Page MenuHomePhabricator

Video in MediaWiki:Loginprompt causes login session problems
Open, LowestPublic

Description

mrwiki had loginprompt message of this content, which prevented everyone to login, because of the video that was in it. This message is from 2014, and this issue is recent, so this is probably a Regression.

[[File:Marathi Wikipedia ULS.webm|thumb|उजवे|300px|मराठीत टाईप करण्यासाठी, ह्या व्हिडिओ क्लिपेत दाखवल्या प्रमाणे, मराठी आणि नंतर अक्षरांतरण पर्याय निवडा, अथवा इनस्क्रिप्ट साठी 'मराठी लिपी' पर्याय, तुम्ही तुमची व्यक्तीगत युनिकोड टायपींग पद्धती वापरू शकता. Click on the '''cc'' to change the subtitle languages to Marathi, English, Sanskrit, Kokani,Ahirani.]]
{{SITENAME}}मध्ये सनोंद-प्रवेशासाठी  स्मृतिशेष सक्षम (कुकिज एनेबल)असणे आवश्यक आहे.

Original description

There has been an issue while logging in on mr.wikipedia.org
We are unable to login to the site since 6/7 days. When we try to log in it shows an error message.

"There seems to be a problem with your login session; this action has been canceled as a precaution against session hijacking. Go back to the previous page, reload that page and then try again."

Those who are already logged in on other sites can easily see themselves logged in on mrwiki too. but fresh session on mrwiki couldn't be started.

Please look into this, as we don't have any technical person in our community. Someone from other community needs to look into this and resolve. thanks

Event Timeline

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJun 27 2019, 6:47 PM
Reedy added a project: Operations.
Reedy added a subscriber: Reedy.

I note I can also replicate this in incognito mode

For anyone affected by log-in problems who wants to help track them down:

Please see and follow https://www.mediawiki.org/wiki/Manual:How_to_debug/Login_problems and report back here. Thanks!

jbond triaged this task as High priority.Jun 28 2019, 10:43 AM
jbond added a subscriber: jbond.

Does it persist after clearing cookies for the wiki domain? No existing cookies in incognito

When logging in in incognito mode? Doesn't work either
When logging in with a different kind of browser? Broken in FF and Chrome
If you use any ad blockers or browser privacy add-ons, are they blocking anything? No Does it work if you turn them off? No because it's not on
Does it affect all user accounts, or just one? Unknown, definitely more than 1 account
Does the "remember me" flag make any difference? (Clear cookies before attempts.) No
If the problems are happening on a WikiMedia wiki, try logging in on another wiki, preferably one that does not share a second-level domain name (so if the problem happens on xy.wikipedia.org, try for example xy.wiktionary.org). Other wikis seem fine (not all tested obviously)

Probably needs a HAR file at this point

Urbanecm added a comment.EditedJun 28 2019, 11:41 AM

I can reproduce this when using mr.wikipedia.org in mr, however, when I try to login with interface switched into English, I have no problems with logging in. @Reedy or anyone having this issue, can you please try to verify this theory?

I can reproduce this when using mr.wikipedia.org in mr, however, when I try to login with interface switched into English, I have no problems with logging in. @Reedy or anyone having this issue, can you please try to verify this theory?

Lol, yes, I can confirm

I actually tried that when debugging on IRC to see the error message, and was able to login. Forgot about it completely... :)

Okay, I think this is caused by local content of mediawiki:Loginprompt. When I copied loginprompt from mrwiki to test.wikipedia.org, I reproduced the issue there as well. When I reverted my test on test.wikipedia, issue disappeared. @Reedy, can you delete MediaWiki:Loginprompt from mrwiki to test this theory there as well? Thanks!

Okay, I think this is caused by local content of mediawiki:Loginprompt. When I copied loginprompt from mrwiki to test.wikipedia.org, I reproduced the issue there as well. When I reverted my test on test.wikipedia, issue disappeared. @Reedy, can you delete MediaWiki:Loginprompt from mrwiki to test this theory there as well? Thanks!

Deleted and confirmed working

the contents were as below, since 12:54, 26 July 2014

[[File:Marathi Wikipedia ULS.webm|thumb|उजवे|300px|मराठीत टाईप करण्यासाठी, ह्या व्हिडिओ क्लिपेत दाखवल्या प्रमाणे, मराठी आणि नंतर अक्षरांतरण पर्याय निवडा, अथवा इनस्क्रिप्ट साठी 'मराठी लिपी' पर्याय, तुम्ही तुमची व्यक्तीगत युनिकोड टायपींग पद्धती वापरू शकता. Click on the '''cc'' to change the subtitle languages to Marathi, English, Sanskrit, Kokani,Ahirani.]]
{{SITENAME}}मध्ये सनोंद-प्रवेशासाठी  स्मृतिशेष सक्षम (कुकिज एनेबल)असणे आवश्यक आहे.
Aklapper renamed this task from Login error on mrwiki to Impossible to log into mrwiki due to broken local "MediaWiki:Loginprompt" page.Jun 28 2019, 11:59 AM
Aklapper removed a project: Operations.
Urbanecm lowered the priority of this task from High to Normal.Jun 28 2019, 12:01 PM

Thank you @Reedy. I've tried to login on test.wikipedia with MediaWiki:Loginprompt containing [[File:Marathi Wikipedia ULS.webm|thumb|उजवे|300px|Test]], failed. It seems that inserting a video to loginprompt causes session problems. Since it's now possible to login on mrwiki without issues, given the loginprompt message is deleted, I'm lowering priority to Normal.

Urbanecm renamed this task from Impossible to log into mrwiki due to broken local "MediaWiki:Loginprompt" page to Video in MediaWiki:Loginprompt causes login session problems.Jun 28 2019, 12:03 PM
Urbanecm added a project: Regression.
Urbanecm updated the task description. (Show Details)
Restricted Application added a subscriber: Liuxinyu970226. · View Herald TranscriptJun 28 2019, 12:03 PM
Urbanecm raised the priority of this task from Normal to Needs Triage.Jun 28 2019, 12:04 PM

IMHO there is no reason to expect this message to be comfortable with holding a video. I'd consider it a local configuration error, now fixed. As a MediaWiki bug report, I'd consider it invalid/wontfix.

Sounds like it might be related to T226840. One of the background requests during the login process may be failing for the same reason (header explosion) and thus cause cookies to be lost.

Tgr added a subscriber: Tgr.

Probably not worth putting much effort into, now that the video player is about to be replaced.

Aklapper triaged this task as Lowest priority.Jul 25 2019, 10:33 AM