[15:33:06] * bd808 tries to remember what the team was supposed to do for Q3
[15:49:26] <bd808>	 anomie, tgr: what did you guys do in Q3 other than session/authmanager, apisandbox, and the gather mess? Making bullet points for the quarterly review slides.
[15:49:58] <anomie>	 bd808: Hmm. I'll have to try to search Phab and Gerrit for that.
[15:50:28] <anomie>	 bd808: Q3 is January-March, right?
[15:51:47] <bd808>	 yeah
[16:07:13] <anomie>	 bd808: ApiSandbox. Other "interesting" patches I had merged include CentralIdLookup (an offshoot of SessionManager), bot passwords (offshoot of AuthManager), HTMLForm using <button> (needed for sanity in bot passwords), oojs-ui DateTimeInputWidget (needed for ApiSandbox), $wgAuthenticationTokenVersion (offshoot of the problems in deploying SessionManager), a few different things helping Performance with memcache loading (some from SessionManager 
[16:07:13] <anomie>	 performance issues and some maybe not), a bunch of work to make load.php enforce its no-session constraint (offshoot of SessionManager). And then various API and Scribunto maintenance and bug fixes. And also lots of code review, particularly for API-related stuff in extensions.
[16:09:08] <bd808>	 anomie: thanks. I'll check to see which of those we claimed in Q2. I know we claimed bot passwords there.
[16:09:37] <bd808>	 I'm calling the Action API hadoop logging green unless someone objects
[16:09:59] <bd808>	 there is work to do there still certainly, but the raw data pipeline is finally done
[16:26:57] <tgr>	 bd808: PageImages non-free filter (sort of Gather), some OAuth bugfixes
[16:27:59] <bd808>	 tgr: thanks. I know I was forgetting something you got pulled into (PageImages)
[17:31:17] <tgr>	 anomie: I found a bug in PasswordReset and I'm not sure what to do about it
[17:31:47] <tgr>	 allowsAuthenticationDataChange($req, false) skips user-provided fields, but username is not considered such a field
[17:32:32] <tgr>	 which means there is no way to use allowsAuthenticationDataChange to tell if setting a temporary password is supported before submitting the form
[17:33:21] <tgr>	 which means there is no way to delist the special page based on configuration
[17:34:36] <anomie>	 tgr: So let's make username be considered such a field?
[17:35:33] <tgr>	 if that doesn't cause problems for the API, sure
[17:36:32] <anomie>	 The API always calls it with $checkData = true
[17:40:21] <tgr>	 ok, I'll do that and see if I run into any problems
[17:41:18] <tgr>	 in theory, "is this user allowed to do this type of thing" seems like an important test, but in practice I can't think of a use case where that wouldn't be handled via getAuthenticationRequests
[21:07:57] <Reedy>	 "Wikimedia Commons uses cookies to log in users. You have cookies disabled. Please enable them and try again."
[21:07:58] * Reedy squints
[21:10:48] * legoktm gives Reedy a cookie
[21:11:28] <bd808>	 legoktm: Reedy prefers chocolate
[21:11:42] <MaxSem>	 chocolate cookie!
[21:11:52] <bd808>	 best of both worlds!
[21:12:34] <bd808>	 legoktm: I sent Roan back to SF with stickers. You should get some from him (Labs logo, Tool Labs logo, I broke Wikipedia...)
[21:20:10] <legoktm>	 oooh, thank you :D
[21:24:21] <legoktm>	 anomie: calls to $context->getLanguage() in the MW_NO_SESSION mode thing are okay right? it's just $context->getUser() calls?
[21:24:30] <legoktm>	 getUser() calls...that are bad? *
[21:25:04] <anomie>	 legoktm: If $context is a ResourceLoaderContext you're good. If it's a RequestContext, you're probably not good.
[21:26:39] <AaronSchulz>	 anomie: any idea why ApiPurge allows non-POSTs?
[21:27:33] <anomie>	 AaronSchulz: We allow non-posts for index.php?action=purge too.
[21:27:55] <MaxSem>	 not for anons though
[21:28:27] <anomie>	 Neither does ApiPurge
[21:28:48] <legoktm>	 anomie: it's a RequestContext
[21:28:54] <legoktm>	 anomie: I'm attempting to fix the Wikibase thing
[21:29:03] <AaronSchulz>	 anomie: yeah, but that lets people see the new page without a click, what's the use for the API? It may as well POST.
[21:30:11] <anomie>	 AaronSchulz: Purging with the extra options the API provides from the browser without having to use ApiSandbox or the like? I do that relatively often.
[21:33:22] <anomie>	 legoktm: Daniel Kinzler said he had an idea what to do about that one. IMO if you can have LinkBeginHookHandler::onLinkBegin() detect that RequestContext::getMain()->getTitle() === null (without the GlobalTitleFail) and just return without doing anything else, that'd do it.
[21:35:28] <AaronSchulz>	 anomie: I mean the use of non-POST for the API?
[21:36:06] <legoktm>	 anomie: oh, that's probably easier than what I was trying to do.
[21:37:04] <anomie>	 AaronSchulz: That's what I meant too. e.g. going to https://en.wikipedia.org/w/api.php?action=purge&forcelinkupdate&titles=Foo
[22:00:07] <MaxSem>	 quick review, anyone? https://gerrit.wikimedia.org/r/282067
[22:00:52] <MatmaRex>	 grumble. again?