MediaWiki-l May 2011

mediawiki-l@lists.wikimedia.org

72 participants
67 discussions

MediaWiki security release 1.16.3
by Tim Starling 26 May '11

26 May '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I would like to announce the release of MediaWiki 1.16.3, which is a security release. Three security issues were discovered. Masato Kinugawa discovered a cross-site scripting (XSS) issue, which affects Internet Explorer clients only, and only version 6 and earlier. Web server configuration changes are required to fix this issue. Upgrading MediaWiki will only be sufficient for people who use Apache with AllowOverride enabled. Due to the diversity of uploaded files that we allow, MediaWiki does not guarantee that uploaded files will be safe if they are interpreted by the client as some arbitrary file type, such as HTML. We rely on the web server to send the correct Content-Type header, and we rely on the web browser to respect it. This XSS issue arises due to IE 6 looking for a file extension in the query string of the URL (i.e. after the "?"), if no extension is found in path part of the URL. Masato Kinugawa discovered that the file extension in the path part can be hidden from IE 6 by substituting the "." with "%2E". To fix this issue, configure your web server to deny requests with URLs that have a path part ending in a dot followed by a dangerous file extension. For example, in Apache with mod_rewrite: RewriteEngine On RewriteCond %{QUERY_STRING} \.[a-z]{1,4}$ [nocase] RewriteRule . - [forbidden] Upgrading MediaWiki is necessary to fix this issue in dynamically-generated content. This issue is easier to exploit using dynamically generated content, since it requires no special privileges. Accounts on both public and private wikis can be compromised by clicking a malicious link in an email or website. For more details, see bug 28235. Wikipedia user Suffusion of Yellow discovered a CSS validation error in the wikitext parser. This is an XSS issue for Internet Explorer clients, and a privacy loss issue for other clients since it allows the embedding of arbitrary remote images. For more details, see bug 28450. MediaWiki developer Happy-Melon discovered that the transwiki import feature neglected to perform access control checks on form submission. The transwiki import feature is disabled by default. If it is enabled, it allows wiki pages to be copied from a remote wiki listed in $wgImportSources. The issue means that any user can trigger such an import to occur. For more details, see bug 28449. The localisations were updated using content from translatewiki.net. ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.16/mediawiki-1.16.3.tar.gz Patch to previous version (1.16.2), without interface text: http://download.wikimedia.org/mediawiki/1.16/mediawiki-1.16.3.patch.gz Interface text changes: http://download.wikimedia.org/mediawiki/1.16/mediawiki-i18n-1.16.3.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.16/mediawiki-1.16.3.tar.gz.sig http://download.wikimedia.org/mediawiki/1.16/mediawiki-1.16.3.patch.gz.sig http://download.wikimedia.org/mediawiki/1.16/mediawiki-i18n-1.16.3.patch.gz… Public keys: https://secure.wikimedia.org/keys.html -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEUEARECAAYFAk2jxbAACgkQgkA+Wfn4zXn38gCWISDEZuC+Ap3Z4aBfibnuNSU1 EgCfeL2lo/4XtCuoKOwah0YbuaHyf5I= =S2JZ -----END PGP SIGNATURE-----

7 9

extension not worked with oracle database
by Rahul Sharma 24 May '11

24 May '11

Dear all, i m facing problem in geting success in external data extension for mediawiki1.17 with oracle database. but it shown me error ORA00942: mediawiki compatible with oracle or not. because i never seen any discussion about oracle. but i am using oracle as backend but i m facing problem with external data, sementic mediawiki because this extension contains sql file. how it will compatible with oracle database.is there any fix or solution for that. please give your suggestion it will help us. Thanks & With Regards, *Rahul Sharma (M.Tech, BE)*

2 1

You should probably change your database password, since you just posted it for the world to see.
by jidanni＠jidanni.org 24 May '11

24 May '11

You know, the current structure of how one sets up MediaWiki is just begging for trouble security wise, "You should probably change your database password, since you just posted it for the world to see." http://www.mediawiki.org/w/index.php?title=Manual_talk:Preventing_access#Do… I mean I can't think of hardly any other components here on my Linux system that encourages one to toss passwords right into the same file with the rest of ones settings. It's like we're still at day one when the program was first baked. Indeed there is even /etc/shadow etc. Yes, the idea is there are two levels of security for /etc files... That way when we send one in for repairs, we don't have to worry if our house keys are still in it somewhere, usually. Yes the user could easily include() the passwords from a separate file, and indeed I remember there was an Adim*.php. However putting the passwords in a separate file should be the default way mediawiki sets up, not something the user must do especially.

4 4

OggHandler doesn't work
by Uwe Baumbach 24 May '11

24 May '11

Hello, need help activating OggHandler. running wiki at version 1.14.1 (Yes, we will update! As soon as we see 1.17 stable) with language code "de". - media handling software is installed on server - extension files are checked out - LocalSettings variables are set - include is activated upload and rendering the media file article at our commons works! rendering an article with embedded ogg file leads to an error: "Magic word 'ogg_noplayer' not found" in ../our-wiki-root/includes/MagicWord.php(239): Language->getMagic(Object(MagicWord)) in OggHandler.i18n.magic.php I can't find $magicWords['de'] = ... may be it doesn´t matter - or not? ogg-... messages are visible in MediaWiki ns ... in German - OK! all other stuff seems to work properly too! So, do one have any ideas? THX in advance! Uwe (Baumbach) U.Baumbach(a)web.de ___________________________________________________________ Schon gehört? WEB.DE hat einen genialen Phishing-Filter in die Toolbar eingebaut! http://produkte.web.de/go/toolbar

2 1

Generate (rendering) PNG files from SVG file
by Danny 23 May '11

23 May '11

Hi! I'm a big fan of the MediaWiki project. I have my own, little Wiki on the MediaWiki engine. I wonder how do you generate the PNG files in various resolutions from one SVG file? For example, on the http://en.wikipedia.org/wiki/File:SVG-logo.svg page where there is such a line: "This image rendered as PNG in other sizes: 200px, 500px, 1000px, 2000px." When I click on the link XXXps, Wikipedia generates a PNG file with XXXpx resolution. This is great! But I'm curious: A) Do you generate a PNG file on the fly? And how are you doing it? B) Or rather, preparing a PNG files before? For example, using a script, bot or something else. I will be grateful for the information because it is very curious to me this smart solution. :) Best regards, -- Danny P.S. Sorry for my bad English.

4 3

Licensing issues with the Collections extension
by Dan Nessett 23 May '11

23 May '11

We are considering whether to install the Collections extension (http:// www.mediawiki.org/wiki/Extension:Collection) on our wiki. One question is licensing. The extension provides for the inclusion of licensing terms for the article's text. However, there is the question about licensing terms for the embedded images. Some of our images are licensed under terms different than the site-wide text license (CC-by-sa 3.0). The wiki pages don't directly display licensing information for embedded images, so when a collection is rendered to a pdf file, how are the licensing terms for the embedded images satisfied? Since the extension is installed on Wikipedia, I thought someone reading this group may be able to answer this question. If I am asking in the wrong place, I would be happy to take this question to another newsgroup, if someone would point me to it. -- -- Dan Nessett

1 0

Fatal error
by KAMOHELO MOFOKENG 20 May '11

20 May '11

Hi All, I'm new to PHP & I'm trying to send mail using PHPMailer & I get the following error: **************************************************************************** Warning: require_once( ) [function.require-once]: failed to open stream: Permission denied in C:\xampp\htdocs\mediawiki\includes\UserMailer.php on line 119 Fatal error: require_once() [function.require]: Failed opening required ' ' (include_path='C:\xampp\htdocs\mediawiki;C:\xampp\htdocs\mediawiki\includes;C:\xampp\htdocs\mediawiki\languages;C: mpp\php\PHPMailer_v5.1\class.phpmailer.php;C: mpp\php\PHPMailer_v5.1\class.smtp.php;.;C:\xampp\php\PHPMailer_v5.1\class.phpmailer.php;C:\xampp\php\PHPMailer_v5.1\class.smtp.php') in C:\xampp\htdocs\mediawiki\includes\UserMailer.php on line 119 **************************************************************************** line 119 in UserMailer.php is: require_once(' '); & my include_path in the php.ini file is: ".;C:\xampp\php\PHPMailer_v5.1\class.phpmailer.php;C:\xampp\php\PHPMailer_v5.1\class.smtp.php" When I leave the default require_once ('mail.php'), my error becomes: **************************************************************************** Fatal error: Class 'Mail' not found in C:\xampp\htdocs\mediawiki\includes\UserMailer.php on line 154 **************************************************************************** What parameter should I pass to the require_once() method? Thanks in advance. Kamo

3 6

Not Found on Windows 7
by KAMOHELO MOFOKENG 20 May '11

20 May '11

Hi All, I'm trying to run MediaWiki 1.16.5 for the first time on Windows 7. Before uploading MediaWiki on the apache server, I downloaded the pre-requisites: - Wampserver: Apache Version: 2.2.17 PHP Version: 5.3.4 MySQL Version: 5.1.53 After installing & starting the apache service, I can access localhost: http://127.0.0.1/. However, I can't access http://localhost/wiki/index.php, I get the error: The requested URL /wiki/index.php was not found on this server. This is after I copied Mediawiki folder to the directory: /wamp/bin/apache/Apache2.2.17/htdocs/. I have checked the forums for solutions but to no avail. These are the following changes that I have made so far based on the suggestions on the forums: - I added localSettings.php in the Mediawiki root - I didn't have it before. I then edited the contents of this file as follows: changed the line $wgScriptPath = "/wiki"; to $wgScriptPath = ; - Changed contents of the .htaccess to read: RewriteEngine on RewriteCond $1 !^(index\.php|images|robots\.txt) RewriteRule ^(.*)$ /index.php/$1 [L] - Changed the contents of httpd.php file as follows: <Directory /> Options FollowSymLinks AllowOverride None Order deny,allow Allow from all </Directory> Can Mediawiki run on Windows 7? What am I missing? What do I still need to configure? Any help is greatly appreciated. Thanks in advance.Kamo

2 1

Seeking assistance with mobile
by Daniel M. Eldridge 19 May '11

19 May '11

I'd like to make a mobile version of semantic media wiki. I want to transform smw to en.m.wikipedia.org. Do I just need a couple, or a few, magic extensions? Any and all suggestions appreciated. tia, --Dan

2 1

IPV6
by Huib Laurens 18 May '11

18 May '11

Dear all, For one of my costumers I'm kind of wondering: * How IPV6 ready is the software? Can MediaWiki be used without problems with IPV6 and how about the core extensions like CheckUser or RevDelete? -- Kind regards, Huib Laurens WickedWay.nl Webhosting the wicked way.

6 5

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

MediaWiki-l May 2011