Loaded the latest release: Auth_remoteuser-REL1_42-f44911a.tar.gz and still have blank wiki pages (white screen) and memory exhaustion messages in the web server error log as above. This is after having upgraded:

Regression was caused by dfc691bfc52 "Migrate callers of deprecated method BlockManager::getUserBlock()" (T345683). In includes/Permissions/PermissionManager.php, the user rights cache was modified. My guess is that the caching stopped working and now the user rights checks run multiple times when a permission check is done within a SessionProvider.

So my bad idea right now is to add the following to the top of the UserNameSessionProvider::refreshSessionInfo method:

static $loaded = false;
if ($loaded) {
    return true;
}
$loaded = true;

The web page displays, but I'm worried that things won't be initialized correctly. I need help! Is it a bug in Mediawiki core? Or am I not allowed to User->isAllowed() inside of a SessionProvider's refreshSessionInfo method?

Here's a much safer temporary workaround: Replace !$user->isAllowed( 'createaccount' ) with true or false within the refreshSessionInfo() method in UserNameSessionProvider.php. true would mean "Users are not allowed to create accounts".

In T369974#10155491, @jrchamp wrote:

Here's a much safer temporary workaround…

@jrchamp Thanks for the workaround!

Hi, I came back to confirm that this bug still exists in the Auth_remoteuser-REL1_43-c985d52.tar.gz release which I just installed when upgrading to 1.43.3.

The bug still exists with Mediawiki version 1.43.7.

Is there a (known) way to fix that bug?

In T369974#11049266, @Onlygecko wrote:

The bug still exists with Mediawiki version 1.43.7.

Is there a (known) way to fix that bug?

The workaround from @jrchamp dated September 17, 2024 above works for me. I would suggest this is just checked in (or, rather, a separate global config variable is added and used here) so this stops biting people, as there doesn't seem to be the interest/experience in "fixing it" in the equivalent way.

@JeredF It's definitely the experience piece that's the limiting factor. Between true and false, the temporary workaround would be to "show the link even if people can't use the link". I'm living in a figurative construction zone right now, so if someone can open a change in the software system, I can review and approve it.

@jrchamp Thanks; I'm flagging this for my "todo" pile unfortunately -- I know nothing about the MW codebase and am currently a bit overcommitted also. :-/

Change #1181135 had a related patch set uploaded (by Robert Vogel; author: Robert Vogel):

[mediawiki/extensions/Auth_remoteuser@REL1_43] Fix infinite loop when checking permissions

https://gerrit.wikimedia.org/r/1181135

I have created a patch at https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Auth_remoteuser/+/1181135

Maybe someone can confirm it works?

In T369974#11110587, @Osnard wrote:

I have created a patch at https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Auth_remoteuser/+/1181135

Maybe someone can confirm it works?

Thank you for your effort. Unfortunately it only half works. In my case it works if the remote user also exists in MediaWiki, but it doesn't work otherwise. Consider that I have "autocreateaccount" disabled, because I want a remote user to have read only permissions if the same user doesn't exist in MediaWiki, and read-write permissions if the user exists in MediaWiki too.

@Osnard @Metaldaze80 I have updated https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Auth_remoteuser/+/1181135 to try and complete the patch. If the infinite loop is resolved and turning the createaccount setting on/off has an effect, then I think this is an overall improvement over the current version. Thank you for your efforts!

Thank you. I can not believe I missed this line. How embarrassing.

Change #1181135 merged by jenkins-bot:

[mediawiki/extensions/Auth_remoteuser@REL1_43] Fix infinite loop when checking permissions

https://gerrit.wikimedia.org/r/1181135

Change #1187013 had a related patch set uploaded (by Jrchamp; author: Robert Vogel):

[mediawiki/extensions/Auth_remoteuser@REL1_44] Fix infinite loop when checking permissions

https://gerrit.wikimedia.org/r/1187013

Change #1187015 had a related patch set uploaded (by Jrchamp; author: Robert Vogel):

[mediawiki/extensions/Auth_remoteuser@master] Fix infinite loop when checking permissions

https://gerrit.wikimedia.org/r/1187015

Change #1187013 merged by jenkins-bot:

[mediawiki/extensions/Auth_remoteuser@REL1_44] Fix infinite loop when checking permissions

https://gerrit.wikimedia.org/r/1187013

Change #1187015 merged by jenkins-bot:

[mediawiki/extensions/Auth_remoteuser@master] Fix infinite loop when checking permissions

https://gerrit.wikimedia.org/r/1187015

Change #1187054 had a related patch set uploaded (by Jrchamp; author: Robert Vogel):

[mediawiki/extensions/Auth_remoteuser@REL1_42] Fix infinite loop when checking permissions

https://gerrit.wikimedia.org/r/1187054

Change #1187054 merged by Jrchamp:

[mediawiki/extensions/Auth_remoteuser@REL1_42] Fix infinite loop when checking permissions

https://gerrit.wikimedia.org/r/1187054

Unfortunately, it only half works for me.

I have

$wgGroupPermissions['*']['createaccount'] = false;
$wgGroupPermissions['*']['autocreateaccount'] = false;
$wgGroupPermissions['*']['edit'] = false;

because I want to grant read-only access to remote users who do not have a MediaWiki account. When such a user tries to log in, the same memory error appears.

To make things working I need to change the following

381c381
<                               if ( $anon->isAllowedAny( 'autocreateaccount', 'createaccount' ) ) {
---
>                               if ( false ) {

I cannot figure out why. Do you have any suggestions?

because I want to grant read-only access to remote users who do not have a MediaWiki account. When such a user tries to log in, the same memory error appears.

Wouldn't

$wgGroupPermissions['*']['createaccount'] = false; // Disallow user registration via web UI
$wgGroupPermissions['*']['autocreateaccount'] = true; // Only applies in case Extension:Auth_remoteuser wants to create a user
$wgGroupPermissions['*']['edit'] = false;

be suitable in this case as well?

Change #1188293 had a related patch set uploaded (by Robert Vogel; author: Robert Vogel):

[mediawiki/extensions/Auth_remoteuser@master] Check local config to avoid infinite loop

https://gerrit.wikimedia.org/r/1188293

FYI: I have created https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Auth_remoteuser/+/1188293 as an proposal. Have set it to WIP, as I didn't have time to test it yet. Open for discussion.

Hint: I am not entirely sure if the original check is still valid in modern MediaWiki. Description says

Our parent class provided a session info, but the $wgGroupPermission for creating user accounts was changed while using this extension.

AFAIK, currently a change in $wgGroupPermission will not be possible anymore once GroupPermissionsLookup has been initialized. So I don't see how this situation can happen in MediaWiki 1.43+

In T369974#11180246, @Osnard wrote:

FYI: I have created https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Auth_remoteuser/+/1188293 as an proposal. Have set it to WIP, as I didn't have time to test it yet. Open for discussion.

This looks great! If it passes your tests, I'm happy to +2.

I tried the patch, but I've got the following error

PHP message: PHP Fatal error:  Type of MediaWiki\\Extension\\Auth_remoteuser\\UserNameSessionProvider::$config must not be defined (as in class MediaWiki\\Session\\SessionProvider) in /var/www/wiki.inturri.net/extensions/Auth_remoteuser/src/UserNameSessionProvider.php on line 6

What does the following line means?

protected Config $config;

Because removing that line, the code seems to be working.

I'm sorry if I cannot be more helpful, but I don't have enough knowledge to fully understand the problem.

Sorry, my bad. As mentioned in the discussion on the change, this object member is not required, as it is already declared in the base class. So, yes, one can safely remove this line.

So I can say that it works perfectly with my configuration.

Thank you very much!

Change #1188293 merged by jenkins-bot:

[mediawiki/extensions/Auth_remoteuser@master] Check local config to avoid infinite loop

https://gerrit.wikimedia.org/r/1188293

Change #1188883 had a related patch set uploaded (by Jrchamp; author: Robert Vogel):

[mediawiki/extensions/Auth_remoteuser@REL1_44] Check local config to avoid infinite loop

https://gerrit.wikimedia.org/r/1188883

Change #1189583 had a related patch set uploaded (by Jrchamp; author: Robert Vogel):

[mediawiki/extensions/Auth_remoteuser@REL1_43] Check local config to avoid infinite loop

https://gerrit.wikimedia.org/r/1189583

Change #1189584 had a related patch set uploaded (by Jrchamp; author: Robert Vogel):

[mediawiki/extensions/Auth_remoteuser@REL1_42] Check local config to avoid infinite loop

https://gerrit.wikimedia.org/r/1189584

Change #1188883 merged by jenkins-bot:

[mediawiki/extensions/Auth_remoteuser@REL1_44] Check local config to avoid infinite loop

https://gerrit.wikimedia.org/r/1188883

Change #1189583 merged by jenkins-bot:

[mediawiki/extensions/Auth_remoteuser@REL1_43] Check local config to avoid infinite loop

https://gerrit.wikimedia.org/r/1189583

Change #1189584 merged by Jrchamp:

[mediawiki/extensions/Auth_remoteuser@REL1_42] Check local config to avoid infinite loop

https://gerrit.wikimedia.org/r/1189584