rdbms: include client ID hash in ChronologyProtector cookies
authorAaron Schulz <aschulz@wikimedia.org>
Fri, 25 May 2018 07:04:23 +0000 (00:04 -0700)
committerAaron Schulz <aschulz@wikimedia.org>
Sat, 2 Jun 2018 03:57:30 +0000 (03:57 +0000)
commitfb51330084b4bde1880c76589e55e7cd87ed0c6d
tree1934bc405527f04ad8be1221b6d010ded9a2e9bb
parent285080c3116a1f99285d05e5bb1eab167ea89d6f
rdbms: include client ID hash in ChronologyProtector cookies

Previously, if an internal service forwarded the cookies for a
user (e.g. for permissions) but not the User-Agent header or not
the IP address (e.g. XFF), ChronologyProtector could timeout
waiting for a matching writeIndex to appear for the wrong key.

The cookie now tethers the client to the key that holds the
DB positions from their last state-changing request.

Bug: T194403
Bug: T190082
Change-Id: I84f2cbea82532d911cdfed14644008894498813a
includes/MediaWiki.php
includes/Setup.php
includes/libs/rdbms/ChronologyProtector.php
includes/libs/rdbms/lbfactory/ILBFactory.php
includes/libs/rdbms/lbfactory/LBFactory.php
tests/phpunit/includes/db/LBFactoryTest.php