Change Details

Per this blog post about Commons' mobile app, it should be possible to allow users that use 2FA to login normally (without BotPassword) by adding a field to the login form to enter the code. https://addshore.com/2017/05/wikimedia-commons-android-app-pre-hackathon/ https://github.com/commons-app/apps-android-commons/blob/e3ef7002d5d77c1e8cd98c2a72bbc38c8959c276/app/src/main/java/fr/free/nrw/commons/auth/LoginTask.java#L117 https://github.com/commons-app/apps-android-commons/blob/b0e8175003a686789474238dd293aa89d1e925c7/app/src/main/java/fr/free/nrw/commons/mwapi/ApacheHttpClientMediaWikiApi.java#L93 ```lang=java api.action("clientlogin") .param("rememberMe", "1") .param("username", username) .param("password", password) .param("logintoken", getLoginToken()) .param("logincontinue", "1") .param("OATHToken", twoFactorCode) .post() ```

Per this blog post about Commons' mobile app, it should be possible to allow users that use 2FA to login normally (without BotPassword) by adding a field to the login form to enter the code. https://addshore.com/2017/05/wikimedia-commons-android-app-pre-hackathon/ https://github.com/commons-app/apps-android-commons/blob/e3ef7002d5d77c1e8cd98c2a72bbc38c8959c276/app/src/main/java/fr/free/nrw/commons/auth/LoginTask.java#L117 https://github.com/commons-app/apps-android-commons/blob/b0e8175003a686789474238dd293aa89d1e925c7/app/src/main/java/fr/free/nrw/commons/mwapi/ApacheHttpClientMediaWikiApi.java#L93 ```lang=java api.action("clientlogin") .param("rememberMe", "1") .param("username", username) .param("password", password) .param("logintoken", getLoginToken()) .param("logincontinue", "1") .param("OATHToken", twoFactorCode) .post() ``` Diagram of how it should work ``` +----------------------+ +---------------------------+ |Bot login is requested| |Classic login is requested | +-----------+----------+ +--------------+------------+ | | | | | v +-------------v-------------+ Nope |* Check if username conform| ????????????????????????? +-------+ (it has @suffix) | | +-------------+-------------+ | | | | Yes | | | | | +-------------v------------------+ | |* Login using standard API query| | | action=login | | +-----+--------------------+-----+ | | | | | | | +------v-----+ +-----v-----------------------+ | |Query failed| |Query is successfuly finished| | +------+-----+ +---------------------------+-+ | | | | | | | | | | | | | | | | | | | | | | +------v----------------------------+ | +-----------------------+ +------>Show error to user with explanation| +--->Login successful. | |on what's wrong | | | +-----------------------------------+ +-----------------------+ ```

Per this blog post about Commons' mobile app, it should be possible to allow users that use 2FA to login normally (without BotPassword) by adding a field to the login form to enter the code. https://addshore.com/2017/05/wikimedia-commons-android-app-pre-hackathon/ https://github.com/commons-app/apps-android-commons/blob/e3ef7002d5d77c1e8cd98c2a72bbc38c8959c276/app/src/main/java/fr/free/nrw/commons/auth/LoginTask.java#L117 https://github.com/commons-app/apps-android-commons/blob/b0e8175003a686789474238dd293aa89d1e925c7/app/src/main/java/fr/free/nrw/commons/mwapi/ApacheHttpClientMediaWikiApi.java#L93 ```lang=java api.action("clientlogin") .param("rememberMe", "1") .param("username", username) .param("password", password) .param("logintoken", getLoginToken()) .param("logincontinue", "1") .param("OATHToken", twoFactorCode) .post() ``` Diagram of how it should work ``` +----------------------+ +---------------------------+ |Bot login is requested| |Classic login is requested | +-----------+----------+ +--------------+------------+ | | | | | v +-------------v-------------+ Nope |* Check if username conform| ????????????????????????? +-------+ (it has @suffix) | | +-------------+-------------+ | | | | Yes | | | | | +-------------v------------------+ | |* Login using standard API query| | | action=login | | +-----+--------------------+-----+ | | | | | | | +------v-----+ +-----v-----------------------+ | |Query failed| |Query is successfuly finished| | +------+-----+ +---------------------------+-+ | | | | | | | | | | | | | | | | | | | | | | +------v----------------------------+ | +-----------------------+ +------>Show error to user with explanation| +--->Login successful. | |on what's wrong | | | +-----------------------------------+ +-----------------------+ ```