Page MenuHomePhabricator

Special:Two-factor_authentication reloads identical after submit (step 4)
Closed, ResolvedPublic

Description

On https://wikitech.wikimedia.org/wiki/Special:Two-factor_authentication , I got my "Two-factor authentication secret key"; I produced a code for "Enter a code from your authentication device to verify" with oathtool -b "1234 5678 90AB CDEF" and entered it, submitted the page.

I. Expected: the page reloads with a warning that my code is not correct and that I probably made a mistake in producing it.
II. Observed: the page reloads identical, with no indication whatsoever that my request was even received or processed, and the text field still carrying the incorrect code (which encourages resubmit).

(By the way, because I know better, I used --totp and easily got things working; but there is no mention of TOTP on https://wikitech.wikimedia.org/wiki/Help:Two-factor_authentication or https://www.mediawiki.org/wiki/Help:Two-factor_authentication ; https://meta.wikimedia.org/wiki/Help:Two-factor_authentication mentions TOTP but not oathtool. Typical chi ha pane non ha denti situation.)

Event Timeline

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptFeb 19 2017, 12:48 AM
TheDJ added a subscriber: TheDJ.Mar 13 2017, 3:58 PM

I've noticed this too. I suspect this is a recent regression. I feel like i've had error or warning notifications before, when I made an error with the code. The source code also explicitly defines error message that should be presented to the user in these cases..

bd808 added a subscriber: bd808.

Removing Cloud-Services because this looks to be a general OATH problem rather than something we have misconfigured on wikitech.wikimedia.org.

TheDJ added a comment.EditedApr 21 2017, 12:38 PM

This is caused by https://gerrit.wikimedia.org/r/322100 which switched the htmlform ui from vform to ooui...

Change 349425 had a related patch set uploaded (by TheDJ):
[mediawiki/core@master] HTMLForm: add errors to html in ooui variants

https://gerrit.wikimedia.org/r/349425

TheDJ claimed this task.Apr 21 2017, 1:02 PM
TheDJ triaged this task as Normal priority.
TheDJ moved this task from Backlog to In Progress on the MediaWiki-extensions-OATHAuth board.

Change 349425 merged by jenkins-bot:
[mediawiki/core@master] HTMLForm: add errors to html in ooui variants

https://gerrit.wikimedia.org/r/349425

matmarex closed this task as Resolved.Apr 21 2017, 2:52 PM
matmarex removed a project: Patch-For-Review.

Change 349425 merged by jenkins-bot:
[mediawiki/core@master] HTMLForm: add errors to html in ooui variants

Thanks! Feels more logical.