Page MenuHomePhabricator

wmgHTTPSBlacklistCountries changes for CN
Closed, DeclinedPublic

Description

It was reported by users that HTTPS block in China was only for Wikipedia, thus the following change is proposed, given the current policy of having the best security while trying to keep access for logged-in users in China.

'wmgHTTPSBlacklistCountries' => array(
'default' => array(

		'IR', // Iran

),
'wikipedia' => array(

		'CN', // China
		'IR', // Iran

),
),


Version: wmf-deployment
Severity: normal
See Also:
T54846: HTTPS only Wikimedia problem for Iran Language related Wikipedias
T66207: Re-test https access fom China (PRC)

Details

Reference
bz53739

Event Timeline

bzimport raised the priority of this task from to Medium.Nov 22 2014, 1:48 AM
bzimport added a project: HTTPS.
bzimport set Reference to bz53739.
bzimport added a subscriber: Unknown Object (MLST).

(In reply to comment #0)

It was reported by users that HTTPS block in China was only for Wikipedia

Any URL (if that question makes sense & does not create problems for anybody)?

(In reply to comment #1)

(In reply to comment #0)

It was reported by users that HTTPS block in China was only for Wikipedia

Any URL (if that question makes sense & does not create problems for
anybody)?

Hmm... it's even blocked in the other way for some other sites:

https://zh.greatfire.org/zh.wikisource.org (blocked)
https://zh.greatfire.org/https/zh.wikisource.org (not blocked)

(In reply to comment #2)

(In reply to comment #1)

(In reply to comment #0)

It was reported by users that HTTPS block in China was only for Wikipedia

Any URL (if that question makes sense & does not create problems for
anybody)?

Hmm... it's even blocked in the other way for some other sites:

https://zh.greatfire.org/zh.wikisource.org (blocked)
https://zh.greatfire.org/https/zh.wikisource.org (not blocked)

I guess I'd better provide English links:

https://en.greatfire.org/zh.wikisource.org (blocked)
https://en.greatfire.org/https/zh.wikisource.org (not blocked)

Liangent: Willing to come up with a patch?

'wmgHTTPSBlacklistCountries' => array(

'default' => array(
    'IR', // Iran
),
'+wikipedia' => array(
    'IR', // Iran
),

),

^ I guess that's the patch...

Change 84781 had a related patch set uploaded by Reedy:
wmgHTTPSBlacklistCountries changes for CN

https://gerrit.wikimedia.org/r/84781

Change 84781 merged by jenkins-bot:
wmgHTTPSBlacklistCountries changes for CN

https://gerrit.wikimedia.org/r/84781

(In reply to comment #7)

Change 84781 merged by jenkins-bot:
wmgHTTPSBlacklistCountries changes for CN

https://gerrit.wikimedia.org/r/84781

Is this correctly patched & deployed?

It seems zhwikibooks behaves correctly but wikidatawiki and commonswiki don't. It seems we should use 'wikipedia' instead of 'wiki' or it might be a suffix match.

Liangent: Situation is still as described in comment 8?

Liangent: Situation is still as described in comment 8?

(In reply to comment #10)

Liangent: Situation is still as described in comment 8?

OK but it's reported by users that HTTPS is not blocked at all now...

Liangent: Did your "OK" mean "Yes" or "Oh well"? :)

(In reply to Andre Klapper from comment #12)

Liangent: Did your "OK" mean "Yes" or "Oh well"? :)

I can't check it now but per user reports, the current situation is that:

  • Desktop sites: no block at all
  • Mobile sites: all projects are blocked

... and this can't be described with our configuration array. :/

Should we still be playing this cat & mouse game?

Aklapper set Security to None.
Aklapper lowered the priority of this task from Medium to Low.Mar 9 2015, 2:22 PM
Aklapper updated the task description. (Show Details)
BBlack claimed this task.
BBlack subscribed.

wmgHTTPSBlacklistCountries is effectively obsolete at this point due to the conversion of everything to HTTPS.

Legoktm changed the task status from Resolved to Declined.Jun 16 2015, 7:48 PM
Legoktm subscribed.