[Mediawiki-l] Login/logout loop: loginreq page with returnto=Userlogout

Christian C. Schouten info at zark3.net
Mon Jul 19 13:48:25 UTC 2010


Hi all,

 

Unsure if this is actually a bug or a coincidental sideeffect, but I've
noticed today (while testing an authentication plugin) that my login page
remained in a loop.

 

Situation: CASAuth.php added and activated. A request from a non-logged in
user to a random page results in an authorization request that correctly
defers to CAS.

User logs in in CAS and CAS redirects back to MediaWiki which shows the
correct new username. So far so good.

 

Now, the user decides to logout using the link in the upper right corner
(http://myserver/mediawiki/index.php?title=Speciaal:Afmelden
<http://myserver/mediawiki/index.php?title=Speciaal:Afmelden&returnto=Hoofdp
agina> &returnto=Hoofdpagina) <-- localized, translates to
title=Special:Userlogout&returnto=MainPage

A login required page is displayed that in it contains a link to log in
again. However, this link apparently takes the current page's title as
opposed to the returnto field resulting in a logON link of:
http://myserver/mediawiki/index.php?title=Speciaal:Aanmelden
<http://myserver/mediawiki/index.php?title=Speciaal:Aanmelden&returnto=Speci
aal%3AAfmelden> &returnto=Speciaal%3AAfmelden
(title=Special:Userlogin&returnto=Special:Userlogout). One can see, a login
is immediately logged out again, resulting in a loop. The loop can be broken
by /not/ using the login link provided in the loginreq page but by first
selecting a random page such as MainPage, changing the inline login link to
title=Special:Userlogin&returnto=MainPage

The login link in the upper right corner seems to display the same
behaviour.

 

My system is MediaWiki 1.15.4 with a HiddenNamespace patch, a (currently
commented out) CAS plugin found on
(http://kellinwood.blogspot.com/2009/01/casify-mediawiki-with-phpcas.html)
and now active Extension:CASAuthentication.

 

 

This behaviour does not seem intended and is not desired. How can I change
this?

 

Met vriendelijke groet,

 

Christian C. Schouten

 



More information about the MediaWiki-l mailing list