Hi Everyone,
I'm using MW 1.35.1 release tarball. We migrated to a new VM using Ubuntu 20, x86_64, fully patched. I also updated composer dependencies.
Below is a new error when we edit a wiki page and click Submit. Preview is OK. We did not experience it on our CentOS 7 VM during Submit.
We are in a hardened state. We can't meet Guzzle's requirements because:
open_basedir="/var/www/html/:/var/lib/php/" allow_url_fopen=Off allow_url_include=Off
Looking at Special:Version, Guzzle is described as "Guzzle is a PHP HTTP client library." I don't believe our Mediawiki should be making outbound requests like this. We disabled Guzzle by disabling SpamBlacklist.
This brings a couple of questions:
* Why is Guzzle filtering Sysops or Administrator actions? * Is there another way to get the Spam blacklist? Like a Systemd service that runs once an hour?
Thanks in advance.
==========
[YGi84aU19iAalBwOJ8j4SAAAAAU] /w/index.php?title=Main_Page&action=submit RuntimeException from line 119 of /var/www/html/w/vendor/guzzlehttp/guzzle/src/functions.php: GuzzleHttp requires cURL, the allow_url_fopen ini setting, or a custom HTTP handler.
Backtrace:
#0 /var/www/html/w/vendor/guzzlehttp/guzzle/src/HandlerStack.php(42): GuzzleHttp\choose_handler() #1 /var/www/html/w/includes/http/GuzzleHttpRequest.php(164): GuzzleHttp\HandlerStack::create() #2 /var/www/html/w/includes/http/HttpRequestFactory.php(186): GuzzleHttpRequest->execute() #3 /var/www/html/w/includes/http/HttpRequestFactory.php(208): MediaWiki\Http\HttpRequestFactory->request() #4 /var/www/html/w/extensions/SpamBlacklist/includes/BaseBlacklist.php(370): MediaWiki\Http\HttpRequestFactory->get() #5 /var/www/html/w/extensions/SpamBlacklist/includes/BaseBlacklist.php(329): BaseBlacklist->getHttpText() #6 /var/www/html/w/extensions/SpamBlacklist/includes/BaseBlacklist.php(294): BaseBlacklist->buildSharedBlacklists() #7 /var/www/html/w/includes/libs/objectcache/wancache/WANObjectCache.php(1529): BaseBlacklist->{closure}() #8 /var/www/html/w/includes/libs/objectcache/wancache/WANObjectCache.php(1376): WANObjectCache->fetchOrRegenerate() #9 /var/www/html/w/extensions/SpamBlacklist/includes/BaseBlacklist.php(295): WANObjectCache->getWithSetCallback() #10 /var/www/html/w/extensions/SpamBlacklist/includes/BaseBlacklist.php(224): BaseBlacklist->getSharedBlacklists() #11 /var/www/html/w/extensions/SpamBlacklist/includes/SpamBlacklist.php(89): BaseBlacklist->getBlacklists() #12 /var/www/html/w/extensions/SpamBlacklist/includes/SpamBlacklistHooks.php(45): SpamBlacklist->filter() #13 /var/www/html/w/includes/HookContainer/HookContainer.php(320): SpamBlacklistHooks::filterMergedContent() #14 /var/www/html/w/includes/HookContainer/HookContainer.php(131): MediaWiki\HookContainer\HookContainer->callLegacyHook() #15 /var/www/html/w/includes/HookContainer/HookRunner.php(1529): MediaWiki\HookContainer\HookContainer->run() #16 /var/www/html/w/includes/EditPage.php(1904): MediaWiki\HookContainer\HookRunner->onEditFilterMergedContent() #17 /var/www/html/w/includes/EditPage.php(2363): EditPage->runPostMergeFilters() #18 /var/www/html/w/includes/EditPage.php(1724): EditPage->internalAttemptSave() #19 /var/www/html/w/includes/EditPage.php(680): EditPage->attemptSave() #20 /var/www/html/w/includes/actions/EditAction.php(71): EditPage->edit() #21 /var/www/html/w/includes/actions/SubmitAction.php(38): EditAction->show() #22 /var/www/html/w/includes/MediaWiki.php(527): SubmitAction->show() #23 /var/www/html/w/includes/MediaWiki.php(313): MediaWiki->performAction() #24 /var/www/html/w/includes/MediaWiki.php(940): MediaWiki->performRequest() #25 /var/www/html/w/includes/MediaWiki.php(543): MediaWiki->main() #26 /var/www/html/w/index.php(53): MediaWiki->run() #27 /var/www/html/w/index.php(46): wfIndexMain() #28 {main}
Hi,
On 4/3/21 12:48 PM, Jeffrey Walton wrote:
Looking at Special:Version, Guzzle is described as "Guzzle is a PHP HTTP client library." I don't believe our Mediawiki should be making outbound requests like this. We disabled Guzzle by disabling SpamBlacklist.
The default configuration of SpamBlacklist will use the Wikimedia spam blacklist so it's useful out of the box. You can disable this functionality by adjusting $wgBlacklistSettings.
This brings a couple of questions:
- Why is Guzzle filtering Sysops or Administrator actions?
The SpamBlacklist filters all users actions, see https://phabricator.wikimedia.org/T36928 for more details on why.
- Is there another way to get the Spam blacklist? Like a Systemd
service that runs once an hour?
Yes, the SpamBlacklist supports referencing a local file to use as input, see the documentation[1]. You could easily set up a systemd timer to automatically wget/curl the latest version of the blacklist.
[1] https://www.mediawiki.org/wiki/Extension:SpamBlacklist#Examples
-- Legoktm
mediawiki-l@lists.wikimedia.org