Page MenuHomePhabricator

Implement Security support for OAuth
Closed, DuplicatePublic

Description

Pywikibot is a collection of tools that automate work on MediaWiki sites. if in case if someone use a stolen password is someone logging in and changing e-mail address, password etc. to lock the user out of their own account.

With OAuth, only a token needs to be stored in the shared environment, and in worst case scenario someone can make a few edits with the token, but it can be revoked at any time, and the malicious user can not lock out the rightful user.

This task is to implement OAuth support in pywikibot. To complete this task, a unit test should be added to the test suite to perform a login and logout using OAuth with assertions that verify APISite._userinfo is correct, and a second unit test should login, edit a userpage, and confirm the edit was performed using the OAuth-authenticated account. The unit test should be configured to run on travis-ci when the secret key is available in the Travis configuration, and skipped when it isnt, able to use the key and secret that you receive when you complete the registration, as long as you approve it using the same mediawiki.org user that you used to register the application.

Related Objects

Event Timeline