[Mediawiki-l] user_token and user_touched fields

Brion Vibber brion at pobox.com
Fri Sep 23 23:03:26 UTC 2005


Erin Spiceland wrote:
> I'm using mediawiki on a site that employs three other web apps that
> require authentication. I'm trying to write a register script that will
> insert the desired authentication and profile data into all 3 apps'
> databases at the same time, so that users won't have to register 3
> separate times. I've got it working on both of the other apps, but
> mediawiki says that the username doesn't exist when I can clearly see it
> in the table.

Can you provide some details of what, exactly, you're putting into the
database and how?

> I think it has something to do with my values of "" that
> I'm putting in the user_token and/or user_touched fields.

Unlikely; it should work fine with either blank.

   -- This is a timestamp which is updated when a user
   -- logs in, logs out, changes preferences, or performs
   -- some other action requiring HTML cache invalidation
   -- to ensure that the UI is updated.
   user_touched char(14) binary NOT NULL default '',

   -- A pseudorandomly generated value that is stored in
   -- a cookie when the "remember password" feature is
   -- used (previously, a hash of the password was used, but
   -- this was vulnerable to cookie-stealing attacks)
   user_token char(32) binary NOT NULL default '',

It's more likely that you've got a problem with an invalid name in the
user_name field, or perhaps some weird bogus user_id. Note that the
user_name field is stored with spaces, not underscores, and an initial
letter must be capitalized.

I just successfully tested a minimal user addition on my 1.5 test
installation (should be same on all prior release versions):

insert into user (user_name) values('Blargy');
update user set user_password=md5(concat(user_id,'-',md5('wonko')))
    where user_name='Blargy';

-- brion vibber (brion @ pobox.com)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 253 bytes
Desc: OpenPGP digital signature
Url : http://lists.wikimedia.org/pipermail/mediawiki-l/attachments/20050923/3a264a44/attachment.pgp 


More information about the MediaWiki-l mailing list