A Community-Tech project to update how password reset requests in MediaWiki are generated. Under this new system, users can optionally select a new checkbox in Preferences. If they check this box, both their username and email address will be required for identity verification on Special:PasswordReset. This project was the #3 request from the 2019 Community Wishlist Survey.
Thanks! Done.
Mentioned in SAL (#wikimedia-operations) [2024-09-12T20:32:58Z] <cjming@deploy1003> Finished scap sync-world: Backport for [[gerrit:1065299|Remove unused $wgAllowRequiringEmailForResets (T242406)]], [[gerrit:1071711|Remove unused $wmgPoweredByMediaWikiIcon]], [[gerrit:1071728|Remove unused settings removed in T339959]] (duration: 07m 19s)
Mentioned in SAL (#wikimedia-operations) [2024-09-12T20:28:22Z] <cjming@deploy1003> matmarex, cjming: Backport for [[gerrit:1065299|Remove unused $wgAllowRequiringEmailForResets (T242406)]], [[gerrit:1071711|Remove unused $wmgPoweredByMediaWikiIcon]], [[gerrit:1071728|Remove unused settings removed in T339959]] synced to the testservers (https://wikitech.wikimedia.org/wiki/Mwdebug)
Mentioned in SAL (#wikimedia-operations) [2024-09-12T20:25:39Z] <cjming@deploy1003> Started scap sync-world: Backport for [[gerrit:1065299|Remove unused $wgAllowRequiringEmailForResets (T242406)]], [[gerrit:1071711|Remove unused $wmgPoweredByMediaWikiIcon]], [[gerrit:1071728|Remove unused settings removed in T339959]]
Change #1065299 merged by jenkins-bot:
[operations/mediawiki-config@master] Remove unused $wgAllowRequiringEmailForResets
Change #1004801 merged by jenkins-bot:
[mediawiki/core@master] PasswordReset: remove $wgAllowRequiringEmailForResets feature flag
Thanks for picking this up! :)
Change #1065299 had a related patch set uploaded (by Bartosz Dziewoński; author: Bartosz Dziewoński):
[operations/mediawiki-config@master] Remove unused $wgAllowRequiringEmailForResets
I'll see if I can finish this patch.
Change #1058151 abandoned by Bartosz Dziewoński:
[mediawiki/core@master] Mark $wgAllowRequiringEmailForResets as stable
Reason:
Superseded by https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1004801 – I will try to get that patch working instead.
Change #1058151 had a related patch set uploaded (by Bartosz Dziewoński; author: Bartosz Dziewoński):
[mediawiki/core@master] Mark $wgAllowRequiringEmailForResets as stable
Change 1007367 merged by jenkins-bot:
[mediawiki/core@REL1_41] ApiResetPassword: Allow both user and email parameters to be passed for reset
Change 1007368 merged by jenkins-bot:
[mediawiki/core@REL1_40] ApiResetPassword: Allow both user and email parameters to be passed for reset
Change 1007369 merged by jenkins-bot:
[mediawiki/core@REL1_39] ApiResetPassword: Allow both user and email parameters to be passed for reset
Change 1007369 had a related patch set uploaded (by Reedy; author: Reedy):
[mediawiki/core@REL1_39] ApiResetPassword: Allow both user and email parameters to be passed for reset
Change 1007368 had a related patch set uploaded (by Reedy; author: Reedy):
[mediawiki/core@REL1_40] ApiResetPassword: Allow both user and email parameters to be passed for reset
Change 1007367 had a related patch set uploaded (by Reedy; author: Reedy):
[mediawiki/core@REL1_41] ApiResetPassword: Allow both user and email parameters to be passed for reset
Removing the feature flag was easy. I struggled however to fix the tests. Presumably, the failing ones are testing scenarios where Password Reset Update does not apply. I recall when we worked on this, we provided different messaging with PWU enabled. I'll revisit when I have more time.
Change 1004801 had a related patch set uploaded (by MusikAnimal; author: MusikAnimal):
[mediawiki/core@master] PasswordReset: remove $wgAllowRequiringEmailForResets feature flag
Change 1003815 merged by jenkins-bot:
[mediawiki/core@master] ApiResetPassword: Allow both user and email parameters to be passed for reset
Change 1003815 had a related patch set uploaded (by Reedy; author: Reedy):
[mediawiki/core@master] ApiResetPassword: Allow user and email parameters for reset
This seems to have always been the case since it's implementation in rMW54d58ef50665: API changes for AuthManager.
@JTannerWMF does your team use the API resetpassword feature? It looks like it's broken and want to make sure this ticket is a one-off.
@dmaza is password reset something that CommTech continues to own? I don't see it in our maintenance page. https://meta.wikimedia.org/wiki/Community_Tech/Maintenance
This should have been part of Community-Tech's work on Password-Reset-Update.