Page MenuHomePhabricator

Remove use of deprecated 'editToken' in mw.user.tokens (replace with 'csrfToken')
Closed, ResolvedPublic

Description

From T234576

It's been some 3 years since this became obsolete.

The editToken key of mw.users.tokens has been replaced by csrfToken since 298cf413dbc3fa4e (MediaWiki 1.27, released 2016).

The primary user of it, mediawiki.api was already migrated in the same commit. This means code using mw.Api#getToken('edit') will continue to work and is already using the new csrfToken key underneath.

What we need to migrate still is anything that uses editToken directly via mw.user.tokens.

Let's update whatever is using this in tarballed/WMF extensions and remove it from the payload.

Related Objects

StatusSubtypeAssignedTask
ResolvedTheSandDoctor
ResolvedTheSandDoctor
ResolvedTheSandDoctor
ResolvedTheSandDoctor
ResolvedTheSandDoctor
ResolvedTheSandDoctor
ResolvedTheSandDoctor
ResolvedTheSandDoctor
ResolvedAndyRussG
Resolvedfreephile
ResolvedTheSandDoctor
ResolvedTheSandDoctor
ResolvedTheSandDoctor
ResolvedTheSandDoctor
ResolvedTheSandDoctor
ResolvedTheSandDoctor
ResolvedTheSandDoctor
InvalidTheSandDoctor
ResolvedTheSandDoctor
ResolvedTheSandDoctor
ResolvedTheSandDoctor
ResolvedTheSandDoctor
ResolvedTheSandDoctor
InvalidTheSandDoctor

Event Timeline

Restricted Application added a subscriber: Aklapper. · View Herald Transcript

@Krinkle so mw.Api#getToken('edit') should be updated to mw.api.postWithToken() (from here) or is that also deprecated? If the latter, what should it be replaced with?

Krinkle updated the task description. (Show Details)

@TheSandDoctor Hi! The mw.Api module was already updated and uses the new csrfToken key (instead of the old editToken key).

There is no need to change any code that uses mw.Api#getToken('edit'). The mw.api.postWithToken method is something else, and is a short cut for querying information from the API together with a token from getToken.

This task is about replacing code that is using the editToken key with mw.user.tokens, such as mw.user.tokens.get('editToken') needs to be replaced with mw.user.tokens.get('csrfToken'). The Codesearch link in my previous comment finds places in our Git repositories that currently use the old code still.

I'll take a shot at this. Seems like a good first task to work at. @Krinkle thanks for the clarifications.

Change 538407 had a related patch set uploaded (by TheSandDoctor; owner: TheSandDoctor):
[mediawiki/extensions/AbuseFilter@master] ext.abuseFilter.tools.js: Replace deprecated mw.users.tokens with csrfToken

https://gerrit.wikimedia.org/r/538407

One done. I will work on the others later. Plan/hope is to have them all done this weekend. :)

Change 538407 merged by jenkins-bot:
[mediawiki/extensions/AbuseFilter@master] ext.abuseFilter.tools.js: Replace deprecated editToken with csrfToken

https://gerrit.wikimedia.org/r/538407

I will update the remaining ones in the morning as it is getting quite late in my time zone.

TheSandDoctor has begun working on it, no need for this project tag.

@TheSandDoctor There is few other extensions, do you have plan to work and on others?

In T233442#5513559, @Zoranzoki21 wrote:

@TheSandDoctor There is few other extensions, do you have plan to work and on others?

Yes. As I had explained above, the delay was because it was rather late in my timezone (e.g. I went to bed). The rest will be done within the next couple of hours.

In T233442#5513559, @Zoranzoki21 wrote:

@TheSandDoctor There is few other extensions, do you have plan to work and on others?

Yes. As I had explained above, the delay was because it was rather late in my timezone (e.g. I went to bed). The rest will be done within the next couple of hours.

OK, I will claim subtasks to you then.

In T233442#5513731, @Zoranzoki21 wrote:
In T233442#5513559, @Zoranzoki21 wrote:

@TheSandDoctor There is few other extensions, do you have plan to work and on others?

Yes. As I had explained above, the delay was because it was rather late in my timezone (e.g. I went to bed). The rest will be done within the next couple of hours.

OK, I will claim subtasks to you then.

Thanks.

Patches have now been submitted for all of these and are just awaiting review and +2. :)

Masumrezarock100 reopened this task as Open.

I thought I was closing a subtask. Sorry for the trouble. (:

Krinkle renamed this task from Remove 'editToken' from mw.user.tokens (deprecated for 'csrfToken') to Remove use of deprecated 'editToken' in mw.user.tokens (replace with 'csrfToken').Oct 3 2019, 9:49 PM
Krinkle updated the task description. (Show Details)
Krinkle moved this task from Unsorted to Migrate / Replace on the Technical-Debt board.
Krinkle moved this task from Limbo to Watching on the Performance-Team (Radar) board.
TheSandDoctor changed the task status from Open to Stalled.Oct 20 2019, 6:57 AM
TheSandDoctor changed the status of subtask T233545: TinyMCE needs 'editToken' replaced with 'csrfToken' from Open to Stalled.
TheSandDoctor changed the status of subtask T233559: UserAgreement needs 'editToken' replaced with 'csrfToken' from Open to Stalled.
TheSandDoctor lowered the priority of this task from Medium to Lowest.Jan 4 2020, 10:52 PM
TheSandDoctor raised the priority of this task from Lowest to High.
TheSandDoctor moved this task from git review pending to merged/done on the User-TheSandDoctor board.

AND it looks like this task can finally be closed :)