Don't save scratch_tokens if empty array (like they are on new TOTP rows)
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	Reedy
	Oct 10 2025, 12:17 AM

Project Tags

Referenced Files

None

Subscribers

Aklapper

Reedy

Description

It seems when we're inserting new TOTP rows we're adding empty scratch_tokens arrays in oad_data... Fallout from T232336: Separate recovery codes into a separate 2FA module.

We should probably stop doing this ASAP, as we'll just need to remove them again (probably part of T405235: Create MediaWiki maintenance script to migrate older TOTP devices to modern TOTP + Recovery Codes configuration, rather than doing another script ontop).

Details

Related Changes in Gerrit:

	Subject	Author	Repo	Branch	Lines +/-
	TOTPKey: Only serialize scratch_tokens if not an empty array	Reedy	mediawiki/extensions/OATHAuth	master	+4 -1

Customize query in gerrit

Related Objects
Search...

Status	Assigned	Task
Resolved	Reedy	T405787 Remove temporary feature flags for MW 1.45 release
Open	None	T399644 FY2025-26 WE4.6.2 Multiple Authenticators
Resolved	Reedy	T404363 Set OATHSecretKey value within Wikimedia production and migrate older 2fa data within oathauth_devices
Resolved	sbassett	T145915 OATHAuth OTP shouldn't be stored in cleartext in the DB
Resolved	Reedy	T408297 Recovery codes aren't consumed when encryption is enabled
Resolved	Reedy	T408305 Add/update maintenance script to encrypt existing recovery codes...
Resolved	Reedy	T404806 Remove $wgOATHAllowMultipleModules and $wgOATHAuthNewUI
Resolved	Reedy	T407057 Run MoveRecoveryCodesFromTOTP.php
Resolved	Reedy	T405235 Create MediaWiki maintenance script to migrate older TOTP devices to modern TOTP + Recovery Codes configuration
Resolved	Reedy	T406953 Don't save scratch_tokens if empty array (like they are on new TOTP rows)
Resolved	Reedy	T404807 Remove $wgOATHAllowMultipleModules and $wgOATHAuthNewUI when no longer needed from CommonSettings-labs.php

Event Timeline

Reedy created this task.Oct 10 2025, 12:17 AM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptOct 10 2025, 12:17 AM

Reedy triaged this task as High priority.Oct 10 2025, 12:17 AM

Reedy updated the task description. (Show Details)Oct 10 2025, 12:21 AM

Change #1195087 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/extensions/OATHAuth@master] TOTPKey: Only serialize scratch_tokens if not an empty array

https://gerrit.wikimedia.org/r/1195087

gerritbot added a project: Patch-For-Review.Oct 10 2025, 12:47 AM

Reedy renamed this task from Don't set scratch_tokens on new TOTP rows to Don't save scratch_tokens if empty array (like they are on new TOTP rows).Oct 10 2025, 12:55 AM

Reedy added a parent task: T405235: Create MediaWiki maintenance script to migrate older TOTP devices to modern TOTP + Recovery Codes configuration.Oct 11 2025, 3:47 PM

Reedy moved this task from Backlog to Bugs on the MediaWiki-extensions-OATHAuth board.Oct 11 2025, 3:50 PM

Change #1195087 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@master] TOTPKey: Only serialize scratch_tokens if not an empty array

https://gerrit.wikimedia.org/r/1195087

Maintenance_bot removed a project: Patch-For-Review.Oct 14 2025, 3:31 PM

ReleaseTaggerBot added a project: MW-1.45-notes (1.45.0-wmf.24; 2025-10-21).Oct 14 2025, 4:00 PM

Reedy closed this task as Resolved.Oct 14 2025, 7:18 PM

Reedy claimed this task.

Catrope moved this task from Backlog to Done on the FY2025-26 WE4.6.2 Multiple Authenticators board.Oct 22 2025, 4:47 AM