Page MenuHomePhabricator

"WikiBreak_Enforcer" script on en.wp does not supply LogoutToken parameter
Closed, InvalidPublic

Description

The code in question being in my common.js here (and on some other wikis) : https://en.wikipedia.org/wiki/User:ShakespeareFan00/common.js (currently commented)

being the code from https://en.wikipedia.org/wiki/Wikipedia:WikiProject_User_scripts/Scripts/WikiBreak_Enforcer

Sequence of actions taken (with script code active):

  1. Log into a a wiki with SUL, where the enforcer script is not active.
  2. Navigate from that wiki back to English Wikipedia, or via a link in a search engine.
  3. Wait for the enforcer script to generate it's first message.
  4. Click the acknowledgement in that message.

Expected behavior:

Enforced Log out on the wiki concerned, and return to the main-page of the wiki in question per the intent of the script.

Observed behavior:

Log out does not seemingly occur, and an error page about using the UI provided logout page is generated. The script then regenerates the Wiki break enforcement notice. Acknowledging it again regenerates the error page and the enforcement notice in an apparently un-ending repeating cycle.

Related Objects

Event Timeline

Aklapper changed the task status from Open to Stalled.May 6 2019, 12:16 PM

@ShakespeareFan00: Why was this reported here and not on https://en.wikipedia.org/wiki/Wikipedia_talk:WikiProject_User_scripts/Scripts/WikiBreak_Enforcer ?
Please elaborate why this is a bug in MediaWiki code and not in the script itself.

Closing as invalid, it's a script error or a script that was written for an earlier version of Special:UserLogout.

Navigating directly to Special:UserLogout doesn't now apparently do anything if it's not supplied with a LogoutToken parameter, which the script doesn't do, so Mediawiki is correctly assuming a 'manual' logout rather than an automated one.

This means that as far as the script is concerned it's seeing a page load with a still active Login, and attempts to enforce the wiki-break, setting up the warning page as the one to return to, which creates the infinite loop of enforcement alerts.

Presumably the approach taken, with respect to Special:UserLogout was to prevent rouge scripts from logging people out without them knowing?

ShakespeareFan00 renamed this task from Changes to Logout UI, causing Wiki Break Enforcer script to loop/regenerate continuously. to Script, does not supply LogoutToken parameter when navigating to Special:UserLogout, leading to infinite attempts at enforcing a wiki-break logout...May 6 2019, 12:43 PM

And for reference the Special:UserLogout changes are related to T25227

Aklapper renamed this task from Script, does not supply LogoutToken parameter when navigating to Special:UserLogout, leading to infinite attempts at enforcing a wiki-break logout.. to "WikiBreak_Enforcer" script on en.wp does not supply LogoutToken parameter.May 6 2019, 1:15 PM