Page MenuHomePhabricator

Client Hints API not called on rollback when user has "Show a confirmation prompt when clicking on a rollback link" preference enabled
Closed, ResolvedPublicBUG REPORT

Description

What is the problem?

When a user has the "Show a confirmation prompt when clicking on a rollback link" preference enabled, the Client Hints REST API is not called on a successful rollback.

Steps to reproduce problem
  1. Install the CheckUser extension
  2. Open the Chrome browser
  3. While logged in or logged out, create a page
  4. Log into a different account than the one used in step 3 that also has the administrator group (sysop).
  5. Enable the preference "Show a confirmation prompt when clicking on a rollback link" shown in the "Appearance" tab of Special:Preferences.
  6. Make an edit to the page created in step 3
  7. Open the history page for this page
  8. Click on the "rollback 1 edit" link for the edit made in step 6 and then click "Rollback" when asked to confirm.
  9. Get the revision ID for the edit performed by clicking the rollback link (this edit should have the Rollback tag).
  10. Inspect the database table cu_useragent_clienthints_map using the following SQL after replacing <rev id> with the revision ID of the rollback gained in step 9:
SELECT * FROM cu_useragent_clienthints_map WHERE uachm_reference_id = <rev id> AND uachm_reference_type = 0;

Expected behavior: Rows should be returned by the query, as the API should have been called
Observed behavior: No rows are returned by the query

Environment

Wiki(s): MediaWiki 1.41.0-alpha (f626d90) 00:43, 3 September 2023. CheckUser 2.5 (560ca5ac) 01:05, 2 September 2023.

Extra info

Because when using this preference, the rollback requests are made via POST. As such, the CheckUser code does not set the HTTP headers because there is no point in setting the headers on post requests (as the action usually is performed once a post request is returned successfully). However, because the Client Hints API makes the request separately using the data from the JS API, the data can be collected via this method on POST requests.

QA Results - Local

Event Timeline

Change 954253 had a related patch set uploaded (by Kosta Harlan; author: Kosta Harlan):

[mediawiki/extensions/CheckUser@master] clienthints: Remove Accept-CH header on action and load module on POST

https://gerrit.wikimedia.org/r/954253

Change 954253 merged by jenkins-bot:

[mediawiki/extensions/CheckUser@master] clienthints: Remove Accept-CH header on action and load module on POST

https://gerrit.wikimedia.org/r/954253

GMikesell-WMF subscribed.

@Dreamy_Jazz Rows are returned by the query as seen from the screenshots below. I will move this to Done. Thanks for the detailed description and all your work!

Status: ✅ PASS
Environment: Local 1.41.0-alpha (30b06ec) 14:14, 6 September 2023. Checkuser 2.5 (9c96054) 10:22, 6 September 2023
OS: macOS Ventura 13.5
Browser: Chrome 116
Device: MBP
Emulated Device:: N/A
Test Link
http://localhost:8080/w/index.php?title=Philadelphia_Eagles&action=history

✅AC1: https://phabricator.wikimedia.org/T345518

Local View HistoryVS SQL
2023-09-06_13-05-13.png (1×3 px, 374 KB)
image.png (223×1 px, 29 KB)