MediaWiki-l May 2024

mediawiki-l@lists.wikimedia.org

9 participants
7 discussions

Call for Contributions - MediaWiki Users and Developers Conference
by Cindy Cicalese 05 Jul '24

05 Jul '24

Greetings, MediaWiki users and developers! We are now accepting contributions for the 2024 MediaWiki Users and Developers Conference [0], which will be held April 17-19 in Portland, OR, USA. The deadline to submit a proposal is March 22. Sign up as soon as possible at [1]. This will primarily be an in-person conference, however we will consider remote presentations on a case-by-case basis.The first two days of the conference will be reserved for presentations. The third day of the conference will be a Create Camp, which will include tutorials, hands-on presentations, and small group hacking sessions. The MediaWiki Users and Developers Conference, formerly EMWCon, brings together the community that makes up MediaWiki – those who develop for MediaWiki, those who deploy MediaWiki, and those who use MediaWiki and are enthusiastic about the software. MediaWiki is used every day in a variety of contexts – educational projects, corporate knowledge bases, even online hobbyist communities – all valuing MediaWiki for its flexibility and its openness. By meeting together we can learn from our experiences and continue to build a true community of support for MediaWiki. Looking forward to seeing you in Portland! - The MediaWiki Users and Developers Conference Organizing Committee: James Hare - Conference Chair Cindy Cicalese - Program Chair Bryan Hilderbrand - Registration Chair Jeffrey Wang - Social Chair Ike Hecht - Sponsor Chair Ryan Schmidt - Technology Chair [0] https://www.mediawiki.org/wiki/MediaWiki_Users_and_Developers_Conference_20… [1] https://www.mediawiki.org/wiki/MediaWiki_Users_and_Developers_Conference_20…

2 1

GSoC Intern Introduction - InlineComments
by Jayanth Vikash Saminathan 21 May '24

21 May '24

Hi, I am Jayanth Vikash S, graduate student pursuing my Masters in Computer Science and Engineering at Vellore Institute of Technology, India. I will be contributing towards improving InlineComments extension during this summer through the Google Summer of Code program ( https://summerofcode.withgoogle.com/programs/2024/projects/UfEm7mJW). Yaron Koren and Brian Wolff will be my mentors for this project. I am new to MediaWiki development and I am hoping to learn and contribute after the program as well. Regards Jayanth Vikash S

1 0

The easter hunt for MW 1.20.7
by Tim Starling 19 May '24

19 May '24

On T190369 <https://phabricator.wikimedia.org/T190369> we're trying to complete our collection of old MediaWiki release tarballs. MediaWiki 1.20.7 was released on September 3, 2013. On December 8, 2013, it was reported that something happened to our download server, and many files went missing. Most of the missing files turn out to have been mirrored in once place or another, but 1.20.7, which was only available for three months at most, hasn't shown up yet. Has anyone got a copy? The filename would have been mediawiki-1.20.7.tar.gz -- Tim Starling

5 6

editor toolbar missing after update to mw 1.35
by Marcus Buss 12 May '24

12 May '24

Hello there, maybe someone can help me out: I recently updated my Mediawiki from 1.31 to 1.35.14. Problem: After the update the Toolbar on top of the edit window of the WikiEditor is not displayed anymore, when editing a page I did a websearch, but only found a very old resolved Problem of that kind, which hat to do with settings in mediawiki:common.css. But that file seems unchanged on my wiki. Maybe someone has an idea what could cause this problem? Greetings, Marcus

1 0

Save the date: November 4-6, MediaWiki Users and Developers Conference
by Bernhard Krabina, KM-A 08 May '24

08 May '24

We are happy to announce that the MediaWiki Users and Developers Conference will take place from November 4-6 in Vienna, Austria. After the first conference in April this year in Portland, Oregon, we are happy to bring the conference to Europe. Please help us spread the word and consider sponsoring the conference. In case you are interested, please conatct me, I will send you sponsorship opportunities. https://www.mediawiki.org/wiki/MediaWiki_Users_and_Developers_Conference_Fa… Hope to see you in Vienna! Best, Bernhard -- Mag. Bernhard Krabina, Managing Partner KM-A Knowledge Management Associates GmbH Gersthofer Straße 162, 1180 Vienna Mobile: +43 676 5103593 Email: bernhard.krabina(a)km-a.net<mailto:bernhard.krabina@km-a.net> Web: https://www.km-a.net/ LinkedIn: linkedin.com/in/krabin<https://www.linkedin.com/in/krabina/>a Twitter: twitter.com/krabina<https://twitter.com/krabina> Data· Information· Knowledge

1 0

MediaWiki Extensions and Skins Security Release Supplement (1.39.7/1.40.3/1.41.1)
by Maryum Styles 06 May '24

06 May '24

Greetings- There was a delay in CVE assignment due to a backlog with Mitre. With the security/maintenance release of MediaWiki .39.7/1.40.3/1.41.1, we would also like to provide this supplementary announcement of MediaWiki extensions and skins with now-public Phabricator tasks, security patches and backports [1]: CheckUser + (T355434, CVE-2024-34505) - Temporary account IP reveal does not check the deleted status https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CheckUser/+/992795/ CheckUser + (T356226, CVE-2024-34501) - CheckUser Client Hints REST API does not use a CSRF token https://gerrit.wikimedia.org/r/q/Idc776c7c7612c8b9e2c134706c9e2ebc2f5b655f ReportIncident + (T356190, CVE-2024-34503) - ReportIncident REST API does not use a CSRF token https://gerrit.wikimedia.org/r/q/I27b5899cf69837c9ab8fee2b5bc9b2e788e69f9e IPInfo + (T356183, CVE-2024-34504) - IPInfo REST APIs are not safe from CSRF attacks https://gerrit.wikimedia.org/r/q/I5974c1e71286f5f920ace51ba064e96c88296a4e WikiDiscover + (GHSA-cfcf-94jv-455f, CVE-2024-25107) - Cross-Site Scripting on Special:WikiDiscover https://github.com/miraheze/WikiDiscover/security/advisories/GHSA-cfcf-94jv… UnlinkedWikibase + (T357203, CVE-2024-34500) - XSS through interface message in UnlinkedWikibase https://gerrit.wikimedia.org/r/c/mediawiki/extensions/UnlinkedWikibase/+/10… WikibaseLexeme + (T357101, CVE-2024-34502) - Special:MergeLexemes makes edits on GET requests without edit tokens https://gerrit.wikimedia.org/r/q/Iae0c7c3b979118559c9ce2276618c6cdec11e63d Cargo + (T331362, CVE-2023-29134) - SQL injection in Cargo handling of quotes inside backticks https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1005478 ManageWiki + (GHSA-cfcf-94jv-455f, CVE-2024-25109) - Special:ManageWiki does not escape escape interface messages https://github.com/miraheze/ManageWiki/security/advisories/GHSA-4jr2-jhfm-2… CreateWiki + (GHSA-8wjf-mxjg-j8p9, CVE-2024-29883) - Special:ManageWiki does not escape escape interface messages https://github.com/miraheze/CreateWiki/security/advisories/GHSA-8wjf-mxjg-j… [1] https://phabricator.wikimedia.org/T353904 [2] https://www.mediawiki.org/wiki/Version_lifecycle [3] https://www.mediawiki.org/wiki/Reporting_security_bugs

1 0

MediaWiki Insights: April edition
by Birgit Müller 01 May '24

01 May '24

Hi All, welcome to the monthly MediaWiki Insights email! First of all, congratulations to Ederporto, SD hehua and Labster who got their first patch in MW core or Wikimedia deployed extensions and services merged during the month of April! Many thanks also to the reviewers for your support and thoughtfulness! It's the collaborative effort that makes MediaWiki scale for what it's built for. 10 months ago <https://www.mediawiki.org/wiki/MediaWiki_Product_Insights/Reports/August_20…> we started the journey of ramping up MediaWiki as a product and thinking about ways to systemically tackle the challenges around the MediaWiki software platform. The initial announcement <https://phabricator.wikimedia.org/T336990> and first conversations already happened before we officially kicked things off: At the Wikimedia Hackathon 2023 in Athens. Many interviews, conversations, explorations, investments and decisions later we’re coming back to the Wikimedia Hackathon <https://www.mediawiki.org/wiki/Wikimedia_Hackathon_2024> this year to connect the dots. MediaWiki, the software platform and interfaces that allow Wikipedia and other projects to function, needs ongoing support for the next decade in order to provide creation, moderation, storage, discovery, and consumption of open, multilingual content at scale. What decisions and platform improvements can we make to ensure that MediaWiki is sustainable? - This has been a key guiding question over the past months. Platform improvements have been the subject of many initiatives mentioned in the monthly MediaWiki Insights emails <https://www.mediawiki.org/wiki/MediaWiki_Product_Insights/Reports>, and the focus on sustainability is also reflected in the draft for the Wikimedia Foundation’s annual plan <https://meta.wikimedia.org/wiki/Wikimedia_Foundation_Annual_Plan/2024-2025/…> for the upcoming fiscal year (July 2024 – June 2025). We plan to present an overview on the state of things at the Hackathon, and hope to use the “hallway track” to discuss questions, plans and ideas with some of you! A related presentation has already been given at the recent MediaWiki users and developers conference. We will follow up with links to presentations, a summary and reflections in the next MediaWiki insights email. Stay tuned! MediaWiki track at the Wikimedia Hackathon in Tallinn The Wikimedia Hackathon starts this week! Beyond wanting to talk about MediaWiki, we’ve also put a MediaWiki track <https://www.mediawiki.org/wiki/Wikimedia_Hackathon_2024/MediaWiki_Track> together to help people get started - or continue - with working on MediaWiki (core), discuss and collaborate with each other (workboard <https://phabricator.wikimedia.org/project/board/7117/>). Whether you want to get started, join as a mentor, or talk about MediaWiki - if you’re attending the Hackathon, please come find us at the MediaWiki track table! Project snapshots: ObjectCacheFactory introduced to MediaWiki core, SUL3 and more work on REST API Caching: We introduced ObjectCacheFactory to MediaWiki core (T358346 <https://phabricator.wikimedia.org/T358346>). ObjectCache is responsible for creating and fetching various cache instances for MediaWiki making use of BagOStuff, which is the mechanism for caching in the software's ecosystem. The introduction of the Cache Factory aims to reduce inconsistencies in our codebase and improve stability. Many thanks to Derick for leading on this work and to Timo, Piotr and Gergö for their support! Help with replacing the deprecated static factory methods is much appreciated! Please see this tracking ticket for more information on which repositories need updates: T363770 <https://phabricator.wikimedia.org/T363770>. MediaWiki REST API: We completed T359652 <https://phabricator.wikimedia.org/T359652>, which disallows optional path parameters <https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1016820> in the MediaWiki REST API <https://www.mediawiki.org/wiki/API:REST_API> (aka rest.php) at the PathMatcher <https://gerrit.wikimedia.org/g/mediawiki/core/+/eab7628c59be589c8bba2b29dab…> level. This is important for compatibility with API modules that we are moving from RESTBase <https://www.mediawiki.org/wiki/RESTBase> into MW Core <https://www.mediawiki.org/wiki/Core> as part of RESTBase sunset <https://phabricator.wikimedia.org/T262315> (such as Reading Lists <https://phabricator.wikimedia.org/T336693>), and avoids issues with our generated OpenAPI/swagger specs <https://meta.wikimedia.beta.wmflabs.org/w/rest.php/> (swagger does not allow optional path parameters <https://swagger.io/docs/specification/describing-parameters/#path-parameters>). A big thanks to Bill for his work on this, and to all the people who provided support! Database: SelectQueryBuilder and Expression Builder: We shared about the work that the Data Persistence team has been doing on the MediaWiki Rdbms library’s interface to improve consistency, security and ease for getting database connections and performing common queries in an earlier email <https://www.mediawiki.org/wiki/MediaWiki_Product_Insights/Reports/October_2…>. A big thanks to Amir for all his work on this to date! Since then, a lot of progress has been made on updating MediaWiki repositories in Wikimedia production to use the new SelectQuery and Expression Builders: Many thanks to all the people who helped with this! A special thanks to Umherirrender for migrating an impressive number of extensions to use SelectQuery <https://phabricator.wikimedia.org/T311866> and Expression <https://phabricator.wikimedia.org/T350075> builders over the past month, and to DannyS712 for many reviews! Another highlight is the work done by Taavi over the past year: Allowing multiple different 2FA devices (T242031 <https://phabricator.wikimedia.org/T242031>) is about to wrap up, which should be a nice improvement to make 2FA easier to use! Many thanks to Taavi and everyone involved for this work! SUL3: Browsers increasingly roll out anti-tracking measures and limitations on third-party cookie use. A side effect of this is that it also impacts CentralAuth autologin. We aim to transition to a single sign-on domain to minimize the number of times users need to enter their credentials when changing wikis as well as for other benefits; and are about to move from the research to the coding phase. The implementation plan (with some question marks) is in T348388 <https://phabricator.wikimedia.org/T348388> and its subtasks - feedback is very welcome! The Language team just released MediaWiki Language Extension Bundle 2024.04 (announcement <https://lists.wikimedia.org/hyperkitty/list/mediawiki-l@lists.wikimedia.org…>). They are also looking into changing how and when we release MLEB. Please see T356847 <https://phabricator.wikimedia.org/T356847> for more information and feedback. MediaWiki Release: The 1.42.0-rc.0 announcement will be out soon. MW 1.42-alpha has been branched since April 9th and added to the on-wiki documentation as the development snapshot. If you have changes that need to go to 1.42, they should be backported. New tasks with commits since April 16th have been targeted to the 1.43 unstable branch <https://phabricator.wikimedia.org/project/profile/7083/>. See some of you in Tallinn! Thanks all for reading, Birgit -- Birgit Müller (she/her) Director of Product, MediaWiki and Developer Experiences Wikimedia Foundation <https://wikimediafoundation.org/>

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

MediaWiki-l May 2024