Extension:AbuseFilter/Global

Global Rules

Note: You are not required to install Extension:CentralAuth, just set up config per below and global filters will work.

For users who use CentralAuth to manage a cluster of wikis, AbuseFilter can support using a rule from a central wiki on all other wikis.

Rules on the central wiki are marked in the database if they are global (af_global is set to 1), and attached wikis add these rules to their local list of rules when processing edits.

Throttling, for triggering a filter's action and automatically disabling a filter that matches too many edits, is aggregated across all wikis.

Logging is done on the central wiki, so that permissions to view private filter logs are managed on the central wiki only.

Enabling

Each wiki that should use the global rules needs to point to the central wiki by setting $wgAbuseFilterCentralDB. For instance, WMF wikis use the following:

$wgAbuseFilterCentralDB = 'metawiki';

The central wiki also needs to have $wgAbuseFilterIsCentral = true set.
In order to mark a rule on the central wiki as public, the user needs to the abusefilter-modify-global permission. By default, this is not assigned to any user groups.

Usage: Central Rules Administrators

This requires the $wgAbuseFilterIsCentral to be evaluated to true which should be the case if the current wiki database name match the value of $wgAbuseFilterCentralDB.

Users with the abusefilter-modify-global permission can make any rule global by checking the "Global filter" checkbox in the rule's Flags section.
Rules that are global include "Global" in the Status column when viewing all of the rules
The filter "Hit Count" is aggregated from all wikis
The AbuseLog can be filtered by wiki, to show only hits from a single wiki

Usage: Local Administrators

On the wikis that use central rules, a new radio button will appear on Special:AbuseFilter, allowing users to switch between the global and local rulesets
To view the actions that have triggered the rules, the admin will need to visit the AbuseLog on the central wiki, and have the appropriate rights

Global Throttling

For any global rules, the rate limit ("Trigger actions only if the user trips a rate limit") is applied across all wikis. So for a rule that matches several of a user's edits, the action will trigger after the rate limit is exceeded, whether the edits are all on one wiki, or across several wikis.