UserLoadFromSession considered evil
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	tstarling
	Oct 19 2012, 3:42 AM

Description

Running code from CentralAuth, AbuseFilter, TitleBlacklist etc. which collectively call half the codebase does not seem like a good thing to be doing while the main context user is half-initialised and has lots of methods which will fail horribly if you try to call them (e.g. T43198).

Perhaps initialisation of the User object from the session can be moved to a function called from Setup.php, such as RequestContext::getUser(). It's not lazy-loaded anyway, User::newFromSession() has always been called unconditionally. Then CentralAuth (and anything else that uses the UserLoadFromSession hook) can be called without User::load() in its call stack.

Version: unspecified
Severity: normal
See Also: T60731

Details

Reference: bz41201

Related Objects
Search...

View Standalone Graph

This task is connected to more than 200 other tasks. Only direct parents and subtasks are shown here. Use View Standalone Graph to show more of the graph.

Status	Assigned	Task
		· · ·
Resolved	Tgr	T43201 UserLoadFromSession considered evil
Open	None	T89459 Modernize MediaWiki authentication system (AuthManager)
		· · ·

Event Timeline

• bzimport raised the priority of this task from to Medium.Nov 22 2014, 1:01 AM

• bzimport added projects: MediaWiki-extensions-CentralAuth, platformeng.

• bzimport set Reference to bz41201.

• bzimport added a subscriber: Unknown Object (MLST).

tstarling created this task.Oct 19 2012, 3:42 AM

Looking at WMF-deployed extensions, I see that OAuth and CentralAuth use this hook.

OAuth checks the request's Title object to avoid running on Special:OAuth itself (Special:OAuth needs to do special stuff). To be able to call UserLoadFromSession in Setup.php, we'd either have to change this check or create Title in Setup.php too, before the $wgExtensionFunctions hooks.

CentralAuth doesn't seem to directly do anything that would blow up if called from Setup.php. But it might call the AbortAutoAccount and AuthPluginAutoCreate hooks, which might have the same sort of expectations of being called after Setup.php as OAuth.

greg edited projects, added MediaWiki-Core-Team; removed platformeng.Dec 8 2014, 10:15 PM

• werdna unsubscribed.Dec 10 2014, 5:14 PM

Legoktm added a project: MediaWiki-Core-AuthManager.Feb 6 2015, 7:07 PM

Legoktm set Security to None.