Page MenuHomePhabricator

Users of ProvieIt gadget get a 403 Forbidden fetching i18n files from Gerrit/Gitiles
Closed, ResolvedPublic

Description

For the last few weeks, when I visit https://gerrit.wikimedia.org from my laptop, I get a 403 Forbidden. If I visit from my mobile via 4G or wifi, I can access. However, if I visit from my laptop via 4G or wifi, I can't access. If I clear my cookies or visit incognito, I get the same 403. So it seems related to my laptop rather than my account or ip.

However, some days ago I got two bug reports regarding a gadget I maintain. I was able to reproduce the bug and it seems the cause is related to this 403 (basically, the gadget loads the latest message translations directly from Gerrit, but gets the 403 instead), and one of the users confirmed they are getting the 403 when visiting Gerrit. So it seems I'm not the only one with this issue.

Event Timeline

@Sophivorus What web browser are you running, and which version?

I do know some older versions had to get blocked due to issues.

@Peachey88 Ah yes, that's probably the cause, I'm running Chrome v103.0.5060.132 (64-bit) and I've been unable to update for some time because apparently my laptop is too old.

I'll update my laptop later this year so I guess I can access Gerrit from other devices until then. As to the gadget, I'll try to remove this strange dependency on Gerrit.

Feel free to close this if you want, thanks!

Hi, I am one of the person maintaining Gerrit at the foundation.

@Peachey88 is correct, the issue is we recently started blocking some old browsers. Part of the rationale is the Gerrit code review system (https://gerrit.wikimedia.org/r/) is mostly used by developers that certainly have recent browsers and the JavaScript application certainly requires recent javascript/css. Chrome 103 was released back in June 2022 (3 years ago).

That being said, the ProveIt gadget can be enabled by our end users, and some certainly might have old versions installed for a variety of reasons (old hardware, corporate computer, auto update not enabled ...).

I went to look at the source https://gerrit.wikimedia.org/r/mediawiki/gadgets/ProveIt.git . Proveit fetches localization updates from Gitiles using URLs:

//gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/gadgets/ProveIt/+/master/i18n/en.json?format=text
//gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/gadgets/ProveIt/+/master/i18n/' + userLanguage + '.json?format=text'

Browseable views of the first link and the second link with fr language:

Those are valid use cases. I don't have a solution to this problem right now unfortunately. Meanwhile you can instruct people to update their browser when possible.

hashar renamed this task from 403 Forbidden on Gerrit to Users of ProvieIt gadget get a 403 Forbidden fetching i18n files from Gerrit/Gitiles.May 22 2025, 7:40 AM

Hi! I'm happy to hear that fetching localization messages from Gitiles is a valid use case, but I think I will replace it for a more standard approach that fetches the messages from a wiki page at mediawiki.org or something (experience has taught me that the most reliable environment are always the wikis). I'm currently requesting a grant to update and improve the gadget anyway, so I'll add this to my to-do list.

I do not know much about gadgets unfortunately, and I imagine the localization files are usually stored in a sub page on the wiki. That requires some synchronization after the code got merged though.

Done! Translations are now hosted at https://commons.wikimedia.org/wiki/Data:Gadget-ProveIt.tab and fetched from there. Can be tested in the development version (see my common.js) and will be deployed in a few days.

Sophivorus claimed this task.

Done! Translations are now hosted at https://commons.wikimedia.org/wiki/Data:Gadget-ProveIt.tab and fetched from there. Can be tested in the development version (see my common.js) and will be deployed in a few days.

Hi! How will they sync with translatewiki?

@Iniquity Hi! They don't. Setting up a Gerrit repo for Proveit, connecting it to TranslateWiki, and loading the translations from there was an experiment. These 403 Forbidden errors me and other users are now getting from Gerrit point to the limitations of this experiment, so I thought it was time to regress to a "safer" alternative, that is, hosting the translations at Commons, where they can be translated by Wikimedia users (but not by TranslateWiki, granted).

That being said, today I came up with another possible solution to this 403 error. We could hard-code the English strings in the JS code of Proveit. Then if a user wants the interface in some other language, we attempt to load the translations from Gerrit, and if that fails, we show the English strings. (As a bonus, this solution would save one request in English wikis.) The problem is that all users with sufficiently old browsers (which might be a lot, we don't know) will get English strings even if they don't understand English. The Commons approach doesn't have that problem.

What do you think?

It seems to me that abandoning the practice of translating global gadgets via translatwiki.net and using the translations at Commons is the worst way. Since the translation at Commons is extremely inconvenient and practically impossible to implement due to problems with the user interface. It is unreadable, it is impossible to edit it normally and search for untranslated strings.
I like the option with the fallback much more, or you can use gitlab-content proxy () https://ru.wikipedia.org/wiki/User:Iniquity/Gadget-script-installer-core.js#L-730.
https://wikitech.wikimedia.org/wiki/Tool:Gitlab-content

@Iniquity I just modified the development version as mentioned: English messages are hard-coded and the translations are fetched from Gerrit. When that fails (because of the 403 error, or because the requested language is not available, or whatever), the English messages are shown, and on English wikis, we save one request. I also prefer this solution now. Thanks for helping me see clearly and decide!