Viewing abuse filter 20: "Poop" vandalism

Filter parameters

Filter ID:	20
Description: (publicly viewable)
Conditions:	!("confirmed" in user_groups) & page_namespace == 0 & edit_delta < 300 & ( poop := "\bP+OO+P+(ES+\|E+R+S\|ED+\|IN+G+\|Y+)?\b"; ccnorm(added_lines) rlike poop & !(ccnorm(old_wikitext) rlike poop) ) !("confirmed" in user_groups) & page_namespace == 0 & edit_delta < 300 & ( poop := "\bP+OO+P+(ES+\|E+R+S\|ED+\|IN+G+\|Y+)?\b"; ccnorm(added_lines) rlike poop & !(ccnorm(old_wikitext) rlike poop) )
Notes:	Simple regex should catch poop vandalism, don't know if + is acceptable over {1,} in this particular system. Testing only for now. "Poo" is not matched as tests produced too many false positives. If I've made a really stupid mistake somewhere, don't hesitate to fix it. If there are false positives, don't hesitate to escape it: … & !(rmspecials(ccnorm(added_lines)) rlike "false positive regex") —Nihiltres Added case that this shouldn't be caught if there's poop in the article title, or if the action's done by a sysop —Nihiltres Changed from sysop to autoconfirmed - Prodego Changed from checking title for the regex to checking the old wikitext for the word poop. -Prodego Filter seems very accurate, enabling warnings. -Nixeagle Please don't set this one on disallow, warnings are fine. -Prodego A couple of minor fixes/simplifications and rationalized the notes here. —Nihiltres fixed so we don't trigger on a false positive by http://en.wikipedia.org/wiki/Special:AbuseFilter/examine?wpSearchUser=24.212.44.161&wpSearchPeriodStart=&wpSearchPeriodEnd=&submit=1&title=Special%3AAbuseFilter%2Fexamine . Also re-order with the quicker checks to the left. Disabling warning while we test. -Xaosflux Reverting you xaos, I did some testing and changes to hopefully optimize it and fix a false positive. -Nixeagle Setting to deny. -Hersfold DISABLING - Taking almost three seconds to run - Hersfold Taking out "action = edit", shouldn't be necessary since we're checking for autoconfirm right after it - Hersfold Rationalized the comments here and noted who said what, also note that if you're going to use \b in the regex make sure that it matches variants like "pooppp" or "pppoop", I recently had to add a + back after the first P. —Nihiltres Removed the rmwhitespace() bit and modified the regex to compensate since the \b and the rmwhitespace() together produced many false negatives. If you start getting false positives, fix it or revert it, but I'm pretty sure this should behave decently —Nihiltres Added a case with some false positives I found using Special:Prefixindex, just to be sure —Nihiltres Added "poo power" to exceptions. - Ruslik Simplified filter. - Ruslik Added "shampoo" to exceptions. - Ruslik Added "Come Poop with Me" to exceptions". - Ruslik Removed "shampoo" from exceptions because the regex doesn't catch it and it'll only cause false negatives, added instead the offending URLs from the false positive found. —Nihiltres Added "youtube poop", because it is producing false positives at a higher rate than just about anything else as of 11-29-09. - Soap Changed trailing P to (P\|!) experimentally to catch "Poo!" cases as well; changed check for old poop to use removed_lines instead of old_wikitext for efficiency… feel free to revert either change if problematic. The "youtube poop" and "party pooper" additions are good. —Nihiltres Changed (P\|!) to [P!] since that's probably better form. —Nihiltres Changed instances of \s? to \s* for better catching of variants… there may have been a reason I didn't include that before, but I don't remember it now. —Nihiltres Added "Poopdeck" to exceptions. - Ruslik added "poopatine" -- Soap and "poopcity" -- Soap Removed straight poop URL per discussion on WT:EF -- Shirik 12 Feb 2010 Added "The Rez Sisters" to allow a quote reported at WP:FALSEPOS -- Shirik 21 Feb 2010 Added "Poopin up on ya" per false positive -- Shirik 22 Feb 2010 Add "pookkum" ... I had wanted a more intelligent solution, but it seems there isnt one that would not lead to this filter allowing "poo poo" through -- Soap "ucanpooptoo" -- Soap Overly intensive, clean it up before reenabling (move exceptions to regex) -P Trying a different approach. Matches if poop is not used anywhere in the old_wikitext. Of course, for speed, that step goes last. Also added a line to strip big edits (more then 300 characters added). Log only for a few days. Hidden from public view. Tim 4/28 Nothing has broken so far. Moved regex to constant. Added regex to match things like p.o.o.p.. Still watching closely. - Tim 4/28 Remove intensive last line. Tim Tagg as "possible vandalism" until we turn on "Disallow". -Tim 4/28 Fix false positive for "poor". Tim Warn. Tim 4/28 Disabling. We're near 5% condition limit hits and this is a candidate for the culprit. -- Shirik I optomized a few things, lets see if this works. Will disable if needed. -- Tim 4/29 Optimized -- Shirik 29 Apr 2010 Should not be private. -P This filter appears to be catching on the string "oo" with an "l" on either side of it, which is causing false positives with words like "pooling" and "bloodflow" (see the F+'s page). Since I can't make heads or tails of the filter (since I barely know enough about the code), I'll leave that for another filter editor to deal with, but the present state isn't acceptable. -v-_-v :Made a fix that I believe will solve the problem. Just as 'popping' doesnt match, now 'pooling' wont either --Soap :Nope, fix isn't working, Soap. Another "pooling" FP today. -v-_-v ::Maybe I should have removed the plus sign from the first part instead. Should be OK now but I'll keep watching. -- Soap for now, changing * after second 'P' to + to stop blocking isolated "poo". More useful suggestions welcome. -- Soap Warn + disallow, as with other vandalism templates. - KoH Bracket per DF and simplify regex. Suggest we user "rmspecials" function to simplify. RF 2015-02-18 Used irlike in last expression to simplify. (Maybe we should use /p{P} and/or /p{S}. Or loose that complexity, since most poop vandalism is simple.) Updated for new ccnorm. RF 20160812 https://phabricator.wikimedia.org/T29987 fully deployed and confirmed working, removing old code ~MA 2016.08.18 Simplifying old_wikitext comparison (irlike is case insensitive and we shouldn't have l33tsp34k in existing wikitext) --Kaldari 2016-11-14 can also end in "Y" --Enterprisey 2019-12-05 Simplify, use same regex for added_lines and old_wikitext check. Only one false negative in 1000 hits (and that was stopped by another filter), but several false positives. --Suffusion of Yellow 23:15 25 Sep 2020
Flags:	Hide details of this filter from public view Enable this filter I understand that details of this filter will be hidden from users who cannot see [https://www.mediawiki.org/wiki/Special:MyLanguage/Extension:AbuseFilter/Rules_format#Protected_variables protected variables] Mark as deleted
Filter last modified:	18:35, 27 September 2021 by WikiDwarf (talk \| contribs)
History:	View this filter's history
Tools:	Export this filter to another wiki {"data":{"rules":"!(\"confirmed\" in user_groups) \u0026\r\npage_namespace == 0 \u0026\r\nedit_delta \u003C 300 \u0026\r\n(\r\n poop := \"\\bP+OO+P+(ES+\|E+R+S\|ED+\|IN+G+\|Y+)?\\b\";\r\n \r\n ccnorm(added_lines) rlike poop \u0026\r\n !(ccnorm(old_wikitext) rlike poop)\r\n)","name":"\"Poop\" vandalism","comments":"Simple regex should catch poop vandalism, don't know if + is acceptable over {1,} in this particular system. Testing only for now. \"Poo\" is not matched as tests produced too many false positives. If I've made a really stupid mistake somewhere, don't hesitate to fix it. If there are false positives, don't hesitate to escape it: \u2026 \u0026 !(rmspecials(ccnorm(added_lines)) rlike \"false positive regex\") \u2014Nihiltres\r\nAdded case that this shouldn't be caught if there's poop in the article title, or if the action's done by a sysop \u2014Nihiltres\r\nChanged from sysop to autoconfirmed - Prodego\r\nChanged from checking title for the regex to checking the old wikitext for the word poop. -Prodego\r\nFilter seems very accurate, enabling warnings. -Nixeagle\r\nPlease don't set this one on disallow, warnings are fine. -Prodego\r\nA couple of minor fixes/simplifications and rationalized the notes here. \u2014Nihiltres\r\nfixed so we don't trigger on a false positive by http://en.wikipedia.org/wiki/Special:AbuseFilter/examine?wpSearchUser=24.212.44.161\u0026wpSearchPeriodStart=\u0026wpSearchPeriodEnd=\u0026submit=1\u0026title=Special%3AAbuseFilter%2Fexamine . Also re-order with the quicker checks to the left. Disabling warning while we test. -Xaosflux\r\nReverting you xaos, I did some testing and changes to hopefully optimize it and fix a false positive. -Nixeagle\r\nSetting to deny. -Hersfold\r\nDISABLING - Taking almost three seconds to run - Hersfold\r\nTaking out \"action = edit\", shouldn't be necessary since we're checking for autoconfirm right after it - Hersfold\r\nRationalized the comments here and noted who said what, also note that if you're going to use \\b in the regex make sure that it matches variants like \"pooppp\" or \"pppoop\", I recently had to add a + back after the first P. \u2014Nihiltres\r\nRemoved the rmwhitespace() bit and modified the regex to compensate since the \\b and the rmwhitespace() together produced many false negatives. If you start getting false positives, fix it or revert it, but I'm pretty sure this should behave decently \u2014Nihiltres\r\nAdded a case with some false positives I found using Special:Prefixindex, just to be sure \u2014Nihiltres\r\nAdded \"poo power\" to exceptions. - Ruslik\r\nSimplified filter. - Ruslik\r\nAdded \"shampoo\" to exceptions. - Ruslik\r\nAdded \"Come Poop with Me\" to exceptions\". - Ruslik\r\nRemoved \"shampoo\" from exceptions because the regex doesn't catch it and it'll only cause false negatives, added instead the offending URLs from the false positive found. \u2014Nihiltres\r\nAdded \"youtube poop\", because it is producing false positives at a higher rate than just about anything else as of 11-29-09. - Soap\r\nChanged trailing P to (P\|!) experimentally to catch \"Poo!\" cases as well; changed check for old poop to use removed_lines instead of old_wikitext for efficiency\u2026 feel free to revert either change if problematic. The \"youtube poop\" and \"party pooper\" additions are good. \u2014Nihiltres\r\nChanged (P\|!) to [P!] since that's probably better form. \u2014Nihiltres\r\nChanged instances of \\s? to \\s for better catching of variants\u2026 there may have been a reason I didn't include that before, but I don't remember it now. \u2014Nihiltres\r\nAdded \"Poopdeck\" to exceptions. - Ruslik\r\nadded \"poopatine\" -- Soap\r\nand \"poopcity\" -- Soap\r\nRemoved straight poop URL per discussion on WT:EF -- Shirik 12 Feb 2010\r\nAdded \"The Rez Sisters\" to allow a quote reported at WP:FALSEPOS -- Shirik 21 Feb 2010\r\nAdded \"Poopin up on ya\" per false positive -- Shirik 22 Feb 2010\r\nAdd \"pookkum\" ... I had wanted a more intelligent solution, but it seems there isnt one that would not lead to this filter allowing \"poo poo\" through -- Soap\r\n\"ucanpooptoo\" -- Soap\r\n\r\nOverly intensive, clean it up before reenabling (move exceptions to regex) -P\r\n\r\nTrying a different approach. Matches if poop is not used anywhere in the old_wikitext. Of course, for speed, that step goes last. Also added a line to strip big edits (more then 300 characters added). Log only for a few days. Hidden from public view. Tim 4/28\r\n\r\nNothing has broken so far. Moved regex to constant. Added regex to match things like p.o.o.p.. Still watching closely. - Tim 4/28\r\n\r\nRemove intensive last line. Tim\r\n\r\nTagg as \"possible vandalism\" until we turn on \"Disallow\". -Tim 4/28\r\n\r\nFix false positive for \"poor\". Tim\r\n\r\nWarn. Tim 4/28\r\nDisabling. We're near 5% condition limit hits and this is a candidate for the culprit. -- Shirik\r\nI optomized a few things, lets see if this works. Will disable if needed. -- Tim 4/29\r\n\r\nOptimized -- Shirik 29 Apr 2010\r\n\r\nShould not be private. -P\r\n\r\nThis filter appears to be catching on the string \"oo\" with an \"l\" on either side of it, which is causing false positives with words like \"pooling\" and \"bloodflow\" (see the F+'s page). Since I can't make heads or tails of the filter (since I barely know enough about the code), I'll leave that for another filter editor to deal with, but the present state isn't acceptable. -v-_-v\r\n:Made a fix that I believe will solve the problem. Just as 'popping' doesnt match, now 'pooling' wont either --Soap\r\n:Nope, fix isn't working, Soap. Another \"pooling\" FP today. -v-_-v\r\n::Maybe I should have removed the plus sign from the first part instead. Should be OK now but I'll keep watching. -- Soap\r\nfor now, changing * after second 'P' to + to stop blocking isolated \"poo\". More useful suggestions welcome. -- Soap\r\nWarn + disallow, as with other vandalism templates. - KoH\r\nBracket per DF and simplify regex. Suggest we user \"rmspecials\" function to simplify. RF 2015-02-18\r\nUsed irlike in last expression to simplify.\r\n(Maybe we should use /p{P} and/or /p{S}. Or loose that complexity, since most poop vandalism is simple.)\r\nUpdated for new ccnorm. RF 20160812\r\n\r\nhttps://phabricator.wikimedia.org/T29987 fully deployed and confirmed working, removing old code ~MA 2016.08.18\r\n\r\nSimplifying old_wikitext comparison (irlike is case insensitive and we shouldn't have l33tsp34k in existing wikitext) --Kaldari 2016-11-14\r\n\r\ncan also end in \"Y\" --Enterprisey 2019-12-05\r\n\r\nSimplify, use same regex for added_lines and old_wikitext check. Only one false negative in 1000 hits (and that was stopped by another filter), but several false positives. --Suffusion of Yellow 23:15 25 Sep 2020","group":"default","actions":{"disallow":["abusefilter-disallowed"]},"enabled":true,"deleted":false,"privacylevel":0,"global":false},"actions":{"disallow":["abusefilter-disallowed"]}}

Actions to take when matched

Trigger actions only if the user trips a rate limit

Number of actions to allow:

Period of time (in seconds):

Group throttle by:

user

See the documentation on mediawiki.org.

Trigger these actions after giving the user a warning

System message to use for warning:

Page name of other message:

(without "MediaWiki:" prefix)

Prevent the user from performing the action in question

System message to use for disallowing:

Page name of other message:

(without "MediaWiki:" prefix)

Revoke the user's autoconfirmed status

Block the user and/or IP address from editing

Block the user and/or IP address from editing their own talk page

Block duration for non-registered users:

Block duration for registered users:

Tag the edit for further review

Tags to apply: