MediaWiki-l April 2021

mediawiki-l@lists.wikimedia.org

20 participants
22 discussions

New episode of Between the Brackets: Liam Wyatt
by Yaron Koren 15 Apr '21

15 Apr '21

Hi, A new episode of the MediaWiki podcast "Between the Brackets" is out - this one is an interview with Liam Wyatt, also known as Wittylama, a longtime Wikimedian who is currently the community liaison for the new Wikimedia Enterprise API project: https://betweenthebrackets.libsyn.com/episode-84-liam-wyatt And while we're at it, now I realize I forgot to send emails about the two previous episodes. So here they are: Jeffrey Wang, founder of the MediaWiki-based wiki farm MyWikis: https://betweenthebrackets.libsyn.com/episode-82-jeffrey-wang Alexander Mashin, administrator of the Russian wiki Traditio: https://betweenthebrackets.libsyn.com/episode-81-alexander-mashin I encourage you to check out all three episodes - they are all interesting in their own way. -Yaron -- WikiWorks · MediaWiki Consulting · http://wikiworks.com

1 0

Unknown: file created in the system's temporary directory
by Jeffrey Walton 14 Apr '21

14 Apr '21

Hi Everyone, I'm seeing some funny business in our log files. [Thu Apr 08 10:52:20.225624 2021] [php7:notice] [pid 1823] [client 71.179.5.32:29418] PHP Notice: Unknown: file created in the system's temporary directory in Unknown on line 0, referer: https://www.cryptopp.com/w/index.php?title=Linux&action=edit We override the upload directory for Apache, so nothing should be written to the system's temporary directory: # grep -IR 'temp_dir' /etc /etc/php/7.4/cli/php.ini:; Defaults to the system default (see sys_get_temp_dir) /etc/php/7.4/cli/php.ini:;sys_temp_dir = "/tmp" /etc/php/7.4/apache2/php.ini:; Defaults to the system default (see sys_get_temp_dir) /etc/php/7.4/apache2/php.ini:sys_temp_dir = "/var/lib/php/tmp" And: # ls -Al /var/lib/php drwxr-xr-x 3 www-data www-data 4096 Mar 31 17:04 modules drwx-wx-wt 2 www-data www-data 4096 Mar 27 2020 sessions drwxr-xr-x 2 www-data www-data 4096 Apr 8 11:37 tmp And: # grep base /etc/php/7.4/apache2/conf.d/99-security.ini open_basedir="/var/www/html/:/var/lib/php/" We are not sure what is going on. I guess we missed a setting somewhere. How is the attacker creating files on the system given they are not logged in? Thanks in advance.

4 5

Syntax Highlighter that does not shell out?
by Jeffrey Walton 13 Apr '21

13 Apr '21

Hi Everyone, I'm looking for a Syntax Highlighter for MW 1.35. The rub is, the extension cannot shell out like the current Syntax Highlighter.[1] Our wiki disables nearly all of those kinds of functions. [1] https://www.mediawiki.org/wiki/Extension:SyntaxHighlight Rather, the extension needs to have (or install via Composer), a Python or PHP compatible library for its use. (Is this considered "native" in the web world?) Would someone recommend a Syntax Highlighter that uses PHP libraries and does not shell out, please?

2 1

Re: [MediaWiki-l] node v4 support in Parsoid deprecated
by José Mª MEDIAVILLA DÍEZ 11 Apr '21

11 Apr '21

1 0

Watchlists load is pin-wheeling under MW 1.35.2
by Jeffrey Walton 10 Apr '21

10 Apr '21

Hi Everyone, We migrated to MW 1.35.2 yesterday. The migration went well and everything seems to work as expected. Today I clicked on Watchlists and found the page load is hanging. I've got the three pulsating circles and some text, but the page does not finish loading. The text is: 17 pages are on your Watchlist (plus talk pages). Email notification is enabled. Changes to pages you haven't visited since the changes occurred are in bold, with solid markers. There are no Mediawiki errors from PHP. There is nothing in error.log. The access.log shows this: x.x.x.x - - [10/Apr/2021:10:37:17 +0000] "GET /wiki/Special:Watchlist HTTP/1.1" 200 7245 x.x.x.x - - [10/Apr/2021:10:37:17 +0000] "GET /w/resources/assets/poweredby_mediawiki_132x47.png HTTP/1.1" 304 - x.x.x.x - - [10/Apr/2021:10:37:17 +0000] "GET /w/load.php?lang=en&modules=startup&only=scripts&raw=1&skin=vector HTTP/1.1" 200 11895 x.x.x.x - - [10/Apr/2021:10:37:17 +0000] "GET /w/load.php?lang=en&modules=jquery%2Coojs%2Coojs-ui-core%2Coojs-ui-widgets%2Csite%7Cjquery.client%2Ccookie%2CmakeCollapsible%7Cjquery.makeCollapsible.styles%7Cmediawiki.String%2CTitle%2CUri%2Capi%2Cbase%2Ccldr%2Ccookie%2CjqueryMsg%2Clanguage%2Cuser%2Cutil%2Cwidgets%7Cmediawiki.libs.pluralruleparser%7Cmediawiki.page.ready%2Cstartup%7Cmediawiki.rcfilters.filters.dm%2Cui%7Cmediawiki.special.changeslist.legend.js%7Cmediawiki.special.recentchanges%2Cwatchlist%7Cmediawiki.widgets.styles%7Coojs-ui-core.icons%2Cstyles%7Coojs-ui-widgets.icons%7Coojs-ui-windows.icons%7Coojs-ui.styles.icons-content%2Cicons-editing-core%2Cicons-editing-styling%2Cicons-interactions%2Cicons-layout%2Cicons-media%2Cicons-moderation%2Cindicators%7Cskins.vector.legacy.js%7Cuser.defaults&skin=vector&version=1y7vj HTTP/1.1" 304 - Any thoughts on how to finish load the Watchlist page? Jeff

1 1

Security and maintenance release: 1.31.13 / 1.35.2
by Sam Reed 09 Apr '21

09 Apr '21

I would like to announce the release of MediaWiki 1.31.13 and 1.35.2! These releases also serve as a maintenance release for these branches. Numerous fixes have been backported into 1.35, including some for PHP 8.0 support (though we are not declaring full PHP 8.0 support yet). This is the first MediaWiki release where zip files are included too. This is due to some issues with the tarballs for some users with certain extraction applications. Composer 2.0 is also now supported on MediaWiki 1.35.2. MediaWiki also has a new logo as of these releases. T270453 does not apply to MediaWiki 1.31.13, as VisualEditor is not bundled. However the patch will be backported to the 1.31 branch if you use VisualEditor, and you should pick up the update from the usual places. T279451 also does not apply to MediaWiki 1.31.13, as Parsoid is not bundled. If you use the node.js service, it is recommended to update this. T276843 has been fixed in different ways on MediaWiki 1.31.13 and MediaWiki 1.35.2. On the former, we have just disabled the known vulnerable lexers. On 1.35.2, we have upgraded pygments from 2.5.2 to 2.7.4. While tarballs have already been uploaded, git tags will follow later on today. An "MediaWiki Extensions Security Release Supplement" email will follow this one. == Security fixes == * (T270453, CVE-2021-30153) SECURITY: ApiVisualEditor leaks info about hidden users. * (T270713, CVE-2021-30152) SECURITY: Allow user to only apply protection they have right to do so via action=protect. * (T270988, CVE-2021-30155) SECURITY: ContentModelChange: Check that user can create pages. * (T272386, CVE-2021-30159) SECURITY: Non-admin deleted enwiki page in fast double move. * (T276843, CVE-2021-20270, CVE-2021-27291) SECURITY: Various SyntaxHighlight lexers are vulnerable to DoS. * (T277009, CVE-2021-30158) SECURITY: Allow blocked users to access Special:ResetTokens. * (T278014, CVE-2021-30154) SECURITY: Escape mediastatistics-header-* messages on Special:NewFiles. * (T278058, CVE-2021-30157) SECURITY: Escape rcfilters-filter-* messages onChangesList pages. * (T279451, CVE-2021-30458) SECURITY: Parsoid comment fostering allows for inserting mostly arbitrary <meta> tags. == Links to all mentioned tasks == * https://phabricator.wikimedia.org/T270453 * https://phabricator.wikimedia.org/T270713 * https://phabricator.wikimedia.org/T270988 * https://phabricator.wikimedia.org/T272386 * https://phabricator.wikimedia.org/T276843 * https://phabricator.wikimedia.org/T277009 * https://phabricator.wikimedia.org/T278014 * https://phabricator.wikimedia.org/T278058 * https://phabricator.wikimedia.org/T279451 == Release notes == Full release notes for 1.31.13: https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_31/RELEASE-NOTES… https://www.mediawiki.org/wiki/Release_notes/1.31 Full release notes for 1.35.2: https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_35/RELEASE-NOTES… https://www.mediawiki.org/wiki/Release_notes/1.35 For information about how to upgrade, see <https://www.mediawiki.org/wiki/Manual:Upgrading> ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.13.tar.gz https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.13.zip Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.31/mediawiki-core-1.31.13.tar.gz https://releases.wikimedia.org/mediawiki/1.31/mediawiki-core-1.31.13.zip Patch to previous version (1.31.12): https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.13.patch.gz https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.13.patch.zip GPG signatures: https://releases.wikimedia.org/mediawiki/1.31/mediawiki-core-1.31.13.tar.gz… https://releases.wikimedia.org/mediawiki/1.31/mediawiki-core-1.31.13.zip.sig https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.13.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.13.zip.sig https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.13.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.13.patch.zip.s… Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.2.tar.gz https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.2.zip Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.35/mediawiki-core-1.35.2.tar.gz https://releases.wikimedia.org/mediawiki/1.35/mediawiki-core-1.35.2.zip Patch to previous version (1.35.1): https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.2.patch.gz https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.2.patch.zip GPG signatures: https://releases.wikimedia.org/mediawiki/1.35/mediawiki-core-1.35.2.tar.gz.… https://releases.wikimedia.org/mediawiki/1.35/mediawiki-core-1.35.2.zip.sig https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.2.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.2.zip.sig https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.2.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.2.patch.zip.sig Public keys: https://www.mediawiki.org/keys/keys.html

3 2

Maintenance release: 1.31.14
by Sam Reed 08 Apr '21

08 Apr '21

The 1.31.14 version fixes an issue with the backports in the 1.31.13 release. The patches linked here need applying on top of the previous patches for 1.31.12. See the previous email for those patches. The full downloads here contain all the previous fixes from the security and maintenance release. Once again, I apologise for the inconvenience of the issues with the previous release. Going forward, we're going to be looking to run more testing on the tarballs (in this case, static analysis via Phan) to hopefully prevent these issues in future. ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.14.tar.gz https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.14.zip Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.31/mediawiki-core-1.31.14.tar.gz https://releases.wikimedia.org/mediawiki/1.31/mediawiki-core-1.31.14.zip Patch to previous version (1.31.13): https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.14.patch.gz https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.14.patch.zip GPG signatures: https://releases.wikimedia.org/mediawiki/1.31/mediawiki-core-1.31.14.tar.gz… https://releases.wikimedia.org/mediawiki/1.31/mediawiki-core-1.31.14.zip.sig https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.14.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.14.zip.sig https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.14.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.14.patch.zip.s… Public keys: https://www.mediawiki.org/keys/keys.html

1 0

Auditing use of tempnam
by Jeffrey Walton 08 Apr '21

08 Apr '21

Hi Everyone, I'm trying to track down what is the cause of the non-logged-in user and the 0-sized file written to /tmp. I'm having trouble auditing the use of tempnam for my Mediawiki installation. I think Mediawiki should provide a wrapper for tempnam, like $wfTempName(...). Ensure the wrapper uses sys_get_temp_dir(). Additionally, the Mediawiki linter should flag direct use of tempnam and point authors to use the wrapper function. Even better, provide a complete wrapper for the tempnam so tempnam is not used. Allow us to put tempnam on the banned function list. Here's the PHP documentation in tempname: https://www.php.net/manual/en/function.tempnam.php. Here's what we get back when trying to audit the use of tempnam: # grep -wIR tempnam /var/www/html/w 2>/dev/null | grep -v sys_get_temp_dir /var/www/html/w/includes/import/WikiImporter.php: $filename = tempnam( wfTempDir(), 'importupload' ); /var/www/html/w/includes/import/ImportableUploadRevisionImporter.php: $tempo = tempnam( wfTempDir(), 'download' ); /var/www/html/w/includes/diff/TextSlotDiffRenderer.php: $tempName1 = tempnam( $tmpDir, 'diff_' ); /var/www/html/w/includes/diff/TextSlotDiffRenderer.php: $tempName2 = tempnam( $tmpDir, 'diff_' ); /var/www/html/w/includes/resourceloader/ResourceLoaderImage.php: $tempFilenameSvg = tempnam( wfTempDir(), 'ResourceLoaderImage' ); /var/www/html/w/includes/resourceloader/ResourceLoaderImage.php: $tempFilenamePng = tempnam( wfTempDir(), 'ResourceLoaderImage' ); /var/www/html/w/includes/GlobalFunctions.php: $oldtextFile = fopen( $oldtextName = tempnam( $td, 'merge-old-' ), 'w' ); /var/www/html/w/includes/GlobalFunctions.php: $mytextFile = fopen( $mytextName = tempnam( $td, 'merge-mine-' ), 'w' ); /var/www/html/w/includes/GlobalFunctions.php: $yourtextFile = fopen( $yourtextName = tempnam( $td, 'merge-your-' ), 'w' ); /var/www/html/w/includes/GlobalFunctions.php: $oldtextFile = fopen( $oldtextName = tempnam( $td, 'merge-old-' ), 'w' ); /var/www/html/w/includes/GlobalFunctions.php: $newtextFile = fopen( $newtextName = tempnam( $td, 'merge-your-' ), 'w' ); /var/www/html/w/extensions/CodeEditor/modules/ace/mode-php_laravel_blade.js:tcpwrap_check|tempnam|textdomain|tidy|tidy_access_count|tidy_config_count|tidy_diagnose|tidy_error_count|tidy_get_error_buffer|\ /var/www/html/w/extensions/CodeEditor/modules/ace/mode-php_laravel_blade.js: "tempnam": [ /var/www/html/w/extensions/CodeEditor/modules/ace/mode-php_laravel_blade.js: "string tempnam(string dir, string prefix)", /var/www/html/w/extensions/CodeEditor/modules/ace/mode-php.js:tcpwrap_check|tempnam|textdomain|tidy|tidy_access_count|tidy_config_count|tidy_diagnose|tidy_error_count|tidy_get_error_buffer|\ /var/www/html/w/extensions/CodeEditor/modules/ace/mode-php.js: "tempnam": [ /var/www/html/w/extensions/CodeEditor/modules/ace/mode-php.js: "string tempnam(string dir, string prefix)", /var/www/html/w/maintenance/mwdocgen.php: $tmpFile = tempnam( wfTempDir(), 'MWDocGen-' ); /var/www/html/w/vendor/phpunit/phpunit/src/Util/PHP/DefaultPhpProcess.php:use function tempnam; /var/www/html/w/vendor/zordius/lightncandy/src/LightnCandy.php: $fn = tempnam($tmpDir, 'lci_'); /var/www/html/w/vendor/phan/phan/src/Phan/Plugin/Internal/UseReturnValuePlugin.php: 'tempnam' => true, /var/www/html/w/vendor/phan/phan/src/Phan/Language/Internal/FunctionSignatureMapReal_php73.php:'tempnam' => '?false|?string', /var/www/html/w/vendor/phan/phan/src/Phan/Language/Internal/FunctionSignatureMap.php:'tempnam' => ['string|false', 'dir'=>'string', 'prefix'=>'string'], /var/www/html/w/vendor/phan/phan/src/Phan/Language/Internal/FunctionSignatureMapReal.php:'tempnam' => 'false|string', /var/www/html/w/vendor/phan/phan/src/Phan/Language/Internal/FunctionDocumentationMap.php:'tempnam' => 'Create file with unique file name', /var/www/html/w/vendor/psy/psysh/src/Configuration.php: return \tempnam($this->getRuntimeDir(), $type . '_' . $pid . '_'); /var/www/html/w/vendor/psy/psysh/src/Command/EditCommand.php: $filePath = \tempnam($this->runtimeDir, 'psysh-edit-command'); /var/www/html/w/vendor/composer/xdebug-handler/src/XdebugHandler.php: if (!$this->tmpIni = @tempnam($tmpDir, '')) { /var/www/html/w/vendor/pear/pear-core-minimal/src/System.php: $tmp = tempnam($tmpdir, $prefix);

1 0

Security pre-release announcement: 1.31.13 / 1.35.2
by Sam Reed 07 Apr '21

07 Apr '21

Hi all, Tomorrow we will be issuing a security and maintenance release to all supported branches of MediaWiki. This has been delayed by a week versus the usual schedule, as making a security last week on 1st April ("April Fools") was deemed not a great idea. The new releases will be: - 1.31.13 - 1.35.2 This will resolve 3 issues in MediaWiki core, 2 issues in bundled extensions (one of which doesn't apply to REL1_31), and also includes some fixes previously committed to git, including minor security and hardening patches along with bug fixes included for maintenance reasons. We will make the fixes available in these respective release branches, and also master. Tarballs will be available for the above mentioned point releases as well. A summary of some of the security fixes that have gone into non-bundled MediaWiki extensions will also follow. [1] https://www.mediawiki.org/wiki/Version_lifecycle

1 0

MediaWiki maintenance scripts documentation
by Jay prakash 07 Apr '21

07 Apr '21

Hello Dear, Sorry for cross posting. I have proposed a project grant to improve documentation of MediaWiki maintenance scripts, to be reviewed during this grants round. The proposal is at https://meta.wikimedia.org/wiki/Grants:Project/Jayprakash12345/Improve_docu… If you have any suggestions or feedback. Please let me know or create a topic on the talk page. Regards, Jay Prakash (he/him)

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

MediaWiki-l April 2021