Page MenuHomePhabricator
Create Task
Maniphest T427398

Unable to edit pages on Mediawiki namespace on 1.47.0-wmf.4, redirects to Verify your Identity page
Closed, ResolvedPublicBUG REPORT
Actions

Description

Steps to replicate the issue (include links if applicable):

This happens only on knwikisource, I am able to edit mediawiki namespace pages on knwikipedia

What happens?:

What should have happened instead?:

  • user should be redirected to edit window

Software version (on Special:Version page; skip for WMF-hosted wikis like Wikipedia):

Other information (browser name/version, screenshots, etc.):

Details

Related Changes in Gerrit:
SubjectAuthorRepoBranchLines +/-
auth: Mark the hidden token field used for reauth as skippableGergő Tiszamediawiki/coremaster+1 -0
auth: Mark the hidden token field used for reauth as skippableCatropemediawiki/corewmf/1.47.0-wmf.4+1 -0
Fix lastAuthTimestamp hackCatropemediawiki/extensions/CentralAuthwmf/1.47.0-wmf.4+2 -1
Fix lastAuthTimestamp hackGergő Tiszamediawiki/extensions/CentralAuthmaster+2 -1
Customize query in gerrit

Related Objects
Search...

Event Timeline

Anoop created this task.May 27 2026, 2:24 PM
Restricted Application added a subscriber: • Aklapper. · View Herald TranscriptMay 27 2026, 2:24 PM
Anoop updated the task description. (Show Details)May 27 2026, 2:26 PM
Reedy triaged this task as High priority.May 27 2026, 2:29 PM
Reedy added projects: Product Safety and Integrity, Regression.
• Aklapper renamed this task from Unable to edit Mediawiki pages on Kannada Wikisource to Unable to edit pages on Kannada Wikisource, redirects to Verify your Identity page.May 27 2026, 2:31 PM
HakanIST subscribed.May 27 2026, 2:36 PM

Same cross-domain security-level desync hits Special:BotPasswords, securitySensitiveOperationStatus() loops indefinitely. Logstash shows other reauth loops too.

Looks like Gerrit 1285894 should fix all of these.

Anoop renamed this task from Unable to edit pages on Kannada Wikisource, redirects to Verify your Identity page to Unable to edit pages on Mediawiki namespace on Kannada Wikisource, redirects to Verify your Identity page.May 27 2026, 2:36 PM
sbassett subscribed.May 27 2026, 2:40 PM

Just to confirm: this does not appear to be affecting all wikis. When I try similar actions on enwiki, the reauth prompts work as expected for me.

HakanIST added a comment.May 27 2026, 3:02 PM
In T427398#11959873, @sbassett wrote:

Just to confirm: this does not appear to be affecting all wikis. When I try similar actions on enwiki, the reauth prompts work as expected for me.

That's because enwiki is still on 1.47.0-wmf.3. Once enwiki rolls to wmf.4, I believe it will break there too.

RhinosF1 added a parent task: T423913: 1.47.0-wmf.4 deployment blockers.May 27 2026, 3:35 PM
Restricted Application added a subscriber: RhinosF1. · View Herald TranscriptMay 27 2026, 3:35 PM
RhinosF1 raised the priority of this task from High to Unbreak Now!.May 27 2026, 3:35 PM
In T427398#11959982, @HakanIST wrote:
In T427398#11959873, @sbassett wrote:

Just to confirm: this does not appear to be affecting all wikis. When I try similar actions on enwiki, the reauth prompts work as expected for me.

That's because enwiki is still on 1.47.0-wmf.3. Once enwiki rolls to wmf.4, I believe it will break there too.

This feels like it should block the train from proceeding then

jnuche subscribed.May 27 2026, 3:39 PM

agreed, this looks like a blocker

SomeRandomDeveloper subscribed.May 27 2026, 3:48 PM
bking subscribed.May 27 2026, 3:52 PM
HakanIST mentioned this in T427419: Unable to finish 2FA.May 27 2026, 4:15 PM
Tgr subscribed.May 27 2026, 4:47 PM

Local reauthentication is broken, reauthentication on auth.wikimedia.org (e.g. when you try to change your password) works. Suggests an issue with CentralAuth setting the LOGIN_WAS_INTERACTIVE flag.

In T427398#11959821, @HakanIST wrote:

Looks like Gerrit 1285894 should fix all of these.

Possibly, but it's not something I anticipated as being needed (there are some ways in which reauth would work weirdly in the time between gerrit 471664 and that patch, but in theory it should still work) and not something I'd like to try to roll out in a rush. There is probably a much simpler fix (or worst case we can just revert the core changes).

Tgr added projects: MediaWiki-extensions-CentralAuth, MediaWiki-Core-AuthManager.May 27 2026, 4:47 PM
Restricted Application added a project: MediaWiki-Core-Platform-Team. · View Herald TranscriptMay 27 2026, 4:47 PM
Tgr added a comment.May 27 2026, 4:48 PM

Probably unrelatedly, automatically starting local login (rather than showing an interstitial with a single button) is also broken.

gerritbot added a comment.May 27 2026, 4:48 PM

Change #1294328 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):

[mediawiki/core@master] auth: Mark the hidden token field used for reauth as skippable

https://gerrit.wikimedia.org/r/1294328

gerritbot added a project: Patch-For-Review.May 27 2026, 4:48 PM
Tgr renamed this task from Unable to edit pages on Mediawiki namespace on Kannada Wikisource, redirects to Verify your Identity page to Unable to edit pages on Mediawiki namespace on 1.47.0-wmf.4, redirects to Verify your Identity page.May 27 2026, 4:49 PM
Nux subscribed.May 27 2026, 4:56 PM

I'm looping on pl.wikimedia.org too. No way to edit JS.

obraz.png (967×448 px, 42 KB)

Tgr added a comment.May 27 2026, 5:44 PM

Confirmed that loginWasInteractive is being set to false in the token store when returning from the central domain.

Tgr added a comment.May 27 2026, 5:45 PM

As a temporary workaround, you can append &usesul3=0 to the URL on the interstitial page with the "Central login" button.

Anoop added a comment.May 27 2026, 5:54 PM
In T427398#11960794, @Tgr wrote:

As a temporary workaround, you can append &usesul3=0 to the URL on the interstitial page with the "Central login" button.

this worked for me https://kn.wikisource.org/w/index.php?title=ಮೀಡಿಯವಿಕಿ:Gadget-charinsert-core.js&oldid=323043

gerritbot added a comment.May 27 2026, 5:55 PM

Change #1294368 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):

[mediawiki/extensions/CentralAuth@master] Fix lastAuthTimestamp hack

https://gerrit.wikimedia.org/r/1294368

gerritbot added a comment.May 27 2026, 6:06 PM

Change #1294368 merged by jenkins-bot:

[mediawiki/extensions/CentralAuth@master] Fix lastAuthTimestamp hack

https://gerrit.wikimedia.org/r/1294368

gerritbot added a comment.May 27 2026, 6:20 PM

Change #1294328 merged by jenkins-bot:

[mediawiki/core@master] auth: Mark the hidden token field used for reauth as skippable

https://gerrit.wikimedia.org/r/1294328

gerritbot added a comment.May 27 2026, 6:24 PM

Change #1294375 had a related patch set uploaded (by Catrope; author: Gergő Tisza):

[mediawiki/core@wmf/1.47.0-wmf.4] auth: Mark the hidden token field used for reauth as skippable

https://gerrit.wikimedia.org/r/1294375

gerritbot added a comment.May 27 2026, 6:25 PM

Change #1294376 had a related patch set uploaded (by Catrope; author: Gergő Tisza):

[mediawiki/extensions/CentralAuth@wmf/1.47.0-wmf.4] Fix lastAuthTimestamp hack

https://gerrit.wikimedia.org/r/1294376

gerritbot added a comment.May 27 2026, 6:39 PM

Change #1294376 merged by jenkins-bot:

[mediawiki/extensions/CentralAuth@wmf/1.47.0-wmf.4] Fix lastAuthTimestamp hack

https://gerrit.wikimedia.org/r/1294376

gerritbot added a comment.May 27 2026, 6:45 PM

Change #1294375 merged by jenkins-bot:

[mediawiki/core@wmf/1.47.0-wmf.4] auth: Mark the hidden token field used for reauth as skippable

https://gerrit.wikimedia.org/r/1294375

Stashbot added a comment.May 27 2026, 6:45 PM

Mentioned in SAL (#wikimedia-operations) [2026-05-27T18:45:54Z] <catrope@deploy1003> Started scap sync-world: Backport for [[gerrit:1294376|Fix lastAuthTimestamp hack (T427398)]], [[gerrit:1294375|auth: Mark the hidden token field used for reauth as skippable (T427398)]]

Stashbot added a comment.May 27 2026, 6:47 PM

Mentioned in SAL (#wikimedia-operations) [2026-05-27T18:47:45Z] <catrope@deploy1003> catrope: Backport for [[gerrit:1294376|Fix lastAuthTimestamp hack (T427398)]], [[gerrit:1294375|auth: Mark the hidden token field used for reauth as skippable (T427398)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.

Stashbot added a comment.May 27 2026, 6:53 PM

Mentioned in SAL (#wikimedia-operations) [2026-05-27T18:53:36Z] <catrope@deploy1003> Finished scap sync-world: Backport for [[gerrit:1294376|Fix lastAuthTimestamp hack (T427398)]], [[gerrit:1294375|auth: Mark the hidden token field used for reauth as skippable (T427398)]] (duration: 07m 41s)

Catrope closed this task as Resolved.May 27 2026, 7:04 PM
Catrope assigned this task to Tgr.
Maintenance_bot removed a project: Patch-For-Review.May 27 2026, 7:30 PM
Nux added a comment.EditedMay 27 2026, 11:12 PM

I can confirm it works on pl.wm, thanks.

Krinkle edited projects, added: MediaWiki-Core-Platform-Team (Kanban); removed: MediaWiki-Core-Platform-Team.Sat, Jun 20, 2:21 AM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits