MER-C/wiki-java

Using Mediawiki API after logon

SomeStrangeName opened this issue · 16 comments

Some Mediawiki configurations need a logon "before" API is available.
The current implementation of wiki-java seems to fetch some API URL "before" the login.

I guess it is the following user setting in LocaleSettings.php of mediawiki installation:

$wgGroupPermissions['*']['read'] = false;

If this is set a login is required before get any data.

This problem occurs in method:
public synchronized void login(String username, char[] password, boolean rateLimit) throws IOException, FailedLoginException

In line:
username = normalize(username);

Normalize will load some data from the API but will fail (because not logged in yet).
Removing this line would work but seems not correct.

Same with me! I have a "closed" wiki and can't get access, when
$wgGroupPermissions['*']['read'] = false;
is set! Is there a work around?

I also think I have this problem so any suggested approaches would be great.

Thanks for the changes!
I got the latest code via github, but login still fails. I debuged a little bit. Server-Response is:
"Fetching a token via action=login is deprecated."

So function public synchronized void login(String username, char[] password) //line 938
will never get into
if (line.contains("result="Success"")) //line 952
and throws AssertionError("Unreachable!"); //line 969

@MER-C unfortuantly you should open this issue again.

MER-C commented

Works for me (tested on test.wikipedia.org).

test.wikipedia.org is not a closed wiki! It's readable for users without login. Please try a wiki with
$wgGroupPermissions['*']['read'] = false;
in LocalSettings.php

MER-C commented

"Fetching a token via action=login is deprecated."
You shouldn't be getting this warning. The code doesn't do this.

What version of MediaWiki are you testing against?
Are you using [[Special:Botpasswords]]?

MW: 1.27.1
SMW: 2.4.1
Yes I use [[Special:Botpasswords]] and try to login with a bot password
Server-Response:

<?xml version="1.0"?><api><warnings><main xml:space="preserve">Unrecognized parameter: 'rawcontinue'</main><login xml:space="preserve">Fetching a token via action=login is deprecated. Use action=query&amp;meta=tokens&amp;type=login instead.</login></warnings><login result="NeedToken" token="1c0ed590fa6fa30e1bf01d1a2ea9bdfc59199f42+\" cookieprefix="MYWIKI-XXX" sessionid="c23n4e8k1p3k723gmj8j44ipn8k7dsqc" /></api><br />

So as i wrote above: if in line 952 will never be reached

MER-C commented

What is the contents of the POST request? Don't forget to blank out the password and fudge the token. I'm still not seeing why you're not getting a login token.

It's weird: username or login are not part of the post-request:
Debug-Info, calls only:
http://mywiki.com/api.php?format=xml&rawcontinue=1&maxlag=5&action=login

MER-C commented

I meant the contents of buffer.toString()

Sorry! Here I have token and password:
lgname=XX_BOT&lgpassword=XXX&lgtoken=99e083145226f0ee940f8320b1e99b5b5919ac70%2B%5C

//line 948:
makes the right post call, but the result String line contains in my case the deprecated warning

MER-C commented

Backing out this commit -> 7a5d3cb should work around the problem. I'm not changing git HEAD because this behavior is deprecated and, as I said, shouldn't be happening.

Sorry, still no login token when in LocalSettings.php is set:

$wgGroupPermissions['*']['read'] = false;

My Bot has no access

MER-C commented

See if the old login code still works ->

public synchronized void login(String username, char[] password, boolean rateLimit) throws IOException, FailedLoginException

Line 960 is the cause of the permission denied errors and should be removed.