From the review at #294 (comment): MediaWiki's password exclusions (id:900919, id:900920 once that PR lands) match only the English names of its special pages, such as Special:CreateAccount. A wiki in another language posts its forms to its own names, such as Spezial:Benutzerkonto_anlegen on a German wiki, so random passwords are still refused there. The same holds for every other exclusion in mediawiki.conf that names a special page.
Definition of done, an analysis comment on this issue before any code:
From MediaWiki's source: whether its forms post to the local name or the canonical English one, whether Special: and the canonical page names work on every language's wiki, and which of the exclusions in mediawiki.conf this affects.
The options, with a recommendation. If the fix is plain, for example matching the canonical name MediaWiki itself sends, build it as one PR into next with a test on one non-English wiki recorded at the digest the first MediaWiki change used. If it needs a list of every language's page names, say so and stop.
From the review at https://git.eeqj.de/sneak/smallwebwaf/pulls/294#issuecomment-174633: MediaWiki's password exclusions (`id:900919`, `id:900920` once that PR lands) match only the English names of its special pages, such as `Special:CreateAccount`. A wiki in another language posts its forms to its own names, such as `Spezial:Benutzerkonto_anlegen` on a German wiki, so random passwords are still refused there. The same holds for every other exclusion in `mediawiki.conf` that names a special page.
**Definition of done**, an analysis comment on this issue before any code:
- From MediaWiki's source: whether its forms post to the local name or the canonical English one, whether `Special:` and the canonical page names work on every language's wiki, and which of the exclusions in `mediawiki.conf` this affects.
- The options, with a recommendation. If the fix is plain, for example matching the canonical name MediaWiki itself sends, build it as one PR into `next` with a test on one non-English wiki recorded at the digest the first MediaWiki change used. If it needs a list of every language's page names, say so and stop.
Start after https://git.eeqj.de/sneak/smallwebwaf/pulls/294 lands.
Model: opus-5-5
clawbot
self-assigned this 2026-11-10 19:27:07 +01:00
Plan.#294 has landed. Post the analysis comment the definition of done asks for first, from MediaWiki 1.46.2's source and, if needed, a German wiki run in Docker at the digest the first MediaWiki change used (remove every container you start). If the fix is plain, build it in internal/coreruleset (mediawiki.conf, testdata/mediawiki-requests.txt, mediawiki_test.go); keep TestPasswordExclusionsAreNarrow passing. If it needs a list of every language's page names, stop after the comment. Post with tea and push over SSH, since GITEA_TOKEN is refused. Follow AGENTS.md: checks only through make targets. make fmt, then flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; a flock timeout also exits 1, so read the output. Start no subagent on another model. Title ending (closes #299).
Model: opus-5-5
**Plan.** https://git.eeqj.de/sneak/smallwebwaf/pulls/294 has landed. Post the analysis comment the definition of done asks for first, from MediaWiki 1.46.2's source and, if needed, a German wiki run in Docker at the digest the first MediaWiki change used (remove every container you start). If the fix is plain, build it in `internal/coreruleset` (`mediawiki.conf`, `testdata/mediawiki-requests.txt`, `mediawiki_test.go`); keep `TestPasswordExclusionsAreNarrow` passing. If it needs a list of every language's page names, stop after the comment. Post with `tea` and push over SSH, since `GITEA_TOKEN` is refused. Follow `AGENTS.md`: checks only through `make` targets. `make fmt`, then `flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check`; a `flock` timeout also exits 1, so read the output. Start no subagent on another model. Title ending ` (closes #299)`.
Model: opus-5-5
Analysis, from MediaWiki 1.46.2's source and a German wiki run at mediawiki@sha256:406a08c7f2cf5a9c9cb590bbe27a21b4d3cb3268b0acf327fa7dd2727ff6b0be.
Forms post to the local name.LoginSignupSpecialPage::getAuthForm takes its action from getPageTitle(), which SpecialPageFactory::getLocalNameFor turns into the wiki's own name. Special:ChangeCredentials posts to the title it was opened under. SpecialPageFactory::executePath first redirects a GET under any other name to the local one. On the German wiki, /index.php/Special:CreateAccount answers 301 to /index.php/Spezial:Benutzerkonto_anlegen, and the form posts there.
Special: and the English names work everywhere, but browsers never post to them.Language::getNsIndex accepts the canonical namespace name, and SpecialPageFactory::getAliasList makes every canonical page name an alias. The redirect above means a browser still ends up on the local name.
Affected exclusions: only id:900919 (password, retype on Special:ChangeCredentials) and id:900920 (retype on Special:CreateAccount and Special:UserLogin). The German pages are Spezial:Anmeldeinformationen_ändern, Spezial:Benutzerkonto_anlegen and Spezial:Anmelden. Every other exclusion matches a path or a field, never a page name.
Options
A, every language's names: each of about 400 message files has its own namespace name and page names, and they change between releases. Not plain.
B, MediaWiki's authAction field: each of these forms sends a hidden authAction whose value is the same in every language: create when signing up, change when changing the password, login-continue when setting a new password at sign-in. password and retype skip the rules when the body's authAction names the form that sends them, on a MediaWiki page whose title has a namespace (Spezial:…, Special:…). This reads the body, so the two rules move to phase 2, as id:900916 already is. They still matter only while SWW_WAF_BODY_LIMIT is set.
C, any page in a namespace: drop the page name and keep the path. Wider: password would skip on every page such as Help:Example.
Recommendation: B. Building it as one PR into next, with the German requests recorded.
Model: opus-5-5
**Analysis**, from MediaWiki 1.46.2's source and a German wiki run at `mediawiki@sha256:406a08c7f2cf5a9c9cb590bbe27a21b4d3cb3268b0acf327fa7dd2727ff6b0be`.
- **Forms post to the local name.** `LoginSignupSpecialPage::getAuthForm` takes its action from `getPageTitle()`, which `SpecialPageFactory::getLocalNameFor` turns into the wiki's own name. `Special:ChangeCredentials` posts to the title it was opened under. `SpecialPageFactory::executePath` first redirects a GET under any other name to the local one. On the German wiki, `/index.php/Special:CreateAccount` answers 301 to `/index.php/Spezial:Benutzerkonto_anlegen`, and the form posts there.
- **`Special:` and the English names work everywhere, but browsers never post to them.** `Language::getNsIndex` accepts the canonical namespace name, and `SpecialPageFactory::getAliasList` makes every canonical page name an alias. The redirect above means a browser still ends up on the local name.
- **Affected exclusions:** only `id:900919` (`password`, `retype` on `Special:ChangeCredentials`) and `id:900920` (`retype` on `Special:CreateAccount` and `Special:UserLogin`). The German pages are `Spezial:Anmeldeinformationen_ändern`, `Spezial:Benutzerkonto_anlegen` and `Spezial:Anmelden`. Every other exclusion matches a path or a field, never a page name.
**Options**
- **A, every language's names:** each of about 400 message files has its own namespace name and page names, and they change between releases. Not plain.
- **B, MediaWiki's `authAction` field:** each of these forms sends a hidden `authAction` whose value is the same in every language: `create` when signing up, `change` when changing the password, `login-continue` when setting a new password at sign-in. `password` and `retype` skip the rules when the body's `authAction` names the form that sends them, on a MediaWiki page whose title has a namespace (`Spezial:…`, `Special:…`). This reads the body, so the two rules move to phase 2, as `id:900916` already is. They still matter only while `SWW_WAF_BODY_LIMIT` is set.
- **C, any page in a namespace:** drop the page name and keep the path. Wider: `password` would skip on every page such as `Help:Example`.
**Recommendation:** B. Building it as one PR into `next`, with the German requests recorded.
Model: opus-5-5
Built option B in #305: password and retype skip the rules when authAction is change, create or login-continue, on a MediaWiki page whose title has a namespace. Requests recorded from a German wiki are in testdata/mediawiki-requests.txt.
Model: opus-5-5
Built option B in https://git.eeqj.de/sneak/smallwebwaf/pulls/305: `password` and `retype` skip the rules when `authAction` is `change`, `create` or `login-continue`, on a MediaWiki page whose title has a namespace. Requests recorded from a German wiki are in `testdata/mediawiki-requests.txt`.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
From the review at #294 (comment): MediaWiki's password exclusions (
id:900919,id:900920once that PR lands) match only the English names of its special pages, such asSpecial:CreateAccount. A wiki in another language posts its forms to its own names, such asSpezial:Benutzerkonto_anlegenon a German wiki, so random passwords are still refused there. The same holds for every other exclusion inmediawiki.confthat names a special page.Definition of done, an analysis comment on this issue before any code:
Special:and the canonical page names work on every language's wiki, and which of the exclusions inmediawiki.confthis affects.nextwith a test on one non-English wiki recorded at the digest the first MediaWiki change used. If it needs a list of every language's page names, say so and stop.Start after #294 lands.
Model: opus-5-5
Plan. #294 has landed. Post the analysis comment the definition of done asks for first, from MediaWiki 1.46.2's source and, if needed, a German wiki run in Docker at the digest the first MediaWiki change used (remove every container you start). If the fix is plain, build it in
internal/coreruleset(mediawiki.conf,testdata/mediawiki-requests.txt,mediawiki_test.go); keepTestPasswordExclusionsAreNarrowpassing. If it needs a list of every language's page names, stop after the comment. Post withteaand push over SSH, sinceGITEA_TOKENis refused. FollowAGENTS.md: checks only throughmaketargets.make fmt, thenflock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; aflocktimeout also exits 1, so read the output. Start no subagent on another model. Title ending(closes #299).Model: opus-5-5
Analysis, from MediaWiki 1.46.2's source and a German wiki run at
mediawiki@sha256:406a08c7f2cf5a9c9cb590bbe27a21b4d3cb3268b0acf327fa7dd2727ff6b0be.LoginSignupSpecialPage::getAuthFormtakes its action fromgetPageTitle(), whichSpecialPageFactory::getLocalNameForturns into the wiki's own name.Special:ChangeCredentialsposts to the title it was opened under.SpecialPageFactory::executePathfirst redirects a GET under any other name to the local one. On the German wiki,/index.php/Special:CreateAccountanswers 301 to/index.php/Spezial:Benutzerkonto_anlegen, and the form posts there.Special:and the English names work everywhere, but browsers never post to them.Language::getNsIndexaccepts the canonical namespace name, andSpecialPageFactory::getAliasListmakes every canonical page name an alias. The redirect above means a browser still ends up on the local name.id:900919(password,retypeonSpecial:ChangeCredentials) andid:900920(retypeonSpecial:CreateAccountandSpecial:UserLogin). The German pages areSpezial:Anmeldeinformationen_ändern,Spezial:Benutzerkonto_anlegenandSpezial:Anmelden. Every other exclusion matches a path or a field, never a page name.Options
authActionfield: each of these forms sends a hiddenauthActionwhose value is the same in every language:createwhen signing up,changewhen changing the password,login-continuewhen setting a new password at sign-in.passwordandretypeskip the rules when the body'sauthActionnames the form that sends them, on a MediaWiki page whose title has a namespace (Spezial:…,Special:…). This reads the body, so the two rules move to phase 2, asid:900916already is. They still matter only whileSWW_WAF_BODY_LIMITis set.passwordwould skip on every page such asHelp:Example.Recommendation: B. Building it as one PR into
next, with the German requests recorded.Model: opus-5-5
Built option B in #305:
passwordandretypeskip the rules whenauthActionischange,createorlogin-continue, on a MediaWiki page whose title has a namespace. Requests recorded from a German wiki are intestdata/mediawiki-requests.txt.Model: opus-5-5