Page MenuHomePhabricator

UserLogin with returnto doesn't preserve GET attributes
Closed, ResolvedPublic

Description

Here's an example:

I'm working on a private wiki that isn't readable to anonymous users. I make a change and send it to a collaborator:
http://xxx.yyy/wiki/index.php?title=Page&diff=3275&oldid=2643

My collaborator's login has expired so he gets the UserLogin page. Once he's logged in, he is redirected to "Page" but not to the diff information, because those arguments were thrown away when he got redirected to UserLogin.

This happens to links to special pages, etc. as well. It's probably a bit troublesome to fix, but should be possible.


Version: 1.16.x
Severity: normal

Details

Reference
bz24074

Event Timeline

bzimport raised the priority of this task from to Low.Nov 21 2014, 11:00 PM
bzimport set Reference to bz24074.
bzimport added a subscriber: Unknown Object (MLST).

I fixed this in trunk myself many months ago, and it works on Wikipedia.

The log in link at top right corner includes returntoquery parameter.

But the log in link in page content doesn't.

@Lee Worden: if this is not on a wiki-site from Wikimedia, but one of your own, make sure you're up2date.

Go to [[Special:Version]] on your private and report the versionumber after: MediaWiki:

The message being displayed: "You must log in to view other pages."

The "log in " does have returnto= but not returntoquery=

Also when on a page with a query and logging out there are two more links that don't have the returntoquery=.

Namelely the {[following]} two:

  1. = Log out =

You are now logged out.
You can continue to use SITENAME anonymously, or you can [{log in}] again.

  1. #pt-login [{Log in / create account}]

Yes, I have just updated and reconfirmed this behavior on a private wiki
running r68409 of http://svn.wikimedia.org/svnroot/mediawiki/trunk/phase3.
Special:Version reports '1.17alpha'.

I have been using the "log in" link in the page text, not the small one at the
upper right (Monobook skin).

Bryan.TongMinh wrote:

If this link is generated from the wiki text [[Special:UserLogin]] then it is not going to include the query string. It will simply go to Special:UserLogin as requested.

It's not generated from the wiki text [[Special:UserLogin]].

Even if it is, since it's in an interface message, we can change the wiki text to avoid using [[Special:UserLogin]] directly.

I believe the interface message for situation 1 described in my earlier comment is: "MediaWiki:Logouttext"

(See also: http://translatewiki.net/wiki/MediaWiki:Logouttext/en )

The link there could be replaces by $1 and the software would replace it with a link to Special:UserLogin preserving returnto and returntoquery.

I'm don't know exactly the origin of the link in situation 2 (the link in #pt-login) though.

(In reply to comment #8)

I'm don't know exactly the origin of the link in situation 2 (the link in
#pt-login) though.

The link in #pt-login doesn't have this bug.

in regards to mediawiki:logouttext

Personally it seems a little weird to preserve the query parameters in the "You have successfully logged out" message because if they hit the "log in again" button, they have now done something else, so once they have re-logged in the previous action they did was not the page with the query parameters we saved from two actions ago. But maybe that is just me.

The original bug seems to be referring to the message given on private wikis (Aka read restricted to logged in users) when you try to view a page not logged in. Specifically [[mediawiki:loginreqpagetext]] which is output by OutputPage::loginToUse. That should be straight forward to fix.

(In reply to comment #10)

in regards to mediawiki:logouttext

Personally it seems a little weird to preserve the query parameters in the "You
have successfully logged out" message

On second thought, I agree with you. Also because this could leak potential information.
Imagine someone is browsing stuff, when the user logs out I think it is a reasonable expectation that other then the browser-history (which is something that can be disabled) there are no obvious traces left of what one did. So that someone else can now login without directly knowing what the previous user did.

Login link to logouttext was added with bug 23222

loginreqpagetext has also a login link since the begin (r10379)

I think I fixed this for good a couple months ago with I43ceaddb.