Page MenuHomePhabricator

Prevent Math from setting preferences for temporary accounts
Closed, ResolvedPublic

Description

Following T335971, it appears the extension is saving preferences for temporary users.
Update the code to treat temporary users like anon users.

Wherever these do something different based on whether a user is anonymous or registered, they may need updating (including comments).

Tests and comments should also be updated.

Notes
To help with searching:

In PHP preferences are saved via UserOptionsManager::saveOptions
In JS preferences are saved via methods defined on options.js: https://gerrit.wikimedia.org/g/mediawiki/core/+/809d4c9a9dd2cff6321cdae7a41e75b6c362cbbd/resources/src/mediawiki.api/options.js

Event Timeline

(Please add codebase project tags to tasks when possible, so such tasks can be found when looking for open tasks related to that codebase - thanks!)

I don't understand the issue. If a (temporary) user changes her preferences in the settings menu the extension should save those or the settings menu should not be displayed in the first place. I would imagine that the preference menu is not showing up for temp users so there should not be an issue for the math extension.

@Physikerwelt UserOptionsManager will throw an error when asked to set preferences for a temporary user, similar to what it does for anonymous users. (Task: T332415: Update UserOptions classes to prevent temporary users having access to preferences.)

This mostly doesn't cause any problems since, as you pointed out, temporary users can't access any forms or APIs to set their own preferences.

However, in some cases preferences are set by the software directly. This will now throw errors for temporary users (as it always has for anon users). So if any extensions are saving preferences directly, they need to check that they are not doing so for a temporary user. We've done a basic code search and filed these tasks (see the parent task), but it might be that not all of the extensions we found need updating.

From a quick look at the search results for the Math extension, it looks as though a preference is set in two places:

Presumably neither of these would ever be run by an anon or temporary user, so it looks as though no updates are needed?

If that's correct, please feel free to decline this task.

Presumably neither of these would ever be run by an anon or temporary user, so it looks as though no updates are needed?

I don't know. Do you know how one can find it out? In theory neither, RefreshLinks script nor tests is run by a real (human) user.

To my understanding: "MediaWiki uses a subset of TEX markup, including some extensions from LaTeX and AMS-LaTeX, for mathematical formulae. It generates either PNG images or simple HTML markup, depending on user preferences and the complexity of the expression." documentation

The function is setting the user option, but not saving into the DB.

/**
	 * MaintenanceRefreshLinksInit handler; optimize settings for refreshLinks batch job.
	 *
	 * @param Maintenance $maint
	 */
	public static function onMaintenanceRefreshLinksInit( $maint ) {
		$user = RequestContext::getMain()->getUser();
		// Don't parse LaTeX to improve performance
		MediaWikiServices::getInstance()->getUserOptionsManager()
			->setOption( $user, 'math', MathConfig::MODE_SOURCE );
	}

I have been testing the extension with a temp user, and running some scripts: I have encountered no errors.

I'm happy to close this task unless someone with a greater understanding of the onMaintenanceRefreshLinksInit Hook and Maintenance scripts disagrees.

Thank you,

AGueyte changed the task status from Open to In Progress.Jun 5 2023, 5:56 PM
Tchanders claimed this task.

Thanks for looking into this @AGueyte - I think it makes sense to close this one.