Page MenuHomePhabricator

detect write api actions
Open, MediumPublic

Description

(Cloned from T57068#602805)

pywikibot api.py has a hard-coded list of 'write' actions, which cause it to assert the user is logged

This should be converted to a detection algorithm (using API action paraminfo)

Details

Event Timeline

bzimport raised the priority of this task from to Needs Triage.Nov 22 2014, 3:47 AM
bzimport set Reference to bz72207.
bzimport added a subscriber: Unknown Object (????).
jayvdb created this task.Oct 18 2014, 7:23 AM

Ideally, a persistent cache should be set up to remember the 'paraminfo' data.

For example, the "writerights" property would enable assertion, while "tokentype" would help guessing the required token type automatically.

E.g.:
https://www.mediawiki.org/w/api.php?action=paraminfo&modules=thank

Ideally, a persistent cache should be set up to remember the 'paraminfo' data.

For example, the "writerights" property would enable assertion, while "tokentype" would help guessing the required token type automatically.

E.g.:
https://www.mediawiki.org/w/api.php?action=paraminfo&modules=thank

We now have a per-site persistent cache - the ParamInfo class, in site._paraminfo.

http://git.wikimedia.org/blob/pywikibot%2Fcore.git/b10b03cf76ca4a4aa35edf67728d5082f2e63e62/pywikibot%2Fdata%2Fapi.py#L128

As ParamInfo uses Request, a little dancing is needed soas to not cause cyclic recursion during bootstrap. One approach is for Request to hard-code that 'paraminfo' is not a write operation, so it doesnt ask ParamInfo if it is a write operation.

jayvdb moved this task from Backlog to Needs Review on the Pywikibot board.Nov 29 2014, 7:26 AM
jayvdb edited subscribers, added: Aklapper; removed: Unknown Object (????).
XZise added a subscriber: XZise.EditedJan 7 2015, 3:35 PM

Regarding the dancing: ParamInfo explicitly says that it wants to use HTTP GET so that Request doesn't look into the ParamInfo whether paraminfo requires HTTP POST. So it could do it similarly.

In theory that is already possible, as the definition whether a request is writing is saved in the Request instance as a boolean which could be changed after creation of the Request and before submitting it.

Change 198485 had a related patch set uploaded (by XZise):
[FEAT] Request: Dynamically determine write

https://gerrit.wikimedia.org/r/198485

XZise claimed this task.Apr 3 2015, 9:53 PM

What about shipping a 'fake' JSON paraminfo for use with old MediaWikis?
That way we wouldn't have to maintain separate fallback techniques here and there, also for T78393, etc.

Replying to posts via Flow can be considered a write action but with the implementation of 3dcdc191 and fd9c7fd2 (via Pywikibot-Flow) -simulate won't block these writes.

Peter601980 renamed this task from detect write api actions to jh.Dec 28 2015, 8:43 AM
Peter601980 removed XZise as the assignee of this task.
Peter601980 updated the task description. (Show Details)
Peter601980 set Security to None.
Restricted Application added a subscriber: StudiesWorld. · View Herald TranscriptDec 28 2015, 8:43 AM
Aklapper renamed this task from jh to detect write api actions.Dec 28 2015, 9:14 AM
Aklapper assigned this task to XZise.
Aklapper updated the task description. (Show Details)
Xqt triaged this task as Medium priority.Oct 30 2016, 11:43 AM
Xqt updated the task description. (Show Details)Jul 5 2017, 12:01 PM

@XZise: Hi! This task has been assigned to you a while ago. Could you maybe share an update? Do you still plan to work on this task?
If you do not plan to work on this task anymore: Please consider removing yourself as assignee (via Add Action...Assign / Claim in the dropdown menu): That would allow others to work on this (in theory), as others won't think that someone is already working on this. Thanks! :)

XZise removed XZise as the assignee of this task.Nov 5 2020, 6:24 PM