Extension talk:AbuseFilter/Rules format/Archive 1

variables overview

is there an overview of those variables like MOVED_TO_TEXT, ADDED_LINES, SUMMARY, USER_GROUPS etc.? -- seth 17:55, 28 January 2009 (UTC)

Note regarding formatting conditions

I don't know if this will help anyone, but I ran into a problem formatting some conditions. I wanted to select all non-minor edits and discovered that, while '= "1"' is honored, '="0"' is not when it comes to asserting actions on live edits, even though testing the filter using that syntax works fine. Therefore, the safest syntax to use is '= true' and '= false'. Again, probably just my duncery, but perhaps it will help someone else. Cheers. Thorncrag 18:47, 6 September 2010 (UTC)

• Another one I discovered, if you want to apply to file uploads, or to exclude from uploads use something like: (action != 'upload'). Thorncrag 19:57, 7 September 2010 (UTC)

Both handy - thanks Thorncrag. --Chriswaterguy 11:42, 7 December 2011 (UTC)

Concatenation

How can I concatenate strings? --Octahedron80 05:32, 13 May 2011 (UTC)

You can just use a +. So "some text" == "foo bar" is the same as "some text" == "foo" + " bar". 207.71.53.42 21:51, 2 June 2011 (UTC)

No Unicode support

Unicode support is required because the following example in French do not work properly :

"testé" regex "\btest\b"

Result: True

There is no workaround as the PCRE syntax is not fully supported like the (*UCP) option.

--DavidL (talk) 22:29, 16 April 2012 (UTC)

A quick glance at AbuseFilter's code shows that much of it relies on the built-in POSIX regex, though a developer may have a different opinion.--Jasper Deng (talk) 00:03, 17 April 2012 (UTC)

blocked IP

is it possible to add variable that can show the user's IP is blocked or not.

it is helpful for cases that open proxy is blocked but only for ip editing not users editing.

in many cases users because of some limitations in their country (some pages are filtered by isp ,...) they use open proxy for editing in specific articles.

I want to filter which users are new and they use this Block IPs.Reza1615 (talk) 21:37, 16 June 2012 (UTC)

article_articleid documentation wrong?

I'm working on a filter that should only apply to the edit that creates a page. The docs list a variable "article_articleid — this is 0 for new pages" but the filter was not trapping the edits that created pages. Turns out the variable value was not 0, but rather some large int value. Digging deeper, that is consistent with the variable's description as "PageID" being a unique token tied to the page (independent of whether it has exited before or not). What would be 0 is probably some token for the previous rev_id, but I don't see an entry for that in the AF docs. For now, old_pagesize works pretty well for my case (though it also catches the first edit after a manual blanking, rather than only "page creation"). DMacks (talk) 19:01, 25 August 2012 (UTC)

Testing further, sometimes article_articleid is 0 for page-creation, but not always. For example, [1] is 36774991 but [2] is 0. WTF?? DMacks (talk) 19:08, 25 August 2012 (UTC)

According to User:hoo at Phab:T72647:

article_articleid still works flawless[...] Please notice that article_articleid = 0 wont work for page creations in "Examine past edits" and "Batch testing".

Dalba 14:02, 17 March 2016 (UTC)

moved_from_recent_contributors

When examining changes triggered on a page move from the abuse log, there's a variable named moved_from_recent_contributors that I want to use, but when use that variable inside the conditions then it says there's a syntax error and that the moved_from_recent_contributors variable is not recognized, so it's not really usable. Maybe it can be used but the validator does not recognize it. --Ciencia Al Poder (talk) 21:54, 21 November 2012 (UTC)

Please add description of variable values

Tracked in Phabricator
Task T52107

In particular I want to know whether "added_lines" and "removed_lines" refer to the number of lines or whether they contain the actual line text, but there are several other ambiguous items. For example, what units do the "size" variables use (Characters? Bytes? Lines? Something else?), what is the user_name field if the user is not logged in, and more. Please put SOMETHING in the value field for each variable, at least describing the data type. —The preceding unsigned comment was added by 205.175.225.22 (talk • contribs) 15:44, 15 March 2013

I agree. In many cases one has to use "try and error" before an abuse filter works. -- Juetho (talk) 08:50, 27 April 2013 (UTC)

+1. And from bug 50107 a better guess would be that "added_lines" and "removed_lines" are actually arrays! Helder 16:25, 5 July 2013 (UTC)

I've added a column to document the type of the variables. I found some variables which look like numbers but are actually strings: comparisons such as timestamp === 1373038946 returns false, but timestamp === "1373038946" returns true. Helder 17:13, 5 July 2013 (UTC)

Comparison

• === and !== — Return true if the left-hand operand is equal to/not equal to the right-hand operand AND the left-hand operand is the same/not the same data type to the right-hand operand respectively.

Sorry for the format, but the page has Visual Editor and the talk page does not have it, and therefore copying is not easy.

So is it "not the same" or "not neccesserily the same"? What about 1===1, true or false? Bináris^talk 06:03, 6 July 2013 (UTC)

IPv6

Does IPv6 work with "ip_in_range" and what would be the syntax? --87.176.254.136 22:04, 5 September 2013 (UTC)

It does, and just the same: ip_in_range(user_name, "2001:8000::/20") --Andrewssi2 (talk) 19:33, 12 November 2015 (UTC)

How to use "new_pst",Requesting documentation

Hi,

Among syntax options available for edit filter there is one option called "new_pst" given discription is :" New page wikitext,pre-save transformed . My question is how do we put this syntax to use ? edit filter example if it has been used already ?

Mahitgar (talk) 05:43, 12 December 2013 (UTC)

Is anyone able to add the explanatory text to the obverse of this page? — billinghurst sDrewth 04:17, 8 March 2015 (UTC)

More examples

I wanted to use if ... then ... else ... end and A ? B : C with user-defined variables and functions but I missed examples. By trial and error I found out that brackets are needed. Where should I add suitable descriptions and examples?

• in the section "Keywords – Examples"?
• in the section "Functions – Examples"?
• or in a new section "More Examples" before Order of Operations?

-- Juetho (talk) 12:32, 15 August 2014 (UTC)

file_sha1

File upload action has had a variable file_sha1 since 2009[3] Can anyone confirm it works. See bugzilla:19565 and bugzilla:14417. John Vandenberg (talk) 05:42, 7 October 2014 (UTC)

Count changes of the same user before this change in the past 1/2 hours or 1 hour

I we had such a variable, the typical 'add something to each page' type vandal could be stopped. This is a quite popular form of vandalism. Muki985 (talk) 09:32, 24 January 2015 (UTC)

Throttle. Look at the edit page more carefully. Rich Farmbrough 19:24, 24 July 2015 (UTC).

Why smaller heading is used?

Generally, heading 2 is used for first subheadings. but in this page, heading 3 is used for first subheadings. I think they should be modified if there is no a special reason. --E.Z.O. (talk) 17:50, 7 September 2015 (UTC)

I modified myself because nobody disproves. --E.Z.O. (talk) 13:12, 23 September 2015 (UTC)

Resolve IP address?

I'm using ip_in_range to detect for certain IP addresses, however some internet provider have a large number of different ranges.

Is there anyway to resolve the IP address to something like *.InternetProvider.com  ?

--Andrewssi2 (talk) 09:10, 1 December 2015 (UTC)

Does action == "upload" even work?

If I try to test action == "upload" against the recent changes, uploads aren't even listed, and a filter using it does not seem to work at all.--Baumgeist (talk) 20:58, 27 February 2016 (UTC)

Escaping Unicode characters

Is it possible to use some escape sequence to escape Unicode characters? I mean something like:

"ی" rlike "\u06CC" /* This is supposed to return true; but it doesn't */

Dalba 04:12, 14 March 2016 (UTC)

I think I found the solution: Use UTF-8 code units! For example the above statement becomes:

"ی" rlike "\xdb\x8c"

Dalba 04:30, 14 March 2016 (UTC)

Another (and probably better) method:

"ی" rlike "\\x{06CC}"

Dalba 05:18, 14 March 2016 (UTC)

"in" is not a Boolean operation

According the current order of operations, "in" is a Boolean operator and is one of the last things that is going to be evaluated. But

2-0 in '0' /* returns true */
2-(0 in '0') /* returns true */
(2-0) in '0' /* returns false */

As you can see, 2-0 in '0' is treated as 2-(0 in '0') which means "in" is evaluated before minus. So I think "in" is treated like other keywords and even has precedence over Boolean inversion:

! true in '0' /* returns true */
! (true in '0') /* returns true */
(! true) in '0' /* returns false */

I'll remove "in" from Booleans. Dalba 05:11, 15 March 2016 (UTC)