bot_passwords table expected to exist despite wgEnableBotPasswords = false
Closed, ResolvedPublic
Actions

Description

I've logged in with old password.
I've been taken immediately to page to change the password claiming the password is invalid due to not being at least 10 chars long.
I've filled old password, new (valid) password and its confirmation and hit the submit button.
I've got the https://wikitech.wikimedia.org/wiki/Special:ChangePassword page with folowing message:

Database error

A database query error has occurred. This may indicate a bug in the software.
Function: BotPassword::invalidateAllPasswordsForCentralId
Error: 1146 Table 'labswiki.bot_passwords' doesn't exist (208.80.154.136)

"wgHostname":"silver" if that helps.

Details

	Subject	Repo	Branch	Lines +/-
	Add checks of $wgEnableBotPasswords in more places	mediawiki/core	wmf/1.27.0-wmf.11	+18 -0
	Add checks of $wgEnableBotPasswords in more places	mediawiki/core	master	+18 -0

Customize query in gerrit

Related Objects
Search...

Status	Subtype	Assigned	Task
Resolved		• Deskana	T75616 Tracking: API/backend issues blocking Wikipedia app development
Resolved		Anomie	T32788 Allow triggering of user password reset email via the API
Open		None	T90925 General authentication improvements for MediaWiki
Resolved		Anomie	T48179 Allow a challenge stage during authentication
Open		None	T5709 Refactoring to make external authentication and identity systems easier
Resolved		Tgr	T43201 UserLoadFromSession considered evil
Resolved		Anomie	T67493 Session is started by EditAction (problem for extensions using UserLoadFromSession hook)
Open	Feature	None	T55156 Provide option to force a login session to end within a certain time
Open		None	T89459 Modernize MediaWiki authentication system (AuthManager)
Resolved		Anomie	T123451 Deploy SessionManager and bot passwords
Resolved		Anomie	T124335 bot_passwords table expected to exist despite wgEnableBotPasswords = false

Event Timeline

Maniphest changed the visibility from "Public (No Login Required)" to "Custom Policy".Jan 21 2016, 7:33 PM

Maniphest changed the edit policy from "All Users" to "Custom Policy".

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJan 21 2016, 7:33 PM

Danny_B created this task.Jan 21 2016, 7:33 PM

Danny_B triaged this task as Unbreak Now! priority.

Danny_B updated the task description. (Show Details)

Danny_B added projects: wikitech.wikimedia.org, acl*security.

Danny_B changed Security from None to Software security bug.

Danny_B edited subscribers, added: Danny_B; removed: Aklapper.

Restricted Application added a project: Cloud-Services. · View Herald TranscriptJan 21 2016, 7:33 PM

Andrew subscribed.Jan 21 2016, 7:35 PM

Why is this in the security area?

Looks like wikitechwiki Missing schema change for wmf11

@Danny_B are you uncomfortable with people knowing you have a password <10 chars? Otherwise we should make this public so all the right people are aware of it.

Krenair renamed this task from Database error on wikitech to bot_passwords table expected to exist despite wgEnableBotPasswords = false.Jan 21 2016, 8:01 PM

Krenair edited projects, added MediaWiki-User-login-and-signup; removed Cloud-Services, wikitech.wikimedia.org.

Legoktm added subscribers: Tgr, Anomie.Jan 21 2016, 8:02 PM

Config change was https://gerrit.wikimedia.org/r/#/c/263804/2/wmf-config/InitialiseSettings.php , ~~apparently that missed labswiki.~~

Should be fixed by https://gerrit.wikimedia.org/r/#/c/265561/, we missed a few code paths where the setting needed to be checked.

In T124335#1953120, @csteipp wrote:

@Danny_B are you uncomfortable with people knowing you have a password <10 chars? Otherwise we should make this public so all the right people are aware of it.

I am from other projects used to report all db errors like this as private due to possible security issues. Feel free to make it public.

Krenair removed a project: acl*security.Jan 21 2016, 9:15 PM

Krenair changed the visibility from "Custom Policy" to "Public (No Login Required)".

Krenair changed the edit policy from "Custom Policy" to "All Users".

Krenair changed Security from Software security bug to None.

ReleaseTaggerBot added projects: MW-1.27-release (WMF-deploy-2016-01-19_(1.27.0-wmf.11)), MW-1.27-release-notes, MW-1.27-release (WMF-deploy-2016-02-02_(1.27.0-wmf.12)).Jan 21 2016, 10:00 PM

Tgr added a parent task: T123451: Deploy SessionManager and bot passwords.Jan 21 2016, 10:29 PM

Aklapper removed a subscriber: Anomie.Oct 16 2020, 5:38 PM

bot_passwords table expected to exist despite wgEnableBotPasswords = falseClosed, ResolvedPublicActions

Description

Details

Related ObjectsSearch...

Event Timeline

bot_passwords table expected to exist despite wgEnableBotPasswords = false
Closed, ResolvedPublic
Actions

Related Objects
Search...