Page MenuHomePhabricator

wfAjaxWatch in AjaxFunctions.php doesn't check the return value of $article->doWatch();
Closed, ResolvedPublic

Description

Author: paolo

Description:
An example where this is a problem: I have two open tabs or windows; I logout in the first, then go to the second one and click "watch". Instead of "you have to be logged in to watch pages", the answer is that the page has been added to the watchlist, while in fact it isn't.


Version: 1.11.x
Severity: normal
URL: http://en.wikipedia.org/w/index.php?action=ajax&rs=wfAjaxWatch&rsargs[]=Bug&rsargs[]=w

Details

Reference
bz11135

Event Timeline

bzimport raised the priority of this task from to Medium.Nov 21 2014, 9:53 PM
bzimport set Reference to bz11135.
bzimport added a subscriber: Unknown Object (MLST).

MediaWiki wrote:

It sounds like this is an issue with checking user authentication or something?

robchur wrote:

(In reply to comment #1)

It sounds like this is an issue with checking user authentication or something?

No, the issue is with the Ajax watch handler's mishandling of failures in the lower-level code that adds a page to a user's watchlist; the authentication is fine, but the code needs to return an appropriate response code or other XML which the client-side code can use to check for an error condition.

MediaWiki wrote:

That would make this an issue with the response. Would simply adding XML output solve the problem, once a parser was added to the script to look for that output value?

Actually, it looks like the watcher script on the server is only returning the operation as a code letter ("<u#>" for unwatch and "<w#>" for watch) followed by the HTML to display on top of the page. Maybe it should have the message watchnologintext returned with a code of "<n#>" or "<f#>" (for "not modified" or "failed") added to the list of possible responses. The script could look for this and display the message like the others, simply changing the ca-watch/ca-unwatch li back to what it had been. Or the server-side script could return different error codes depending on what operation was attempted.

Done in r38527. Would be nice to add a custom message or something.