Change Details

Upgraded from MW 1.29 to MW 1.31. AutoWikiBrowser, PyWikiBot, and mwclient are all affected by this. This also affects browsers, but requires rapid fire editing. The EditPage::POST_EDIT_COOKIE_KEY_PREFIX cookie is being set on every edit causing the cookie header to infinity grow. This affects bots the most since the bots do not follow the redirect to the view page to get the cookie cleared. This results in the cookie header being truncated which causes the bot to get logged out. One of our editors is also able to reproduce this behavior in Firefox and Chrome due to them making rapid edits along with not always loading the view page afterwards. The only reason this cookie appears to have been added was to selectively add the `mediawiki.action.view.postEdit` resource module to the page. Previously in MW 1.29 it was being added to every article view.

Upgraded from MW 1.29 to MW 1.31. AutoWikiBrowser, PyWikiBot, and mwclient are all affected by this. This also affects browsers, but requires rapid fire editing. The EditPage::POST_EDIT_COOKIE_KEY_PREFIX cookie is being set on every edit causing the cookie header to infinity grow. This affects bots the most since the bots do not follow the redirect to the view page to get the cookie cleared. This results in the cookie header being truncated which causes the bot to get logged out. One of our editors is also able to reproduce this behavior in Firefox and Chrome due to them making rapid edits along with not always loading the view page afterwards. The only reason this cookie appears to have been added was to selectively add the `mediawiki.action.view.postEdit` resource module to the page. Previously in MW 1.29 it was being added to every article view. This happens in both the web and API entry points. Reference: See EditPage::setPostEditCookie() where it creates the cookie key: `$postEditKey = self::POST_EDIT_COOKIE_KEY_PREFIX . $revisionId;`

Upgraded from MW 1.29 to MW 1.31. AutoWikiBrowser, PyWikiBot, and mwclient are all affected by this. This also affects browsers, but requires rapid fire editing. The EditPage::POST_EDIT_COOKIE_KEY_PREFIX cookie is being set on every edit causing the cookie header to infinity grow. This affects bots the most since the bots do not follow the redirect to the view page to get the cookie cleared. This results in the cookie header being truncated which causes the bot to get logged out. One of our editors is also able to reproduce this behavior in Firefox and Chrome due to them making rapid edits along with not always loading the view page afterwards. The only reason this cookie appears to have been added was to selectively add the `mediawiki.action.view.postEdit` resource module to the page. Previously in MW 1.29 it was being added to every article view. This happens in both the web and API entry points. Reference: See EditPage::setPostEditCookie() where it creates the cookie key: `$postEditKey = self::POST_EDIT_COOKIE_KEY_PREFIX . $revisionId;`