MediaWiki-l November 2017

mediawiki-l@lists.wikimedia.org

33 participants
28 discussions

by Alexander Kallenbach

Hi, I just wanted to apply the patch for the new version 1.27.4 but dry- running the patch gave me some error messages. So I stopped. For version 1.27.3 there have been no patch so I manually made the changes. Can I simply use the patch ignoring the error messages? Or what should I do? Here comes the output of the dry-run: patch -p1 --dry-run -i mediawiki-1.27.4.patch checking file api.php checking file composer.json Hunk #1 FAILED at 50. 1 out of 3 hunks FAILED checking file docs/extension.schema.json checking file includes/actions/HistoryAction.php checking file includes/actions/RawAction.php checking file includes/api/ApiBase.php checking file includes/api/ApiFormatBase.php checking file includes/api/ApiFormatRaw.php checking file includes/api/ApiHelp.php checking file includes/api/ApiLogin.php checking file includes/api/ApiPageSet.php checking file includes/api/ApiQuery.php checking file includes/auth/LocalPasswordPrimaryAuthenticationProvider.php checking file includes/Block.php checking file includes/composer/ComposerVendorHtaccessCreator.php checking file includes/DefaultSettings.php checking file includes/Defines.php checking file includes/EditPage.php checking file includes/exception/MWException.php checking file includes/Feed.php checking file includes/installer/PostgresUpdater.php checking file includes/jobqueue/JobRunner.php checking file includes/Linker.php checking file includes/Message.php checking file includes/OutputPage.php checking file includes/page/Article.php checking file includes/page/CategoryPage.php checking file includes/page/ImagePage.php Hunk #2 FAILED at 348. 1 out of 2 hunks FAILED checking file includes/page/WikiPage.php checking file includes/registration/ExtensionProcessor.php checking file includes/registration/ExtensionRegistry.php checking file includes/Revision.php checking file includes/search/SearchDatabase.php checking file includes/search/SearchEngine.php checking file includes/search/SearchMssql.php checking file includes/search/SearchMySQL.php checking file includes/search/SearchOracle.php checking file includes/search/SearchSqlite.php checking file includes/specialpage/LoginSignupSpecialPage.php checking file includes/specials/pagers/ActiveUsersPager.php checking file includes/specials/SpecialBotPasswords.php checking file includes/specials/SpecialUpload.php checking file includes/Title.php checking file includes/upload/UploadBase.php checking file includes/user/BotPassword.php checking file includes/user/User.php checking file includes/utils/MWCryptRand.php checking file languages/i18n/en.json checking file languages/i18n/qqq.json checking file languages/LanguageConverter.php checking file maintenance/checkComposerLockUpToDate.php checking file maintenance/update.php checking file RELEASE-NOTES-1.27 checking file tests/parser/parserTests.txt checking file tests/phpunit/includes/api/ApiLoginTest.php checking file tests/phpunit/includes/registration/ExtensionProcessorTest.php checking file tests/phpunit/includes/search/SearchEngineTest.php checking file tests/phpunit/includes/user/BotPasswordTest.php checking file tests/phpunit/languages/LanguageConverterTest.php checking file vendor/.htaccess Thanks in advance! Alex

6 years, 5 months

Cargo extension version 1.5: recreating data made more painless

by Yaron Koren

Hi, Version 1.5 of the Cargo extension has been released. This is a big release because it solves, or at least is intended to solve, the two big problems that have been experienced by (some) Cargo users: a painfully slow "recreate table" process for data tables that are very large, and duplicate data showing up within tables. These two problems are actually tied in with one another somewhat, in that a slow recreate process has caused some admins to press the "recreate data" button more than once, which in turn causes data duplication to happen (which then in turn makes another "recreate data" call necessary, which can cause even more problems). Version 1.5 contains the following changes and additions: - Now, by default, recreating a Cargo table puts all the new content into a "replacement" table, which can be viewed but is not yet used for querying. Then, only when the administrator is ready to switch, the old/current table gets deleted and the new one gets replaced in. In this way, functionality on the site is never harmed while data is being recreated. Note that MediaWiki's update.php must be called for this new functionality to appear, since it required a small database change. - In order to avoid duplicate rows, the software now checks every row about to be added to a table to make sure it doesn't match some existing row - There were a number of improvements made to the "calendar" display format, which in turn uses the FullCalendar JavaScript library: - In the upcoming version 1.30, MediaWiki switched from jQuery 1 to jQuery 3. It looks like there is no one version of FullCalendar that works with both, so Cargo now contains two copies of FullCalendar, at different versions, with the one used depending on the jQuery/MW version. - Most of the text displayed in the calendar, like month names, was hardcoded in English; the code now uses FullCalendar's own "locale" handling to display the right text. FC's internationalization support is not nearly as comprehensive as MediaWiki's - it supports 50 instead of 200 languages - but it has support for things like deciding what the first day of each week should be based on the language, and was in general a lot easier to implement. Eventually it will be good to switch to using MediaWiki's i18n. - Events that have both a start and end time set now have both times displayed on the calendar, instead of just the start time; the default FullCalendar behavior is to just show the start time, for some reason. - Calendar week and day displays were made more detailed, with an "agenda" view. - A "list" view was added, in addition to the "month", "week" and "day" views; although it only shows up with MediaWiki 1.30 and higher. - The _fileData table, which holds information on every uploaded file, now contains two additional possible fields: _lastUploadDate and_numPages (the latter is only stored for PDF files). Thanks to Paul Troughton for help with these. - There was a bug where the standard _pageNamespace field in tables could not be displayed in queries; this has been fixed. - There was a fix for the display of list fields where the delimiter is ";" and one or more values contain quotation marks. - There was a fix for the parsing of queries containing "WITHIN", a keyword added in Cargo 1.4; thanks to Feroz Ahmed for this. - Many of the PHP files were moved into a new /includes directory. - Many error messages which were hardcoded in English are now translated. You can read more about Cargo, and download the new version, here: https://www.mediawiki.org/wiki/Extension:Cargo -Yaron

6 years, 5 months

Re: [MediaWiki-l] [Wikitech-l] Security release: 1.29.2 / 1.28.3 / 1.27.4

by bawolff

Hi, just a quick update - The tags are now in git. You can now download from git using the 1.29.2, 1.28.3 or 1.27.4 tags Alternatively you can use the REL1_29, REL1_28 or REL1_27 branches if you like. The difference between the branch and the tag, is the tag contains exactly what was released in the tarball, where the REL1_XX branches will be continously updated with any minor bugfixes that happen between official releases. Apologies for the delay on tagging, phpcs was complaing about some code style issues in the release, and we spent a lot of time fighting with Wikimedia continuous integration infrastructure to fix those issues. -- Brian On Wed, Nov 15, 2017 at 4:43 PM, Greg Rundlett (freephile) <greg(a)freephile.com> wrote: >> >> >> > There is no corresponding Git tags 1.29.2, 1.28.3, 1.27.4, could someone >> > issue them? >> > >> > I guess they are respectively ee7f9fe, 5b85506, a806476. >> > > Thanks Seb > > > Greg Rundlett > https://eQuality-Tech.com <https://equality-tech.com/> > https://freephile.org > _______________________________________________ > Wikitech-l mailing list > Wikitech-l(a)lists.wikimedia.org > https://lists.wikimedia.org/mailman/listinfo/wikitech-l

6 years, 5 months

List only parent (root) articles in a namespace

by Evans, Richard K. (GRC-H000)

Hi .. What's the right extension to use to list just the root pages in a given namespace? I'm using Extension:SubPageList3 and I'm able to get subpages of pages I already know, but I'd like a way to show the parent (root) pages only in a subpage. -Rich

6 years, 5 months

[MediaWiki-announce] Security release: 1.29.2 / 1.28.3 / 1.27.4

by Sam Reed

I would like to announce the release of MediaWiki 1.29.2, 1.28.3 and 1.27.4! These releases fix nine security issues in core and one related issue in the vendor folder. Download links are given at the end of this email. Patches will be pushed to gerrit after this email is sent, and will land into the relevant branches as fast as our CI infrastructure allows. Git tags will follow soon after. All related tasks will be made public in phabricator too in the following few hours. Please note that this month is the End-Of-Life date for MediaWiki 1.28. This means that MediaWiki 1.28.3 will be the last security release for that version, barring any unforeseen issues. We would strongly encourage users of MediaWiki 1.28 to upgrade to MediaWiki 1.29, released in July 2017, or a yet newer version as soon as possible. MediaWiki 1.29 will be supported until July 2018. See <https://www.mediawiki.org/wiki/Version_lifecycle> for more information. This release also serves as a maintenance release for these branches. == Security fixes == * (T128209) Reflected File Download from api.php. Reported by Abdullah Hussam. (CVE-2017-8809) * (T165846) BotPasswords doesn't throttle login attempts. * (T134100) On private wikis, login form shouldn't distinguish between login failure due to bad username and bad password. (CVE-2017-8810) * (T178451) XSS when $wgShowExceptionDetails = false and browser sends non-standard url escaping. (CVE-2017-8808) * (T176247) It's possible to mangle HTML via raw message parameter expansion. (CVE-2017-8811) * (T125163) id attribute on headlines allow raw >. (CVE-2017-8812) * (T124404) language converter can be tricked into replacing text inside tags by adding a lot of junk after the rule definition. (CVE-2017-8814) * (T119158) Language converter: unsafe attribute injection via glossary rules (CVE-2017-8815) The following only affects 1.29: * (T180488) (T125177) "api.log contains passwords in plaintext" wasn't correctly fixed in all branches in the previous security release. (CVE-2017-0361) The following only affects 1.27 and 1.28: * (T180231) composer.json has require-dev versions of PHPUnit with known security issues. Reported by Tom Hutchison. (CVE-2017-9841) It is recommended to run `composer update --no-dev` after upgrading to MW 1.27.4 or 1.28.3 if you installed MediaWiki via git. If you are using the tarball, you are not affected, and you do not need to run this command. This will remove developer dependancies that production wikis do not require. If you require developer dependancies, run `composer update` which will update to a version of PHPUnit without known RCE. If you cannot run `composer update` for any reason, it is recommended that you delete the offending file as a minimum yourself using the following command: `rm -rf vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php` == Links to all mentioned tasks == https://phabricator.wikimedia.org/T128209 https://phabricator.wikimedia.org/T165846 https://phabricator.wikimedia.org/T134100 https://phabricator.wikimedia.org/T178451 https://phabricator.wikimedia.org/T176247 https://phabricator.wikimedia.org/T125163 https://phabricator.wikimedia.org/T180231 https://phabricator.wikimedia.org/T125163 https://phabricator.wikimedia.org/T124404 https://phabricator.wikimedia.org/T119158 https://phabricator.wikimedia.org/T180488 https://phabricator.wikimedia.org/T125177 == Release notes == Full release notes for 1.27.4: https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_27/RELEASE-NOTES… https://www.mediawiki.org/wiki/Release_notes/1.27 Full release notes for 1.28.3: https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_28/RELEASE-NOTES… https://www.mediawiki.org/wiki/Release_notes/1.28 Full release notes for 1.29.2: https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_29/RELEASE-NOTES… https://www.mediawiki.org/wiki/Release_notes/1.29 For information about how to upgrade, see <https://www.mediawiki.org/wiki/Manual:Upgrading> ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.27/mediawiki-1.27.4.tar.gz Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.27/mediawiki-core-1.27.4.tar.gz Patch to previous version (1.27.3): https://releases.wikimedia.org/mediawiki/1.27/mediawiki-1.27.4.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.27/mediawiki-core-1.27.4.tar.gz.… https://releases.wikimedia.org/mediawiki/1.27/mediawiki-1.27.4.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.27/mediawiki-1.27.4.patch.gz.sig Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.28/mediawiki-1.28.3.tar.gz Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.28/mediawiki-core-1.28.3.tar.gz Patch to previous version (1.28.2): https://releases.wikimedia.org/mediawiki/1.28/mediawiki-1.28.3.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.28/mediawiki-core-1.28.3.tar.gz.… https://releases.wikimedia.org/mediawiki/1.28/mediawiki-1.28.3.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.28/mediawiki-1.28.3.patch.gz.sig Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.29/mediawiki-1.29.2.tar.gz Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.29/mediawiki-core-1.29.2.tar.gz Patch to previous version (1.29.1): https://releases.wikimedia.org/mediawiki/1.29/mediawiki-1.29.2.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.29/mediawiki-core-1.29.2.tar.gz.… https://releases.wikimedia.org/mediawiki/1.29/mediawiki-1.29.2.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.29/mediawiki-1.29.2.patch.gz.sig Public keys: https://www.mediawiki.org/keys/keys.html _______________________________________________ MediaWiki announcements mailing list To unsubscribe, go to: https://lists.wikimedia.org/mailman/listinfo/mediawiki-announce

6 years, 5 months

Security release: 1.29.2 / 1.28.3 / 1.27.4

by Sam Reed

6 years, 5 months

Fwd: Security pre-release announcement: 1.29.2 / 1.28.3 / 1.27.4

by Sam Reed

Hi all, Tomorrow we will be issuing a security release to all supported branches of MediaWiki. The new releases will be: 1.29.2 1.28.3 1.27.4 This will resolve 9 issues in MediaWiki core. Fixes will be available in these respective release branches, the currently unreleased 1.30.0 and also master. Tarballs will be available for the above mentioned point releases as well. 1.28 was previously announced as end of life, but 1.28.3 will be the final security and maintenance release barring any unforeseen issues. This security release includes fixes for MediaWiki core. --- Sam Reed

6 years, 5 months

"Edit their own user page" right

by Evans, Richard K. (GRC-H000)

Hi .. Happy Monday.. I see in the list of user rights there is a set of rights that relate permit a user to change/view things related only to themselves (i.e.: editmyusercss, viewmywatchlist, etc..) .. but I don't see a right that allows a user to edit their own user page (and subpages) for the user namespace. Editing in the "User" namespace seems to be all-or-nothing. Is it possible to allow a user to edit their own user page, but not any other user's page? Thanks! -Rich

6 years, 5 months

Dependency in positioning an element in a table

by Emanuele D'Arrigo

Hi everybody! I'm in the process of manually converting a number PDF documents to wiki pages. The work is mostly straightforward copy&paste. There is one feature of the original PDFs document however that is hard to convert. To simplify the issue, imagine that document has a two columns layout, one column quite wide and the other, much narrower (say 85%/15%) width. The wide column is full of normal text with some structure (i.e. sections, paragraph and lists). The narrow column has small sparse notes (i.e. dates and people's names) that relate to specific lines of text in the wide column: in the PDF a note is at the same height as the line of text it relates to. Obviously, in a static PDF this works, but in a browser window the text in the wide column will reflow depending on the size and ratio of the window. Therefore, how do I ensure that the note in the small column remains at the same level with the portion of text it relates to? Effectively, how do I anchor the y-position of an element in a column of a wikitable to the y-position of, say, a specific word in another column of the same wiki table? Kind Regards, Manu

6 years, 5 months

Announcing new MediaWiki forum

by Ryan Schmidt

All, Right now, all methods of getting support for and general discussion about MediaWiki fall flat in many areas. * This mailing list is good for long-form questions and answers, but is difficult to search leading to multiple duplicate questions. The nature of the list also makes things like embedding screenshots difficult. * [[Project:Support desk]] on mediawiki.org is serviceable, but long-form questions or answers require a large amount of scrolling due to the narrow content width in Flow, and again attaching screenshots to illustrate problems is difficult. * The #mediawiki channel on IRC (and related channels) are not easy for newbies to discover or use, and many organizations block IRC meaning that we cut off this support method from those at such organizations who have MediaWiki questions. Like the other support methods, screenshots are also difficult. As such, I have launched a new support forum for MediaWiki[1]. It aims to make it easier to not only ask for and receive support compared to the methods I outlined above, but also hopes to serve as a hub where people who run their own MediaWiki installations can connect, share tips, and network. To my knowledge, there is no such “MediaWiki Users Group” outside of mailing lists at this time. The service is ad-free and content posted is available under CC-BY-SA 3.0 so that particularly good answers can be used to bolster documentation on mediawiki.org. I encourage anyone that is interested to check it out, and please let me know if you have any feedback, suggestions, or questions about it 😊. Regards, Skizzerz [1] https://mwusers.org

6 years, 5 months

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

MediaWiki-l November 2017