I experience the same now on dewikisource now.

There is another message coming in front of that above:

WARNING: API warning (login): Fetching a token via action=login is deprecated. Use action=query&meta=tokens&type=login instead.

When the old login method will be turned off?

@MaxBioHazard I am not sure. It was marked as "deprecated" in response to T110276 in rMW54d58ef50665 and I think @Anomie might be able to answer your question best.

In T137805#2778915, @MaxBioHazard wrote:

When the old login method will be turned off?

There are currently no plans to turn it off. However, if something makes the "main account" login process require anything beyond the submission of a username and password field, action=login will just fail. That's why it's deprecated outside of use with BotPasswords, which themselves were created specifically so there would be a way for action=login to reliably keep working for bots instead of requiring that all bots convert to using OAuth.

For example, if your password needs to be reset, Special:UserLogin will return a second page asking you to change your password before actually logging you in and action=clientlogin will return a response with a similar request, while action=login will just fail.

For another example, if you enable two-factor authentication[1] on the bot's account, Special:UserLogin will return a second page asking for the second factor and action=clientlogin will return a response with a similar request, while action=login will just fail.

For still another example, if failed login attempts from your IP cause a captcha to be displayed on Special:UserLogin, the process for using action=clientlogin will signal that and will indicate how to submit the captcha answer, while action=login will not be able to signal it and attempting to log in will just fail because no captcha answer can be supplied.

[1] 2FA is technically deployed already, but needs a special user right to be able to turn it on. I guess a wider deployment is stuck on T100375 and its subtasks.

In T137805#2754035, @Xqt wrote:

There is another message coming in front of that above:

WARNING: API warning (login): Fetching a token via action=login is deprecated. Use action=query&meta=tokens&type=login instead.

That's an unrelated warning.

• Long ago, you could log in with action=login by just providing a username and password.
• Then it was realized this was a CSRF vulnerability, so now you have to provide a username, password, and a CSRF token to be able to log in. The only way to get this token was to hit action=login without providing a token, in which case you'd get a NeedToken response with the necessary token.
• Some time later, all token fetching was consolidated into action=query&meta=tokens and other methods of fetching a token were deprecated.

Again, there are no plans to actually remove the ability to fetch the login token by hitting action=login and getting a NeedToken response any time soon. Someday it might be removed, if the logs behind Special:ApiFeatureUsage indicate that reasonably close to no one is hitting this warning anymore. But it has been hit 85914 times just in the past 24 hours, so that day doesn't seem like it'll be coming any time soon.

Now we have a lot of tests failing due to this issue

We can use BotPasswords to make tests pass and avoid warnings, but it would mean we have one password for Beta Cluster wikis, another password for Wikimedia wikis and another password for musicbrainz wiki

In T137805#5225739, @Dvorapa wrote:

We can use BotPasswords to make tests pass and avoid warnings, but it would mean we have one password for Beta Cluster wikis, another password for Wikimedia wikis and another password for musicbrainz wiki

I see two problems there:

• the botpasswords file does only contain tuples for different users but not for different sites
• botpasswords are in plain text

In T137805#5225757, @Xqt wrote:

• the botpasswords file does only contain tuples for different users but not for different sites

We can fix this in several ways:

• add a possibility to store different wiki farms in botpasswords file
• create multiple environment variables like PYWIKIBOT_BOTPASSWD_WIKI, PYWIKIBOT_BOTPASSWD_BETA, PYWIKIBOT_BOTPASSWD_MB and update .travis.yml to use the one it needs ...

See also:

In T143905#3223779, @Framawiki wrote:

• what about same username on different wiki farms ?

In T137805#5225757, @Xqt wrote:

• botpasswords are in plain text

It has permissions so only the author can view the file, but I'm not sure, how cross-platform this thing is

• Wouldnt ("en", "wikipedia", "my_username", BotPassword("botpassword suffix", "bot password")) work in the password file? See LoginManager.readPassword in login.py.
  • If not, that sounds like something we should support...
• I believe it is possible to pass the botpassword in the classic login process by using "prefix@password" as password (this is not clearly documented on mw.org but is shown after creating a botpassword).

In T137805#5226704, @valhallasw wrote:

• I believe it is possible to pass the botpassword in the classic login process by using "prefix@password" as password (this is not clearly documented on mw.org but is shown after creating a botpassword).

It is indeed. That option was added specifically with pywikibot in mind, see T142304: Allow using a bot password with base username .

In T137805#5247968, @Anomie wrote:

In T137805#5226704, @valhallasw wrote:

• I believe it is possible to pass the botpassword in the classic login process by using "prefix@password" as password (this is not clearly documented on mw.org but is shown after creating a botpassword).

It is indeed. That option was added specifically with pywikibot in mind, see T142304: Allow using a bot password with base username .

Of course, but still we have different Botpassword for Beta Cluster and different for wikis, which is a thing we need to overcome somehow. I suggested to have an environment variable containing Botpassword for each wiki family we use to test (I think there are 3 or 4 of them), which needs some additional code to make it work, but it should work.

What do you do now, without BotPasswords? Have your test account have the same password everywhere?

In T137805#5248026, @Anomie wrote:

What do you do now, without BotPasswords? Have your test account have the same password everywhere?

Ehm, yes. This is what we discussed above. It has been easy to use in tests on Travis CI

In T137805#5248010, @Dvorapa wrote:

Of course, but still we have different Botpassword for Beta Cluster and different for wikis, which is a thing we need to overcome somehow. I suggested to have an environment variable containing Botpassword for each wiki family we use to test (I think there are 3 or 4 of them), which needs some additional code to make it work, but it should work.

As far as I understand, a password file can contain multiple entries to support multiple passwords for multiple usernames/sites/etc.
https://docs.travis-ci.com/user/encrypting-files/ suggests Travis supports encrypting entire files, so it should be possible to skip the environment variables altogether, and just encrypt the passwords file.

I see. I'm not sure I understand correctly, where the file would be located, but anyway, this seems doable.

I think T137805 and T224712 are the same issue. Tests fail randomly on zh.wikisource.org

Change 584017 had a related patch set uploaded (by Dvorapa; owner: Dvorapa):
[pywikibot/core@master] [bugfix] Resolve action=login deprecation warning

https://gerrit.wikimedia.org/r/584017

Change 584017 merged by jenkins-bot:
[pywikibot/core@master] [bugfix] Resolve action=login deprecation warning

https://gerrit.wikimedia.org/r/584017

I don't see this error :) Finally!!

kizule@kizule-laptop1:~/Desktop/development/pywikibot-core$ python pwb.py login
WARNING: No user is logged in on site wikipedia:sr
Password for user Zoranzoki21 on wikipedia:sr (no characters will be shown): 
Logging in to wikipedia:sr as Zoranzoki21
Logged in on wikipedia:sr as Zoranzoki21.
kizule@kizule-laptop1:~/Desktop/development/pywikibot-core$

Yep! \o/

Great job, @Dvorapa! Thanks!