Wikipedia:Bots/Requests for approval/Matthewrbot

Add links
From Wikipedia, the free encyclopedia
The following discussion is an archived debate. Please do not modify it. To request review of this BRFA, please start a new section at WT:BRFA. The result of the discussion was Request Expired.

Matthewrbot[edit]

Operator: Matthewrbowker (talk · contribs · SUL · edit count · logs · page moves · block log · rights log · ANI search)

Time filed: 17:26, Friday, April 1, 2016 (UTC)

Automatic, Supervised, or Manual: Automatic

Programming language(s): PHP

Source code available: Bot Source Code, Web-based tool source code

Function overview: Takes requests from a web-based form and places it on the appropriate subpage of Wikipedia:Requested Articles.

Links to relevant discussions (where appropriate): WT:RA

Edit period(s): Every half-hour (If there are requests pending)

Estimated number of pages affected: Wikipedia:Requested articles and sub-pages

Exclusion compliant (Yes/No): Not for this task, there is no need for exclusion compliance

Already has a bot flag (Yes/No):

Function details: This bot will take requests posted on a web-based form. It will sanitize the input to work with {{article request}} then post the request directly above {{User:Matthewrbot/Requests}}. If the template is not found, the bot will place the request at the bottom of the page and add the pages to Category:Requested Articles Pages with no template.

It will not re-add a request once it has been removed. The form itself contains a honeypot and eventually a Captcha based on Mediawiki's system.

Discussion[edit]

Note: Bot is not yet complete, I am still working on building it. Wanted to start the BRFA because it is a non-traditional request and I wanted to give time to handle concerns.

External Loads
What is this sending to bootstrapcdn? — xaosflux Talk 20:32, 1 April 2016 (UTC)[reply]
Nothing is sent to bootstrapcdn. The bootstrap styling is retrieved from the bootstrap cdn, as bootstrap hasn't designed their repo to allow for git submoduling. ~ Matthewrbowker Drop me a note 20:56, 1 April 2016 (UTC)[reply]
@Xaosflux: As of this commit, BootstrapCDN is no longer used. ~ Matthewrbowker Drop me a note 00:30, 5 April 2016 (UTC)[reply]
Thank you! — xaosflux Talk 00:55, 5 April 2016 (UTC)[reply]
Matthewrbowker it looks like your landing web page is explicitly sending to third parties again (code.jquery.com , maxcdn.bootstrapcdn.com) - is this the long term solution? — xaosflux Talk 19:22, 5 April 2016 (UTC)[reply]
@Xaosflux: Which one are you looking at? I don't believe I've deployed the fix to the live form yet. ~ Matthewrbowker Drop me a note 19:59, 5 April 2016 (UTC)[reply]
This link. — xaosflux Talk 20:09, 5 April 2016 (UTC)[reply]
That is the live version of the tool. Updated. ~ Matthewrbowker Drop me a note 23:28, 5 April 2016 (UTC)[reply]
Page configurations

@Matthewrbowker: I'm a little concerned that anyone can edit the tool at User:Matthewrbot/Config/1/interface/all. The idea is cute, but it clearly appears to allow arbitrary html injection, which is probably a significant security and privacy risk to our users. --slakr\ talk / 02:46, 2 April 2016 (UTC)[reply]

@Slakr: A concern of mine as well. I contacted an admin via IRC several months ago for cascading semi-protection, but was told that the protection is unlikely to be applied unless I can demonstrate vandalism. Would caching of the strings solve this concern? Alternatively, I can move them into xml files on the tool itself. P.S. Did I handle the template right? If not, my apologies ~ Matthewrbowker Drop me a note 03:25, 2 April 2016 (UTC)[reply]
@Matthewrbowker: Cascading semi protection is not permitted because it's a security hazard. A plain full protection may be better if that "control" page has security implications.Jo-Jo Eumerus (talk, contributions) 17:55, 3 April 2016 (UTC)[reply]
There's some precedent for this sort of thing (meta:www.wikipedia.org template), but it still makes me uncomfortable. Besides, if one of us full-protects the pages then you won't be able to edit them. Also, wouldn't this mean the tool is constantly fetching pages from on-wiki whenever it's loaded? While caching could help, that's still an inherently expensive operation. I suggest taking the configuration off-wiki. — Earwig talk 21:36, 3 April 2016 (UTC)[reply]
@Jo-Jo Eumerus: @The Earwig: Acknowledged. I'm working on a quick patch that should be pushed tonight. It will move the configuration local. ~ Matthewrbowker Drop me a note 03:47, 4 April 2016 (UTC)[reply]
@Slakr: @Jo-Jo Eumerus: @The Earwig: Fixed in this commit Fixed version has been pushed to the test version of the tool. ~ Matthewrbowker Drop me a note 07:10, 4 April 2016 (UTC)[reply]
We can change the content model of this page to .js then it will be protected - would that work? (re: User:Matthewrbot/Config/1/interface/all) — xaosflux Talk 20:09, 5 April 2016 (UTC)[reply]
Example User:Matthewrbot/Config/1/interface/all/2. — xaosflux Talk 20:12, 5 April 2016 (UTC)[reply]
Hmm, you will have to log on with the bot's account to change that now though - that locks it to page owner and admins. — xaosflux Talk 20:14, 5 April 2016 (UTC)[reply]
A thought perhaps, the concern with the editable pages was allowing experienced users to edit the tool. As of right now, the local configuration is functional. ~ Matthewrbowker Drop me a note 23:28, 5 April 2016 (UTC)[reply]
@Xaosflux: Whoa, how did you do that...? — Earwig talk 04:06, 13 April 2016 (UTC)[reply]
Off site privacy
What type of privacy policy is in place here? As you are soliciting usernames, and have access to request and address information. — xaosflux Talk 00:56, 5 April 2016 (UTC)[reply]
@Xaosflux: See Labs Terms of use. I do not have access to IP addresses (they are stripped from the logs), so only username and request data is stored. ~ Matthewrbowker Drop me a note 19:03, 5 April 2016 (UTC)[reply]
Sample outputs
New question: What will the output on to wiki look like, can you make a post manually for example purposes? — xaosflux Talk 20:09, 5 April 2016 (UTC)[reply]
Using {{Article request}}, see User:Matthewrbot/example1 (Headings have different examples) ~ Matthewrbowker Drop me a note 23:28, 5 April 2016 (UTC)[reply]
The web form seems to have an extensive category selector - will that be posted on wiki as well? — xaosflux Talk 21:32, 6 April 2016 (UTC)[reply]
@Xaosflux: Pages will be in the following form: "Wikipedia:Requested Articles/[category]/[sub-category]/sub-sub category]." If the sub-sub category is "other" it is chopped off. This does require re-structuring the existing RA sub pages. ~ Matthewrbowker Drop me a note 21:52, 6 April 2016 (UTC)[reply]
Are there any rate limits to prevent someone flooding the tool? --slakr\ talk / 04:38, 12 April 2016 (UTC)[reply]
@Slakr: The web-based form has no rate limiting as of yet, as I don't have an ability to really distinguish different users (Again, I don't have access to IPs). The bot will edit at a rate of one request every five seconds. ~ Matthewrbowker Drop me a note 05:27, 12 April 2016 (UTC)[reply]
Any plans to add a captcha of some form? --slakr\ talk / 05:52, 16 April 2016 (UTC)[reply]
Yes, it's in the works. I have to write my own solution, as there's currently no captcha solution for labs (specifically one that's compatible with the ToU, as far as I know). ~ Matthewrbowker Drop me a note 05:55, 16 April 2016 (UTC)[reply]

On Hold - I don't know if I'm doing this right, but I'm placing this request on hold. After discussion on IRC and some thought, I will be implementing OAuth functionality to the web-based interface. ~ Matthewrbowker Drop me a note 04:29, 27 April 2016 (UTC)[reply]

Request Expired. @Matthewrbowker: I'm moving this to expired, you may reactivate it in the future when ready. — xaosflux Talk 12:30, 7 May 2016 (UTC)[reply]
The above discussion is preserved as an archive of the debate. Please do not modify it. To request review of this BRFA, please start a new section at WT:BRFA.
Retrieved from "https://en.wikipedia.org/w/index.php?title=Wikipedia:Bots/Requests_for_approval/Matthewrbot&oldid=1136105516"