Viewing abuse filter 3: New user removing references

Filter parameters

Filter ID:	3
Description: (publicly viewable)
Conditions:	!("confirmed" in user_groups) & page_namespace == 0 & /* narrow down edits to just those dealing with references / removed_lines contains "<ref" & / this edit_delta ignores large blankings treated by another filter / edit_delta >= -3000 & / No added lines usually means a blanking which is dealt with by other filters / length(added_lines) != 0 & !("#redirect" in lcase(added_lines)) & ( ( / More opening ref tags are removed than added / rcount("(<ref\b)", removed_lines) > rcount("(<ref\b)", added_lines) ) \| / OR / ( / More closing ref tags are removed than added / rcount("(<ref\b[^>]\>)", removed_lines) > rcount("(<ref\b[^>]\>)", added_lines) ) ) & / Exclude removal of references to Wikipedia / count("//en.wikipedia.org", removed_lines) <= count("//en.wikipedia.org", added_lines) & / If removed empty ref, probs OK / count("<ref></ref>", removed_lines) <= count("<ref></ref>", added_lines) & / ignore conversion between <ref> and </ref> / rcount("</?ref>", removed_lines) > rcount("</?ref>", added_lines) & / if they removed a probable comment with ref tag then its probs OK / rcount("<!--.</?ref>.-->", removed_lines) <= rcount("<!--.</?ref>.-->", added_lines) !("confirmed" in user_groups) & page_namespace == 0 & / narrow down edits to just those dealing with references / removed_lines contains "<ref" & / this edit_delta ignores large blankings treated by another filter / edit_delta >= -3000 & / No added lines usually means a blanking which is dealt with by other filters / length(added_lines) != 0 & !("#redirect" in lcase(added_lines)) & ( ( / More opening ref tags are removed than added / rcount("(<ref\b)", removed_lines) > rcount("(<ref\b)", added_lines) ) \| / OR / ( / More closing ref tags are removed than added / rcount("(<ref\b[^>]\>)", removed_lines) > rcount("(<ref\b[^>]\>)", added_lines) ) ) & / Exclude removal of references to Wikipedia / count("//en.wikipedia.org", removed_lines) <= count("//en.wikipedia.org", added_lines) & / If removed empty ref, probs OK / count("<ref></ref>", removed_lines) <= count("<ref></ref>", added_lines) & / ignore conversion between <ref> and </ref> / rcount("</?ref>", removed_lines) > rcount("</?ref>", added_lines) & / if they removed a probable comment with ref tag then its probs OK / rcount("<!--.</?ref>.-->", removed_lines) <= rcount("<!--.</?ref>.*-->", added_lines)
Notes:	Original from Wikipedia (https://en.wikipedia.org/wiki/Special:AbuseFilter/61) "<ref\|</ref" split for clarity Appears to get more and better hits on referenced info now too. Apparently, previous version wasn't working properly. --Mgm Switched on. - It Is Me Here Tagging instead of disallowing, there are plenty of good reasons to remove references. -- Mgm Oh, is this for all references? Wasn't there one regarding removing a {{Reflist}} template? - It Is Me Here That one (filter 79) was a test, and it doesn't appear to be working properly. It hasn't caught anything for at least 24 hours. - Mgm removed private flag, unnecessary -- Zzuuzz Updated format that should also catch named references and avoid the old reference grouping tag. --Mgm Filter 79 now working properly, removing line that specifies reflist. Working on better regex to avoid <references/> being hit with this one --Mgm Changing to edit_delta <= -1000 from >= -1000; seems like this was the intent. >= and <= comparisons are based on actual value, not absolute value. Correct me if this was the intent. Also, we are getting some false positives on this, see http://en.wikipedia.org/w/index.php?title=Interstate_5_in_Washington&diff=279452062&oldid=278504317 - Hersfold >= is correct. It is supposed to exclude large removals from being evaluated since they're covered by blanking filters. It was an error in the regex. Instead of allowing for <ref name="whatever">, the regex allowed choosing between <ref> and <ref name>, the last of which obviously didn't work. -- Mgm added note in filter to avoid confusion --Mgm Altered regex to treat refs as whole blocks, to avoid situation where a duplicate ref is changed to a named ref (<ref>Blah</ref> --> <ref name=foo/>). Now won't catch users removing one end of a ref though. Might have ec'd with cmt above, but can't tell in this wierd system :D --HM Okay... I THINK this is finally a correct regex that: 1) grabs <ref> ... </ref> as entire blocks 2) grabs <ref name="foo"/> 3) ignores <references/> 4) allows newline breaks between <ref> and </ref> tags. 5) grabs only consecutive <ref>, </ref> pairs (as opposed to jumping from the first <ref> to the last </ref>). -DF Restored original version, added exclusions for naming references and removing closing tags of named references. --Mgm Added comments for clarity --Mgm Too many false positives, setting to log only. --Conti From Coppertwig: A more exact count might be obtained by defining a ref-opening as either "<ref>" or "<ref name" and a ref-closing as either "</ref>" or "ref name ... />". (With the named reference, the same tag will sometimes count as both an opening and a closing.) The code might look something like this (assuming rcount expects regular expressions): /* count of removed ref-openings exceeds count of added ref-openings, or count of removed ref-closings exceeds count of added ref-closings; named refs with slashes count as both openings and closings. / & (rcount("(<ref>\|<ref\sname)",removed_lines) > rcount("(<ref>\|<ref\sname)",added_lines) \| rcount("(</ref>\|<ref\sname[^>/]/>)",removed_lines) > rcount("(</ref>\|<ref\sname[^>/]*/>)",added_lines) Adjusted delta to -3000 due to a sock removing references that has been missed due to the total removed content. Ref [[User:Ryulong/Sandbox#Ref_removing_vandal]] - Shirik 24 Jan I replaced \sname with \s(name\|group). - Ruslik Something 'wrong' here .. it catches also '<ref></ref>' (i.e., empty tags, as included in the article creation wizard). They should be excluded. Disable. Most of the hits are false positives. -Sole Soul Mark as deleted. - KoH Simplify (can deal with HTML comments and Wikipedia links if this seems otherwise useful) RF 2015-05-03 Added <ref></ref> since it's easy and cheap. RF 2015-06-04 Added item to ignore if only conversion between <ref> and </ref> - now should probably be re-factored. RF 20150915 Added code to pragmatically exclude most single line comment deletions. RF 20160201 readd tag "references removed" since reenabled - Cen 22-10-2016
Flags:	Hide details of this filter from public view Enable this filter I understand that details of this filter will be hidden from users who cannot see [https://www.mediawiki.org/wiki/Special:MyLanguage/Extension:AbuseFilter/Rules_format#Protected_variables protected variables] Mark as deleted
Filter last modified:	02:56, 12 February 2026 by Sammyrms1 (talk \| contribs)
History:	View this filter's history
Tools:	Export this filter to another wiki {"data":{"rules":"!(\"confirmed\" in user_groups) \u0026\r\npage_namespace == 0 \u0026\r\n/* narrow down edits to just those dealing with references /\r\nremoved_lines contains \"\u003Cref\" \u0026\r\n/ this edit_delta ignores large blankings treated by another filter /\r\nedit_delta \u003E= -3000 \u0026\r\n/ No added lines usually means a blanking which is dealt with by other filters /\r\nlength(added_lines) != 0 \u0026\r\n!(\"#redirect\" in lcase(added_lines)) \u0026 (\r\n (\r\n / More opening ref tags are removed than added /\r\n rcount(\"(\u003Cref\\b)\", removed_lines) \u003E rcount(\"(\u003Cref\\b)\", added_lines)\r\n ) \| / OR / (\r\n / More closing ref tags are removed than added /\r\n rcount(\"(\u003Cref\\b[^\u003E]\\\u003E)\", removed_lines) \u003E rcount(\"(\u003Cref\\b[^\u003E]\\\u003E)\", added_lines)\r\n )\r\n) \u0026\r\n/ Exclude removal of references to Wikipedia /\r\ncount(\"//en.wikipedia.org\", removed_lines) \u003C= count(\"//en.wikipedia.org\", added_lines) \u0026\r\n/ If removed empty ref, probs OK /\r\ncount(\"\u003Cref\u003E\u003C/ref\u003E\", removed_lines) \u003C= count(\"\u003Cref\u003E\u003C/ref\u003E\", added_lines) \u0026\r\n/ ignore conversion between \u003Cref\u003E and \u003C/ref\u003E /\r\nrcount(\"\u003C/?ref\u003E\", removed_lines) \u003E rcount(\"\u003C/?ref\u003E\", added_lines) \u0026\r\n/ if they removed a probable comment with ref tag then its probs OK /\r\nrcount(\"\u003C!--.\u003C/?ref\u003E.--\u003E\", removed_lines) \u003C= rcount(\"\u003C!--.\u003C/?ref\u003E.--\u003E\", added_lines)","name":"New user removing references","comments":"Original from Wikipedia (https://en.wikipedia.org/wiki/Special:AbuseFilter/61)\r\n\r\n\"\u003Cref\|\u003C/ref\" split for clarity\r\n\r\nAppears to get more and better hits on referenced info now too. Apparently, previous version wasn't working properly. --Mgm\r\n\r\nSwitched on. - It Is Me Here\r\nTagging instead of disallowing, there are plenty of good reasons to remove references. -- Mgm\r\nOh, is this for all references? Wasn't there one regarding removing a {{Reflist}} template? - It Is Me Here\r\n That one (filter 79) was a test, and it doesn't appear to be working properly. It hasn't caught anything for at least 24 hours. - Mgm\r\nremoved private flag, unnecessary -- Zzuuzz\r\nUpdated format that should also catch named references and avoid the old reference grouping tag. --Mgm\r\nFilter 79 now working properly, removing line that specifies reflist. Working on better regex to avoid \u003Creferences/\u003E being hit with this one --Mgm\r\n\r\nChanging to edit_delta \u003C= -1000 from \u003E= -1000; seems like this was the intent. \u003E= and \u003C= comparisons are based on actual value, not absolute value. Correct me if this was the intent. Also, we are getting some false positives on this, see http://en.wikipedia.org/w/index.php?title=Interstate_5_in_Washington\u0026diff=279452062\u0026oldid=278504317 - Hersfold\r\n\r\n\u003E= is correct. It is supposed to exclude large removals from being evaluated since they're covered by blanking filters. It was an error in the regex. Instead of allowing for \u003Cref name=\"whatever\"\u003E, the regex allowed choosing between \u003Cref\u003E and \u003Cref name\u003E, the last of which obviously didn't work. -- Mgm\r\n\r\nadded note in filter to avoid confusion --Mgm\r\n\r\nAltered regex to treat refs as whole blocks, to avoid situation where a duplicate ref is changed to a named ref (\u003Cref\u003EBlah\u003C/ref\u003E --\u003E \u003Cref name=foo/\u003E). Now won't catch users removing one end of a ref though. Might have ec'd with cmt above, but can't tell in this wierd system :D --HM\r\n\r\n\r\nOkay... I THINK this is finally a correct regex that:\r\n\r\n 1) grabs \u003Cref\u003E ... \u003C/ref\u003E as entire blocks\r\n 2) grabs \u003Cref name=\"foo\"/\u003E\r\n 3) ignores \u003Creferences/\u003E\r\n 4) allows newline breaks between \u003Cref\u003E and \u003C/ref\u003E tags.\r\n 5) grabs only consecutive \u003Cref\u003E, \u003C/ref\u003E pairs (as opposed to jumping from the first \u003Cref\u003E to the last \u003C/ref\u003E).\r\n\r\n-DF\r\n\r\nRestored original version, added exclusions for naming references and removing closing tags of named references. --Mgm\r\n\r\nAdded comments for clarity --Mgm\r\n\r\nToo many false positives, setting to log only. --Conti\r\n\r\nFrom Coppertwig:\r\nA more exact count might be obtained by defining a ref-opening as either \"\u003Cref\u003E\" or \"\u003Cref name\" and a ref-closing as either \"\u003C/ref\u003E\" or \"ref name ... /\u003E\". (With the named reference, the same tag will sometimes count as both an opening and a closing.) The code might look something like this (assuming rcount expects regular expressions):\r\n\r\n/ count of removed ref-openings exceeds count of added ref-openings, or count of removed ref-closings exceeds count of added ref-closings; named refs with slashes count as both openings and closings. / \u0026 (rcount(\"(\u003Cref\u003E\|\u003Cref\\sname)\",removed_lines) \u003E rcount(\"(\u003Cref\u003E\|\u003Cref\\sname)\",added_lines) \| rcount(\"(\u003C/ref\u003E\|\u003Cref\\sname[^\u003E/]/\u003E)\",removed_lines) \u003E rcount(\"(\u003C/ref\u003E\|\u003Cref\\sname[^\u003E/]*/\u003E)\",added_lines)\r\n\r\nAdjusted delta to -3000 due to a sock removing references that has been missed due to the total removed content. Ref [[User:Ryulong/Sandbox#Ref_removing_vandal]] - Shirik 24 Jan\r\n\r\nI replaced \\sname with \\s(name\|group). - Ruslik\r\n\r\nSomething 'wrong' here .. it catches also '\u003Cref\u003E\u003C/ref\u003E' (i.e., empty tags, as included in the article creation wizard). They should be excluded.\r\n\r\nDisable. Most of the hits are false positives. -Sole Soul\r\n\r\nMark as deleted. - KoH\r\n\r\nSimplify (can deal with HTML comments and Wikipedia links if this seems otherwise useful) RF 2015-05-03\r\nAdded \u003Cref\u003E\u003C/ref\u003E since it's easy and cheap. RF 2015-06-04\r\nAdded item to ignore if only conversion between \u003Cref\u003E and \u003C/ref\u003E - now should probably be re-factored. RF 20150915\r\nAdded code to pragmatically exclude most single line comment deletions. RF 20160201\r\n\r\nreadd tag \"references removed\" since reenabled - Cen 22-10-2016","group":"default","actions":{"tag":["references removed"]},"enabled":true,"deleted":false,"privacylevel":0,"global":false},"actions":{"tag":["references removed"]}}

Actions to take when matched

Trigger actions only if the user trips a rate limit

Number of actions to allow:

Period of time (in seconds):

Group throttle by:

user

See the documentation on mediawiki.org.

Trigger these actions after giving the user a warning

System message to use for warning:

Page name of other message:

(without "MediaWiki:" prefix)

Prevent the user from performing the action in question

System message to use for disallowing:

Page name of other message:

(without "MediaWiki:" prefix)

Revoke the user's autoconfirmed status

Block the user and/or IP address from editing

Block the user and/or IP address from editing their own talk page

Block duration for non-registered users:

Block duration for registered users:

Tag the edit for further review

Tags to apply:

references removed