MediaWiki-l July 2024

mediawiki-l@lists.wikimedia.org

8 participants
5 discussions

MediaWiki Insights - June edition
by Birgit Müller 11 Jul '24

11 Jul '24

Hi All, Welcome to the monthly MediaWiki Insights email! First of all, many thanks and congratulations to Harshrathod50 and Ahecht who got their first patch merged in MediaWiki core, extensions or services deployed in Wikimedia production during the month of June! As we concluded the Foundation’s fiscal year 2023/2024 on June 30, 2024, it’s also time to share the final stats for contributions to MediaWiki core over the past year: We’ve achieved a 25% increase in the number of authors who have committed more than 5 patches! The overview <https://www.mediawiki.org/wiki/MediaWiki_Product_Insights/Contributor_reten…>and celebration <https://www.mediawiki.org/wiki/MediaWiki_Product_Insights/Contributor_reten…> pages now include the updated count and authors. Thank you all so much. Project snapshots: Migration to Prometheus reaches milestone, work in flight on REST API, and updates to Wikimedia password storage The Observability team has completed the migration of MediaWiki core metrics to the Prometheus-capable library StatsLib and made significant progress overall <https://grafana.wikimedia.org/d/nCxX65cSk/mediawiki-statslib-migration?orgI…> (tracking task: T343020 <https://phabricator.wikimedia.org/T343020>). This marks a key milestone on the path towards using Prometheus as the standard metrics infrastructure in Wikimedia production. The migration to Prometheus will continue over the next year with the goal to be able to sunset Graphite. Many thanks to the Observability team and everyone who has helped with this migration so far! The MediaWiki Interfaces team has been working on improving the experience of REST API endpoint creators and callers through multiple related initiatives: - Ability to specify REST modules in an OpenApi-like JSON syntax <https://phabricator.wikimedia.org/T366837> - Ability to define JSON schema definitions for body param validation <https://phabricator.wikimedia.org/T362108> - Ability to generate request body specs from param settings <https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1017343> - Exposing a Swagger-UI view of MW REST endpoints <https://phabricator.wikimedia.org/T362006> Putting all this together, REST endpoints can be specified and defined in ways that not only support better namespacing, versioning, and parameter validation, but which also feed directly into generation of an OpenAPI spec which can be viewed on-wiki in an interactive sandbox. Some of this work is still being completed – but these changes should benefit both endpoint creators and endpoint callers. The work has been done in a backward-compatible way, which means we've just introduced the ability to do these things. More work remains to actually realize the benefits of these changes. Many thanks to the MediaWiki Interfaces team and Daniel Kinzler for driving much of the vision for this work. The MediaWiki platform team worked on the completion of the Less.php upgrade work for Less.js 3.0 compatibility, with the release of Less.php 5.0. The release notes are at https://gerrit.wikimedia.org/g/mediawiki/libs/less.php/+/v5.0.0/CHANGES.md. Before we can enable use of new CSS "slash" features in Less.php 5.0, a few extensions and components have to first prepare themselves. Maintainers and contributors are invited to help with this, details are at T368921 <https://phabricator.wikimedia.org/T368921>. Many thanks to Hannah, Dringsim, Piotr, Timo and Bartosz for their work! More highlights from work done to improve security, ease of use, maintainability and overall code health: Zabe updated Wikimedia’s password storage: All passwords are now encrypted <https://phabricator.wikimedia.org/T150647> and we use the stronger Argon2 hashing algorithm <https://phabricator.wikimedia.org/T216682> instead of PBKDF2, which together adds an extra layer of security. A big thanks to Zabe for this important work & to the MediaWiki platform team for code reviews! Rdbms library: We shared about the efforts to improve consistency, security and ease for getting database connections and performing common queries already in the October <https://www.mediawiki.org/wiki/MediaWiki_Product_Insights/Reports/October_2…> and April <https://www.mediawiki.org/wiki/MediaWiki_Product_Insights/Reports/April_202…> MW Insights editions. Over the past weeks, work continued on removing or deprecating methods <https://phabricator.wikimedia.org/T363839> that are no longer needed after the introduction of the new APIs. To date, 19 methods have been removed, the remaining are deprecated or marked internal. The related work to update WMF-deployed extensions to use SelectQueryBuilder <https://phabricator.wikimedia.org/T311866> was completed in May, and the work to migrate WMF-deployed extensions to use expression builder <https://phabricator.wikimedia.org/T350075> made substantial progress over the past months! A huge thanks to Amir Sarabadani for leading on this work, Umherirrender for taking on many updates to extensions, and everyone else who helped make this happen. TK999 refactored redirect storage to follow modern architecture standards ( T290639 <https://phabricator.wikimedia.org/T290639>) - many thanks for working on this :-) Umherirrender worked on removing inline namespaces across core and extensions over the past months (example <https://gerrit.wikimedia.org/r/c/mediawiki/extensions/OAuth/+/1042353>) - many thanks for this impressive long tail of work to ensure consistent usage of namespaced classes across MediaWiki. A big shout out also to Danny712 for supporting this effort with code reviews! The Wikimedia *interwiki-map on Meta* was migrated from a wikitext table to a machine-readable JSON format (T365803 <https://phabricator.wikimedia.org/T365803>). The map is now maintained as JSON at https://meta.wikimedia.org/wiki/Interwiki_map/list, with the former page rendering this into a table for reading convenience, powered by a Scribunto Lua module. Many thanks to Reedy for carrying out this work, and to Pppery and Timo for supporting it! Last, many thanks to the Kiwix team for their work on migrating from Mobile Content Service (MSC) to its replacement, the Page Content Service <https://www.mediawiki.org/wiki/Page_Content_Service> (PCS). This enabled us to set the sunset deadline for the Mobile Content Service <https://phabricator.wikimedia.org/T328036#9930794> for the end of July, 2024. Outlook: We just started with the new annual plan <https://meta.wikimedia.org/wiki/Wikimedia_Foundation_Annual_Plan/2024-2025/…> (July 2024-June 2025) and will share more about this work in the upcoming Insights email. Thanks all for reading! Birgit -- Birgit Müller (she/her) Director of Product, MediaWiki and Developer Experiences Wikimedia Foundation <https://wikimediafoundation.org/>

1 0

MediaWiki Extensions and Skins Security Release Supplement (1.39.8/1.40.4/1.41.2/1.42.0)
by Manfredi Martorana 10 Jul '24

10 Jul '24

Greetings- With the security/maintenance release of MediaWiki 1.39.8/1.40.4/1.41.2/1.42.0, we would also like to provide this supplementary announcement of MediaWiki extensions and skins with now-public Phabricator tasks, security patches and backports [1]: CheckUser + (T361293 <https://phabricator.wikimedia.org/T361293>, CVE-2024-40606) - Special:CheckUser 'Get users' shows hidden usernames to those who do not have the rights to see it https://gerrit.wikimedia.org/r/q/Idc7ed16ca9f3b97735758286c1d1b924b49fb1b2 CheckUser + (T361295 <https://phabricator.wikimedia.org/T361295>, CVE-2024-40610) - CheckUser API for the 'ipusers' and 'actions' request type shows hidden usernames to those who cannot see them https://gerrit.wikimedia.org/r/q/I7a797d509e86916b8cc8a5b6519c42e6aa355ea9 CheckUser + (T361296 <https://phabricator.wikimedia.org/T361296>, CVE-2024-40608) - Special:Investigate exposes suppressed usernames to those who do not have the rights to see them https://gerrit.wikimedia.org/r/q/I75cce32b121ce4c7c2e35f7d00929dc201392241 CheckUser + (T361479 <https://phabricator.wikimedia.org/T361479>, CVE-2024-40607) - Special:CheckUser 'Get actions' page link can expose the username of a suppressed user via the 'logs' URL https://gerrit.wikimedia.org/r/q/I67d76232b131054713534d619d04972f4d84e232 CheckUser + (T326867 <https://phabricator.wikimedia.org/T326867>, CVE-2024-40598) - CheckUser API can expose suppressed information for log events https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CheckUser/+/1017294 CheckUser + (T326865 <https://phabricator.wikimedia.org/T326865>, CVE-2024-40597) - Special:CheckUser can expose suppressed information for log events https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CheckUser/+/1018782 CheckUser + (T338419 <https://phabricator.wikimedia.org/T338419>, CVE-2024-40609) - Wikimedia\RequestTimeout\RequestTimeoutException on Special:Investigate timeline mode https://gerrit.wikimedia.org/r/q/I968310f1f2383001d399befdfc72d41636501f22 CheckUser + (T268147 <https://phabricator.wikimedia.org/T268147>, CVE-2024-40611) - Special:CheckUser shows deleted edits to non-admins CheckUser + (T326866 <https://phabricator.wikimedia.org/T326866>, CVE-2024-40596) - Special:Investigate can expose suppressed information for log events https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CheckUser/+/1034524 https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CheckUser/+/1034100 GuMaxDD + (T361448 <https://phabricator.wikimedia.org/T361448>, CVE-2024-40599) - GuMaxDD skin: stored XSS via MediaWiki:Sidebar https://gerrit.wikimedia.org/r/q/I6c8a72fc6b9d53fc1cefa2ba20ea951eff21060a Nimbus + (T361450 <https://phabricator.wikimedia.org/T361450>, CVE-2024-40604) - Nimbus skin: stored XSS via MediaWiki:Nimbus-sidebar https://gerrit.wikimedia.org/r/q/Ie06722d1728d9cca010dc08fe1b08257c6d77dad Tempo + (T361451 <https://phabricator.wikimedia.org/T361451>, CVE-2024-40602) - Tempo skin: stored XSS via MediaWiki:Sidebar https://gerrit.wikimedia.org/r/q/I574710e673bf09270f385afb4e4b045790a5c14a Foreground + (T361452 <https://phabricator.wikimedia.org/T361452>, CVE-2024-40605) - Foreground skin: stored XSS via MediaWiki:Sidebar https://gerrit.wikimedia.org/r/q/I19522422f6dde1602322b9bd67f8ce028ee48344 BlueLL + (T361453 <https://phabricator.wikimedia.org/T361453>, CVE-2024-40612) - BlueLL skin: stored XSS via MediaWiki:Sidebar https://github.com/lingua-libre/BlueLL/pull/18 Metrolook + (T361449 <https://phabricator.wikimedia.org/T361449>, CVE-2024-40600) - Metrolook skin: stored XSS via MediaWiki:Sidebar https://gerrit.wikimedia.org/r/q/I269fa3af31ff4cdc18a65b095bc7e7d6f175582e MediaWikiChat + (T362588 <https://phabricator.wikimedia.org/T362588>, CVE-2024-40601) - Classic CSRF in MediaWikiChat's API modules https://gerrit.wikimedia.org/r/c/mediawiki/extensions/MediaWikiChat/+/10234… ArticleRatings + (T363884 <https://phabricator.wikimedia.org/T363884>, CVE-2024-40603) - Special:ChangeRating is vulnerable to CSRF https://gerrit.wikimedia.org/r/q/Iafe1b12bc8567d39ca964b16223784374e8e4aa7 Gadgets + (T363773 <https://phabricator.wikimedia.org/T363773>, CVE-2024-40613) - Evil regex used to process gadget definitions https://gerrit.wikimedia.org/r/q/Ic9e1a181b261ae4d25e9ce2f91ad12f92e9855d9 The Wikimedia Security Team recommends updating these extensions and/or skins to the current master branch or relevant, supported release branch [2] as soon as possible. Some of the referenced Phabricator tasks above _may_ still be private. Unfortunately, when security issues are reported, sometimes sensitive information is exposed and since Phabricator is historical, we cannot make these tasks public without exposing this sensitive information. If you have any additional questions or concerns regarding this update, please feel free to contact security(a)wikimedia.org or file a security task within Phabricator [3]. [1] https://phabricator.wikimedia.org/T361321 [2] https://www.mediawiki.org/wiki/Version_lifecycle [3] https://www.mediawiki.org/wiki/Reporting_security_bugs

1 0

Upgrade to 1.42.1 Error
by Bri 07 Jul '24

07 Jul '24

I am upgrading to version 1.42.1 and am getting the following error: ...cargo_tables_template_id key doesn't exist. Running D:\...\extensions\OATHAuth/maintenance/updateTOTPScratchTokensToArray.php... An error occurred: Error 1044: Access denied for user 'db_username'@'%' to database 'virtual' Function: Wikimedia\Rdbms\DatabaseMySQL::doSelectDomain Query: USE `virtual` Notes: $wgDBuser = is _not_ in the form of an email address (xxxxx(a)yyyyyy.zzz) db_username (above is a replacement for the actual db username). Any ideas on how to overcome this? -Brian

3 6

Call for Contributions - MediaWiki Users and Developers Conference
by Cindy Cicalese 05 Jul '24

05 Jul '24

Greetings, MediaWiki users and developers! We are now accepting contributions for the 2024 MediaWiki Users and Developers Conference [0], which will be held April 17-19 in Portland, OR, USA. The deadline to submit a proposal is March 22. Sign up as soon as possible at [1]. This will primarily be an in-person conference, however we will consider remote presentations on a case-by-case basis.The first two days of the conference will be reserved for presentations. The third day of the conference will be a Create Camp, which will include tutorials, hands-on presentations, and small group hacking sessions. The MediaWiki Users and Developers Conference, formerly EMWCon, brings together the community that makes up MediaWiki – those who develop for MediaWiki, those who deploy MediaWiki, and those who use MediaWiki and are enthusiastic about the software. MediaWiki is used every day in a variety of contexts – educational projects, corporate knowledge bases, even online hobbyist communities – all valuing MediaWiki for its flexibility and its openness. By meeting together we can learn from our experiences and continue to build a true community of support for MediaWiki. Looking forward to seeing you in Portland! - The MediaWiki Users and Developers Conference Organizing Committee: James Hare - Conference Chair Cindy Cicalese - Program Chair Bryan Hilderbrand - Registration Chair Jeffrey Wang - Social Chair Ike Hecht - Sponsor Chair Ryan Schmidt - Technology Chair [0] https://www.mediawiki.org/wiki/MediaWiki_Users_and_Developers_Conference_20… [1] https://www.mediawiki.org/wiki/MediaWiki_Users_and_Developers_Conference_20…

2 1

Tutorial on accessing mySQL data in MediaWiki
by Matthew Shell 02 Jul '24

02 Jul '24

Hello, I recently configured my MediaWiki instance to pull data from a mySQL server using the External Data connector. It was a bit tricky, and I couldn’t find any existing tutorials, so I decided to create one. https://youtu.be/4LV0X5M5Kts This page has the step-by-step instructions: https://mshell.net/wikidemo I hope you find this helpful! Matt

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

MediaWiki-l July 2024