[Pywikipedia-bugs] [Maniphest] [Updated] T137805: API action=login is deprecated

[Dvorapa]

Dvorapa added a subtask: T248768: clientlogin seems to respond with badtoken 
instead of NeedToken or WrongToken; but site.tokens does not handle logintoken.

TASK DETAIL
  https://phabricator.wikimedia.org/T137805

EMAIL PREFERENCES
  https://phabricator.wikimedia.org/settings/panel/emailpreferences/

To: Dvorapa
Cc: zhuyifei1999, XZise, Paucabot, Zoranzoki21, Pablo-WMDE, Prod, Framawiki, 
Dvorapa, protonotarios, Hasenlaeufer, Masti, XXN, Jnanaranjan_sahu, Anomie, 
MBH, Huji, Glavkos, Vladis13, MZMcBride, DrTrigon, Aschroet, MarcoAurelio, 
Jogo.obb, valhallasw, jayvdb, Aklapper, Zppix, Xqt, pywikibot-bugs-list, 
Zkhalido, Viztor, Wenyi, Tbscho, MayS, Mdupont, JJMC89, Altostratus, 
Avicennasis, mys_721tx, Alchimista, Rxy
___
pywikibot-bugs mailing list
pywikibot-bugs@lists.wikimedia.org
https://lists.wikimedia.org/mailman/listinfo/pywikibot-bugs

[Pywikipedia-bugs] [Maniphest] [Updated] T137805: API action=login is deprecated

[Maintenance_bot]

Maintenance_bot removed a project: Patch-For-Review.

TASK DETAIL
  https://phabricator.wikimedia.org/T137805

EMAIL PREFERENCES
  https://phabricator.wikimedia.org/settings/panel/emailpreferences/

To: Dvorapa, Maintenance_bot
Cc: zhuyifei1999, XZise, Paucabot, Zoranzoki21, Pablo-WMDE, Prod, Framawiki, 
Dvorapa, protonotarios, Hasenlaeufer, Masti, XXN, Jnanaranjan_sahu, Anomie, 
MBH, Huji, Glavkos, Vladis13, MZMcBride, DrTrigon, Aschroet, MarcoAurelio, 
Jogo.obb, valhallasw, jayvdb, Aklapper, Zppix, Xqt, pywikibot-bugs-list, 
Zkhalido, Viztor, Wenyi, Tbscho, MayS, Mdupont, JJMC89, Altostratus, 
Avicennasis, mys_721tx, Alchimista, Rxy, Oblanco79, Alter-paule, Beast1978, 
Un1tY, Hook696, Daryl-TTMG, RomaAmorRoma, E.S.A-Sheild, Kent7301, Meekrab2012, 
joker88john, CucyNoiD, NebulousIris, Gaboe420, Versusxo, Majesticalreaper22, 
Giuliamocci, Adrian1985, Cpaulf30, Af420, Darkminds3113, Bsandipan, Lordiis, 
Adik2382, Th3d3v1ls, Ramalepe, Liugev6, WSH1906, Lewizho99, Maathavan
___
pywikibot-bugs mailing list
pywikibot-bugs@lists.wikimedia.org
https://lists.wikimedia.org/mailman/listinfo/pywikibot-bugs

[Pywikipedia-bugs] [Maniphest] [Updated] T137805: API action=login is deprecated

[gerritbot]

gerritbot added a project: Patch-For-Review.

TASK DETAIL
  https://phabricator.wikimedia.org/T137805

EMAIL PREFERENCES
  https://phabricator.wikimedia.org/settings/panel/emailpreferences/

To: Dvorapa, gerritbot
Cc: zhuyifei1999, XZise, Paucabot, Zoranzoki21, Pablo-WMDE, Prod, Framawiki, 
Dvorapa, protonotarios, Hasenlaeufer, Masti, XXN, Jnanaranjan_sahu, Anomie, 
MBH, Huji, Glavkos, Vladis13, MZMcBride, DrTrigon, Aschroet, MarcoAurelio, 
Jogo.obb, valhallasw, jayvdb, Aklapper, Zppix, Xqt, pywikibot-bugs-list, 
Oblanco79, Alter-paule, Beast1978, Un1tY, Zkhalido, Hook696, Daryl-TTMG, 
RomaAmorRoma, E.S.A-Sheild, Kent7301, Meekrab2012, joker88john, Viztor, 
CucyNoiD, NebulousIris, Wenyi, Gaboe420, Versusxo, Majesticalreaper22, 
Giuliamocci, Adrian1985, Cpaulf30, Af420, Darkminds3113, Bsandipan, Lordiis, 
Adik2382, Th3d3v1ls, Ramalepe, Liugev6, Tbscho, MayS, WSH1906, Lewizho99, 
Mdupont, JJMC89, Maathavan, Altostratus, Avicennasis, mys_721tx, Alchimista, Rxy
___
pywikibot-bugs mailing list
pywikibot-bugs@lists.wikimedia.org
https://lists.wikimedia.org/mailman/listinfo/pywikibot-bugs

[Pywikipedia-bugs] [Maniphest] [Updated] T137805: API action=login is deprecated

[Dvorapa]

Dvorapa added a comment.


  I think T137805  and T224712 
 are the same issue. Tests fail 
randomly, but somehow en:wsbeta fails **always**.

TASK DETAIL
  https://phabricator.wikimedia.org/T137805

EMAIL PREFERENCES
  https://phabricator.wikimedia.org/settings/panel/emailpreferences/

To: Dvorapa
Cc: zhuyifei1999, XZise, Paucabot, Zoranzoki21, Pablo-WMDE, Prod, Framawiki, 
Dvorapa, protonotarios, Hasenlaeufer, Masti, XXN, Jnanaranjan_sahu, Anomie, 
MBH, Huji, Glavkos, Vladis13, MZMcBride, DrTrigon, Aschroet, MarcoAurelio, 
Jogo.obb, valhallasw, jayvdb, Aklapper, Zppix, Xqt, pywikibot-bugs-list, 
Zkhalido, Viztor, Wenyi, Tbscho, MayS, Mdupont, JJMC89, Altostratus, 
Avicennasis, mys_721tx, Alchimista, Rxy
___
pywikibot-bugs mailing list
pywikibot-bugs@lists.wikimedia.org
https://lists.wikimedia.org/mailman/listinfo/pywikibot-bugs

[Pywikipedia-bugs] [Maniphest] [Updated] T137805: API action=login is deprecated

[Xqt]

Xqt added a subtask: T224712: Attempt to login fails several times.

TASK DETAIL
  https://phabricator.wikimedia.org/T137805

EMAIL PREFERENCES
  https://phabricator.wikimedia.org/settings/panel/emailpreferences/

To: Xqt
Cc: zhuyifei1999, XZise, Paucabot, Zoranzoki21, Pablo-WMDE, Prod, Framawiki, 
Dvorapa, protonotarios, Hasenlaeufer, Masti, XXN, Jnanaranjan_sahu, Anomie, 
MaxBioHazard, Huji, Glavkos, Vladis13, MZMcBride, DrTrigon, Aschroet, 
MarcoAurelio, Jogo.obb, valhallasw, jayvdb, Aklapper, Zppix, Xqt, 
pywikibot-bugs-list, Viztor, DannyS712, Wenyi, Tbscho, MayS, Mdupont, JJMC89, 
Altostratus, Avicennasis, mys_721tx, Alchimista, Rxy
___
pywikibot-bugs mailing list
pywikibot-bugs@lists.wikimedia.org
https://lists.wikimedia.org/mailman/listinfo/pywikibot-bugs

[Pywikipedia-bugs] [Maniphest] [Updated] T137805: API action=login is deprecated

[Xqt]

Xqt added a parent task: T225591: Make Travis and Appveyor pass again.

TASK DETAIL
  https://phabricator.wikimedia.org/T137805

EMAIL PREFERENCES
  https://phabricator.wikimedia.org/settings/panel/emailpreferences/

To: Xqt
Cc: zhuyifei1999, XZise, Paucabot, Zoranzoki21, Pablo-WMDE, Prod, Framawiki, 
Dvorapa, protonotarios, Hasenlaeufer, Masti, XXN, Jnanaranjan_sahu, Anomie, 
MaxBioHazard, Huji, Glavkos, Vladis13, MZMcBride, DrTrigon, Aschroet, 
MarcoAurelio, Jogo.obb, valhallasw, jayvdb, Aklapper, Zppix, Xqt, 
pywikibot-bugs-list, Viztor, DannyS712, Wenyi, Tbscho, MayS, Mdupont, JJMC89, 
Altostratus, Avicennasis, mys_721tx, Alchimista, Rxy
___
pywikibot-bugs mailing list
pywikibot-bugs@lists.wikimedia.org
https://lists.wikimedia.org/mailman/listinfo/pywikibot-bugs

[Pywikipedia-bugs] [Maniphest] [Updated] T137805: API action=login is deprecated

[Dvorapa]

Dvorapa added a comment.


  In T137805#5225757 , @Xqt 
wrote:
  
  > - the botpasswords file does only contain tuples for different users but 
not for different sites
  
  
  We can fix this in several ways:
  
  - add a possibility to store different sites in botpasswords file
  - create multiple environment variables like `PYWIKIBOT_BOTPASSWD_WIKI`, 
`PYWIKIBOT_BOTPASSWD_BETA`, `PYWIKIBOT_BOTPASSWD_MB` and update .travis.yml to 
use the one it needs ...
  
  In T143905#3223779 , 
@Framawiki wrote:
  
  > - what about same username on different wiki farms ?
  
  
  
  
  In T137805#5225757 , @Xqt 
wrote:
  
  > - botpasswords are in plain text
  
  
  It has permissions so only the author can view the file, but I'm not sure, 
how cross-platform this thing is

TASK DETAIL
  https://phabricator.wikimedia.org/T137805

EMAIL PREFERENCES
  https://phabricator.wikimedia.org/settings/panel/emailpreferences/

To: Dvorapa
Cc: Paucabot, Zoranzoki21, Pablo-WMDE, Prod, Framawiki, Dvorapa, protonotarios, 
Hasenlaeufer, Masti, XXN, Jnanaranjan_sahu, Anomie, MaxBioHazard, Huji, 
Glavkos, Vladis13, MZMcBride, DrTrigon, Aschroet, MarcoAurelio, Jogo.obb, 
valhallasw, jayvdb, Aklapper, Zppix, Xqt, pywikibot-bugs-list, Viztor, 
DannyS712, Wenyi, Tbscho, MayS, Mdupont, JJMC89, Avicennasis, mys_721tx, 
Alchimista, Rxy
___
pywikibot-bugs mailing list
pywikibot-bugs@lists.wikimedia.org
https://lists.wikimedia.org/mailman/listinfo/pywikibot-bugs

[Pywikipedia-bugs] [Maniphest] [Updated] T137805: API action=login is deprecated

[Xqt]

Xqt added a project: Pywikibot-tests.
Xqt added a comment.


  Now we have a lot of tests failing due to this issue

TASK DETAIL
  https://phabricator.wikimedia.org/T137805

EMAIL PREFERENCES
  https://phabricator.wikimedia.org/settings/panel/emailpreferences/

To: Xqt
Cc: Paucabot, Zoranzoki21, Pablo-WMDE, Prod, Framawiki, Dvorapa, protonotarios, 
Hasenlaeufer, Masti, XXN, Jnanaranjan_sahu, Anomie, MaxBioHazard, Huji, 
Glavkos, Vladis13, MZMcBride, DrTrigon, Udo_T, Aschroet, MarcoAurelio, 
Jogo.obb, valhallasw, jayvdb, Aklapper, Zppix, Xqt, pywikibot-bugs-list, 
Viztor, DannyS712, Wenyi, Tbscho, MayS, Mdupont, JJMC89, Avicennasis, 
mys_721tx, Alchimista, Rxy
___
pywikibot-bugs mailing list
pywikibot-bugs@lists.wikimedia.org
https://lists.wikimedia.org/mailman/listinfo/pywikibot-bugs

[Pywikipedia-bugs] [Maniphest] [Updated] T137805: API action=login is deprecated

[Dvorapa]

Dvorapa added a parent task: T178061: Reduce API warning clutter in login.py after clean installation.
TASK DETAILhttps://phabricator.wikimedia.org/T137805EMAIL PREFERENCEShttps://phabricator.wikimedia.org/settings/panel/emailpreferences/To: DvorapaCc: Dvorapa, protonotarios, Hasenlaeufer, Masti, XXN, Jnanaranjan_sahu, Anomie, MaxBioHazard, Huji, Glavkos, Vladis13, MZMcBride, DrTrigon, Udo_T, Aschroet, MarcoAurelio, Jogo.obb, valhallasw, jayvdb, Aklapper, Zppix, Xqt, pywikibot-bugs-list, Magul, Tbscho, MayS, Mdupont, JJMC89, Avicennasis, Dalba, Alchimista, Rxy___
pywikibot-bugs mailing list
pywikibot-bugs@lists.wikimedia.org
https://lists.wikimedia.org/mailman/listinfo/pywikibot-bugs

[Pywikipedia-bugs] [Maniphest] [Updated] T137805: API action=login is deprecated

[Dvorapa]

Dvorapa added a project: Pywikibot-core.
TASK DETAILhttps://phabricator.wikimedia.org/T137805EMAIL PREFERENCEShttps://phabricator.wikimedia.org/settings/panel/emailpreferences/To: DvorapaCc: Dvorapa, protonotarios, Hasenlaeufer, Masti, XXN, Jnanaranjan_sahu, Anomie, MaxBioHazard, Huji, Glavkos, Vladis13, MZMcBride, DrTrigon, Udo_T, Aschroet, MarcoAurelio, Jogo.obb, valhallasw, jayvdb, Aklapper, Zppix, Xqt, pywikibot-bugs-list, Magul, Tbscho, MayS, Mdupont, JJMC89, Avicennasis, Dalba, Alchimista, Rxy___
pywikibot-bugs mailing list
pywikibot-bugs@lists.wikimedia.org
https://lists.wikimedia.org/mailman/listinfo/pywikibot-bugs

[Pywikipedia-bugs] [Maniphest] [Updated] T137805: API action=login is deprecated

[Huji]

Huji removed projects: Pywikibot-General, Pywikibot-core.
TASK DETAILhttps://phabricator.wikimedia.org/T137805EMAIL PREFERENCEShttps://phabricator.wikimedia.org/settings/panel/emailpreferences/To: HujiCc: Hasenlaeufer, Masti, XXN, Jnanaranjan_sahu, Anomie, MaxBioHazard, Huji, Glavkos, Vladis13, MZMcBride, DrTrigon, Udo_T, Aschroet, MarcoAurelio, Jogo.obb, valhallasw, jayvdb, Aklapper, Zppix, Xqt, pywikibot-bugs-list___
pywikibot-bugs mailing list
pywikibot-bugs@lists.wikimedia.org
https://lists.wikimedia.org/mailman/listinfo/pywikibot-bugs

[Pywikipedia-bugs] [Maniphest] [Updated] T137805: API action=login is deprecated

[Anomie]

Anomie added a comment.

In T137805#2778915, @MaxBioHazard wrote:
When the old login method will be turned off?


There are currently no plans to turn it off. However, if something makes the "main account" login process require anything beyond the submission of a username and password field, action="" will just fail. That's why it's deprecated outside of use with BotPasswords, which themselves were created specifically so there would be a way for action="" to reliably keep working for bots instead of requiring that all bots convert to using OAuth.

For example, if your password needs to be reset, Special:UserLogin will return a second page asking you to change your password before actually logging you in and action="" will return a response with a similar request, while action="" will just fail.

For another example, if you enable two-factor authentication[1] on the bot's account, Special:UserLogin will return a second page asking for the second factor and action="" will return a response with a similar request, while action="" will just fail.

For still another example, if failed login attempts from your IP cause a captcha to be displayed on Special:UserLogin, the process for using action="" will signal that and will indicate how to submit the captcha answer, while action="" will not be able to signal it and attempting to log in will just fail because no captcha answer can be supplied.

[1] 2FA is technically deployed already, but needs a special user right to be able to turn it on. I guess a wider deployment is stuck on T100375 and its subtasks.


In T137805#2754035, @Xqt wrote:
There is another message coming in front of that above:

WARNING: API warning (login): Fetching a token via action="" is deprecated. Use action="" instead.


That's an unrelated warning.


Long ago, you could log in with action="" by just providing a username and password.
Then it was realized this was a CSRF vulnerability, so now you have to provide a username, password, and a CSRF token to be able to log in. The only way to get this token was to hit action="" without providing a token, in which case you'd get a NeedToken response with the necessary token.
Some time later, all token fetching was consolidated into action="" and other methods of fetching a token were deprecated.


Again, there are no plans to actually remove the ability to fetch the login token by hitting action="" and getting a NeedToken response any time soon. Someday it might be removed, if the logs behind Special:ApiFeatureUsage indicate that reasonably close to no one is hitting this warning anymore. But it has been hit 85914 times just in the past 24 hours, so that day doesn't seem like it'll be coming any time soon.TASK DETAILhttps://phabricator.wikimedia.org/T137805EMAIL PREFERENCEShttps://phabricator.wikimedia.org/settings/panel/emailpreferences/To: AnomieCc: Anomie, MaxBioHazard, Huji, Glavkos, Vladis13, MZMcBride, DrTrigon, Udo_T, Aschroet, MarcoAurelio, Jogo.obb, valhallasw, jayvdb, Aklapper, Zppix, Xqt, pywikibot-bugs-list, MayS, Mdupont, JJMC89, Alchimista, Rxy___
pywikibot-bugs mailing list
pywikibot-bugs@lists.wikimedia.org
https://lists.wikimedia.org/mailman/listinfo/pywikibot-bugs

[Pywikipedia-bugs] [Maniphest] [Updated] T137805: API action=login is deprecated

[Huji]

Huji added a subscriber: Anomie.Huji added a comment.
@MaxBioHazard I am not sure. It was marked as "deprecated" in response to T110276 in rMW54d58ef50665 and I think @Anomie might be able to answer your question best.TASK DETAILhttps://phabricator.wikimedia.org/T137805EMAIL PREFERENCEShttps://phabricator.wikimedia.org/settings/panel/emailpreferences/To: HujiCc: Anomie, MaxBioHazard, Huji, Glavkos, Vladis13, MZMcBride, DrTrigon, Udo_T, Aschroet, MarcoAurelio, Jogo.obb, valhallasw, jayvdb, Aklapper, Zppix, Xqt, pywikibot-bugs-list, MayS, Mdupont, JJMC89, Alchimista, Rxy___
pywikibot-bugs mailing list
pywikibot-bugs@lists.wikimedia.org
https://lists.wikimedia.org/mailman/listinfo/pywikibot-bugs

[Pywikipedia-bugs] [Maniphest] [Updated] T137805: API action=login is deprecated

[jayvdb]

jayvdb added a subtask: T142155: Bot can't login. keyError in GetCookie.
TASK DETAILhttps://phabricator.wikimedia.org/T137805EMAIL PREFERENCEShttps://phabricator.wikimedia.org/settings/panel/emailpreferences/To: jayvdbCc: Aschroet, MarcoAurelio, Jogo.obb, valhallasw, jayvdb, Aklapper, Zppix, Xqt, pywikibot-bugs-list, Mdupont___
pywikibot-bugs mailing list
pywikibot-bugs@lists.wikimedia.org
https://lists.wikimedia.org/mailman/listinfo/pywikibot-bugs