Page MenuHomePhabricator

Fix or remove mediawiki-announce auto subscription code in the MediaWiki Installer
Open, MediumPublic

Description

https://gerrit.wikimedia.org/g/mediawiki/core/+/d7dbcb2327695ca1eb2d4e15ba23b72899dff594/includes/installer/Installer.php#1836

Postorius has CSRF protection so adapting this will be more complicated as you will need to 1) hit the subscription endpoint (which also does the MM2 or MM3 check by checking the response) 2) extract the CSRF token 3) pass back the same cookies to <stuff>/anonymous_subscribe with the token and email address.

It might just be easier to provide a link saying "sign up for mediawiki-announce" but I doubt we'd get the same conversion rate.

Event Timeline

Legoktm triaged this task as High priority.Apr 30 2021, 1:22 AM
Legoktm created this task.

It might just be easier to provide a link saying "sign up for mediawiki-announce" but I doubt we'd get the same conversion rate.

Do we actually get that many anyway from it?

I get numerous ticket systems replying. Numerous "you can't send to this address" and occasionally a few people wanting to unsubscribe.

It might just be easier to provide a link saying "sign up for mediawiki-announce" but I doubt we'd get the same conversion rate.

Do we actually get that many anyway from it?

Well...no. It's totally broken after we added CSRF to it a few years ago:

km@cashew ~> curl -X POST -F "email=legoktm@wikimedia.org" -F "language=en" -F "digest=0" "https://lists.wikimedia.org/mailman/subscribe/mediawiki-announce"
<!-- $Revision: 3550 $ -->
<html>
<head><title>MediaWiki-announce Subscription results</title></head>
<body bgcolor="white">
<h1>MediaWiki-announce Subscription results</h1>
There was no hidden token in your submission or it was corrupted.

<p>You must GET the form before submitting it.
<hr><address><a href="../listinfo/mediawiki-announce">MediaWiki-announce</a> list run by <a href="mailto:mediawiki-announce-owner@lists.wikimedia.org">mediawiki-announce-owner at lists.wikimedia.org</a><br><a href="../admin/mediawiki-announce">MediaWiki-announce administrative interface</a> (requires authorization)<br><a href="../listinfo">Overview of all lists.wikimedia.org mailing lists</a><p>
<table WIDTH="100%" BORDER="0">
  <tr>
    <td><a href="http://www.gnu.org/software/mailman/index.html"><img src="/images/mailman/mailman.jpg" alt="Delivered by Mailman" border="0" /><br>version 2.1.29</a></td>
    <td><a href="http://www.python.org/"><img src="/images/mailman/PythonPowered.png" alt="Python Powered" border="0" /></a></td>
    <td><a href="http://www.gnu.org/"><img src="/images/mailman/gnu-head-tiny.jpg" alt="GNU's Not Unix" border="0" /></a></td>
    <td><a href="https://www.debian.org/"><img src="/images/mailman/debianpowered.png" alt="Debian Powered" border="0" /></a></td>
  </tr>
</table>
</address>
</body>
</html>

Given that no one has noticed until now probably a link is good enough?

Haha. Probably. Not worth the extra hassle.

Legoktm lowered the priority of this task from High to Medium.Apr 30 2021, 2:09 AM
Legoktm renamed this task from Update MediaWiki installer for Mailman3 to Remove broken mediawiki-announce auto subscription code from the MediaWiki Installer.Apr 30 2021, 3:17 AM

It might just be easier to provide a link saying "sign up for mediawiki-announce" but I doubt we'd get the same conversion rate.

Do we actually get that many anyway from it?

So I dug through the logs a bit, in the month of April, there were 592 POSTs to the mediawiki-announce subscribe page, from a user-agent matching "MediaWiki/1.". (actually an interesting datapoint on which versions of MediaWiki are being installed!)

I think that's actually a high enough number to worth supporting.

legoktm@lists1001:/var/log/apache2$ zgrep "http://lists.wikimedia.org/mailman/subscribe/mediawiki-announce" lists.wikimedia.org-access.log*.gz | grep "POST" | grep "MediaWiki/1." | awk '{print $12}' | sort |uniq -c
      1 MediaWiki/1.19.24
      1 MediaWiki/1.23.10
      1 MediaWiki/1.24.1
      3 MediaWiki/1.24.2
      1 MediaWiki/1.25.1
      1 MediaWiki/1.25.3
     19 MediaWiki/1.27.1
      2 MediaWiki/1.27.4
      4 MediaWiki/1.28.0
      1 MediaWiki/1.29.2
      1 MediaWiki/1.30.0
      2 MediaWiki/1.30.2
      1 MediaWiki/1.31.0
     10 MediaWiki/1.31.12
     13 MediaWiki/1.31.14
      4 MediaWiki/1.31.7
      1 MediaWiki/1.32.0
      1 MediaWiki/1.33.0
      5 MediaWiki/1.33.1
      1 MediaWiki/1.33.3
      4 MediaWiki/1.33.4
      3 MediaWiki/1.34.0
      1 MediaWiki/1.34.4
     24 MediaWiki/1.35.0
    223 MediaWiki/1.35.1
    259 MediaWiki/1.35.2
      1 MediaWiki/1.36.0-alpha
      4 MediaWiki/1.37.0-alpha
Legoktm renamed this task from Remove broken mediawiki-announce auto subscription code from the MediaWiki Installer to Fix or remove mediawiki-announce auto subscription code in the MediaWiki Installer.May 1 2021, 6:02 AM

Change 685493 had a related patch set uploaded (by Jforrester; author: Jforrester):

[mediawiki/core@master] WebInstaller: Don't show the announce-l subscribe checkbox temporarily

https://gerrit.wikimedia.org/r/685493

Change 685886 had a related patch set uploaded (by Reedy; author: Jforrester):

[mediawiki/core@REL1_36] WebInstaller: Don't show the announce-l subscribe checkbox temporarily

https://gerrit.wikimedia.org/r/685886

Change 685887 had a related patch set uploaded (by Reedy; author: Jforrester):

[mediawiki/core@REL1_35] WebInstaller: Don't show the announce-l subscribe checkbox temporarily

https://gerrit.wikimedia.org/r/685887

Change 685888 had a related patch set uploaded (by Reedy; author: Jforrester):

[mediawiki/core@REL1_31] WebInstaller: Don't show the announce-l subscribe checkbox temporarily

https://gerrit.wikimedia.org/r/685888

Change 685493 merged by jenkins-bot:

[mediawiki/core@master] WebInstaller: Don't show the announce-l subscribe checkbox temporarily

https://gerrit.wikimedia.org/r/685493

Change 685888 merged by jenkins-bot:

[mediawiki/core@REL1_31] WebInstaller: Don't show the announce-l subscribe checkbox temporarily

https://gerrit.wikimedia.org/r/685888

Change 685887 merged by jenkins-bot:

[mediawiki/core@REL1_35] WebInstaller: Don't show the announce-l subscribe checkbox temporarily

https://gerrit.wikimedia.org/r/685887

Change 685886 merged by jenkins-bot:

[mediawiki/core@REL1_36] WebInstaller: Don't show the announce-l subscribe checkbox temporarily

https://gerrit.wikimedia.org/r/685886

Moved to "not a blocker" as I've commented it out. But let's do better. :-)