Page MenuHomeMiraheze

Investigate why spam blacklist hits are not logged
Closed, ResolvedPublic

Description

Wiki: testwiki

Problem: When a user attempts to add an URL in the spam blacklist (the local or global spam blacklist log), the attempt is thwarted, but no log entry is made. This is a problem for Stewards and the Counter Vandalism Team members for properly being able to assess problems or false-positives, and, so, there must be a public log. Local administrators should also find it useful, too

Steps to reproduce:

  1. Add a URL to the MediaWiki:Spam-blacklist (local spam blacklist page)
  2. Attempt to add the URL to any page on that wiki, from a user account not exempt from the spam blacklist
  3. Attempt should be thwarted, but no log entry is made in the spam blacklist log

TestWiki's spam blacklist log: permalink

Event Timeline

Dmehus triaged this task as High priority.Apr 24 2022, 16:31
Dmehus created this task.
Dmehus moved this task from Backlog to Short Term on the MediaWiki (SRE) board.
Dmehus updated the task description. (Show Details)

I'm pretty sure the log is explicitly private for good reason.

I'm pretty sure the log is explicitly private for good reason.

Is that documented anywhere?

Personally, I feel having it log would be more useful to sysops etc. than it not being logged and the number of false positives being potentially quite high.

Probably in phab's history. It was to do with PII I think.

I think I was thinking title blacklist as it looks like the config has been this way since early days.

Just noting but WMF seems to allow the blacklist to be publicly visible by default.

Universal_Omega lowered the priority of this task from High to Normal.

Mentioned PR was merged.