Repository: LemmyNet/lemmy (language: rust)

Issue:
Users banned from their home instance show in other instances' banned lists
### Is your proposal related to a problem?

<!--
  Provide a clear and concise description of what the problem is.
  For example, "I'm always frustrated when..."
-->

![image](https://github.com/LemmyNet/lemmy/assets/7509232/200b4541-b039-4be8-933b-78a55a557268)

https://lemmy.ml/post/1160784

As described in this Lemmy Support post, banned users show in the modlog for instances where they weren't banned. I believe these are users who were banned from the instance that they signed up with. The relevance of this to other instance owners is somewhat questionable, as unbanning them wouldn't have any effect anyway. 

### Describe the solution you'd like

<!--
  Provide a clear and concise description of what you want to happen.
-->

Filter the modlog to only show bans relevant to the instance, maybe optionally add a "show federated bans" or similar. This list could become enormous over time if there are large influxes of bot users that get banned en-masse, so filtering those out unless explicitly requested from the server would be useful

### Describe alternatives you've considered

<!--
  Let us know about other solutions you've tried or researched.
-->

N/A

### Additional context

<!--
  Is there anything else you can add about the proposal?
  You might want to link to related issues here, if you haven't already.
-->

I considered whether this should be on Lemmy-UI, but I feel like it shouldn't even bother fetching these users from the backend by default.



Discussion / hints:
I've verified this confusing functionality with another user.

We had my `lemmy.world` account create an account on `zemmy.cc`.
That `lemmy.world` account was then banned by the admin of `crystal.rest`.
We then verified that later mod actions were appearing in the modlog of `zemmy.cc` from `crystals.rest`.

The banned user did not appear in the `zemmy.cc` banned users list, meaning they were only banned from `crystal.rest`, rather than any server `crystal.rest` federates with.

Additionally we saw that a user was banned from lemmy.ml by Dessalines, which _did_ appear in both of our ban lists.

If a user is banned in their home instance, there is no reason to populate them in the ban lists of servers that federate with the home instance they were banned from. That banned user will not be able to interact with any federated instances because they can't authenticate with their home instance.
I agree with all of this, but just realized that it might be good if you're on the lookout for the user to create an account on a different instance and don't want them there either. 
> I agree with all of this, but just realized that it might be good if you're on the lookout for the user to create an account on a different instance and don't want them there either.

That makes sense, but then it should be outlined in a separate area. Maybe a dedicated "Banned users from subscribed communities", because as is it's not clearly communicating the origin of the ban.

Right now if you wanted to ban that user from your instance while they are still banned from their home instance, you don't have a clear way of knowing if you or one of your admins has already done that, since they will appear in the banned users list for your instance in either state.
Eskuero brought up a valid concern in the Matrix server, someone could troll with this by creating a large number of fake users and then banning them, flooding the modlog and the banned users list.

This would obviously require victims to already be subscribed to a community on the trolls server, but it's still a vector
> I agree with all of this, but just realized that it might be good if you're on the lookout for the user to create an account on a different instance and don't want them there either.

I can see this being valid, but I suspect it'll quickly become unwieldy over time - the number of banned users isn't going to go down really. I doubt anybody is going to be able to keep up with that over time. I guess it could be an optional API endpoint with an ability to search it? That way a tool could auto-flag users for mods if a username is similar. 

Either way, at the very least it needs much clearer messaging
The code is at the two places below. If you dont want the banned users listed under /admin nor in the mod log, these can be removed. Then bans would only get federated in order to remove the user's posts (if that option was selected).

https://github.com/LemmyNet/lemmy/blob/main/crates/apub/src/activities/block/block_user.rs#L157
https://github.com/LemmyNet/lemmy/blob/main/crates/apub/src/activities/block/block_user.rs#L177


There are also similar lines further down in the file, and more mod log writes in undo_block_user.rs

Fix patch:
diff --git a/crates/db_views/src/person/person_view.rs b/crates/db_views/src/person/person_view.rs
index bc12e6559d..5c1a3ae70e 100644
--- a/crates/db_views/src/person/person_view.rs
+++ b/crates/db_views/src/person/person_view.rs
@@ -91,10 +91,12 @@ fn queries<'a>(
       ListMode::Banned => {
         query = query
           .filter(
-            person::banned.eq(true).and(
-              person::ban_expires
-                .is_null()
-                .or(person::ban_expires.gt(now().nullable())),
+            person::local.eq(true).and(
+              person::banned.eq(true).and(
+                person::ban_expires
+                  .is_null()
+                  .or(person::ban_expires.gt(now().nullable())),
+              ),
             ),
           )
           .filter(person::deleted.eq(false));


Test patch: