Page MenuHomePhabricator

Login with the required password change doesn't log me in globally
Closed, ResolvedPublic

Description

In the recent user data leaking issue, we forced users to change password on login. After password is changed, the user is logged locally (and also project-wise, eg, for other wikipedia sites) automatically, but not logged in on another project.


Version: unspecified
Severity: normal

Details

Reference
bz54914

Event Timeline

bzimport raised the priority of this task from to High.Nov 22 2014, 2:36 AM
bzimport set Reference to bz54914.
bzimport added a subscriber: Unknown Object (MLST).

Logins using temporary password ("Reset your password" feature) are also affected.

I saw this last night. You're actually logged in as your SUL user (as you noted, but being logged into other wikipedia.org subdomains), but we don't do the redirect through loginwiki since the normal login hooks aren't called, so you won't be logged into the other projects.

I'm planning to rework the patches we put in for this particular incident, which will do the full SUL2 handshake after the login finishes.

(In reply to comment #2 by csteipp)

I'm planning to rework the patches we put in for this particular incident,
which will do the full SUL2 handshake after the login finishes.

csteipp: Any vague timeframe (if this is still the plan)?

Platform has let me schedule some password work this quarter, which this falls under. So March-ish is a good target.

(In reply to Chris Steipp from comment #4)

Platform has let me schedule some password work this quarter, which this
falls under. So March-ish is a good target.

Chris: How did reality bite, and any new approx. timeframe? :)

I haven't been able to get to it yet

A user reported this recently. Apparently he's using a temporary password, as he doesn't know neither his current, nor his old passwords. It stays saved in his browser, so he's able to log into Wikipedia, but the problem is he cannot log into any other project, like Wikidata or Commons. He also says that the system randomly logs him out on Wikipedia too. Is there a way to fix this issue as per user, so that he can keep working like usual, until this entire problem is resolved?

Tgr claimed this task.
Tgr subscribed.

Please reopen if this is still an issue, but I'm pretty sure it was fixed by AuthManager - other parts of the login stack, such as CentralAuth, now don't know whether there was a password change step.