Page MenuHomePhabricator

emailuser ratelimit should make use of user-global
Closed, ResolvedPublic

Description

MediaWiki (as configured by Wikimedia) imposes rate limits on emailing other users at 20 mails/user/day. Unfortunately, the limit looks to be per wiki currently. That gives users an option to bypass that limit easily, by emailing from multiple wikis. Since most wikis we operate are connected via centralauth, the wiki you decide to do emailing from doesn't matter much (it only affects language of the footer).

I propose switching to user-global, which will enforce the current rate limit at all wikis combined (so if you send 10 mails from enwiki, 10 mails from enwiktionary, you wouldn't be able to send another 10 from enwikiversity).

This is likely User-notice worthy.

Event Timeline

Restricted Application added a subscriber: Aklapper. · View Herald Transcript
Urbanecm renamed this task from Change emailuser ratelimit to use user-global to emailuser ratelimit should make use of user-global.Oct 20 2021, 8:33 AM

Change 732260 had a related patch set uploaded (by Urbanecm; author: Urbanecm):

[operations/mediawiki-config@master] emailuser ratelimit: Use user-global rather than user

https://gerrit.wikimedia.org/r/732260

@Urbanecm hi, 3 questions:
(1) When do you expect this change to be live?
(2) Do you have any suggestions for what the Tech News entry should say? I would guess something like:

There is a limit on the amount of emails a user can send each day. This limit is now global instead of per-wiki. This change is to prevent abuse.

(3) Also I wonder if this should be included the week after the change is live, to prevent BEANS issues? Thanks.

@Urbanecm hi, 3 questions:
(1) When do you expect this change to be live?

Sometime next week. Would you like me to schedule an exact date for it?

(2) Do you have any suggestions for what the Tech News entry should say? I would guess something like:

There is a limit on the amount of emails a user can send each day. This limit is now global instead of per-wiki. This change is to prevent abuse.

LGTM!

(3) Also I wonder if this should be included the week after the change is live, to prevent BEANS issues? Thanks.

Ideally, yes. Thanks for pointing this out.

Sometime next week. Would you like me to schedule an exact date for it?

Nope, no need for an exact date - I now know to place this in the following week's issue! Thanks again.

Change 732260 merged by jenkins-bot:

[operations/mediawiki-config@master] emailuser ratelimit: Use user-global rather than user

https://gerrit.wikimedia.org/r/732260

Mentioned in SAL (#wikimedia-operations) [2021-10-28T18:53:07Z] <urbanecm@deploy1002> Synchronized wmf-config/InitialiseSettings.php: 4e0200e3f5ad9c7514ddbeda6f7ee4f8b5ed2ec7: emailuser ratelimit: Use user-global rather than user (T293866) (duration: 01m 04s)