Fix Wikimini session expiration
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	valerio.bozzolan
	Mar 9 2021, 3:36 PM

Description

Fix Wikimini session issues.

This is an issue known since February 2021.

Original report

It's a serious issue, because if the user doesn't check "Keep me logged in", he will always be disconnected when trying to edit an article and get an error (impossible to submit any edit!) :-( Some experienced users are still reporting this issue: https://fr.wikimini.org/wiki/Sp%C3%A9cial:AWCforum/st/id22044
I suggested as a workaround to make this checkbox checked by default. Would it be possible? But this issue needs to be investigated.
Probably related to this, I also get a session failure message when I switch from the visual editor to the wiki editor and then submit an edit. It never works. For this issue, the "checkbox" workaround doesn´t help.

Kind regards
Laurent

Steps to reproduce

Login into https://fr.wikimini.org/wiki/Special:Login
Visit a random page like https://fr.wikimini.org/wiki/Genre_litt%C3%A9raire
Click on Modifier cette page
Click on Modifier le wikicode
You are now logout!

Thanks to @Ilario for these precise instructions.

Steps to reproduce (newer)

Login into https://fr.wikimini.org/wiki/Special:Login
Visit a random stock page: https://stock.wikimini.org/wiki/Main_Page
You are now logout!

Related Objects

Mentioned Here: T268880: Upgrade production Wikimini from MediaWiki 1.28.0 to at least 1.31 (current Debian GNU/Linux stable)

Event Timeline

valerio.bozzolan claimed this task.Mar 9 2021, 3:36 PM

valerio.bozzolan triaged this task as High priority.

valerio.bozzolan created this task.

valerio.bozzolan updated the task description. (Show Details)Mar 9 2021, 4:04 PM

valerio.bozzolan updated the task description. (Show Details)Mar 22 2021, 7:42 AM

valerio.bozzolan added a subscriber: Ilario.

Uhm. A waterfall of strange things lived here.

I've found that a legacy unexisting jQuery resource was pointing to Stock wiki, invalidating the whole session for no rational explanation.

Check it out:

In short, in wikitext-mode, the page was enqueuing this unexisting script:

https://stock.wikimini.org/wiki/Resources/lib/jquery/jquery.js

That page was sending this header, causing session invalidation:

Set-Cookie: wikimini_stockwiki_session=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; domain=.wikimini.org; secure; HttpOnly

For now I've mitigated just dropping that unexisting script:

extensions-external/SelectCategory/SelectCategory_body.php

//                      $wgOut->addScriptFile( "https://stock.wikimini.org/wiki/resources/lib/jquery/jquery.js");

Anyway it seems that normal sessions are broken in Wikimini.

valerio.bozzolan renamed this task from Fix Wikimini session issues to Fix Wikimini session expiration.Mar 22 2021, 4:01 PM

valerio.bozzolan updated the task description. (Show Details)

Well, I've applied another workaround:

includes/specialpage/LoginSignupSpecialPage.php

'rememberMe' => [
        // option for saving the user token to a cookie
        'type' => 'check',
        'name' => 'wpRemember',
        'label-message' => $this->msg( 'userlogin-remembermypassword' )
                ->numParams( $expirationDays ),
        'id' => 'wpRemember',
         'default' => true,
],

Note the default to true.