Possible violations of global rights policy (last 11 months)

This query is marked as a draft This query has been published by Pppery.

This query looks for actions in 2019 that should have been impossible, ignoring global groups. Many of these actions, therefore, are likely to violate the global rights policy of the English Wikipedia

Global false positives: staff, users who lost relevant user groups
Result set 1; Moves without redirect by users who shouldn't be able to do that. 
Known false positives: Known false positives: global rollbackers/stewards legitimately reverting page-move vandalism, moves in content models that don't support redirects.
----
Result set 2: Other admin actions by non-admins. Known false positives: Stewards doing bigdeletes
----
Result sets 3-5: Edits through non-semi protection that should have been impossible (No false positives known)
----
Result set 6: Violations of account creation rate limit (No false positives known)
----
This query is not intended to be exhaustive list, and there are many ways for the global rights policy to be violated without triggering this list.
A perfect query is literally impossible, as it cannot catch, ex., stewards viewing oversighted content, which is technically a violation but leaves no traces behind.

SQL

/* Moves by non-autoconfirmed  */
use enwiki_p;
select log_id, log_type, log_action, user_name, user_editcount, user_registration from logging
join actor on actor_id = log_actor join user on user_id=actor_user where log_type="move" 
and (user_editcount < 10 || user_registration > (DATE_FORMAT((NOW() - INTERVAL 4 DAY),'%Y%m%d%H%i%S'))) 
and not exists (select * from user_groups where ug_user=user_id and ug_group="confirmed")
and log_timestamp > "20190101010101" limit 100;
/* Moves without redirect */
select log_id, log_type, log_action, user_name, user_editcount, user_registration, log_params from logging
join actor on actor_id = log_actor join user on user_id = actor_user join comment on comment_id = log_comment_id 
where log_type="move" and log_params like '%"5::noredir";s:1:"1%' and log_timestamp > "20190101010101"  
and comment_text not like "Automatically moved page while renaming the user%"
and not exists (select * from user_groups where ug_user = actor_user and (ug_group="extendedmover" || ug_group="sysop" || ug_group="bot"));
/* Other admin actions 
XXX this query is hunting for rogue stewards, which should hopefully never occur, but to be safe ... */
select log_id, log_type, log_action, user_name, user_editcount, user_registration, log_params from logging
join actor on actor_id = log_actor join user on user_id = actor_user
where (log_type = "block" || (log_type = "protect" and log_action != "move_prot") || (log_type="delete" && log_action != "delete_redir")
      || log_type == "contentmodel" || log_type=="gblblock" || log_type=="merge" || log_type=="stable")
and not exists (select * from user_groups where ug_user = actor_user and ug_group="sysop") and log_timestamp > "20190101010101";
/* Other actions not checked for here; editing protected pages using steward rights, continuing to use GIE rights after local revocation
some esoteric uses of admin tools, such as mass message sending */

By running queries you agree to the Cloud Services Terms of Use and you irrevocably agree to release your SQL under CC0 License.

Submit Query Stop Query

All SQL code is licensed under CC0 License.

SQL

Checking query status...