in "log only" mode) before being brought to full force ("warn", "disallow", or "throttle" modes). Only administrators are allowed to modify any of the filters.

Extension documentation

Filtering criteria

For all the following, we can do extensive normalization, regex matching, length comparison and regular comparisons (less than, greater than, equal to) matching, combining different filters with Boolean logic.

User

• Edit count.
• Account age.
• Groups.
• Email-confirmed status.

Titles (moved-to, moved from included)

• Namespace.
• Title.
• Full text.
• Restrictions and protection status.

Action

• The action type (edit, move, createaccount, autocreateaccount, delete, stashupload, upload, or other).
• Edit summary.
• Contents of the edit.

Throttling

• Filters can specify whether actions done at a certain rate are by the same IP address, account, /16 range, account-creation-date, and/or to the same page, for a consequence (below) to be invoked.
• Any of the above conditions can be combined to produce a separate rate-limiter. For instance, we can group all accounts created on the same date, from the same /16, for the purposes of rate-limiting.
• Any actions set for that filter will occur if, and only if, the rate-limiter is tripped. This reduces false-positives by making the filter apply only if the same user is consistently tripping a particular filter, rather than a single false-positive.

Actions which can be assigned in response to filtered edits

If a user triggers a filter, the edit filter can apply any of the following sanctions based on the severity of the offense:

• All actions triggering a filter are logged at a special page.
• The user's action can be tagged for further review.
• The user can be warned that their actions may be unconstructive.
• The user's action may be disallowed.
• The user's account may have its autoconfirmed status removed.

The following actions are currently not available on this wiki:

• The user's account may be blocked from editing, along with all IP addresses used in the last 7 days.
• The user's account may be removed from all privileged groups (such as sysop or bot).

Note: Individual sanctions can be disabled selectively. Any administrator can restore autoconfirmed status in case of an error.

Monitoring

All edits triggering an action will produce a report at Special:AbuseLog. On this page, a brief log entry is entered. Users with the appropriate permissions may view the log summary. Administrators may view details on the log entry. This includes all information available to the filter when it ran, and may be useful for debugging purposes. CheckUsers may view private data about the action which caused the log event, such as the user's IP address. The edit can also be tested against another existing or proposed filter via an "examine" link.

Sample log entries

A sample detailed log entry

• 06:43, 23 June 2008: Example~enwikibooks (discuss | contribs | block) triggered filter 1, making an edit on Main Page. Actions taken: Warn, disallow; Filter description: Test Filter (details | examine)
• 06:43, 23 June 2008: Example~enwikibooks (discuss | contribs | block) triggered filter 2, making an edit on Main Page. Actions taken: None; Filter description: Test Filter (details | examine)
• 06:42, 23 June 2008: Example~enwikibooks (discuss | contribs | block) triggered filter 1, making an edit on Main Page. Actions taken: Warn; Filter description: Test Filter (details | examine)
• 06:42, 23 June 2008: Example~enwikibooks (discuss | contribs | block) triggered filter 2, making an edit on Main Page. Actions taken: None; Filter description: Test Filter (details | examine)
• 06:22, 23 June 2008: Example~enwikibooks (discuss | contribs | block) triggered filter 1, making an edit on Main Page. Actions taken: Warn, Disallow; Filter description: Test Filter (details | examine)
• 06:22, 23 June 2008: Example~enwikibooks (discuss | contribs | block) triggered filter 2, making an edit on Main Page. Actions taken: None; Filter description: Test Filter (details | examine)

The details link brings up a screen like that on the right.

Safeguards

To protect the wiki against poorly configured filters, a technical limit is imposed on the maximum percentage of actions that will trigger a given filter. Other technical limits are in the process of being written.

Notification

All notifications are based on the template {{edit filter warning}}.

Standard notifications shown to a user triggering a filter action:

Message name	Message text
abusefilter-disallowed	This action has been automatically identified as harmful, and therefore disallowed. If you believe your action was constructive, please inform an administrator of what you were trying to do. A brief description of the abuse rule which your action matched is: $1
abusefilter-degrouped	This action has been automatically identified as harmful. Consequently, it has been disallowed, and, since your account is suspected of being compromised, all rights have been revoked. If you believe this to have been in error, please contact a bureaucrat with an explanation of this action, and your rights may be restored. A brief description of the abuse rule which your action matched is: $1
abusefilter-autopromote-blocked	This action has been automatically identified as harmful, and it has been disallowed. In addition, as a security measure, some privileges routinely granted to established accounts have been temporarily revoked from your account. A brief description of the abuse rule which your action matched is: $1

Generic warning message is below. Administrators are advised to use custom warnings.

Message name	Message text
abusefilter-warning	අවවාදයයි:මෙම ක්‍රියාව හානිදායක බව ස්වයංක්‍රීයව හඳුනාගෙන ඇත. Unconstructive edits will be quickly reverted, and egregious or repeated unconstructive editing will result in your account or IP address being blocked. If you believe this edit to be constructive, you may click Submit again to confirm it. A brief description of the abuse rule which your action matched is: $1

Some existing filters and their warnings:

Filter and message	Message text
1: large deletions removal	මාධ්‍යවිකි:Abusefilter-warning-removal
3: link spamming possible link spam	මාධ්‍යවිකි:Abusefilter-warning-link-spam

If a filter is set to warn and disallow, then a user clicking "Save page" will alternatively see that warning and standard disallowed message.

Known issues

When the extension was initially installed, the available actions did not include blocking or removing from privileged groups. This restricted usage was determined by community consensus, and if the extension is successful, the community had the option to enable the block, rangeblock or degroup actions. In February 2021, the block action was added.