[05:36:42] Is there a tool for managing multiple mediawiki vhosts on the same box? I've made scripts for doing stuff like updates and ugly extension management, but I'm guessing someone's already taken a crack at it [08:47:00] it seems that does not imply . some things inside a block are still parsed, such as links. is there a way to set to imply as well? [08:47:20] obviously this is important if ever contains code [09:29:48] A client is customizing the wording on various extensions. Should I add a new language in languages/messages/ with en as a fallback, modify the message text directly, or do something else? I'm looking for a solution that won't get overwritten when we do updates and follows best practices. [09:32:29] Abulafia: use a hook... [09:32:59] MessageCache::get [09:35:21] Thanks Nikerabbit. And override the file to one of my own? Is it safe to keep the new file in the extension's directory, or should I have a directory for the customizations? [09:35:56] Abulafia: you can make an extension, use the hook to rename the messages you want to override and translate them as that extension's messages [13:08:34] hmmm running cleanupTitles.php changed a page named "ヴァル" to "Broken/id:6440" [13:08:54] not exactly what i had in mind. any idea why it did that ? [13:10:10] it also seems to have changed the title to "ヴァル" which doesn't render correctly anymore, showing empty boxes in place of some of the characters [19:38:30] * revansx[m] sent a long message: < https://matrix.org/_matrix/media/v1/download/matrix.org/vSOwPfveUZVimynPVcmWLPzU > [19:40:17] Just paste what you typed here. [19:40:28] revansx[m]: ^ [19:42:53] * revansx[m] sent a long message: < https://matrix.org/_matrix/media/v1/download/matrix.org/IrioelMzAYTzVCvqKnOBSIcH > [19:43:35] revansx[m]: ^ [19:43:47] @Trela, Is that what you meant? [19:44:18] "revansx[m] sent a long message: < https://matrix.org/_matrix/media/v1/download/matrix.org/IrioelMzAYTzVCvqKnOBSIcH >" [19:44:59] Trela: ah.. sec [19:45:43] Just pointing out that appearing in a channel and dropping a reasonably suspicious link will not make people click on it. :P [19:45:49] can someone take a peek at task: ```https://phabricator.wikimedia.org/T191730``` for the "Auth_RemoteUser" extension and tell me if they think it relates to the "First Save" bug reported here: [19:45:50] ```https://meta.wikimedia.org/wiki/User_talk:Otheus/Auto_Login_via_REMOTE_USER#First-Save_Bug``` [19:47:33] Trela: gotcha. thanks. that said.. are the link I just sent rendered as the text I wrote or are they appearing as a "long message" link? [19:48:03] Just appearing as a "long message" link. Looks like a classic IRC scam to get people to clink on links that distribute malware. [19:48:44] Oof, yeah, that is an annoying bug with the AuthManager sessions. I previous had that in the SessionProvider I wrote for my stack and it took a lot of work to fix it. [19:50:51] matrix.org is not really suspicious, it's like pastebin (in this case; more generally it's a chat network similar to and compatible with IRC) [19:51:07] Assuming that you know what it is. [19:51:27] oh, wow.. that you know about this is very encouraging. [19:51:28] which is why I'm helpfully telling you :) [19:51:42] again thanks. [19:51:47] I know what Matrix.org is. Still looks like a classic IRC scam. :P [19:51:57] From what I remember it was more or less that the session was technically anonymous until the user made an edit. Then the session would be recreated, but kill the edit token. [19:52:39] anyway, you should not use session_start in 1.27+, MediaWiki has its own session handling from there on [19:52:46] The SessionProvider I created was a light provider in that it just tried to "assist" the base SessionProvider provided by MediaWiki's code. I ended up having to extend and override more of the base class methods to actually properly wrangled the sessions. [19:53:07] yes, exactly... i have seen a work-around from the MW 1.7 era, but nothing that translates to the MW 1.30 era.. any thoughts? [19:53:12] which might or might not be implemented via PHP sessions depending on how the wiki is configured [19:54:21] i'm really in a bind because of it 😞 [19:54:44] That extension author probably just needs to do a full audit of the code to see where the root cause of the issue is. :/ [19:55:41] I'm encouraged that someone else as recently as April of this year made a phabricator task for it, but I have had the most difficult time trying to find anyone to talk to me about it with some firsthand experience.. [19:55:52] how did you solve it? [19:55:57] (or work around it) [19:56:41] ah.. just read your comment above [19:58:18] i'm just a novice programmer and could not take on the task of extending/overriding the base class methods to actually properly wrangled the sessions like you did.. but I could implement a fix that someone else prescribes.. that's what I'm hoping for in lieu of the author fixing it properly [19:58:21] the Phab task does not say what class.user.php does so it's not particularly useful, but in general mixing MediaWiki sessions with sessions set up by another application is not supported, and IMO not a reasonable thing to do [19:58:58] as in, it worked pre 1.27 but could backfire in any number of ways [19:59:13] but the session from another application (iiuc) is literally what my session provider is doing [19:59:28] if you do insist on doing it, there are two ways I can think of [20:00:23] here is my exact set-up: ```https://www.mediawiki.org/wiki/Topic:Ug7imtddoqehuvx4``` [20:01:17] I'm using CA Policy Agent to enforce secure authenticated sessions [20:01:28] one of them is to set $wgPHPSessionHandling = 'disable', which detaches MediaWiki from PHP sessions entirely, and then you can do with them as you wish [20:01:57] which is something that needs to be set by the site administrator, not the extension author, so that's a bit problematic [20:02:03] nice.. the other? [20:02:12] also AFAIK no big site uses it so not well tested [20:06:31] I had to go to the bathroom.(Helps me remember too!) Basically all our session persistence was previously being done through cookies. With the change over to the new SessionProvider setup we moved to a two-pair setup with most of the session data being stored in Redis and only key token being stored in the cookies. That got around issues with cookies being unintentionally destroyed and allowed us to recreate those cookies if needed [20:06:31] without losing the session. [20:08:10] ha. bio-breaks not a bug, they are a feature! ha ha [20:08:31] They get the bugs out! [20:09:04] the other is to back up the session, clear it, call the external session handling code, read what you need, restore the session [20:09:31] indeed! lol ... my site is a small private enterprise site. small site behind a the firewall of a big organization.. [20:09:39] RequestContext::importScopedSession has an example of that, although a somewhat overcomplicated one [20:10:56] I guess you can just do something like [20:11:06] i'm completely dumb with respect to cookie, and session, security issues .. and even dumber about who mediawiki session and cookie handling need to work [20:11:16] $ctx = RequestContext::getMain(); [20:11:29] $session = $ctx->exportSession(); [20:11:56] $scope = $ctx->importScopedSession( $session ); [20:12:24] from my perspective the situation is simple.. RHEL7 with CA Policy Agent enforcing remotely authenticated browser sessions.. mediawiki installed on top with Auth_RemoteUser providing automatic user-login [20:12:39] revansx[m]: NASA Glenn? :O [20:12:47] ScopedCallback::consume( $scope ); [20:12:53] would you be willing to make these comments on my Talk Page Topic: ```https://www.mediawiki.org/wiki/Topic:Ug7imtddoqehuvx4``` [20:13:28] and call the external code which messes with the session between creating and consuming the scope [20:14:18] yes. trying to bring our part of the agency up to date with sematic open-linked data tools [20:14:29] what does remotely authenticated browser session mean? [20:14:58] but stumbling terribly on the basics of user authentication and authorization [20:16:37] it means that by the time a client browser get to interact with my site, their browser session has already been authenticated by an agency identity provided that has a trust relationship with my server [20:16:52] tgr: US government organizations typically use browser plugins that preauthenticate the user, typically with a CAC(card), to give the user access. [20:17:14] so my server can 'trust' the identity properties provided in the session header [20:17:27] sure, but how is that information transferred to your site? [20:17:48] the agency user a product called "Policy Agent" by a company called "Computer Associates" [20:17:51] the code in T191730 suggests that it happens via the PHP session backend which sounds rather horrible [20:17:52] T191730: Calling session_start() with Auth_remoteuser extension causes AuthManager tokens not to match - https://phabricator.wikimedia.org/T191730 [20:18:19] see my session data here: ```https://www.mediawiki.org/wiki/File:2018-06-04--09-51-53--screenshot-rkevans001.png``` [20:19:14] that screenshot details each step of the remote authentication process [20:19:25] well, that's cookie data, not session data [20:19:32] not PHP session data I mean [20:19:55] in that case just write a SessionProvider which reads from those cookies [20:20:01] oh, .. see.. i'm a moron [20:20:45] I wish I knew how to do what you are describing .. you make is sound so simple [20:20:46] Oh... ha. Yeah, that would work. [20:20:51] subclass ImmutableSessionProviderWithCookie, override provideSessionInfo [20:21:34] it gets a WebRequest, check the cookie through that, return a SessionInfo [20:21:56] is that something I would write in LocalSettings.php? [20:22:08] You would need to create an extension to handle his. [20:22:52] the problem seems to be that the existing code in includes/class.user.ph sets a PHP session, so if you can just stop it from doing that, your existing code should work [20:23:07] but ideally you'd have a session handling extension for this, yeah [20:23:40] that sounds promising. [20:23:52] Give me a few minutes and I can stub one out for you. [20:24:36] oh, wow.. you would be my hero [20:24:54] I mean, you would have to find out if it actually works. :P [20:30:02] i'm a great guinea pig! lol [20:34:16] I am taking a look at the existing extension first hoping it is a simple bug. [20:38:23] revansx[m]: Trela: it would look something like this: https://www.mediawiki.org/wiki/Manual:SessionManager_and_AuthManager/SessionProvider_examples [20:39:03] Does your web server have register globals turned on? Is $HTTP_AGENCYUID setup by the PHP process start up? That looks like it... [20:39:09] revansx[m]: ^ [20:39:54] If so you should update to $_SERVER['HTTP_AGENCYUID'] and similar for the rest of those. [20:40:27] That or $_SESSION. [20:41:21] I know that the variable $HTTP_AGENCYUID is defined, i have no idea if it qualifies as a registered global variable [20:41:39] Please bear with me as I try to make sense of everything you are saying [20:41:42] (and thank you) [20:42:05] do I use the ```https://www.mediawiki.org/wiki/Manual:SessionManager_and_AuthManager/SessionProvider_examples``` as is? [20:42:09] Did you define that variable somewhere? If not your server is turning register_globals on which is 1.) Bad for security 2.) Not necessarily supported by MediaWiki. [20:42:28] and where do I install it? .. in LocalSettings.php? [20:42:43] Read that example a little closer. "getLoggedInStatusFromCookieSomehow" It stubs it out, but the logic still needs to be filled in. [20:44:44] I would start first with updating your configuration to make sure that no old cruft is causing new code to misbehave. [20:45:51] * revansx[m] sent a long message: < https://matrix.org/_matrix/media/v1/download/matrix.org/yVpukuBzEfdXLaRADuCqXFVz > [20:46:37] that the CA Policy Agent guarantees that that attribute is valid [20:48:04] Ah, yeah. So you or someone else in the past did turn off register_globals(good) and put in that work around to keep from having to update it everywhere else. [20:49:34] I need to update my Topic to include that.. sec.. [20:49:43] What are you using a string of "NULL" instead of regular old null? $wgAuthRemoteuserUserName will use string of "NULL" as a valid user name. [20:52:23] that "NULL" string could be anything. It only only needs to be some string that is guaranteed to never be a registered user by the agency [20:53:12] Right, but the Auth_remoteuser extension will take the "NULL" string as a literal user and attempt to create a valid session for it. Which can pollute the end user's session cookies. [20:53:21] *literal valid user [20:54:00] ah! ok.. so is there a better way to configure Auth_RemoteUser for my application? [20:54:15] Just take the quotes off "NULL". :D [20:54:25] So that it is the data type of NULL. [20:54:50] null [20:55:04] will do [20:55:24] do you think that alone might create a positive result? [20:56:26] Only one way to find out. [21:02:45] changed the ```="NULL";``` to ```=null;``` .. no joy [21:09:10] :( [21:09:40] * revansx[m] sent a long message: < https://matrix.org/_matrix/media/v1/download/matrix.org/BqhSCXMcnJZpmOzndwdxjEZv > [21:09:54] The metric is the "First Save" bug [21:10:17] whatever MW is doing upon first save attempt needs to happen upon first visit [21:11:22] because after the failed "first save" attempt, things pretty much work [21:11:25] ok [21:13:19] Sorry, I have to go. :O Good luck! [21:13:57] you have been extremely helpful and have provided some serious leads for me to explore [21:13:57] thank you! [21:35:07] tgr and Trela .. thank youo [21:35:43] thank "you"