Page MenuHomePhabricator

Flag to prevent blocked users from sending email via Special:Emailuser
Closed, ResolvedPublic

Description

Author: mapellegrini

Description:
Blocked users have taken to spamming dozens and possibly hundreds of admins,
requesting to be unblocked. While this has always been true to some extent,
lately it has been happening with increasing frequency. It generates a great
deal of confusion for admins (to get emails from users they have had no contact
with, asking to be unblocked), and the blocking admin receives dozens of
messages from other admins asking why he blocked a particular user.

At block time, a blocking admin should have the option of disabling the blocked
user's ability to send emails through the email-this-user function. More
importantly, Mediawiki should also have a throttle setting, (so that the feature
cannot be used more than X times per hour, for example). This won't stop the
abuse, but it will make it significantly more difficult.


Version: unspecified
Severity: enhancement
See Also:
https://bugzilla.wikimedia.org/show_bug.cgi?id=4995

Details

Reference
bz7997

Event Timeline

bzimport raised the priority of this task from to Medium.Nov 21 2014, 9:28 PM
bzimport set Reference to bz7997.
bzimport added a subscriber: Unknown Object (MLST).

nsle.wikipedia wrote:

Hmm... so what about blocked users with talk pages protected trying to initiate
Arb cases? Don't those normally start through email? Plus, currently
[[MediaWiki:Blockedtext]] encourages the use of email directly to the blocking
admin to solve blocks (it also suggest the use of the unblock-en-l list). This
has the potential for abuse by admins, too.

mapellegrini wrote:

(1) The arbcom doesn't take cases of clearcut problem users (anymore). If a user
is blocked, it's usually for good reason. So the arbcom will rarely intervene if
one of the parties is already blocked. (2) I trust the administrators not to
abuse this a heck of a lot more than I trust the people they are blocking not to
abuse it.

MacGyverMagic wrote:

Occasionally a user is blocked by mistake and when the admin in question blocks
emails from this user, they have no way to appeal. I prefer a throttle.

WAvegetarian wrote:

ditto Mgm, there should be a throttle of some sort

mapellegrini wrote:

*** Bug 10078 has been marked as a duplicate of this bug. ***

ryulong.wiki wrote:

Can we impliment it yet? The spam I've gotten from one user has exceeded 1000 total e-mails from his accounts. I wouldn't care if a throttle or if a block feature is implimented entirely. The idiot I have has been doing 100 at one sitting on his 30 or so accounts now.

cannon.danielc wrote:

Something to do the job ...

This should do what is needed--it will enable sysops to block users from sending e-mail if $wgSysopEmailBans is true. By default this value is false. As such, we can very easily enable the blocking of e-mail on Wikipedia, while sparing those smaller wikis where it may be more prone to abuse.

I'm hesitant in committing it right away, however, and will only do so if there is agreement to. It's been tested, but not particularly thoroughly, so if someone would like to test it in more depth, that would be nice :).

I also have this running at https://amidaniel.com/testwiki if anyone wants to play with it.

Attached:

cannon.danielc wrote:

Talked with Tim Starling and, having implemented his recommended changes, have committed this as r22816.

mapellegrini wrote:

From your description, it looks like the new patch allows a blocking admin to prevent the blocked user from sending emails. (The first half of my original feature request)

But (and correct me if I'm mistaken) it won't help in Ryulong's case, where the emails are being sent from throw-away accounts. We also need rate email rate limiting (e.g, a user can send no more than X emails per day; or, alternatively, a user cannot receive more than Y emails per day).

ryulong.wiki wrote:

They're not really throw away accounts. They're the accounts of one massive sockpuppeteer that I managed to piss off by blocking what he considered his "good hand" account. Although this is off topic.

cannon.danielc wrote:

(In reply to comment #9)

From your description, it looks like the new patch allows a blocking admin to
prevent the blocked user from sending emails. (The first half of my original
feature request)

But (and correct me if I'm mistaken) it won't help in Ryulong's case, where the
emails are being sent from throw-away accounts. We also need rate email rate
limiting (e.g, a user can send no more than X emails per day; or,
alternatively, a user cannot receive more than Y emails per day).

Please open a new bug for the throttle if you think it necessary.