Page MenuHomePhabricator

Due to CORS to mobile site, the "add listing" button does not work on Firefox for Android when using desktop Wikivoyage site
Open, Needs TriagePublicBUG REPORT

Description

Steps to Reproduce:

Using Firefox 68.1 on Android 8.0.0. Also reproduced with Firefox Nightly 68.2a1 (2019-09-10).

  1. Load a page on wikivoyage (I used this article).
  2. Enable "Request desktop site".
  3. Make sure that you are actually on the desktop site, removing the .m in the URL if necessary.
  4. Select "add listing" next to a section header, once the button loads in.

Note that I am overriding to the desktop site on a per-tab basis, not using a setting that forces it on all pages (I can't remember if one actually exists).

Actual Results:

The listing editor fails to open; on my phone I get the rather unspecific alert "The page at https://en.wikivoyage.org says: Error: unable to initialize the listing editor: error". With remote debugging, I can see that the following is printed into the console:

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://en.m.wikivoyage.org/w/index.php?title=San_Francisco%2FCastro-Noe_Valley&action=raw&section=8&_=1568264253427. (Reason: CORS header ‘Access-Control-Allow-Origin’ missing).
Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://en.m.wikivoyage.org/w/index.php?title=San_Francisco%2FCastro-Noe_Valley&action=raw&section=8&_=1568264253427. (Reason: CORS request did not succeed).

Looking at the network tab, I see a GET to https://en.wikivoyage.org/..., which 302s and becomes an OPTIONS to https://en.m.wikivoyage.org/... for the same URL, which returns 200 and has no Allow response header or any Access-Control response headers. I don't know enough about CORS to say whether that makes any sense or whether the issue is that the redirect is happening in the first place.

Expected Results:

The listing editor opens, as happens on desktop Firefox (69.0).

Event Timeline

Aklapper renamed this task from The "add listing" button does not work on Firefox for Android when using desktop Wikivoyage site to Due to CORS to mobile site, the "add listing" button does not work on Firefox for Android when using desktop Wikivoyage site.Sep 12 2019, 10:41 AM
Aklapper added a project: Mobile.

Thanks for reporting this.

Weird. $wgCrossSiteAJAXdomains in https://noc.wikimedia.org/conf/CommonSettings.php.txt lists '*.wikivoyage.org' already.

Hm. According to [[https://m.mediawiki.org/wiki/Manual:$wgCrossSiteAJAXdomains|the manual for $wgCrossSiteAJAXdomains]], it only affects api.php:

This only affects requests to the API. Other entry points (index.php) are not affected.

So I think that matches the intended behavior for the variable... Should it even be making the redirect to the mobile site in the first place?