Wikitech-l October 2015

wikitech-l@lists.wikimedia.org

122 participants
120 discussions

[MediaWiki-announce] Security Release: 1.25.3, 1.24.4 and 1.23.11
by Chad 16 Oct '15

16 Oct '15

I would like to announce the release of MediaWiki 1.25.3, 1.24.4, and 1.23.11. These releases fix five security issues in core, in addition to other bug fixes. Download links are given at the end of this email == Security fixes == * Wikipedia user RobinHood70 reported two issues in the chunked upload API. The API failed to correctly stop adding new chunks to the upload when the reported size was exceeded (T91203), allowing a malicious users to upload add an infinite number of chunks for a single file upload. Additionally, a malicious user could upload chunks of 1 byte for very large files, potentially creating a very large number of files on the server's filesystem (T91205). <https://phabricator.wikimedia.org/T91203> <https://phabricator.wikimedia.org/T91205> * Internal review discovered that it is not possible to throttle file uploads. <https://phabricator.wikimedia.org/T91850> * Internal review discovered a missing authorization check when removing suppression from a revision. This allowed users with the 'viewsuppressed' user right but not the appropriate 'suppressrevision' user right to unsuppress revisions. <https://phabricator.wikimedia.org/T95589> * Richard Stanway from teamliquid.net reported that thumbnails of PNG files generated with ImageMagick contained the local file path in the image metadata. <https://phabricator.wikimedia.org/T108616> == Bug Fixes in 1.25.3 == * Fix having multiple callbacks for a single hook. <https://phabricator.wikimedia.org/T98975> * maintenance/refreshLinks.php did not always remove all links pointing to nonexistent pages. <https://phabricator.wikimedia.org/T107632> * $wgEmergencyContact and $wgPasswordSender now use their default value if set to an empty string. <https://phabricator.wikimedia.org/T104142> * Provide fallbacks for use of mb_convert_encoding() in HtmlFormatter. It was causing an error when accessing the api help page if the mbstring PHP extension was not installed. <https://phabricator.wikimedia.org/T62174> * Confirmation emails would sometimes contain invalid codes. <https://phabricator.wikimedia.org/T105896> * Fixed edit stash inclusion queries. <https://phabricator.wikimedia.org/T105597> == Bug Fixes in 1.24.4 == * Minimal PSR-3 debug logger to support backports from 1.25+. <https://phabricator.wikimedia.org/T91653> * Fix indexing of moved pages with PostgreSQL. Requires running update.php to fix. <https://phabricator.wikimedia.org/T68650> == Release notes == Full release notes for 1.25.3: <https://www.mediawiki.org/wiki/Release_notes/1.25> Full release notes for 1.24.4: <https://www.mediawiki.org/wiki/Release_notes/1.24> Full release notes for 1.23.11: <https://www.mediawiki.org/wiki/Release_notes/1.23> For information about how to upgrade, see <https://www.mediawiki.org/wiki/Manual:Upgrading> ********************************************************************** 1.25.3 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.25/mediawiki-1.25.3.tar.gz https://releases.wikimedia.org/mediawiki/1.25/mediawiki-core-1.25.3.tar.gz Patch to previous version: https://releases.wikimedia.org/mediawiki/1.25/mediawiki-1.25.3.patch.gz https://releases.wikimedia.org/mediawiki/1.25/mediawiki-i18n-1.25.3.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.25/mediawiki-1.25.3.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.25/mediawiki-1.25.3.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.25/mediawiki-core-1.25.3.tar.gz.… https://releases.wikimedia.org/mediawiki/1.25/mediawiki-i18n-1.25.3.patch.g… Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** 1.24.4 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.24/mediawiki-1.24.4.tar.gz https://releases.wikimedia.org/mediawiki/1.24/mediawiki-core-1.24.4.tar.gz Patch to previous version: https://releases.wikimedia.org/mediawiki/1.24/mediawiki-1.24.4.patch.gz https://releases.wikimedia.org/mediawiki/1.24/mediawiki-i18n-1.24.4.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.24/mediawiki-1.24.4.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.24/mediawiki-1.24.4.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.24/mediawiki-core-1.24.4.tar.gz.… https://releases.wikimedia.org/mediawiki/1.24/mediawiki-i18n-1.24.4.patch.g… Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** 1.23.11 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.11.tar.gz https://releases.wikimedia.org/mediawiki/1.23/mediawiki-core-1.23.11.tar.gz Patch to previous version: https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.11.patch.gz https://releases.wikimedia.org/mediawiki/1.23/mediawiki-i18n-1.23.11.patch.… GPG signatures: https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.11.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.11.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.23/mediawiki-core-1.23.11.tar.gz… https://releases.wikimedia.org/mediawiki/1.23/mediawiki-i18n-1.23.11.patch.… Public keys: https://www.mediawiki.org/keys/keys.html -Chad _______________________________________________ MediaWiki announcements mailing list To unsubscribe, go to: https://lists.wikimedia.org/mailman/listinfo/mediawiki-announce

1 0

Code of conduct consensus discussions update
by Matthew Flaschen 16 Oct '15

16 Oct '15

Full consensus was not reached on "Follow-up consensus discussion on intro, "Principles", "Expected behavior" and "Unacceptable behavior" sections" (https://www.mediawiki.org/wiki/Talk:Code_of_conduct_for_technical_spaces/Dr…). Instead, there are a few discussions about how to move forward (I already sent the first two to the list, so consider those a reminder): * Whether to consider most of the text from the last discussion done, but improve the controversial text (certain sentences/paragraphs drew the vast majority of the objections): https://www.mediawiki.org/wiki/Talk:Code_of_conduct_for_technical_spaces/Dr… * Whether to move out the "Expected behavior" to a separate non-binding guidelines page: https://www.mediawiki.org/wiki/Talk:Code_of_conduct_for_technical_spaces/Dr… * Whether to rearrange the pages used in the discussion process: https://www.mediawiki.org/wiki/Talk:Code_of_conduct_for_technical_spaces/Dr… * Whether to replace the end of the "Unacceptable behavior" section ("Our open source community acknowledges" etc.") with two sentences (https://www.mediawiki.org/wiki/Talk:Code_of_conduct_for_technical_spaces/Dr…). Thanks, Matt Flaschen

2 1

Tools repository
by Ilya Korniyko 15 Oct '15

15 Oct '15

Is there a repository of tools, research projects etc related to wikimedia projects? I think it's a good idea to have one. I even dream about https://www.mediawiki.org/wiki/Community_Tech_team taking lead and responsibility for maintaining it. However I'm going to start working on it in background. Is there a specific existing page or portal that I can improve, or where should be better to create it, if it does not exist? Regards, Ilya Korniiko / [[User:Ilya]]

7 8

Announcement: Security Release Tomorrow
by Chad 15 Oct '15

15 Oct '15

Hi all, Tomorrow we will be issuing a security release to all supported branches of MediaWiki. The new releases will be: 1.25.3 1.24.4 1.23.11 Fixes will be available in these respective release branches, the unreleased 1.26.x branch, and master. Tarballs will be available for the above mentioned point releases as well. This security release will encompass core only, no bundled extensions are affected. -Chad

1 0

no more 350ms delay in webkit!
by Brian Gerstle 15 Oct '15

15 Oct '15

x-post from /r/webdev https://trac.webkit.org/changeset/191072 Probably another reason to try using WKWebView in the iOS app. -- EN Wikipedia user page: https://en.wikipedia.org/wiki/User:Brian.gerstle IRC: bgerstle

1 0

PHP CodeSniffer is now voting on MediaWiki core patches
by Legoktm 15 Oct '15

15 Oct '15

Hi, Thanks to the hard work of a lot of different people, PHP CodeSniffer is now voting on all MediaWiki core patchsets! It checks for basic code style issues automatically so new contributors (and experienced ones!) can fix basic issues without a human needing to point them out. I added some brief instructions to [1] on how to run it locally, or you can read the jenkins output. There are still a few code style rules that are disabled, [2] is tracking fixing those issues. Please file any bugs or feature requests in the MediaWiki-CodeSniffer[3] project on Phabricator. [1] https://www.mediawiki.org/wiki/Continuous_integration/PHP_CodeSniffer [2] https://phabricator.wikimedia.org/T102609 [3] https://phabricator.wikimedia.org/tag/mediawiki-codesniffer/ -- Legoktm

4 4

Developer Relations Weekly Summary
by Quim Gil 15 Oct '15

15 Oct '15

Second edition of the Developer Relations Weekly Summary, still an experiment welcoming your feedback at https://phabricator.wikimedia.org/T114224. (Last week's summary had problems with HTML rendering when going through this mailing list. I'm not sure what to change to make it render correctly, but I have tried something...) Source: https://www.mediawiki.org/wiki/Developer_Relations/Weekly_summary - The Wikimedia Developer Summit 2016 <https://www.mediawiki.org/wiki/Wikimedia_Developer_Summit_2016> has 6 session proposals on track, 4 missing active discussion, 42 missing expected information. - Outreachy round 11 <https://www.mediawiki.org/wiki/Outreachy/Round_11> has 7 project ideas featured, 16 missing mentors, 28 needing discussion. ( workboard <https://phabricator.wikimedia.org/tag/possible-tech-projects/> ) - The discussion about the Code of Conduct draft <https://www.mediawiki.org/wiki/Code_of_conduct_for_technical_spaces/Draft> welcomes feedback on these points: - Move "Expected behavior" out to a separate guidelines page? <https://www.mediawiki.org/wiki/Talk:Code_of_conduct_for_technical_spaces/Dr…> - Move "Our open source community acknowledges..." out of the CoC? <https://www.mediawiki.org/wiki/Talk:Code_of_conduct_for_technical_spaces/Dr…> - "Publication of non-harassing private communication" <https://www.mediawiki.org/wiki/Talk:Code_of_conduct_for_technical_spaces/Dr…> - "Participate in an authentic and active way"... <https://www.mediawiki.org/wiki/Talk:Code_of_conduct_for_technical_spaces/Dr…> - Project administrators and maintainers have the right and responsibility..." <https://www.mediawiki.org/wiki/Talk:Code_of_conduct_for_technical_spaces/Dr…> - Timo Tijhof (WMF) <https://www.mediawiki.org/wiki/User:Timo_Tijhof_(WMF)> has joined the Architecture Committee <https://www.mediawiki.org/wiki/Architecture_committee>. ( announcement <https://lists.wikimedia.org/pipermail/wikitech-l/2015-October/083540.html> ) - Is there a repository of Wikimedia tools, research projects etc? The answer is between No and Lots. (discussion <http://www.gossamer-threads.com/lists/wiki/wikitech/640172>) - A canonical location for metrics documentation? Meta, mediawiki.org, Wikitech? (discussion <http://comments.gmane.org/gmane.org.wikimedia.analytics/2815>) - Historiography.io draws historical events from Wikipedia and self-updates daily with new recorded events. (about <http://cargocollective.com/matanstauber/Histography> - source <https://lists.wikimedia.org/pipermail/wikimedia-l/2015-October/079442.html> ) Metrics Code repositories with slowest code review <http://korma.wmflabs.org/browser/gerrit_review_queue.html>: 1. Wikistats <https://gerrit.wikimedia.org/r/#/q/project:analytics/wikistats+status:open,…>: 475 days, 5 changesets. (T113695 <https://phabricator.wikimedia.org/T113695>) 2. Collection/OfflineContentGenerator/latex renderer <https://gerrit.wikimedia.org/r/#/q/status:open+project:mediawiki/extensions…>: 463 days, 4 changesets. 3. BookManagerv2 <https://gerrit.wikimedia.org/r/#/q/status:open+project:mediawiki/extensions…>: 443 days, 21 changesets. 4. BayesianFilter <https://gerrit.wikimedia.org/r/#/q/status:open+project:mediawiki/extensions…>: 386 days, 1 changeset. 5. Babel <https://gerrit.wikimedia.org/r/#/q/status:open+project:mediawiki/extensions…>: 370 days, 1 changeset. -- Quim Gil Engineering Community Manager @ Wikimedia Foundation http://www.mediawiki.org/wiki/User:Qgil

1 0

i would like that i need not set standart spacing in my code
by dinar qurbanov 15 Oct '15

15 Oct '15

i think i lose my individuality and that i have to make extra key presses to set extra spaces near brackets and commas. currently tests / automatical reviews show in gerrit that my commit has such errors. what if they are not (would not be? were not? ) blamed on commit (patch set) uploads, but only automatically prettified/standartised at/before actual commit/merge? and, by the way, i think, should not they even be saved as they are written and should not, instead, diff tools automatically standartise them before calculating difference?

9 12

Re: [Wikitech-l] PHP CodeSniffer is now voting on MediaWiki core patches
by Florian Schmidt 15 Oct '15

15 Oct '15

*yay* thanks for the work! :) Gesendet mit meinem HTC ----- Nachricht beantworten ----- Von: "Legoktm" <legoktm.wikipedia(a)gmail.com> An: "Wikimedia developers" <wikitech-l(a)lists.wikimedia.org> Betreff: [Wikitech-l] PHP CodeSniffer is now voting on MediaWiki core patches Datum: Do., Okt. 15, 2015 01:13 Hi, On 09/26/2015 04:28 PM, Legoktm wrote: > There are still a few code style rules that are disabled, [2] is > tracking fixing those issues. These have all been resolved, and all rules in the MediaWiki standard are now passing and voting \o/ > [2] https://phabricator.wikimedia.org/T102609 -- Legoktm _______________________________________________ Wikitech-l mailing list Wikitech-l(a)lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/wikitech-l

1 0

2015-10-14 Scrum of Scrums meeting notes
by Grace Gellerman 15 Oct '15

15 Oct '15

https://www.mediawiki.org/wiki/Scrum_of_scrums/2015-10-24

1 1

← Newer
1
...
4
5
6
7
8
9
10
11
12
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

Wikitech-l October 2015