Page MenuHomePhabricator

Redirect to HTTPS for account creation
Closed, ResolvedPublic

Description

Now the HTTP login page redirects to the HTTPS version, but for some reason creating an account is exempt.

Is there any reason to allow the login details to be sent in cleartext even once?

What I expect: [1] should redirect to [2]

[1] http://en.wiktionary.org/w/index.php?title=Special:UserLogin&returnto=Wiktionary%3AMain+Page&type=signup

[2] https://en.wiktionary.org/w/index.php?title=Special:UserLogin&returnto=Wiktionary%3AMain+Page&type=signup


Version: wmf-deployment
Severity: normal

Details

Reference
bz53651

Event Timeline

bzimport raised the priority of this task from to Unbreak Now!.Nov 22 2014, 2:11 AM
bzimport added a project: HTTPS.
bzimport set Reference to bz53651.
Skalman created this task.Sep 1 2013, 11:26 AM

Not only for Wiktionary, there are lots of signup pages which should redirect to https. For instance,

http://en.wikipedia.org/w/index.php?title=Special:UserLogin&returnto=Main+Page

should redirect to

https://en.wikipedia.org/w/index.php?title=Special:UserLogin&returnto=Main+Page

But currently it doesn't redirect.

(In reply to comment #1)
Sorry, I meant:

http://en.wikipedia.org/w/index.php?title=Special:UserLogin&returnto=Main+Page&type=signup

and

https://en.wikipedia.org/w/index.php?title=Special:UserLogin&returnto=Main+Page&type=signup

(In the original post, the link points to the login page rather than the signup page.)

greg added a comment.Sep 9 2013, 4:47 PM

Confirmed on enwiki. Re-prioritizing.

I have vague memories of doing that for a reason, but I can't seem to find it right now. Git blame points to Tyler for the $this->mType !== 'signup' in the code. Tyler, do you remember why signup was excluded there?

I can't seem to recall why I put that condition there. I don't think there was a reason. The commit this condition was added on was way back in 565014a8, when I originally fixed $wgSecureLogin functionality (because before that the feature was completely broken and didn't work). It should be safe to just take that out of the if() statement.

csteipp: Any news here, after Tyler's reply?