Wikitech-l December 2014

wikitech-l@lists.wikimedia.org

88 participants
99 discussions

MediaWiki core tests now require HHVM compliance
by Antoine Musso 18 Dec '14

18 Dec '14

Hello, Jenkins runs the MediaWiki core unit tests under HHVM and the job will now prevent changes to be merged if it fails. Huge thanks to everyone that helped fix tests and HHVM code base! -- Antoine "hashar" Musso

3 2

MediaWiki Security and Maintenance Releases: 1.24.1, 1.23.8, 1.22.15 and 1.19.23
by Markus Glaser 18 Dec '14

18 Dec '14

Hello everyone, I would like to announce the release of MediaWiki 1.24.1, 1.23.8, 1.22.15 and 1.19.23. This is a regular security and maintenance release. Download links are given at the end of this email. Please note this release marks the end of lifetime for MediaWiki 1.22 branch. == Security fixes in 1.24.1, 1.23.8, 1.22.15 and 1.19.23 == * (bug T76686) [SECURITY] thumb.php outputs wikitext message as raw HTML, which could lead to xss. Permission to edit MediaWiki namespace is required to exploit this. * (bug T77028) [SECURITY] Malicious site can bypass CORS restrictions in $wgCrossSiteAJAXdomains in API calls if it only included an allowed domain as part of its name. == Bugfixes == * (bug T74222) The original patch for T74222 was reverted as unnecessary. * Fixed a couple of entries in RELEASE-NOTES-1.24. * (bug T76168) OutputPage: Add accessors for some protected properties. * (bug T74834) Make 1.24 branch directly installable under PostgreSQL. * Add missing $ in front of variable in OutputPage.php == Security fixes in extensions == * (bug T77624) [SECURITY] Extension:Listings: missing validation in the 'name' and 'url' parameters. * (bug T73111) [SECURITY] Extension:ExpandTemplates: parses user input as wikitext and shows a preview, yet it fails to add an edit token to the form and check it. This can be exploited as an XSS when $wgRawHtml = true. Note this only affects the 1.19/1.22 branches. * (bug T76195) [SECURITY] Extension:TemplateSandbox: Special:TemplateSandbox needs edit token when raw HTML is allowed * (bug T69180) [SECURITY] Extension:Hovercards: XSS in text extracts. * (bug T73167) [SECURITY] Extension:Scribunto allows cross-origin leakage of data from a wiki through timing * (bug T71209) [SECURITY] Extension:TimedMediaHandler: Patch getid3 library for CVE-2014-2053. Full release notes for 1.24.1: <https://www.mediawiki.org/wiki/Release_notes/1.24> Full release notes for 1.23.8: <https://www.mediawiki.org/wiki/Release_notes/1.23> Full release notes for 1.22.15: <https://www.mediawiki.org/wiki/Release_notes/1.22> Full release notes for 1.19.23: <https://www.mediawiki.org/wiki/Release_notes/1.19> Public keys: <https://www.mediawiki.org/keys/keys.html> ********************************************************************** 1.24.1 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.24/mediawiki-1.24.1.tar.gz Patch to previous version (1.24.0): https://releases.wikimedia.org/mediawiki/1.24/mediawiki-1.24.1.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.24/mediawiki-core-1.24.1.tar.gz.… https://releases.wikimedia.org/mediawiki/1.24/mediawiki-1.24.1.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.24/mediawiki-1.24.1.patch.gz.sig ********************************************************************** 1.23.8 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.8.tar.gz Patch to previous version (1.23.7): https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.8.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.23/mediawiki-core-1.23.8.tar.gz.… https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.8.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.8.patch.gz.sig ********************************************************************** 1.22.15 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.15.tar.gz Patch to previous version (1.22.14): https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.15.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.22/mediawiki-core-1.22.15.tar.gz… https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.15.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.15.patch.gz.sig ********************************************************************** 1.19.23 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.23.tar.gz Patch to previous version (1.19.22): https://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.23.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.19/mediawiki-core-1.19.23.tar.gz… https://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.23.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.23.patch.gz.sig Markus Glaser (Wiki Release Team)

4 5

Autoloader/ResourceLoader to be tested on extensions
by Antoine Musso 18 Dec '14

18 Dec '14

Hello, I found out we do not run on extensions the 'structure' testsuite of mediawiki/core. It is made of three tests in tests/phpunit/structure AutoLoaderTest.php verify classes are properly registered, and the autloader entries point to an actual file ResourcesTest.php ditto for the Resource Loader StructureTest.php makes sure test files ends with Test.php Jenkins runs on extensions the 'extension' testsuite, I will add the 'structure' directory to it tomorrow morning ~9am UTC. You can verify whether your extension pass by running: php tests/phpunit/phpunit.php --testsuite structure The patch for core is: https://gerrit.wikimedia.org/r/#/c/180496/ Ideally we should backport it to REL branches as well. Filled as https://phabricator.wikimedia.org/T78798 -- Antoine "hashar" Musso

1 1

ANN: WikiMedia recent changes DDP API
by Mitar 18 Dec '14

18 Dec '14

Hi! I made a a Meteor DDP API to the stream of recent changes on all WikiMedia wikis. Now you can simply use DDP.connect on in your Meteor application to connect to stream of changes on Wikipedia. :-) http://wikimedia.meteor.com/ Mitar -- http://mitar.tnode.com/ https://twitter.com/mitar_m

2 2

eliminate wgParser from WikitextContent
by Keith Welter 18 Dec '14

18 Dec '14

Can anyone think of a reason *not* to eliminate wgParser usage from WikitextContent? I have a bug (T76651) that is resolved by making WikitextContent use its own parser instance rather than wgParser. I wrote an experimental fix of WikitextContent that clones the parser in the same way as MessageCache::getParser and am trying to decide the best way forward. Thanks, Keith Welter

2 1

Scrum of Scrums Notes for 2014-12-17
by Dan Andreescu 17 Dec '14

17 Dec '14

https://www.mediawiki.org/wiki/Scrum_of_scrums/2014-12-17

1 0

Welcome, Marko Obrovac, to the Services team
by Rob Lanphier 17 Dec '14

17 Dec '14

Hi everyone I'm pleased to (belatedly) welcome another new member of the Services team: Marko Obrovac. Marko started working in the Services team with Gabriel Wicke and James Douglas on RESTbase. Marko comes to us from Reflected Networks, a Croatian web-hosting company specializing in high-traffic websites. While there he developed a distributed message passing framework for their monitoring system there. Prior to that, Marko earned his PhD at Université de Rennes I / IRISA, INRIA, focused on distributed systems, such as AutoChem (a chemical computuing system) and XtreemOS (grid operating system) and kDFS (a symmetrical distributed file system) Marko is in the process of relocating to Marseille, France, where he'll be in January. You can find Marko on Freenode IRC as "mobrovac". Welcome, Marko! Rob

2 1

MediaWiki flame graphs
by Ori Livneh 16 Dec '14

16 Dec '14

I'm writing to draw your attention to a newly-available resource for performance analysis: flame graphs of MediaWiki code. http://performance.wikimedia.org/xenon/svgs/ Flame graphs are a visualization of application stack traces. Each application server on the Wikimedia cluster has a software timer that interrupts MediaWiki once every ten minutes to capture a stack trace. The stack trace shows what the code the application server was in the process of executing when the timer expired. A central log aggregator collects these traces and uses them to generate flame graphs. Each box in a flame graph represents a function in the stack. The y-axis shows stack depth. The topmost box shows the function that was on-CPU at the moment the trace was captured. The function below a function is its parent. The x-axis spans the sample population. The width of the box shows the total time it was on-CPU or part of an ancestry that was on-CPU, based on sample count. Here is an example: http://performance.wikimedia.org/xenon/svgs/hourly/2014-12-15_22.svgz To learn more about flame graphs and how to interpret them, see < http://www.brendangregg.com/flamegraphs.html>.

2 1

Live preview
by Derk-Jan Hartman 16 Dec '14

16 Dec '14

Hi all, I've had a significant update to Live Preview in the pipeline for a while now. It brings a few major improvements, the most important of it being able to load resourceloader modules that the preview requires, fixing a whole slew of problems that the old implementation had. The only place where it is a bit limited is with regard for previewing the list of languages in in skins other than vector. The code is here: https://gerrit.wikimedia.org/r/#/c/131346/ <https://gerrit.wikimedia.org/r/#/c/131346/> And it could use some user testing and review. Some people have been asking me about this lately, so I figured time to strip the WIP tag of it and see if we can get this merged already. Long term, I would like to improve it to make use of mw.template for some of the elements, but that is not a necessity right now I think. DJ

3 2

RFC meeting this week
by Tim Starling 16 Dec '14

16 Dec '14

In the next RFC meeting we would like to discuss the following RFC: * Release notes automation <https://www.mediawiki.org/wiki/Requests_for_comment/Release_notes_automation> The meeting will be on the IRC channel #wikimedia-office on irc.freenode.org at the following time: * UTC: Wednesday 21:00 * US PST: Wednesday 13:00 * Europe CET: Wednesday 22:00 * Australia AEDT: Thursday 08:00 -- Tim Starling

1 0

← Newer
1
2
3
4
5
6
7
8
9
10
Older →

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

Wikitech-l December 2014