Mediawiki-enterprise

mediawiki-enterprise@lists.wikimedia.org

255 discussions

MediaWiki Security and Maintenance Releases: 1.24.1, 1.23.8, 1.22.15 and 1.19.23
by Markus Glaser 18 Dec '14

18 Dec '14

Hello everyone, I would like to announce the release of MediaWiki 1.24.1, 1.23.8, 1.22.15 and 1.19.23. This is a regular security and maintenance release. Download links are given at the end of this email. Please note this release marks the end of lifetime for MediaWiki 1.22 branch. == Security fixes in 1.24.1, 1.23.8, 1.22.15 and 1.19.23 == * (bug T76686) [SECURITY] thumb.php outputs wikitext message as raw HTML, which could lead to xss. Permission to edit MediaWiki namespace is required to exploit this. * (bug T77028) [SECURITY] Malicious site can bypass CORS restrictions in $wgCrossSiteAJAXdomains in API calls if it only included an allowed domain as part of its name. == Bugfixes == * (bug T74222) The original patch for T74222 was reverted as unnecessary. * Fixed a couple of entries in RELEASE-NOTES-1.24. * (bug T76168) OutputPage: Add accessors for some protected properties. * (bug T74834) Make 1.24 branch directly installable under PostgreSQL. * Add missing $ in front of variable in OutputPage.php == Security fixes in extensions == * (bug T77624) [SECURITY] Extension:Listings: missing validation in the 'name' and 'url' parameters. * (bug T73111) [SECURITY] Extension:ExpandTemplates: parses user input as wikitext and shows a preview, yet it fails to add an edit token to the form and check it. This can be exploited as an XSS when $wgRawHtml = true. Note this only affects the 1.19/1.22 branches. * (bug T76195) [SECURITY] Extension:TemplateSandbox: Special:TemplateSandbox needs edit token when raw HTML is allowed * (bug T69180) [SECURITY] Extension:Hovercards: XSS in text extracts. * (bug T73167) [SECURITY] Extension:Scribunto allows cross-origin leakage of data from a wiki through timing * (bug T71209) [SECURITY] Extension:TimedMediaHandler: Patch getid3 library for CVE-2014-2053. Full release notes for 1.24.1: <https://www.mediawiki.org/wiki/Release_notes/1.24> Full release notes for 1.23.8: <https://www.mediawiki.org/wiki/Release_notes/1.23> Full release notes for 1.22.15: <https://www.mediawiki.org/wiki/Release_notes/1.22> Full release notes for 1.19.23: <https://www.mediawiki.org/wiki/Release_notes/1.19> Public keys: <https://www.mediawiki.org/keys/keys.html> ********************************************************************** 1.24.1 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.24/mediawiki-1.24.1.tar.gz Patch to previous version (1.24.0): https://releases.wikimedia.org/mediawiki/1.24/mediawiki-1.24.1.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.24/mediawiki-core-1.24.1.tar.gz.… https://releases.wikimedia.org/mediawiki/1.24/mediawiki-1.24.1.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.24/mediawiki-1.24.1.patch.gz.sig ********************************************************************** 1.23.8 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.8.tar.gz Patch to previous version (1.23.7): https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.8.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.23/mediawiki-core-1.23.8.tar.gz.… https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.8.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.8.patch.gz.sig ********************************************************************** 1.22.15 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.15.tar.gz Patch to previous version (1.22.14): https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.15.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.22/mediawiki-core-1.22.15.tar.gz… https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.15.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.15.patch.gz.sig ********************************************************************** 1.19.23 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.23.tar.gz Patch to previous version (1.19.22): https://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.23.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.19/mediawiki-core-1.19.23.tar.gz… https://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.23.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.23.patch.gz.sig Markus Glaser (Wiki Release Team)

1 0

BlueSpice MediaWiki distribution released
by Richard Heigl 09 Dec '14

09 Dec '14

Hello everyone, I would like to announce the release of BlueSpice free 2.23 today. This MediaWiki enterprise distribution is also used by many non-profit wikis in the web. Here you can find some information on the new release: English: http://wp.me/p1L9lX-kr German: http://wp.me/pEDy7-S3 Download on sourceforge: http://sourceforge.net/projects/bluespice/#BlueSpice Installer version: http://sourceforge.net/projects/bluespice/files/?source=navbar Hopefully others will find this useful as well. Feedback and contributions are highly welcome. Best regards, Richard Dr. Richard Heigl Hallo Welt! - Medienwerkstatt GmbH Residenzstraße 2 93047 Regensburg Germany Tel. +49 (0) 941 - 66 0 80-193 Fax. +49 (0) 941 - 66 0 80-189 www.hallowelt.biz<http://www.hallowelt.biz/> heigl(a)hallowelt.biz<mailto:heigl@hallowelt.biz> Sitz: Regensburg Amtsgericht: Regensburg Handelsregister: HRB 10467 E.USt.Nr.: DE 253050833 Geschäftsführer: Anja Ebersbach, Markus Glaser, Dr. Richard Heigl, Radovan Kubani

1 0

Re: [Mediawiki-enterprise] [MediaWiki-l] Mediawiki + Google Search Appliance
by Bill Traynor 02 Dec '14

02 Dec '14

On Tue, Dec 2, 2014 at 9:44 AM, Nikolas Everett <neverett(a)wikimedia.org> wrote: > On Tue, Dec 2, 2014 at 9:30 AM, Bill Traynor <btraynor(a)gmail.com> wrote: > >> Hello, >> >> I'm working with a client to utilize their Google Search Appliance >> (GSA) for searching within their externally facing customer wiki. I'm >> required to access the GSA through it's API and pass the following >> parameters: >> >> linkID=10 (this tells the GSA what enterprise site is being searched) >> searchTerm= the query string >> selectionTopic=default_en (returns English results and is constant) >> startNum=0 (the start result number) >> >> I've been trying to get mediawiki-gsa-engine >> (https://code.google.com/p/mediawiki-gsa-engine/) to work >> unsuccessfully. And it would appear the extension is unmaintained. >> >> What's my path of least resistance here? Should I simply hack the >> SimpleSearch section of the Vector.php? >> >> I haven't found any other extensions in the wild that integrate with a GSA. >> >> Any advice would be appreciated. >> >> Thanks >> Bill >> > > At this point I think the only maintained search backend for Mediawiki is > database backed and CirrusSearch. CirrusSearch only targets Elasticsearch. > > I'm not really sure what the path of least resistance is if you are forced > into GSA. It might be reviving the extension but it looks like its been > fallow for a long time. Thanks Nik, I may end up reviving the extension. Right now, I'm experimenting with $wgSearchForwardUrl which may suffice if I can get it to work. > > Nik > _______________________________________________ > MediaWiki-l mailing list > To unsubscribe, go to: > https://lists.wikimedia.org/mailman/listinfo/mediawiki-l

1 1

Mediawiki + Google Search Appliance
by Bill Traynor 02 Dec '14

02 Dec '14

Hello, I'm working with a client to utilize their Google Search Appliance (GSA) for searching within their externally facing customer wiki. I'm required to access the GSA through it's API and pass the following parameters: linkID=10 (this tells the GSA what enterprise site is being searched) searchTerm= the query string selectionTopic=default_en (returns English results and is constant) startNum=0 (the start result number) I've been trying to get mediawiki-gsa-engine (https://code.google.com/p/mediawiki-gsa-engine/) to work unsuccessfully. And it would appear the extension is unmaintained. What's my path of least resistance here? Should I simply hack the SimpleSearch section of the Vector.php? I haven't found any other extensions in the wild that integrate with a GSA. Any advice would be appreciated. Thanks Bill

1 0

MediaWiki - Software moving towards the Future II
by Richard Heigl 02 Dec '14

02 Dec '14

Hi, part two of the blog post series is online: http://blog.blue-spice.org/2014/12/02/mediawiki-software-moving-towards-the… Share, copy, translate remix if this is helpful for you. And of course: comments and additions are highly welcome :) Richard Dr. Richard Heigl Strategieberatung [Industriepreis]<http://www.blue-spice.org/de/loesungen/packages/bluespice-docu/> Hallo Welt! - Medienwerkstatt GmbH Residenzstraße 2 93047 Regensburg Tel. +49 (0) 941 - 66 0 80-193 Fax. +49 (0) 941 - 66 0 80-189 www.hallowelt.biz<http://www.hallowelt.biz/> heigl(a)hallowelt.biz<mailto:heigl@hallowelt.biz> Sitz: Regensburg Amtsgericht: Regensburg Handelsregister: HRB 10467 E.USt.Nr.: DE 253050833 Geschäftsführer: Anja Ebersbach, Markus Glaser, Dr. Richard Heigl, Radovan Kubani

1 0

Open blog posts about MediaWiki
by Richard Heigl 01 Dec '14

01 Dec '14

Hi there, we're actually publishing three blog posts about the latest MediaWiki developments. Saying, there are great features coming. The first one is already online: http://blog.blue-spice.org/2014/12/01/mediawiki-software-moving-towards-the… The other two will follow tomorrow and the day after tomorrow. You can share this link or copy, edit and translate this article for your own publications - however you want. Greetings, Richard Dr. Richard Heigl Strategieberatung [Industriepreis]<http://www.blue-spice.org/de/loesungen/packages/bluespice-docu/> Hallo Welt! - Medienwerkstatt GmbH Residenzstraße 2 93047 Regensburg Tel. +49 (0) 941 - 66 0 80-193 Fax. +49 (0) 941 - 66 0 80-189 www.hallowelt.biz<http://www.hallowelt.biz/> heigl(a)hallowelt.biz<mailto:heigl@hallowelt.biz> Sitz: Regensburg Amtsgericht: Regensburg Handelsregister: HRB 10467 E.USt.Nr.: DE 253050833 Geschäftsführer: Anja Ebersbach, Markus Glaser, Dr. Richard Heigl, Radovan Kubani

1 0

End of lifetime announcement for MediaWiki 1.22
by Markus Glaser 27 Nov '14

27 Nov '14

Hello everyone, with the release of MediaWiki 1.24, the lifetime of MediaWiki version 1.22 ends. There will be a final maintenance release on 17th of December, 2014. The new legacy version is 1.23. Users still using MediaWiki 1.22 are advised to upgrade to version 1.24.0 (latest stable) or 1.23.7 (legacy and LTS version). MediaWiki 1.19 LTS will continue to be supported until May, 2015. Best, Mark Hershberger and Markus Glaser (Wiki Release Team)

1 0

MediaWiki Security and Maintenance Releases: 1.23.7, 1.22.14 and 1.19.22
by Markus Glaser 27 Nov '14

27 Nov '14

Hello everyone, I would like to announce the release of MediaWiki 1.23.7, 1.22.14 and 1.19.22. This is a regular security and maintenance release. Download links are given at the end of this email. == Security fixes == * (bugs 66776, 71478) SECURITY: User PleaseStand reported a way to inject code into API clients that used format=php to process pages that underwent flash policy mangling. This was fixed along with improving how the mangling was done for format=json, and allowing sites to disable the mangling using $wgMangleFlashPolicy. <https://phabricator.wikimedia.org/T68776> <https://phabricator.wikimedia.org/T73478> * (bug 70901) SECURITY: User Jackmcbarn reported that the ability to update the content model for a page could allow an unprivileged attacker to edit another user's common.js under certain circumstances. The user right "editcontentmodel" was added, and is needed to change a revision's content model. <https://phabricator.wikimedia.org/T72901> * (bug 71111) SECURITY: User PleaseStand reported that on wikis that allow raw HTML, it is not safe to preview wikitext coming from an untrusted source such as a cross-site request. Thus add an edit token to the form, and when raw HTML is allowed, ensure the token is provided before showing the preview. This check is not performed on wikis that both allow raw HTML and anonymous editing, since there are easier ways to exploit that scenario. <https://phabricator.wikimedia.org/T73111> * (bug 72222) SECURITY: Do not show log action when the entry is revdeleted with DELETED_ACTION. NOTICE: this may be reverted in a future release pending a public RFC about the desired functionality. This issue was reported by user Bawolff. <https://phabricator.wikimedia.org/T74222> == Bugfixes == * (bug 71621) Make allowing site-wide styles on restricted special pages a config option. <https://phabricator.wikimedia.org/T73621> * (bug 42723) Added updated version history from 1.19.2 to 1.22.13 <https://phabricator.wikimedia.org/T44723> * $wgMangleFlashPolicy was added to make MediaWiki's mangling of anything that might be a flash policy directive configurable. Full release notes for 1.23.7: <https://www.mediawiki.org/wiki/Release_notes/1.23> Full release notes for 1.22.14: <https://www.mediawiki.org/wiki/Release_notes/1.22> Full release notes for 1.19.22: <https://www.mediawiki.org/wiki/Release_notes/1.19> Public keys: <https://www.mediawiki.org/keys/keys.html> ********************************************************************** 1.23.7 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.7.tar.gz https://releases.wikimedia.org/mediawiki/1.23/mediawiki-core-1.23.7.tar.gz Patch to previous version (1.23.6): https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.7.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.23/mediawiki-core-1.23.7.tar.gz.… https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.7.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.7.patch.gz.sig ********************************************************************** 1.22.14 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.14.tar.gz Patch to previous version (1.22.13): https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.14.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.22/mediawiki-core-1.22.14.tar.gz… https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.14.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.14.patch.gz.sig ********************************************************************** 1.19.22 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.22.tar.gz Patch to previous version (1.19.21): https://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.22.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.19/mediawiki-core-1.19.22.tar.gz… https://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.22.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.22.patch.gz.sig Mark Hershberger and Markus Glaser (Wiki Release Team)

1 0

MediaWiki 1.24.0 released
by Markus Glaser 27 Nov '14

27 Nov '14

Hello everyone, I am happy to announce the availability of the first stable release of the new MediaWiki 1.24 release series. MediaWiki 1.24 is a large release that contains many new features and bug fixes. This is a summary of the major changes of interest to users. You can consult the RELEASE-NOTES-1.24 file for the full list of changes in this version. Our thanks to everyone who helped to improve MediaWiki by testing the release candidates and submitting bug reports. == What's new? == MediaWiki 1.24 includes all changes released in the smaller 1.24wmfX software deployments to Wikimedia sites. == Preferences made easier == MediaWiki is known to be extremely flexible and customisable, but few users use its full potential. In 1.24, we aim to make dozens obscure preferences easily discoverable and obvious to use. == New features == * Category pages can now be moved (bug 5451). * MergeHistory for all administrators by default (bug 66155). * Improvements have been made to the password storage system, allowing improved security against offline attacks should a wiki's database be compromised by attackers. Then, the default password storage algorithm was changed to PBKDF2. PBKDF2 and Bcrypt have built-in support in PHP. The new extensible password API makes it trivial to implement scrypt support if we wanted to. == Usability == * The move feature and other actions are now discoverable in Vector, thanks to a label for the dropdown where they're hidden by default (bug 44591). * Specify default language on a per-page basis * Redirect to Special:UserLogin when logging is in required to proceed, instead of showing an error message == Performance == In 2014, MediaWiki development has a new focus on frontend performance. * (bug 39035) Improved Vector skin performance by removing collapsibleNav, which used to collapse some sidebar elements by default. This removes -list id suffixes like p-lang-list: instead of using things like #p-lang-list, you can do #p-lang .body ul. If you would like CollapsibleNav back please use the CollapsibleVector extension. ==Upgrade notices for MediaWiki administrators== === Breaking changes === * Upgrade jQuery to version 1.11.x: [[mailarchive:wikitech-l/2014-June/076842.html]] * Support for register_globals (deprecated 5 years ago) was dropped, MediaWiki will no longer run with it enabled. * {{!}} is now a magic word that results in |, mainly for use in templates and other complex templates. If your wiki has another template at Template:!, you will need to change the name and update any usage of it. If your Template:! is just |, it can be safely deleted. === API changes === Starting with MediaWiki 1.24, we're cleaning up the API, and working towards an API 2.0. See the roadmap for more details. * Rarely used formats deprecated: dbg, dump, txt, wddx, yaml. These may be removed in a future release. * Token handling overhauled: the action=tokens module is now deprecated and replaced by action=query&meta=tokens. Most actions now just take a generic "csrf" token, and the token type is now properly documented in the auto-generated documentation. * And more! See the RELEASE-NOTES-1.24 file for a full list. === Directory changes === * The legacy '''skins/common/''' directory has been emptied and deleted as part of the skin system cleanup. Files that have been present in it have been moved elsewhere or deleted (if they were unused). If you loaded any of these files as part of your custom skin or on-wiki CSS/JS, you should make a copy of the old files in a non-MediaWiki directory. See the RELEASE-NOTES-1.24 file for the full list of moved/deleted files. === Browser support deprecated or removed === * Full support for Internet Explorer 6 and Internet Explorer 7 has been removed: it will browse MediaWiki without JavaScript. JavaScript fixes specific to it have also been removed. Additional IE6 and IE7 fixes that exist in MediaWiki:Common.js and similar can be safely removed. === Skins no longer loaded after upgrade? === MediaWiki 1.24 no longer uses the skin autodiscovery mechanism to load default skins, instead requiring that the skins be manually loaded in LocalSettings.php, much like extensions (see [[Manual:Skin configuration#Installing skins]]). This will require you to update LocalSettings.php after the upgrade - a prominently displayed warning message should guide you through the process, suggesting the exact configuration that you need to add. If you're upgrading via a tarball release, that is all you need to do. If you're upgrading via git or otherwise from source, note that the skins themselves have been each moved to a separate repository and will need to be installed separately (much like extensions, some basic ones are included in the tarball). === Composer === If you are using extensions managed by composer, make sure to backup your existing composer.json file as it will be overwritten on upgrade. Full release notes: https://git.wikimedia.org/blob/mediawiki%2Fcore.git/1.24.0/RELEASE-NOTES-1.… https://www.mediawiki.org/wiki/Release_notes/1.24 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.24/mediawiki-1.24.0.tar.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.24/mediawiki-1.24.0.tar.gz.sig Public keys: https://www.mediawiki.org/keys/keys.html Mark Hershberger and Markus Glaser (Wiki Release Team)

1 0

FW: [Wikitech-l] Recognition of the MediaWiki Stakeholder's Group
by Derric Atzrott 13 Nov '14

13 Nov '14

Thought this might be of interest to the folks on this list as well. Thank you, Derric Atzrott -----Original Message----- From: wikitech-l-bounces(a)lists.wikimedia.org [mailto:wikitech-l-bounces@lists.wikimedia.org] On Behalf Of Gregory Varnum Sent: 09 November 2014 22:34 To: Wikimedia Mailing List; Wikimedia developers Subject: [Wikitech-l] Recognition of the MediaWiki Stakeholder's Group Greetings, The Affiliations Committee is pleased to announce the recognition [1] of the MediaWiki Stakeholder's Group - a user group for "MediaWiki developers, admins, users, consultants, and hosting providers who cooperate in order to improve the software and advocate the needs of MediaWiki users outside the Wikimedia Foundation (WMF) and its projects." This group shows great promise and potential for helping organize folks who are interested in making MediaWiki even better and give a voice to the many non-WMF users of the software. So, now we have them joining the family of affiliates. Please, let's give them a warm welcome! More info about the group: https://www.mediawiki.org/wiki/MediaWiki_Stakeholder%27s_Group Congratulations! -greg aka varnent Vice-Chair, Affiliations Committee 1: https://meta.wikimedia.org/wiki/Affiliations_Committee/Resolutions/MediaWik… _______________________________________________ Wikitech-l mailing list Wikitech-l(a)lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/wikitech-l

1 0

← Newer
1
...
6
7
8
9
10
11
12
...
26
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

Mediawiki-enterprise