Remove unused CentralAuth code identified by new monitoring
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	matmarex
	Oct 25 2023, 6:11 PM

Description

While adding the monitoring code in T327046, I've noticed several chunks of code that are probably unused. I'd like to use this monitoring to verify that, and then remove it.

Details

Subject	Repo	Branch	Lines +/-
Remove option to display a message after central login success	mediawiki/extensions/CentralAuth	master	+23 -123
Remove support for inconsistent $wgCentralAuthLoginWiki	mediawiki/extensions/CentralAuth	master	+0 -8
Remove unused 'gu_id' URL parameter	mediawiki/extensions/CentralAuth	master	+0 -6
Bump some login debug logging to info level	mediawiki/extensions/CentralAuth	master	+4 -4

Customize query in gerrit

Related Objects

Mentioned In: T351215: Consider removing no-JS subresource autologin from CentralAuth
Mentioned Here: T327046: Improve (or identify) monitoring for CentralAuth autologins on Wikimedia wikis

Event Timeline

matmarex created this task.Oct 25 2023, 6:11 PM

Restricted Application added a project: MediaWiki-Platform-Team. · View Herald TranscriptOct 25 2023, 6:11 PM

Restricted Application added a subscriber: Aklapper. · View Herald Transcript

matmarex claimed this task.Oct 25 2023, 6:11 PM

matmarex moved this task from Inbox, needs triage to Current Sprint on the MediaWiki-Platform-Team board.

Change 968383 had a related patch set uploaded (by Bartosz Dziewoński; author: Bartosz Dziewoński):

[mediawiki/extensions/CentralAuth@master] Bump some login logging to info level

https://gerrit.wikimedia.org/r/968383

gerritbot added a project: Patch-For-Review.Oct 25 2023, 6:14 PM

Mainframe98 subscribed.Oct 26 2023, 7:56 AM

Change 968383 merged by jenkins-bot:

[mediawiki/extensions/CentralAuth@master] Bump some login debug logging to info level

https://gerrit.wikimedia.org/r/968383

ReleaseTaggerBot added a project: MW-1.42-notes (1.42.0-wmf.3; 2023-10-31).Oct 31 2023, 1:00 AM

Maintenance_bot removed a project: Patch-For-Review.Oct 31 2023, 1:10 AM

matmarex mentioned this in T351215: Consider removing no-JS subresource autologin from CentralAuth.Nov 14 2023, 1:50 PM

Change 974195 had a related patch set uploaded (by Bartosz Dziewoński; author: Bartosz Dziewoński):

[mediawiki/extensions/CentralAuth@master] Remove option to display a message after central login success

https://gerrit.wikimedia.org/r/974195

gerritbot added a project: Patch-For-Review.Nov 14 2023, 2:24 PM

Change 974198 had a related patch set uploaded (by Bartosz Dziewoński; author: Bartosz Dziewoński):

[mediawiki/extensions/CentralAuth@master] Remove unused 'gu_id' URL parameter

https://gerrit.wikimedia.org/r/974198

Change 974203 had a related patch set uploaded (by Bartosz Dziewoński; author: Bartosz Dziewoński):

[mediawiki/extensions/CentralAuth@master] Remove support for inconsistent $wgCentralAuthLoginWiki

https://gerrit.wikimedia.org/r/974203

The latter two have a very small, but non-zero, number of hits in the logs:

A few of them look like someone accidentally copy-pasted the edge login HTML from Wikipedia in 2013 to their personal website. A few others look like they might be automated vulnerability scanning / pentesting. I think the code is still safe to remove (and thus respond to these requests with errors).

Change 974198 merged by jenkins-bot:

[mediawiki/extensions/CentralAuth@master] Remove unused 'gu_id' URL parameter

https://gerrit.wikimedia.org/r/974198

ReleaseTaggerBot edited projects, added MW-1.42-notes (1.42.0-wmf.7; 2023-11-28); removed MW-1.42-notes (1.42.0-wmf.3; 2023-10-31).Nov 15 2023, 9:00 PM

Change 974203 merged by jenkins-bot:

[mediawiki/extensions/CentralAuth@master] Remove support for inconsistent $wgCentralAuthLoginWiki

https://gerrit.wikimedia.org/r/974203

Change 974195 merged by jenkins-bot: