MediaWiki-l October 2021

mediawiki-l@lists.wikimedia.org

8 participants
7 discussions

by Jeffrey Walton

Hi Everyone, During a Mediawiki 1.34.3 to Mediawiki 1.34.4 upgrade... When updating vendor components using 'php -d extension=phar.so composer.phar update': Package wikimedia/password-blacklist is abandoned, you should avoid using it. Use wikimedia/common-passwords instead. Package jakub-onderka/php-parallel-lint is abandoned, you should avoid using it. Use php-parallel-lint/php-parallel-lint instead. Package jakub-onderka/php-console-color is abandoned, you should avoid using it. Use php-parallel-lint/php-console-color instead. Package jakub-onderka/php-console-highlighter is abandoned, you should avoid using it. Use php-parallel-lint/php-console-highlighter instead. Package phpunit/php-token-stream is abandoned, you should avoid using it. No replacement was suggested. Package phpunit/phpunit-mock-objects is abandoned, you should avoid using it. No replacement was suggested. I don't add things to vendor/, and I did not install packages like password-blacklist or php-parallel-lint. It looks like these are part of a Mediawiki installation. /var/www/html/wiki# find . -name password-blacklist ./vendor/wikimedia/password-blacklist /var/www/html/wiki# find . -name php-parallel-lint ./vendor/jakub-onderka/php-parallel-lint Jeff

1 year, 12 months

MediaWiki Language Extension Bundle 2021.10 release

by Kartik Mistry

Hello all, I would like to announce the release of MediaWiki Language Extension Bundle 2021.10. This bundle is compatible with '''MediaWiki 1.35.3''' or above and requires '''PHP 7.3.19''' or above. Next MLEB is expected to be released in 3 months. If there are very important bug fixes, we will do an intermediate release. Please give us your feedback at [[Talk:MLEB|https://www.mediawiki.org/wiki/Talk:MLEB]]. * Download: https://translatewiki.net/mleb/MediaWikiLanguageExtensionBundle-2021.10.tar… * sha256sum: ce923b2a661e3a97ec8f0add9eb9369637e02cbb70a47b80a1e50f3e8c0001d6 * Signature: https://translatewiki.net/mleb/MediaWikiLanguageExtensionBundle-2021.10.tar… Quick links: * Installation instructions are at: https://www.mediawiki.org/wiki/MLEB * Announcements of new releases will be posted to a mailing list: https://lists.wikimedia.org/mailman/listinfo/mediawiki-i18n * Report bugs to: https://phabricator.wikimedia.org/project/view/1464/ Release notes for each extension are below. -- Kartik Mistry == Highlights == * MLEB now requires MediaWiki 1.35.3 and PHP 7.3.19 * This release contains security fixes. We recommend updating as soon as possible. * Prevent non-wikitext pages from being marked for translation ([[gerrit:c/mediawiki/extensions/Translate/+/718014|Gerrit]], [[phab:T163254|Phabricator]]) * Add support for moving talkpages when moving translatable pages ([[gerrit:c/mediawiki/extensions/Translate/+/709102|Gerrit]], [[phab:T41023|Phabricator]]) * The translation UI (TUX) now uses the user preferred edit fonts when displaying the source message & the editor ([[gerrit:c/719641|Gerrit]], [[phab:T213658|Phabricator]]) == Known Issues == * The new Vector skin has a configuration parameter <code>$wgVectorLanguageInHeader</code> that moves the language links from the sidebar into a menu beside the page title. With MediaWiki 1.36, New Vector (REL1_36 branch) and <code>$wgVectorLanguageInHeader</code> set to true, the menu beside the title does not respond to click events and is hence unusable. We recommend setting <code>$wgVectorLanguageInHeader</code> to false if you are using MediaWiki 1.36. == Babel, cldr, and LocalisationUpdate == * Localisation and maintenance updates. == CleanChanges == * Fix: RecentChanges: When filtering with only a nonexistent user, changes from all users are displayed ([ https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CleanChanges/+/730538 Gerrit], [https://phabricator.wikimedia.org/T293257 Phabricator]) * Localisation and maintenance updates. == Translate == * SpecialPageTranslation: Show correct number of units marked for translation ([[gerrit:c/mediawiki/extensions/Translate/+/705885|Gerrit]]) * Fix translation of pages with custom content models ([[gerrit:c/mediawiki/extensions/Translate/+/693984|Gerrit]], [[phab:T258756|Phabricator]]) * TranslatablePageMover: Fix incorrect target page validation ([[gerrit:c/mediawiki/extensions/Translate/+/710285|Gerrit]]) * Extended export.php's capabilities to allow exporting everything with a single invocation ([[phab:T287476|Phabricator]]) * Fix Discouraged translatable page is no longer discouraged after move ([[gerrit:c/mediawiki/extensions/Translate/+/708493|Gerrit]], [[phab:T287373|Phabricator]]) * Special:PageTranslation: Display consistent success/warning/error messages ([[gerrit:c/mediawiki/extensions/Translate/+/714972|Gerrit]]) * Fix Pages discouraged from translation should warn translators ([[gerrit:c/mediawiki/extensions/Translate/+/714215|Gerrit]], [[phab:T237590|Phabricator]]) * Fix TUX should have try again button upon save failure ([[gerrit:c/mediawiki/extensions/Translate/+/713234|Gerrit]], [[phab:T272791|Phabricator]]) * TUX: Ensure optional message is checked based on URL options ([[gerrit:c/mediawiki/extensions/Translate/+/713219|Gerrit]], [[phab:T264075|Phabricator]]) * SpecialTranslate: Fix proofreading tooltip anchor ([[gerrit:c/mediawiki/extensions/Translate/+/713637|Gerrit]], [[phab:T281466|Phabricator]]) * Fix Page display title no longer translatable by default ([[gerrit:c/mediawiki/extensions/Translate/+/709502|Gerrit]], [[phab:T287816|Phabricator]]) * Fix TUX should not use a wrong uselang value as fallback ([[gerrit:c/mediawiki/extensions/Translate/+/713601|Gerrit]], [[phab:T279252|Phabricator]]) * Add new validator NotEmptyValidator ([[gerrit:c/mediawiki/extensions/Translate/+/713880|Gerrit]], [[phab:T261305|Phabricator]]) * Add dir/lang attribute for outdated translation header ([[gerrit:c/mediawiki/extensions/Translate/+/714323|Gerrit]], [[phab:T289440|Phabricator]]) * Special:PageTranslation: Require <code><nowiki><translate></nowiki></code> tags on the latest version for marking ([[gerrit:c/mediawiki/extensions/Translate/+/714971|Gerrit]], [[phab:T289697|Phabricator]]) * Special:PageTranslation: <code>tpt-badtitle</code> expects a parameter ([[gerrit:c/mediawiki/extensions/Translate/+/714970|Gerrit]]) * Use user preferred edit font in sourcemessage & editor ([[gerrit:c/719641|Gerrit]], [[phab:T213658|Phabricator]]) * Fix The page translation language list should use HTML list instead of literal bullet points ([[gerrit:c/mediawiki/extensions/Translate/+/718862|Gerrit]], [[phab:T280742|Phabricator]]) * Remove language URL parameter in "Translate this page" link ([[gerrit:c/mediawiki/extensions/Translate/+/720664|Gerrit]], [[phab:T286110|Phabricator]]) * Add support for moving talkpages when moving translatable pages ([[gerrit:c/mediawiki/extensions/Translate/+/709102|Gerrit]], [[phab:T41023|Phabricator]]) * Redirect page should not block translation page ([[gerrit:c/mediawiki/extensions/Translate/+/710300|Gerrit]], [[phab:T284116|Phabricator]]) * Prevent non-wikitext pages from being marked for translation ([[gerrit:c/mediawiki/extensions/Translate/+/718014|Gerrit]], [[phab:T163254|Phabricator]]) * Update moveTranslatablePageScript.php to make moving sub pages the default ([[gerrit:c/mediawiki/extensions/Translate/+/721821|Gerrit]]) * Fix Special:PageMigration - "query - messagecollection" API throws an error ([[gerrit:c/mediawiki/extensions/Translate/+/723813|Gerrit]]) * Performance optimizations for Translate metadata ([[phab:T204026|Phabricator]]) * Add <code>%MESSAGE_URL%</code> placeholder for support params ([[gerrit:c/mediawiki/extensions/Translate/+/724701|Gerrit]]) * Avoid outputting invalid lang="qqq" on Special:Translations and Special:SupportedLanguages ([[phab:T259137|Phabricator]]) * Allow excluding certain messages from validation ([[gerrit:c/mediawiki/extensions/Translate/+/730034|Gerrit]], [[phab:T289480|Phabricator]]) * Special:Translate: Ensure translated name for the group appears ([[gerrit:c/mediawiki/extensions/Translate/+/731970|Gerrit]]) * Localisation and maintenance updates === Security === * Allow revdel-related actions in translatable pages ([[gerrit:c/mediawiki/extensions/Translate/+/725385|Gerrit]]) === Breaking changes === * Export script: remove <code>--hours</code> ([[gerrit:c/mediawiki/extensions/Translate/+/705677|Gerrit]]) * Remove translation aids customization (Hook: <code>TranslateTranslationAids</code>) ([[gerrit:c/mediawiki/extensions/Translate/+/715939|Gerrit]]) * Remove <code>$wgTranslateDelayedMessageIndexRebuild</code> ([[gerrit:c/mediawiki/extensions/Translate/+/719062|Gerrit]]) * Remove <code>getConfiguration</code> and <code>getFFS</code> from MessageGroup ([[gerrit:c/mediawiki/extensions/Translate/+/715946|Gerrit]]) * Group configuration: Rename validator keymatch option to include ([[gerrit:c/mediawiki/extensions/Translate/+/730035|Gerrit]]) == UniversalLanguageSelector == * '''SECURITY''': Language name search: Avoid searching for very long search keys ([[gerrit:c/mediawiki/extensions/UniversalLanguageSelector/+/732274|Gerrit]], [[phab:T293749|Phabricator]]) * Improve support for the new Vector Skin * Remove configuration <code>ULSEnableAnon</code> ([[gerrit:c/mediawiki/extensions/UniversalLanguageSelector/+/707229|Gerrit]]) * Add support for multiple ULS buttons ([[gerrit:c/mediawiki/extensions/UniversalLanguageSelector/+/719325|Gerrit]]) * Localisation and maintenance updates. -- Kartik Mistry | કાર્તિક મિસ્ત્રી kartikm.wordpress.com

2 years, 1 month

Pages not showing with error messages

by Jingyi C. Shi

Dear all, I am restoring my mediawiki website on a new server. It happened this error: [4027854c] /dir/index.php/Welcome_to_MyWebsite MWException from line 1287 of /var/www/xxx/dir/includes/parser/Preprocessor_DOM.php: PPFrame_DOM::expand: Invalid parameter type Do you have any ideas? What does it indicate? I look forward to any help. Thank you all! Best, Catherine

2 years, 1 month

Recent episodes of Between the Brackets: Bill Pirkle, Ziko van Dijk, etc.

by Yaron Koren

Hi, I host a podcast, "Between the Brackets", where I talk to notable MediaWiki developers, administrators and consultants. It looks like I last posted to this mailing list about it in August - since then four new episodes have come out. Here they are: Igor Absorto, a freelance MediaWiki developer and consultant based in Brazil: https://betweenthebrackets.libsyn.com/episode-93-igor-absorto Bill Pirkle, a senior software engineer on the Platform Engineering Team at the Wikimedia Foundation: https://betweenthebrackets.libsyn.com/episode-94-bill-pirkle Ziko van Dijk, a veteran Wikimedian and author, who also co-runs the children's wiki encyclopedia Klexikon: https://betweenthebrackets.libsyn.com/episode-96-ziko-van-dijk Bryan Hilderbrand, a MediaWiki consultant for both TeGnosis and WikiWorks: https://betweenthebrackets.libsyn.com/episode-97-bryan-hilderbrand All four were good discussions - feel free to check out one or more of them! -Yaron

2 years, 1 month

MediaWiki 1.37.0-rc.0 is ready for testing

by Sam Reed

I'm pleased to announce the immediate availability of MediaWiki 1.37.0-rc.0, the first release candidate for 1.37.x. Download links are at the end of the e-mail. The tag has been signed and pushed to Git. This is not a final release, and should not be used for production websites. Known issues are tracked in Phabricator on the release workboard [1]. As with every release of MediaWiki, a large number of changes have landed in the last six months (over 1700 commits since 1.36.0 was cut), and you should read over the preliminary release notes as part of assuring yourself of areas that may have issues with your configuration, your skins, and/or your extensions. As always, please try out the release candidate in a test environment and do report any issues that you discover. Please use the #MW-1.37-Release [2] tag in Phabricator when reporting issues specific to this release, to make sure that we find them as quickly as possible. It is expected that MediaWiki 1.37 will become final in November 2021, though the date may slip if blockers are identified. Preliminary release notes: https://gerrit.wikimedia.org/g/mediawiki/core/+/REL1_37/RELEASE-NOTES-1.37 https://www.mediawiki.org/wiki/Release_notes/1.37 Public keys: https://www.mediawiki.org/keys/keys.html Open Bugs: [1] https://phabricator.wikimedia.org/project/board/4928/ Bug report form: [2] https://phabricator.wikimedia.org/maniphest/task/edit/form/1/?tags=MW-1.37-… ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.0-rc.0.tar.gz https://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.0-rc.0.zip Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.37/mediawiki-core-1.37.0-rc.0.ta… https://releases.wikimedia.org/mediawiki/1.37/mediawiki-core-1.37.0-rc.0.zip GPG signatures: https://releases.wikimedia.org/mediawiki/1.37/mediawiki-core-1.37.0-rc.0.ta… https://releases.wikimedia.org/mediawiki/1.37/mediawiki-core-1.37.0-rc.0.zi… https://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.0-rc.0.tar.gz.… https://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.0-rc.0.zip.sig Public keys: https://www.mediawiki.org/keys/keys.html

2 years, 1 month

Subject: MediaWiki Extensions and Skins Security Release Supplement (1.31.16/1.35.4/1.36.2)

by Maryum Styles

Greetings- With the security/maintenance release of MediaWiki 1.31.16/1.35.4/1.36.2 [0], we would also like to provide this supplementary announcement of MediaWiki extensions and skins with now-public Phabricator tasks, security patches and backports [1]: == DataDump == + (T286376, CVE-2021-32774) - Potential CSRF generating dumps < https://github.com/miraheze/DataDump/commit/67a82b76e186925330b89ace9c5fd89… > == GlobalWatchlist == + (T286385, CVE-2021-42046) - XSS in GlobalWatchlist <https://gerrit.wikimedia.org/r/q/Ib7f9b009730fe0df283cec1169f84c7a83a58b1d> <https://gerrit.wikimedia.org/r/q/Id2204fb5afe591d63764466de35ac0aaa5999983> == Translate == + (T286884, CVE-2021-42049) - Oversight action not reversible in translated page <https://gerrit.wikimedia.org/r/q/I4d95220ef414337147235f7ebedc9b945c3348e3 > == GrowthExperiments == + (T289063, CVE-2021-42047) - Mentor dashboard: Permanent XSS exploitable by wiki admins < https://gerrit.wikimedia.org/r/c/mediawiki/extensions/GrowthExperiments/+/7… > == GrowthExperiments == + (T289064, CVE-2021-42048) - Newcomer homepage Impact module: Permanent XSS exploitable by admins for new accounts <https://gerrit.wikimedia.org/r/q/Iaa90a8976834d70caad592e9d1b18510318db537 > == SecurePoll == + (T289385, CVE-2021-42045) - Modified HTTP headers allow XSS <https://gerrit.wikimedia.org/r/q/I4f04083cd00884d3b85245460774c81c7639a578> == Growth Experiments == + (T289408, CVE-2021-42044) - Permanent XSS exploitable by wiki admins (client-side part) <https://gerrit.wikimedia.org/r/q/I858d55fb2eca9b50ac6ef5a6f2a7b2784f0fa0d6> == Growth Experiments == + (T290692, CVE-2021-42042) - Permanent XSS exploitable by wiki admins in SpecialEditGrowthConfig <https://gerrit.wikimedia.org/r/q/Ibeb13d032ca044af53f6b2334e27b6b97b6f4e9f> == Loops == + (T287347, CVE-2021-42040) - Loops can cause php-fpm exhaustion <https://gerrit.wikimedia.org/r/q/I0caf6f129f94612b5bcf406a171aa5ffedea1f80> == CentralAuth == + (T291696, CVE-2021-42041) - XSS vulnerability in the 'setchange' log <https://gerrit.wikimedia.org/r/q/I7aeaa6e4de5ccaa5eeb6bf4fb00c96b01d5fea35> == MediaSearch == + (T291600, CVE-2021-42043) - XSS on Special:MediaSearch <https://gerrit.wikimedia.org/r/q/If64eb5842237c92290d07ebc3fe14710d9de3fc2> The Wikimedia Security Team recommends updating these extensions and/or skins to the current master branch or relevant, supported release branch [2] as soon as possible. Some of the referenced Phabricator tasks above _may_ still be private. Unfortunately, when security issues are reported, sometimes sensitive information is exposed and since Phabricator is historical, we cannot make these tasks public without exposing this sensitive information. If you have any additional questions or concerns regarding this update, please feel free to contact security(a)wikimedia.org or file a security task within Phabricator [3]. [0] https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikime… [1] https://phabricator.wikimedia.org/T285414 [2] https://www.mediawiki.org/wiki/Version_lifecycle [3] https://www.mediawiki.org/wiki/Reporting_security_bugs

2 years, 1 month

SMWCon 2021 Call for Contributions

by Ad Strack van Schijndel

Hello (Semantic) MediaWiki maintainers, software developers, consultants, researchers! The SMWCon in fall 2021 (https://www.semantic-mediawiki.org/wiki/SMWCon_Fall_2021) will again be held online and free of charge. On three days there will be talks, tutorials and hackathons. Call for Contributions ---------------------------- We are looking for use cases and best practices that provide insight in issues like * How can we use semantic technologies to create smart organizations * How do semantic wikis fit in * How can we use Semantic MediaWiki in research * How do we develop and deploy semantic wiks Your experience is valuable for all of us! So please share and propose a talk, tutorial or other contribution. Go to the Conference Page (https://www.semantic-mediawiki.org/wiki/SMWCon_Fall_2021) and hit the 'Propose a talk here' button. We look forward to your contribution until October 31st! Sponsoring ---------------- Should you be interested in sponsoring the conference, please let us know. We are glad to discuss the options with you. The organizers of SMWCon 2021 * Bernhard Krabina (General Chair) * Ad Strack van Schijndel (Program Chair) * Billy Sims (Local Chair)

2 years, 1 month

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

MediaWiki-l October 2021