Looks like the problem has fixed itself in the 3 years since I filed the ticket :)

My patch had a couple of quality of life things such as installing PHP Composer, installing Symfony CLI, installing XDebug and configuring it to allow VS Code step debugging, and allowing directory listings. I haven't checked if today's patch has those or not, but those might be good additions to add in a follow up.

Re-opening since I think there's a couple more in my screenshot we could add comments to.

Thanks for the patch!

I wrote the patch. Someone else test and backport please :)

Thanks for being flexible to feedback. I love how you're taking people's feedback into account and trying to release compromise versions of icons. I think this is great for community relations. Looking forward to further refinements.

In T427868#12052392, @Ponor wrote:

In T427868#12052342, @DTorsani-WMF wrote:

The demo with the latest amendments should be working now. cc @Chaotic_Enby

@DTorsani-WMF does this mean that the "bra" icon ( cdxIconAppearance) is staying? :[
There's a better icon for these settings even at your demo site (top right)

Page loads in 0.9 seconds for me now. That's without backporting today's patch. Suggests it was fixed by something else.

QA - After the patch merges, will need to wait for train, then will need testing in production to see if the page load time improved below 4 seconds for the page https://en.wikipedia.org/w/index.php?title=Special:SecurePoll/list/821&sort=vote_id&limit=500&asc=&desc=1

In T427868#12048525, @TurboSuperAAA wrote:

In T427868#12038782, @Chaotic_Enby wrote:

Newspaper and Die coming in:

The step to reproduce that we were missing was title = "2026年召集人任命选举". All that replica database, primary database, and cluster stuff was a red herring. Thank you PSI team for solving this!

In T427868#12042152, @Ponor wrote:

<svg aria-hidden="true" class="svg-icon iconInbox" width="20" height="18" viewBox="0 0 20 18"><path d="M4.63 1h10.56a2 2 0 0 1 1.94 1.35L20 10.79V15a2 2 0 0 1-2 2H2a2 2 0 0 1-2-2v-4.21l2.78-8.44c.25-.8 1-1.36 1.85-1.35m8.28 12 2-2h2.95l-2.44-7.32a1 1 0 0 0-.95-.68H5.35a1 1 0 0 0-.95.68L1.96 11h2.95l2 2z"></path></svg>

Can we please consider improving the tray icon? I can no longer tell that it is a tray. And it's a highly visible icon that is shown on every page to logged in users.

Cross link for those looking for it: I think work on refining these icons moved to the ticket T427868: Icon refinement follow ups.

Changed ended up being intentional. Closing.

I don't have enough access to do that, but seems like a good idea. Maybe Product Safety and Integrity can add this ticket to one of their sprints? This is a local election held a month ago that still doesn't have its results, so seems kind of urgent to me. cc @Niharika

@ZhaoFJx, question above for you when you get a minute. STran suggests that you try tallying again (making a brand new tally). Have you tried that yet? What happens?

Also, the Community Tech team no longer exists, so that may not be the correct tag for this.

This was intended to be a task where we plan out those details. None of the acceptance criteria have been met yet (picking a date, marketing it). I would suggest reopening.

@ZhaoFJx, question above for you when you get a minute.

Did you use the encryption setting for your election? Any other settings that might be relevant to your election that I might not be reproducing correctly in beta cluster?

If you're thinking about adding strict_types to anything else, I would recommend against it. This ticket caused 6 production errors in SecurePoll. Not sure that's worth whatever benefit strict_types provides.

A bit odd that there have been no edits using the tag. Could be a bug. Maybe ask your favorite interface administrator to make a test edit?

T428584 is fixed now.

https://en.wikipedia.beta.wmcloud.org/wiki/Special:SecurePoll/tallies/67/result/1 works now. Thanks!

Stack trace on beta cluster has now changed to the following. Might need an additional patch.

Just now I went to go reproduce this bug on betawiki, but I am encountering a different error that probably needs to be fixed first: T428584: TypeError when tallying STV elections.

It's a tricky patch to review since it sounds like the bug is not reproducible in localhost. Someone will probably need to confirm the bug in beta cluster, merge the patch, wait for beta cluster to pick it up, then confirm the fix in beta cluster. If the patch doesn't fix the bug, then would probably want to revert it.

In T423755#11991583, @AROHI_SINGH wrote:

i am claimimg this task

I don't see the latest patch on https://www.wikinews.org/. Probably needs to be deployed.

In T427721#11970263, @Soda wrote:

In T427721#11970258, @Aklapper wrote:

Not a Community Wishlist wish, thus removing project tag

@Aklapper, how do you propose we track changes to the wishlist process?

I am able to reproduce using the steps A_smart_kitten mentioned.

A small suggestion on the order of steps in Clement's comment. Perhaps the dump should occur after the wiki is set to read only. Edits -> freeze -> snapshot, instead of snapshot -> edits -> freeze.

We should probably let a WMF team close this one, since it is on the QA column of their kanban board, which is often a signal for their test engineer to manually test the fix.

In T423120#11956587, @mszwarc wrote:

The old 2FA enforcement mechanism (that was active since spring 2025 until March 2026) was rights-based. While it did encourage active users to enable 2FA to use their sensitive permissions, it did not actually secure inactive accounts (those who had their permissions left in a disabled state). If an attacker took over such account, they would be able to configure 2FA on such account and freely use the sensitive permissions. The current approach ensures that all sensitive rights holders either configure 2FA or lose potential access to the rights (without explicit action by someone else).

What happens if someone doesn't have 2FA after 2FA is turned on? Does the account become de facto disabled for doing everything until it's turned on?

Looks like the code is fixed but the backport hasn't been deployed yet. Not really allowed to deploy backports on weekends, and it's a holiday in the US on Monday, so Tuesday maybe?

I'm not sure taking SecurePoll maintenance scripts out of the SecurePoll repo is the best way to organize things. Would need some convincing.

Phab is usually for requesting changes to software. Just to clarify, are there any software changes being asked for here? If not it might make sense to close this, since the decision of whether to subpage a big discussion is usually handled onwiki.

Reproducible in localhost. Git bisect says https://gerrit.wikimedia.org/r/c/mediawiki/extensions/MultimediaViewer/+/1281824 is the cause. cc @simon04, @Jdforrester-WMF

T426960: Mediaviewer missing left/right arrows and X/Y counter is out of sync is a regression that I just noticed. Maybe caused by this week's train?

Patch was reverted. Will need a different patch.

Still happening. Example from today:

I'm not an expert on tokens. I just know you should never post them. So please be careful. An unexpired token can be used to do things logged in as you.

@Gerges. Please log out and back in to reset your token. It is dangerous to post your token in screenshots since it can be used to impersonate you.

Are you running it on a non privileged account? If you run it on a sysop account or a bot account, that'll give you noratelimit and apihighlimits. Some combination of those user rights should probably turn off throttling.

Good brainstorming. If you want to edit your original post with instructions on exactly what you want programmed, that'll make this more likely to get worked on. Due to discussion, I find the following things unclear and these need someone to decide on them before this can be easily worked on:

Another issue is that out of the box, the script grovels forever as it keeps hitting the anonymous API throttle.

The URL can be modified to do this: https://en.wikipedia.org/w/index.php?limit=5000&title=Special%3ASecurePoll%2Flist%2F893

OK, so you just want an unpaginated version of the /list page, with checkuser-ish columns included, and formatted in TSV.

What data do you need exactly? There's a link called "Dump" that lets you download anonymized votes. Do you instead need the voter metadata including checkuser ish stuff like IP? What fields does the python scriot need and what does the python script do with the data?

Thanks for taking previous feedback onboard and revising your plan.

I think we can make this ticket public. The fact that securepoll can detect csrf abnormalities is not a secret and can be found in our public source code. And i don't think there's an exploit here, just a proposal to get rid of a not very helpful scrutineering signal by changing/improving the design.

Small correction to what I said above: arbcom_zh is in group 1, so will auto deploy on Wed 5/20.

Alright, I merged your patch. It will auto deploy to zhwiki on Thursday 5/21. If you need it sooner let us know and we can look into backporting it.

I'm able to reproduce. Might be a regression. Possibly caused by https://gerrit.wikimedia.org/r/c/mediawiki/extensions/SecurePoll/+/1252573. Will take a look at your patch.

Thanks for working on this and for the quick and thorough replies. I appreciate it.

Someone should probably check the times those accounts became qualified to vote. I wonder if they all fall near or within the couple hour window where the tools were running. For any tool that takes hours to run, and runs on 1000 wikis, tool A might check eligibility at 8AM, and tool B might check eligibility at 10AM, leading to slight differences in the results, without actually being a bug.

Please consider attaching the uploaded file to the ticket.

Maybe the Corto IRC bot's create command should be split into create public and create private, and if create public is selected, the Phab ticket starts its life off public? create public could also write the Phab ticket link to https://wikitech.wikimedia.org/wiki/Incident_status.

I agree with the sentiments of this ticket. I am a trusted volunteer (I'm in the Phabricator groups acl*security and WMF-NDA), and I can't see much about public or private incidents. It seems like most of this has moved to Google Docs, which is out of sight of most volunteers. Maybe someday I will apply for access to the IRC channel #mediawiki_security, but it would be nice to be able to read more about incidents via Phabricator (private incidents) and via Wikitech (public incidents).