[17:19:59] ostriches: https://gerrit.wikimedia.org/r/#/c/305627/ [17:25:19] anomie: I think you are the only one that knows SP: https://gerrit.wikimedia.org/r/#/projects/mediawiki/extensions/SecurePoll,dashboards/default [17:45:51] AaronSchulz: TimStarling knows SecurePoll too [17:46:21] anomie: well, he deferred to you for these since he hadn't looked at it in a long time. :) [17:47:30] I suspect he looked at it slightly more recently than I did, since I don't think I've looked at it since I wrote that code and he reviewed that code sometime after that ;) [17:47:36] * anomie will try to look at it [19:18:28] anomie: I added connection/readonly checks [19:18:44] * AaronSchulz also wonders if the job push() call should be post-commit...though that is pre-existing [21:47:40] anomie: I just saw your e-mail on posting passwords to API, etc. Two things.... [21:48:04] One: can this be imposted on the browser too? So you can't do Special:Login?username=foo&password=bar? [21:48:17] And two: Should/can this be backported to like 1.27 maybe since it's LTS? [22:34:43] ostriches: if you are thinking about form prefilling, that does not work with password fields [22:34:54] Ah, didn't know ;-) [22:35:11] Does it work with POSTing with it in the query string? [22:35:38] (I mean I guess we can't stop someone from putting their password in a URL, but we could avoid it from actually working so you can't get an idea of if it works just from the response) [22:35:45] Mainly just thinking aloud [22:36:06] it would probably work, hard to imagine why someone would do it though [22:36:27] logging in programatically via the web for seems a lot harder than via the API [22:37:47] we can prevent logins like that, but seems like dont do that then territory to me [22:38:01] the API query param thing was actually done by a few bots [22:47:49] ya [22:49:12] What about the 2nd question? [22:50:42] tgr: thanks, btw, for handling that VE+Sentry issue. I appreciate your thoroughness. [22:51:46] well, you break it, you fix it :) [22:51:56] yup [23:12:35] ostriches: personally I would consider it a new feature, not a bugfix, but that might just be the laziness talking [23:13:03] Yeah it's not really a bugfix, but it's a deprecation that will impact a lot of people [23:13:07] (potentially a lot) [23:13:21] Why I suggested backporting to 1.27. Below that idgafos [23:13:33] why backport a deprecation though? [23:14:09] all it does is show a warning, Wikipedia should be good enough for awareness-raising amongst bot authors [23:14:35] or are you worried that someone only runs their bot on their 1.27 wiki, then switch to 1.31 and it breaks? [23:15:00] Yeah. Some $third_party_wiki has a bot that runs against LTS release(s) [23:15:17] Then they jump to next LTS and it goes from no warming to a breakage. [23:15:23] yeah, that makes sense [23:15:25] (considering the warning itself is mostly harmless)