Bug 113743 - MediaWiki publisher does not work with Wiki configured to use Basic Authentication
Summary: MediaWiki publisher does not work with Wiki configured to use Basic Authentic...
Status: RESOLVED INSUFFICIENTDATA
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Extensions (show other bugs)
Version:
(earliest affected)
5.4.2.2 release
Hardware: All All
: medium normal
Assignee: Not Assigned
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-11-09 18:08 UTC by Sven Neuz (SERPENTEQ)
Modified: 2021-05-29 04:53 UTC (History)
4 users (show)

See Also:
Crash report or crash signature:


Attachments
Extremely ugly POC patch - do NOT use!!! (2.81 KB, patch)
2017-11-09 18:19 UTC, Sven Neuz (SERPENTEQ)
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Sven Neuz (SERPENTEQ) 2017-11-09 18:08:05 UTC
Description:
It is impossible to publish documents to a MediaWiki with the provided extension if the Wiki uses Basic Authentication instead of the Wiki logon screen. 

Basic Authentication is officially supported by MedIaWiki, so the extension should be able to handle it. 

It fails as early as adding the URL to the server list.

Tested on Linux and Windows. Both behave the same (the JAR file of the extension is the same anyways).

Steps to Reproduce:
1. Configure a MediaWiki that uses Basic Authentication
a. Requires wfLoadExtension( 'Auth_remoteuser' ); in LocalSettings.php
b. Requires matching Apache Config
2. Add the Wiki to the MediaWiki Publisher Extension 
3. Even adding the URL will fail. The server log will show it responded with 401 (as it should be)

Actual Results:  
Adding the URL to the MediWiki fails. Posting articles if of course also impossible then.

Expected Results:
The extension detects the Basic Authentication and uses it instead of the Wiki logon screen.


Reproducible: Always


User Profile Reset: No



Additional Info:
It is possible to patch the extension to always include the Basic Auth header by adding
String basicAuth = Base64.getEncoder().encodeToString((sWikiUser+":"+sWikiPass).getBytes(StandardCharsets.UTF_8));
connGet.setRequestProperty("Authorization", "Basic " + basicAuth);

Note that the User/Password variable names are different depending on the part of the change.

This is of course just an ugly hack to prove it is working and actually a very bad idea to always send user and password even on plain text connections, so please do not use this in a productive environment.


User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0
Comment 1 Sven Neuz (SERPENTEQ) 2017-11-09 18:19:38 UTC
Created attachment 137648 [details]
Extremely ugly POC patch - do NOT use!!!

With this patch it is possible to access a MediWiki which uses Basic Auth and post an article. Even though the article is posted, the extension still displays an error message. It seems that the extension tries to read the newly created article but does not use the Basic Auth header this time (and also ignored the set user agent)

xxx - sen [09/Nov/2017:18:32:14 +0100] "POST /index.php?title=Test&action=submit HTTP/1.1" 302 1229 "-" "LibreOffice Wiki Publisher 1.2.1"
xxx - - [09/Nov/2017:18:32:14 +0100] "GET /Test HTTP/1.1" 401 1120 "-" "Java/1.8.0_144"

Note that I changed the Special Page from logon to ListUsers as a MediaWiki using Basic Auth does not provide this page. Also just an ugly hack.
Comment 2 Xisco Faulí 2018-06-12 11:06:14 UTC
Hello Sven Neuz,
Still working on this issue?
Would you mind submitting a patch to gerrit for review? More info: https://wiki.documentfoundation.org/Development/gerrit/SubmitPatch
Comment 3 Sven Neuz (SERPENTEQ) 2018-06-18 09:59:04 UTC
Actually I don't work on this issue, I just reported it. I created this really ugly POC patch to see if it works at all. Of course I can submit it but it *should not be used* as it will break the "normal" login and does have a terrible coding style.
Comment 4 Xisco Faulí 2018-12-19 10:57:22 UTC
A new major release of LibreOffice is available since this bug was reported.
Could you please try to reproduce it with the latest version of LibreOffice
from https://www.libreoffice.org/download/libreoffice-fresh/ ?
I have set the bug's status to 'NEEDINFO'. Please change it back to
'UNCONFIRMED' if the bug is still present in the latest version.
Comment 5 Sven Neuz (SERPENTEQ) 2018-12-19 13:10:02 UTC
Still the same issue in 6.1.0.3.
Comment 6 Julien Nabet 2019-07-20 17:11:05 UTC
Dennis: IMHO, it's more a new feature than a bug. Anyway, I can't help here.
Comment 7 Xisco Faulí 2020-07-17 10:58:07 UTC Comment hidden (obsolete)
Comment 8 Dennis Roczek 2020-10-29 08:57:05 UTC
I'm not sure, but isn't something like
    https://Aladdin:OpenSesame@www.example.com/index.html
working?
Comment 9 QA Administrators 2021-04-28 03:51:18 UTC Comment hidden (obsolete)
Comment 10 QA Administrators 2021-05-29 04:53:24 UTC
Dear Sven Neuz (SERPENTEQ),

Please read this message in its entirety before proceeding.

Your bug report is being closed as INSUFFICIENTDATA due to inactivity and
a lack of information which is needed in order to accurately
reproduce and confirm the problem. We encourage you to retest
your bug against the latest release. If the issue is still
present in the latest stable release, we need the following
information (please ignore any that you've already provided):

a) Provide details of your system including your operating
   system and the latest version of LibreOffice that you have
   confirmed the bug to be present

b) Provide easy to reproduce steps – the simpler the better

c) Provide any test case(s) which will help us confirm the problem

d) Provide screenshots of the problem if you think it might help

e) Read all comments and provide any requested information

Once all of this is done, please set the bug back to UNCONFIRMED
and we will attempt to reproduce the issue. Please do not:

a) respond via email 

b) update the version field in the bug or any of the other details
   on the top section of our bug tracker

Warm Regards,
QA Team

MassPing-NeedInfo-FollowUp