Hello,
I hope this is the right place to request some support for this subject.
Our wiki (http://www.wikimac.fr) has been vandalized and even though I found some informations on the mediawiki site, I can't really figure out how to resolve quickly this problem and how to protect our wiki to avoid such a problem again.
1) Is there any quick way to recover the pages that have been erase without having to go on the history and recover the content article after article ?
2) I guess to avoid this problem, the best way would be to move our wiki to version 1.5, is that right and is there some extra things to do on the default install to protect it ?
3) Is there a place where I can post (if this can help) the IP that vandalized our wiki ?
Thank you for your precious help
Cyril
1) The quickest way to recover your wiki is to do a database restore from the previous days backup, this will only work if you have a backup and if you wiki doesn't have to many good edits each day.
2) I don't know if 1.5 is any better for this but I believe there is a captcha add-on project you can use. You can also increase the number of posts any one IP can make in given time frame.
3) IP's aren't very usefull as most people use dynamic IP's and a lot of ISP's route all / a lot of there users through proxys.
Arthur Guy
arthur@astarsolutions.co.uk a star solutions www.astarsolutions.co.uk
Audio & Video Leads Adapters and Accessories -----Original Message----- From: mediawiki-l-bounces@Wikimedia.org [mailto:mediawiki-l-bounces@Wikimedia.org] On Behalf Of Cyril Pavillard Sent: 22 October 2005 23:32 To: mediawiki-l@Wikimedia.org Subject: [Mediawiki-l] Wiki vandalized
Hello,
I hope this is the right place to request some support for this subject.
Our wiki (http://www.wikimac.fr) has been vandalized and even though I found some informations on the mediawiki site, I can't really figure out how to resolve quickly this problem and how to protect our wiki to avoid such a problem again.
1) Is there any quick way to recover the pages that have been erase without having to go on the history and recover the content article after article ?
2) I guess to avoid this problem, the best way would be to move our wiki to version 1.5, is that right and is there some extra things to do on the default install to protect it ?
3) Is there a place where I can post (if this can help) the IP that vandalized our wiki ?
Thank you for your precious help
Cyril _______________________________________________ MediaWiki-l mailing list MediaWiki-l@Wikimedia.org http://mail.wikipedia.org/mailman/listinfo/mediawiki-l
'a star solutions' disclaimer The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. If you are not the intended recipient of this message you are hereby notified that any use, review, retransmission, dissemination, distribution, reproduction or any action taken in reliance upon this message is prohibited. If you received this in error, please contact the sender and delete the material from any computer. Any views expressed in this message are those of the individual sender and may not necessarily reflect the views of the company. We believe that this communication is free from viruses and other potentially dangerous programmes, but the recipient opens this communication at their own risk. We assume no responsibility for any loss or damage arising from the receipt or use of this communication
On Oct 23, 2005, at 12:40 AM, Arthur Guy wrote:
The quickest way to recover your wiki is to do a database restore from the previous days backup, this will only work if you have a backup and if you wiki doesn't have to many good edits each day.
:`( well, knowing that I realized a bit too late what happened, there's no more useful backup that can be used.
I don't know if 1.5 is any better for this but I believe there is a captcha add-on project you can use. You can also increase the number of posts any one IP can make in given time frame.
Oh yes, good idea, gonna check that out
IP's aren't very usefull as most people use dynamic IP's and a lot of ISP's route all / a lot of there users through proxys.
That's true, I have been trying to make some search about the IP's but it doesn't give much informations unfortunately.
Arthur Guy
arthur@astarsolutions.co.uk a star solutions www.astarsolutions.co.uk
Audio & Video Leads Adapters and Accessories -----Original Message----- From: mediawiki-l-bounces@Wikimedia.org [mailto:mediawiki-l-bounces@Wikimedia.org] On Behalf Of Cyril Pavillard Sent: 22 October 2005 23:32 To: mediawiki-l@Wikimedia.org Subject: [Mediawiki-l] Wiki vandalized
Hello,
I hope this is the right place to request some support for this subject.
Our wiki (http://www.wikimac.fr) has been vandalized and even though I found some informations on the mediawiki site, I can't really figure out how to resolve quickly this problem and how to protect our wiki to avoid such a problem again.
- Is there any quick way to recover the pages that have been erase
without having to go on the history and recover the content article after article ?
- I guess to avoid this problem, the best way would be to move our
wiki to version 1.5, is that right and is there some extra things to do on the default install to protect it ?
- Is there a place where I can post (if this can help) the IP that
vandalized our wiki ?
Thank you for your precious help
Cyril _______________________________________________ MediaWiki-l mailing list MediaWiki-l@Wikimedia.org http://mail.wikipedia.org/mailman/listinfo/mediawiki-l
'a star solutions' disclaimer The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. If you are not the intended recipient of this message you are hereby notified that any use, review, retransmission, dissemination, distribution, reproduction or any action taken in reliance upon this message is prohibited. If you received this in error, please contact the sender and delete the material from any computer. Any views expressed in this message are those of the individual sender and may not necessarily reflect the views of the company. We believe that this communication is free from viruses and other potentially dangerous programmes, but the recipient opens this communication at their own risk. We assume no responsibility for any loss or damage arising from the receipt or use of this communication
MediaWiki-l mailing list MediaWiki-l@Wikimedia.org http://mail.wikipedia.org/mailman/listinfo/mediawiki-l
Cyril Pavillard wrote:
Hello,
I hope this is the right place to request some support for this subject.
Our wiki (http://www.wikimac.fr) has been vandalized and even though I found some informations on the mediawiki site, I can't really figure out how to resolve quickly this problem and how to protect our wiki to avoid such a problem again.
- Is there any quick way to recover the pages that have been erase
without having to go on the history and recover the content article after article ?
Not really, you will have to play with the database and manually delete the entries :o) I dont think there is any way to selectivly delete revisions from the interface.
- I guess to avoid this problem, the best way would be to move our
wiki to version 1.5, is that right and is there some extra things to do on the default install to protect it ?
Use the spamblacklist extension: http://meta.wikimedia.org/wiki/SpamBlacklist_extension That will deny editing if some text is in a list.
You can use the global list in use on wikimedia servers: http://meta.wikimedia.org/wiki/Spam_blacklist
MediaWiki 1.3.9 got some security issues, you should upgrade to at least 1.3.17. You might want to upgraded to 1.4.11 (lot of bug fixes, same almost the same database schema).
1.5.0 is the lastest stable version and should be faster (but might got some exciting new bugs, database schema changed).
- Is there a place where I can post (if this can help) the IP that
vandalized our wiki ?
Not really, but you can propose the URL spammed on: http://meta.wikimedia.org/wiki/Talk:Spam_blacklist
cheers,
Just to be more precise, all the articles on our wiki have been "erased" so we end up with hundreds of blank pages, the first time it happened I had started to manually go back from the history and restore all the pages but the content keeps being erased and this is being done over a very short time, I guess there's an automatic process doing this.
On Oct 23, 2005, at 12:43 AM, Ashar Voultoiz wrote:
Cyril Pavillard wrote:
Hello,
I hope this is the right place to request some support for this subject.
Our wiki (http://www.wikimac.fr) has been vandalized and even though I found some informations on the mediawiki site, I can't really figure out how to resolve quickly this problem and how to protect our wiki to avoid such a problem again.
- Is there any quick way to recover the pages that have been erase
without having to go on the history and recover the content article after article ?
Not really, you will have to play with the database and manually delete the entries :o) I dont think there is any way to selectivly delete revisions from the interface.
- I guess to avoid this problem, the best way would be to move our
wiki to version 1.5, is that right and is there some extra things to do on the default install to protect it ?
Use the spamblacklist extension: http://meta.wikimedia.org/wiki/SpamBlacklist_extension That will deny editing if some text is in a list.
You can use the global list in use on wikimedia servers: http://meta.wikimedia.org/wiki/Spam_blacklist
MediaWiki 1.3.9 got some security issues, you should upgrade to at least 1.3.17. You might want to upgraded to 1.4.11 (lot of bug fixes, same almost the same database schema).
1.5.0 is the lastest stable version and should be faster (but might got some exciting new bugs, database schema changed).
- Is there a place where I can post (if this can help) the IP that
vandalized our wiki ?
Not really, but you can propose the URL spammed on: http://meta.wikimedia.org/wiki/Talk:Spam_blacklist
cheers,
-- Ashar Voultoiz - WP++++ http://en.wikipedia.org/wiki/User:Hashar http://www.livejournal.com/community/wikitech/ IM: hashar@jabber.org ICQ: 15325080
MediaWiki-l mailing list MediaWiki-l@Wikimedia.org http://mail.wikipedia.org/mailman/listinfo/mediawiki-l
Cyril Pavillard:
Just to be more precise, all the articles on our wiki have been "erased" so we end up with hundreds of blank pages, the first time it happened I had started to manually go back from the history and restore all the pages but the content keeps being erased and this is being done over a very short time, I guess there's an automatic process doing this.
As has been pointed out, you're running a MediaWiki version that has a bug which can lead to database corruption. Upgrade to version 1.3.17, 1.4.11 or 1.5.0 ASAP to avoid serious and permanent loss of data. The 1.5.0 upgrade process is the most dangerous of all these, so make sure you have backups.
Until you do so, I suggest locking the database - if you have the necessary permissions, you should be able to do this using the page Special:Lockdb. You can also manually lock it by creating the file specified in $wgReadOnlyFile in your DefaultSettings.php.
1.5 has many security measures (rate limiting, SORBS proxy blacklist, support for spam blacklist extension etc.). Until you figure out which method is the most effective, you may want to simply disable editing by anonymous users. In 1.5, this is done with $wgGroupPermissions['*']['edit']=false; in LocalSettings.php. This will not help against a determined attacker, but may be enough to deter drive by vandalbots or spambots for some time.
HTH,
Erik
Thank you very Much Erik as well as everybody that answered on the list or directly, I'll work on that and hopefully this will avoid getting other problems.
This Really Helped
Cyril
On Oct 23, 2005, at 2:13 AM, Erik Moeller wrote:
Cyril Pavillard:
Just to be more precise, all the articles on our wiki have been "erased" so we end up with hundreds of blank pages, the first time it happened I had started to manually go back from the history and restore all the pages but the content keeps being erased and this is being done over a very short time, I guess there's an automatic process doing this.
As has been pointed out, you're running a MediaWiki version that has a bug which can lead to database corruption. Upgrade to version 1.3.17, 1.4.11 or 1.5.0 ASAP to avoid serious and permanent loss of data. The 1.5.0 upgrade process is the most dangerous of all these, so make sure you have backups.
Until you do so, I suggest locking the database - if you have the necessary permissions, you should be able to do this using the page Special:Lockdb. You can also manually lock it by creating the file specified in $wgReadOnlyFile in your DefaultSettings.php.
1.5 has many security measures (rate limiting, SORBS proxy blacklist, support for spam blacklist extension etc.). Until you figure out which method is the most effective, you may want to simply disable editing by anonymous users. In 1.5, this is done with $wgGroupPermissions['*']['edit']=false; in LocalSettings.php. This will not help against a determined attacker, but may be enough to deter drive by vandalbots or spambots for some time.
HTH,
Erik _______________________________________________ MediaWiki-l mailing list MediaWiki-l@Wikimedia.org http://mail.wikipedia.org/mailman/listinfo/mediawiki-l
- I guess to avoid this problem, the best way would be to move our
wiki to version 1.5, is that right and is there some extra things to do on the default install to protect it ?
Use the spamblacklist extension: http://meta.wikimedia.org/wiki/SpamBlacklist_extension That will deny editing if some text is in a list.
Reading the named page several times, I am not shure, if I undestood als things well:
1. Where do I find the "Spam Blacklist extension"?
2. How do I install or activate it?
Regards Karl Kirst
-------------------------------------- post@karl-kirst.de
www.karl-kirst.de / www.schule-und-internet.de
Mitarbeit am ZUM-Wiki: www.zum.de/wiki --------------------------------------
Quoted from the MediaWiki page:
"You can get the files via CVS from sourceforge (use the "download" link for each file), including a readme file with detailed instructions."
Re-read the leader of the page with the URL you supplied, and download the Readme for further instructions.
Rob Church
On 23/10/05, Karl-Otto Kirst post@karl-kirst.de wrote:
- I guess to avoid this problem, the best way would be to move our
wiki to version 1.5, is that right and is there some extra things to do on the default install to protect it ?
Use the spamblacklist extension: http://meta.wikimedia.org/wiki/SpamBlacklist_extension That will deny editing if some text is in a list.
Reading the named page several times, I am not shure, if I undestood als things well:
Where do I find the "Spam Blacklist extension"?
How do I install or activate it?
Regards Karl Kirst
post@karl-kirst.de
www.karl-kirst.de / www.schule-und-internet.de
Mitarbeit am ZUM-Wiki: www.zum.de/wiki
MediaWiki-l mailing list MediaWiki-l@Wikimedia.org http://mail.wikipedia.org/mailman/listinfo/mediawiki-l
Thanks for your helpful advise. (I've been some days in hospital and couldn't answer before.)
Regards Karl Kirst
-----Ursprüngliche Nachricht----- Von: mediawiki-l-bounces@Wikimedia.org [mailto:mediawiki-l-bounces@Wikimedia.org]Im Auftrag von Rob Church Gesendet: Montag, 24. Oktober 2005 03:03 An: MediaWiki announcements and site admin list Betreff: Re: [Mediawiki-l] Re: Wiki vandalized
Quoted from the MediaWiki page:
"You can get the files via CVS from sourceforge (use the "download" link for each file), including a readme file with detailed instructions."
Re-read the leader of the page with the URL you supplied, and download the Readme for further instructions.
Rob Church
On 23/10/05, Karl-Otto Kirst post@karl-kirst.de wrote:
- I guess to avoid this problem, the best way would be to move our
wiki to version 1.5, is that right and is there some extra things to do on the default install to protect it ?
Use the spamblacklist extension: http://meta.wikimedia.org/wiki/SpamBlacklist_extension That will deny editing if some text is in a list.
Reading the named page several times, I am not shure, if I undestood als things well:
Where do I find the "Spam Blacklist extension"?
How do I install or activate it?
Regards Karl Kirst
post@karl-kirst.de
www.karl-kirst.de / www.schule-und-internet.de
Mitarbeit am ZUM-Wiki: www.zum.de/wiki
MediaWiki-l mailing list MediaWiki-l@Wikimedia.org http://mail.wikipedia.org/mailman/listinfo/mediawiki-l
MediaWiki-l mailing list MediaWiki-l@Wikimedia.org http://mail.wikipedia.org/mailman/listinfo/mediawiki-l
mediawiki-l@lists.wikimedia.org