Page MenuHomePhabricator

Employer autocomplete showing readonly error in production
Closed, ResolvedPublic


Calls to the new API show the following:


{"error":{"code":"readapidenied","info":"You need read permission to use this module.","*":"See for API usage. Subscribe to the mediawiki-api-announce mailing list at <> for notice of API deprecations and breaking changes."}}

Event Timeline

We need to white list the page because we have: $wgGroupPermissions['*']['read'] = false; set.

It looks like we're using Lockdown. There's a chance this may be more challenging.

I'm currently looking at: to see how I add the api to the allow list.

There are two paths:

  • allow the api to be accessed by any anonymous user (still making sure we can do this) - but I think it would be adding "api" to the $wgWhitelistRead array
  • figure out how to add authentication based on a config variable
  • or do both

Based on a brief conversation in chat with @AndyRussG and @jgleeson we will want to lock this down and probably add a config token for accessing it.

@Ejegg says we can try allowing it. Now I just have to make sure that's doable :).

I added Lockdown locally and am trying to match the prod settings.

mepps renamed this task from Employer autocomplete showing readonly error when testing to Employer autocomplete showing readonly error in production.Jun 17 2020, 8:13 PM

Sadly adding "api" to the setting did not solve the problem :(.

So even though the settings say "Lockdown", it looks we don't have it installed. However, the problem remains the same that $wgGroupPermissions['*']['read'] = true; is blocking api access and I'm not sure how to make it accessible.

Change 606296 had a related patch set uploaded (by Mepps; owner: Mepps):
[mediawiki/extensions/DonationInterface@master] Change to require post and not read mode to allow access from form

Change 606296 merged by jenkins-bot:
[mediawiki/extensions/DonationInterface@master] Change to not read mode to allow access from form

AndyRussG claimed this task.
AndyRussG reassigned this task from AndyRussG to mepps.