MediaWiki-l June 2023

mediawiki-l@lists.wikimedia.org

7 participants
11 discussions

Lis tes messages avant qu'ils ne soient effacés!

by Badoo

Lis ton message de Nganguem Victor avant qu'il ne soit effacé! Pour lire ton message, suis simplement ce lien: http://eu1.badoo.com/chatnoirxx/in/p4hxwt052ok/?lang_id=6 D'autres personnes sont aussi présentes: Oded (Tel Aviv, Israël) Priya (Udaipur, Inde) RajaYogi BK (Udaipur, Inde) Karuna (Udaipur, Inde) Chika Reginald Onyia (Pnompen', Cambodge) ...Qui d'autre? http://eu1.badoo.com/chatnoirxx/in/p4hxwt052ok/?lang_id=6 Les liens ne fonctionnent pas dans ce message? Copie les dans la barre d'adresse de ton navigateur. Tu as reçu cet email suite à un message envoyé par Nganguem Victor de notre système. S'il s'agit d'une erreur, ignore simplement cet email. La requête sera alors effacée du système. Amuse-toi bien ! L'équipe Badoo Courrier automatique de Badoo suite à l'envoi d'un message à ton attention sur Badoo. Les réponses ne sont ni stockées, ni traitées. Si tu ne veux plus recevoir de message de Badoo, fais-le nous savoir: http://eu1.badoo.com/impersonation.phtml?lang_id=6&mail_code=65&email=media…

3 months, 3 weeks

MediaWiki 1.38 is End of Life

by Sam Reed

As per the MediaWiki version lifecycle[1], I would like to announce the formal end of life (EOL) of MediaWiki 1.38 as of today, Friday June 30, 2023. 1.38.7 is expected to be the last release for this branch. This means that MediaWiki 1.38 will no longer receive maintenance or security backports. It is therefore strongly discouraged that you continue to use it. It is recommended to upgrade either to MediaWiki 1.39 (LTS), which will be supported until November 2025 or to 1.40 (released today), which will be supported until June 2024. Thanks! Sam Reed [1] https://www.mediawiki.org/wiki/Version_lifecycle

10 months

MediaWiki Extensions and Skins Security Release Supplement (1.35.11/1.38.7/1.39.4/1.40.0)

by Maryum Styles

Greetings- With the security/maintenance release of MediaWiki 1.35.11/1.38.7/1.39.4/1.40.0, we would also like to provide this supplementary announcement of MediaWiki extensions and skins with now-public Phabricator tasks, security patches and backports [1]: CheckUser + (T333569, CVE-2023-37255) - Special:CheckUser 'get edits' is vulnerable to HTML injection through user agent string. https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CheckUser/+/905706/ GoogleAnalyticsMetrics + (T333980, CVE-2023-37251) - GoogleAnalyticsMetrics parser function in extension does not properly escape js in onclick handler and does not prevent using javascript urls. https://gerrit.wikimedia.org/r/c/905661 CheckUser + (T330968, CVE-2023-37252) - Special:CheckUserLog shows usernames which have been hidden. https://gerrit.wikimedia.org/r/c/933686 https://gerrit.wikimedia.org/r/c/932822 Cargo + (T331311, CVE-2023-37256) - Cargo allows storing javascript URLs in URL fields, and automatically linking them. https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/894679 Cargo + (T331065, CVE-2023-37254) - XSS in Special:CargoQuery using default format. https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/894666 ProofreadPage + (T326952, CVE-2023-37253) - ProofreadPage leaks suppressed user via the API and config variables. https://gerrit.wikimedia.org/r/q/Ibe5f8e25dea155bbd811a65833394c0d4b906a34 DoubleWiki + (T323651, CVE-2023-37304) - XSS in DoubleWiki extension (Wikisource). https://gerrit.wikimedia.org/r/c/933666 https://gerrit.wikimedia.org/r/c/933667 https://gerrit.wikimedia.org/r/c/932825 CheckUser + (T338276, CVE-2023-37303) - Wikimedia\Rdbms\DBQueryDisconnectedError when blocking user. https://gerrit.wikimedia.org/r/c/932823 Wikibase + (T250720, CVE-2023-37301) - Wikidata edit filter does not fire when test tool says it should. https://gerrit.wikimedia.org/r/c/933663 Wikibase + (T339111, CVE-2023-37302) - Style injection into badges on Wikidata due to unescaped quotes. https://gerrit.wikimedia.org/r/c/933649 https://gerrit.wikimedia.org/r/c/933650 The Wikimedia Security Team recommends updating these extensions and/or skins to the current master branch or relevant, supported release branch [2] as soon as possible. Some of the referenced Phabricator tasks above _may_ still be private. Unfortunately, when security issues are reported, sometimes sensitive information is exposed and since Phabricator is historical, we cannot make these tasks public without exposing this sensitive information. If you have any additional questions or concerns regarding this update, please feel free to contact security(a)wikimedia.org or file a security task within Phabricator [3]. [1] https://phabricator.wikimedia.org/T333626 [2] https://www.mediawiki.org/wiki/Version_lifecycle [3] https://www.mediawiki.org/wiki/Reporting_security_bugs

10 months

Announcing MediaWiki 1.40.0

by Sam Reed

I am happy to announce the availability of the general release of MediaWiki 1.40! This includes the security fixes announced in 1.35.11/1.38.7/1.39.4. Tarballs have already been uploaded, and the git tag has been pushed. Thanks to everyone who helped out with this release, especially thanks to those who tested out the release candidate and provided feedback, as well as the developers who worked hard to get several important fixes merged in time for the 1.40 final release. To see what's changed in 1.40, see the release notes below. MediaWiki 1.40 is the second release of MediaWiki 'born' with PHP 8.0 and PHP 8.1 support included. We anticipate there may be some as-yet undiscovered bugs with PHP 8.x support, of which we'd love to hear reports so they can be fixed. We plan to back-port fixes to 1.39, 1.38 and 1.35 to the extent possible. MediaWiki 1.40 is due to be supported until the end of June 2024. As a reminder, 1.35 LTS is due to become end-of-life in November 2023, and 1.38 became end-of-life today, 30 June 2023. === Changes since MediaWiki 1.40.0-rc.0 === * Localisation updates. * (T330464) Work around argument corruption bug in XMLReader::open. * build: Updating mediawiki/mediawiki-phan-config to 0.12.1. * Fix frame and frameless rdfa depending on file existing. * (T329214) Pass whether current rev of file exists to Linker::makeBrokenImageLinkObj. * (T334659) Handle thumb errors when !$enableLegacyMediaDOM. * A manualthumb that doesn't exist should be considered a thumb error. * (T313157) IndexPager: Also protect against $offset being 0. * (T335612, CVE-2023-36674) SECURITY: Move badFile lookup to Linker. Open Bugs: [1] https://phabricator.wikimedia.org/project/board/6139/ Bug report form: [2] https://phabricator.wikimedia.org/maniphest/task/edit/form/1/?tags=MW-1.40-… ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.40/mediawiki-1.40.0.tar.gz https://releases.wikimedia.org/mediawiki/1.40/mediawiki-1.40.0.zip Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.40/mediawiki-core-1.40.0.tar.gz https://releases.wikimedia.org/mediawiki/1.40/mediawiki-core-1.40.0.zip Patch to previous version (1.40.0-rc.0): https://releases.wikimedia.org/mediawiki/1.40/mediawiki-1.40.0.patch.gz https://releases.wikimedia.org/mediawiki/1.40/mediawiki-1.40.0.patch.zip GPG signatures: https://releases.wikimedia.org/mediawiki/1.40/mediawiki-core-1.40.0.tar.gz.… https://releases.wikimedia.org/mediawiki/1.40/mediawiki-core-1.40.0.zip.sig https://releases.wikimedia.org/mediawiki/1.40/mediawiki-1.40.0.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.40/mediawiki-1.40.0.zip.sig https://releases.wikimedia.org/mediawiki/1.40/mediawiki-1.40.0.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.40/mediawiki-1.40.0.patch.zip.sig Public keys: https://www.mediawiki.org/keys/keys.html

10 months

Security and maintenance release: 1.35.11 / 1.38.7 / 1.39.4

by Sam Reed

10 months

MediaWiki to register ad Digital Public Good

by Bernhard Krabina, KM-A

Hi, I just found out about the Digital Public Goods Alliance that has a registry: https://digitalpublicgoods.net/registry/ I think WMF should register MediaWiki as digital public good. Other examples in there are CKAN https://app.digitalpublicgoods.net/a/10593 or Drupal https://app.digitalpublicgoods.net/a/10499 Best, Bernhard

10 months

Security pre-release announcement: 1.35.11 / 1.38.7 / 1.39.4

by Sam Reed

Hi all, On Friday we will be issuing a security and maintenance release to all supported branches of MediaWiki. The new releases will be: - 1.35.11 - 1.38.7 - 1.39.4 This will resolve three minor security issues in MediaWiki core, along with bug fixes included for maintenance reasons. This includes various patches for PHP 8.0, PHP 8.1 and PHP 8.2 support. Due to the low severity of two of the patches, they already exist in the respective release branches in git. We will make the fixes available in the respective release branches (plus 1.40 which will also be released tomorrow) and master in git. Tarballs will be available for the above mentioned point releases as well. A summary of some of the security fixes that have gone into non-bundled MediaWiki extensions will also follow later. As a reminder, 1.38 becomes end of life (EOL) tomorrow, June 30, 2023. 1.38.7 is therefore expected to be the last release for this branch. It is recommended to upgrade to 1.39 (the next LTS after 1.35), which will be supported until November 2025, or the newly released 1.40, which will be supported until June 2024. [1] https://www.mediawiki.org/wiki/Version_lifecycle

10 months

Removing the edit form's hidden categories' list

by Sam Wilson

Does anyone have an opinion on the hidden categories list that's shown below the editing form? We're wondering if it should be deleted, because its contents is duplicated in the main categories box further down the page (if you have the showhiddencats preference enabled, and if you do not you perhaps don't want to see hidden categories). Details here: https://phabricator.wikimedia.org/T340606

10 months

New Code of Conduct Committee members

by Martin Urbanec

Hello everyone, The Committee has finished selecting its new members. The new committee candidates are (in alphabetical order): - Amir Sarabadani - Egbe Eugene Agbor (Eugene233) - Jayprakash12345 - MusikAnimal - Nuria Ruiz (Nurieta) Auxiliary members will be (alphabetically): - Effie Mouzeli - Joris Darlington Quarshie - Martin Urbanec - SD0001 - Tony Thomas (01tonythomas) You can read more information about the members at [1]. List of changes from the last term: - Jay is joining the main committee (served as auxiliary member for several years) - I'm moving to the aux committee - SD0001 and Joris Darlington Quarshie are joining the aux committee - Huji and Luke081515 are leaving the aux committee This is not the final structure. According to the CoC [2], the current committee publishes the new members and call for public feedback for *six weeks* and after that, the current committtee might apply changes to the structure based on public feedback. Please let the committee know (via techconduct(a)wikimedia.org) if you have any concern regarding the members and its structure until *30 July 2023* and after that, the new committee will be in effect and will serve for a year. [1] https://www.mediawiki.org/wiki/Code_of_Conduct/Committee/Members/Candidates [2] https://www.mediawiki.org/wiki/Code_of_Conduct/Committee#Selection_of_new_m… Martin Urbanec, on behalf of the Code of Conduct Committee

10 months, 1 week

MediaWiki 1.40.0-rc.0 is ready for testing

by Sam Reed

Apologies for the typo in the subject of the previous email. I'm pleased to announce the immediate availability of MediaWiki 1.40.0-rc.0, the first release candidate for 1.40.0. Download links are at the end of the e-mail. The tag has been signed and pushed to Git. This is not a final release, and should not be used for production websites. Known issues are tracked in Phabricator on the release workboard [1]. As with every release of MediaWiki, a large number of changes have landed in the last six months (over 1850 commits since 1.39.0 was cut), and you should read over the preliminary release notes as part of assuring yourself of areas that may have issues with your configuration, your skins, and/or your extensions. As always, please try out the release candidate in a test environment and do report any issues that you discover. Please use the #MW-1.40-Release [2] tag in Phabricator when reporting issues specific to this release, to make sure that we find them as quickly as possible. It is expected that MediaWiki 1.40 will become final in late June 2023, along with the end-of-life of 1.38. This date may slip if blockers are identified. Preliminary release notes: https://gerrit.wikimedia.org/g/mediawiki/core/+/REL1_40/RELEASE-NOTES-1.40 Open Bugs: [1] https://phabricator.wikimedia.org/tag/mw-1.40-release/ Bug report form: [2] https://phabricator.wikimedia.org/maniphest/task/edit/form/1/?tags=MW-1.40-… ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.40/mediawiki-1.40.0-rc.0.tar.gz https://releases.wikimedia.org/mediawiki/1.40/mediawiki-1.40.0-rc.0.zip Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.40/mediawiki-core-1.40.0-rc.0.ta… https://releases.wikimedia.org/mediawiki/1.40/mediawiki-core-1.40.0-rc.0.zip GPG signatures: https://releases.wikimedia.org/mediawiki/1.40/mediawiki-core-1.40.0-rc.0.ta… https://releases.wikimedia.org/mediawiki/1.40/mediawiki-core-1.40.0-rc.0.zi… https://releases.wikimedia.org/mediawiki/1.40/mediawiki-1.40.0-rc.0.tar.gz.… https://releases.wikimedia.org/mediawiki/1.40/mediawiki-1.40.0-rc.0.zip.sig Public keys: https://www.mediawiki.org/keys/keys.html

10 months, 3 weeks

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

MediaWiki-l June 2023