Currently, the hack in WikimediaCustomizations prompts for reauthentication when the user tries to go to the edit form. Instead, we want to allow the user to go to the edit form without reauthenticating, and only prompt for reauth when the user tries to save the edit.
This requires stashing the contents of the edit form that the user submitted, and resubmitting them after the user completes the reauth process.
| Subject | Author | Repo | Branch | Lines +/- | |
|---|---|---|---|---|---|
| Prompt for reauthentication after submitting a site JS edit, not before | SBassett | mediawiki/core | master | +399 -18 |
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Open | None | T197160 All security-sensitive MediaWiki functionality should require elevated security | |||
| Resolved | sbassett | T427955 Prompt for reauthentication after submitting a site JS edit, not before | |||
| Resolved | sbassett | T429986 Use AuthPopup for reauth on EditPage |
AuthManagerSpecialPage::handleReauthBeforeExecute() does something similar for auth forms (although it does send to reauth when showing the form as well), although in a somewhat hacky way.
Change #1301450 had a related patch set uploaded (by SBassett; author: SBassett):
[mediawiki/core@master] Prompt for reauthentication after submitting a site JS edit, not before
Change #1301450 merged by jenkins-bot:
[mediawiki/core@master] Prompt for reauthentication after submitting a site JS edit, not before