Last modified: 2014-01-10 18:26:05 UTC

Wikimedia Bugzilla is closed!

Wikimedia migrated from Bugzilla to Phabricator. Bug reports are handled in Wikimedia Phabricator.
This static website is read-only and for historical purposes. It is not possible to log in and except for displaying bug reports and their history, links might be broken. See T50371, the corresponding Phabricator task for complete and up-to-date bug report information.
Bug 48371 - RequestContext::importScopedSession doesn't work with suhosin.session.encrypt = on
RequestContext::importScopedSession doesn't work with suhosin.session.encrypt...
Status: NEW
Product: MediaWiki
Classification: Unclassified
General/Unknown (Other open bugs)
1.22.0
All All
: Normal normal (vote)
: ---
Assigned To: Nobody - You can work on this!
:
Depends on:
Blocks: chunked-upload
  Show dependency treegraph
 
Reported: 2013-05-12 07:48 UTC by Bawolff (Brian Wolff)
Modified: 2014-01-10 18:26 UTC (History)
2 users (show)

See Also:
Web browser: ---
Mobile Platform: ---
Assignee Huggle Beta Tester: ---


Attachments

Description Bawolff (Brian Wolff) 2013-05-12 07:48:25 UTC
ImportSession doesnt seem to actually import the session data if using native php session support. Furthermore, in that case it seems to delete the existing session, changing the users tokens (which can be annoying)

Given we already have to store request info to make this scheme work, im not sure why we don't just store this info in the db (or even just in memcache if something more ephemeral is wanted.)
Comment 1 Daniel Friesen 2013-05-12 08:02:28 UTC
Yeah, RequestContext was built so that code could create new contexts and build the output for certain requests (like special pages inside parser outputs and maintenance scripts dumping offline versions by creating contexts for pages and grabbing the output). It was NOT built to allow cli scripts to access sessions attached to requests made from the browser.

If this chunked upload job stuff wants to work with data attached to some session. Instead of using RequestContext it should create some class were some new session id is setup, a container is registered inside of either a cache or the database. And the browser session gets an id telling what one of those cache/db containers is being used. Then the job works with the data that is put into that container for it's use.

After that I think we should delete RequestContext::exportSession and RequestContext::importScopedSession.
Comment 2 Bawolff (Brian Wolff) 2013-05-12 08:10:49 UTC
As an additional comment, im not overly a fan of storing ip addresses in the db for purposes such as this if it can be avoided.
Comment 3 Bawolff (Brian Wolff) 2013-05-12 14:35:32 UTC
Hmm, now its not working even though I'm using $wgSessionsInObjectCache = true;
Comment 4 Gerrit Notification Bot 2013-07-08 01:54:56 UTC
Change 72473 had a related patch set uploaded by Brian Wolff:
Have Chunked upload jobs bail if cannot associate with session.

https://gerrit.wikimedia.org/r/72473
Comment 5 Bawolff (Brian Wolff) 2013-07-08 01:56:40 UTC
Turns out this was (at least for me) due to suhosin.session.encrypt being turned on, which encrypts the session based on the IP of the user.
Comment 6 Gerrit Notification Bot 2013-07-16 23:55:40 UTC
Change 72473 merged by jenkins-bot:
Have Chunked upload jobs bail if cannot associate with session.

https://gerrit.wikimedia.org/r/72473

Note You need to log in before you can comment on or make changes to this bug.


Navigation
Links