Wikitech-l November 2017

wikitech-l@lists.wikimedia.org

60 participants
56 discussions

2017 Community Wishlist Survey starts today!
by Danny Horn 17 Nov '17

17 Nov '17

Hi everyone, The third annual Community Wishlist Survey starts today, and you're invited to post proposals for projects that you'd like WMF's Community Tech team to work on: https://meta.wikimedia.org/wiki/2016_Community_Wishlist_Survey The Community Tech team builds features and makes changes that active Wikimedia contributors want, and the Wishlist Survey sets the team's agenda for the year. The Wishlist Survey starts with a two-week proposal period, when contributors from all Wikimedia projects are invited to post, discuss and improve propsals. After that, there's a two-week voting period, when everyone can post support-votes on the proposals that they think are worthwhile. We end up with a ranked list of wishes, measured by the participants' enthusiasm for each idea. Community Tech is responsible for addressing the top 10 wishes on the list, as well as some wishes from smaller groups and projects that are doing important work, but don't have the numbers to get their proposal into the top 10. The Wishlist is also used by volunteer developers and other teams, who want to find projects to work on that the community really wants. So I hope that everybody comes and participates; it's an opportunity to set the agenda for a Wikimedia Foundation product team. We would also ask that you help us spread the word. Please do post on your wikis and tell others this is happening, and that if they don't feel comfortable writing in English, proposals are welcome in any language. I hope to see everyone there! Danny Horn WMF Community Tech

3 3

MediaWiki train for 1.31.0-wmf.8 is on hold due to a database failure
by Greg Grossmeier 17 Nov '17

17 Nov '17

Hello, There was a badly timed database failure today that has caused all deployments to be on hold until the situation is resolved. See: https://phabricator.wikimedia.org/T180714 "db1063 crashed" The MW Train blocker task, https://phabricator.wikimedia.org/T178635, will be updated when we move forward. Sorry for the inconvenience, Greg -- | Greg Grossmeier GPG: B2FA 27B1 F7EB D327 6B8E | | Release Team Manager A18D 1138 8E47 FAC8 1C7D |

1 1

TechCom Radar, 2017-11-15
by Daniel Kinzler 17 Nov '17

17 Nov '17

Hello all! Here are the minutes from this week's meeting: * Marko Obrovac joined the Technical Committee. We are looking forward to working with him. Welcome Marko! * Last Call: RFC on imported user names <https://phabricator.wikimedia.org/T179832>. After the public discussion on November 15, it was agreed that this RFC should enter the last call period. If no pertinent concerns remain unaddressed by November 29, this RFC will be approved for implementation. * Next week’s RFC discussion: Bump PHP requirement to 7.0 in MW 1.31 <https://phabricator.wikimedia.org/T172165>. This is a reiteration of the RFC discussion from a few weeks ago, which ended with a last call for the proposal to go to PHP 5.6 for MW 1.31. The last call did not lead to approval, due to a suggestion made by Anomie, namely to go for a subset of PHP 7 that is supposed by hhvm in default mode, without the PHP7 flag set. As always, the discussion will take place in the IRC channel #wikimedia-office on Wednesday, at 2pm PST / 23:00 CET / 22:00 UTC. * Roan is experimenting with RemexHTML for tag stripping You can also find our meeting minutes at <https://www.mediawiki.org/wiki/Wikimedia_Technical_Committee/Minutes> See also the TechCom RFC board <https://phabricator.wikimedia.org/tag/mediawiki-rfcs/>. -- Daniel Kinzler Principal Platform Engineer Wikimedia Deutschland Gesellschaft zur Förderung Freien Wissens e.V.

1 0

Security release: 1.29.2 / 1.28.3 / 1.27.4
by Sam Reed 15 Nov '17

15 Nov '17

I would like to announce the release of MediaWiki 1.29.2, 1.28.3 and 1.27.4! These releases fix nine security issues in core and one related issue in the vendor folder. Download links are given at the end of this email. Patches will be pushed to gerrit after this email is sent, and will land into the relevant branches as fast as our CI infrastructure allows. Git tags will follow soon after. All related tasks will be made public in phabricator too in the following few hours. Please note that this month is the End-Of-Life date for MediaWiki 1.28. This means that MediaWiki 1.28.3 will be the last security release for that version, barring any unforeseen issues. We would strongly encourage users of MediaWiki 1.28 to upgrade to MediaWiki 1.29, released in July 2017, or a yet newer version as soon as possible. MediaWiki 1.29 will be supported until July 2018. See <https://www.mediawiki.org/wiki/Version_lifecycle> for more information. This release also serves as a maintenance release for these branches. == Security fixes == * (T128209) Reflected File Download from api.php. Reported by Abdullah Hussam. (CVE-2017-8809) * (T165846) BotPasswords doesn't throttle login attempts. * (T134100) On private wikis, login form shouldn't distinguish between login failure due to bad username and bad password. (CVE-2017-8810) * (T178451) XSS when $wgShowExceptionDetails = false and browser sends non-standard url escaping. (CVE-2017-8808) * (T176247) It's possible to mangle HTML via raw message parameter expansion. (CVE-2017-8811) * (T125163) id attribute on headlines allow raw >. (CVE-2017-8812) * (T124404) language converter can be tricked into replacing text inside tags by adding a lot of junk after the rule definition. (CVE-2017-8814) * (T119158) Language converter: unsafe attribute injection via glossary rules (CVE-2017-8815) The following only affects 1.29: * (T180488) (T125177) "api.log contains passwords in plaintext" wasn't correctly fixed in all branches in the previous security release. (CVE-2017-0361) The following only affects 1.27 and 1.28: * (T180231) composer.json has require-dev versions of PHPUnit with known security issues. Reported by Tom Hutchison. (CVE-2017-9841) It is recommended to run `composer update --no-dev` after upgrading to MW 1.27.4 or 1.28.3 if you installed MediaWiki via git. If you are using the tarball, you are not affected, and you do not need to run this command. This will remove developer dependancies that production wikis do not require. If you require developer dependancies, run `composer update` which will update to a version of PHPUnit without known RCE. If you cannot run `composer update` for any reason, it is recommended that you delete the offending file as a minimum yourself using the following command: `rm -rf vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php` == Links to all mentioned tasks == https://phabricator.wikimedia.org/T128209 https://phabricator.wikimedia.org/T165846 https://phabricator.wikimedia.org/T134100 https://phabricator.wikimedia.org/T178451 https://phabricator.wikimedia.org/T176247 https://phabricator.wikimedia.org/T125163 https://phabricator.wikimedia.org/T180231 https://phabricator.wikimedia.org/T125163 https://phabricator.wikimedia.org/T124404 https://phabricator.wikimedia.org/T119158 https://phabricator.wikimedia.org/T180488 https://phabricator.wikimedia.org/T125177 == Release notes == Full release notes for 1.27.4: https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_27/RELEASE-NOTES… https://www.mediawiki.org/wiki/Release_notes/1.27 Full release notes for 1.28.3: https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_28/RELEASE-NOTES… https://www.mediawiki.org/wiki/Release_notes/1.28 Full release notes for 1.29.2: https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_29/RELEASE-NOTES… https://www.mediawiki.org/wiki/Release_notes/1.29 For information about how to upgrade, see <https://www.mediawiki.org/wiki/Manual:Upgrading> ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.27/mediawiki-1.27.4.tar.gz Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.27/mediawiki-core-1.27.4.tar.gz Patch to previous version (1.27.3): https://releases.wikimedia.org/mediawiki/1.27/mediawiki-1.27.4.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.27/mediawiki-core-1.27.4.tar.gz.… https://releases.wikimedia.org/mediawiki/1.27/mediawiki-1.27.4.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.27/mediawiki-1.27.4.patch.gz.sig Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.28/mediawiki-1.28.3.tar.gz Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.28/mediawiki-core-1.28.3.tar.gz Patch to previous version (1.28.2): https://releases.wikimedia.org/mediawiki/1.28/mediawiki-1.28.3.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.28/mediawiki-core-1.28.3.tar.gz.… https://releases.wikimedia.org/mediawiki/1.28/mediawiki-1.28.3.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.28/mediawiki-1.28.3.patch.gz.sig Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.29/mediawiki-1.29.2.tar.gz Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.29/mediawiki-core-1.29.2.tar.gz Patch to previous version (1.29.1): https://releases.wikimedia.org/mediawiki/1.29/mediawiki-1.29.2.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.29/mediawiki-core-1.29.2.tar.gz.… https://releases.wikimedia.org/mediawiki/1.29/mediawiki-1.29.2.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.29/mediawiki-1.29.2.patch.gz.sig Public keys: https://www.mediawiki.org/keys/keys.html

5 4

TechCom Radar, 2017-11-08
by Daniel Kinzler 15 Nov '17

15 Nov '17

Hello all! Here are the minutes from this week's meeting: * Previous week’s RFC discussion: How to modify all preferences? <https://phabricator.wikimedia.org/T178449>. Many details seem unclear, so this RFC went back to “under discussion”. * This week’s discussion on IRC was about the RFC process itself. Log at <https://tools.wmflabs.org/meetbot/wikimedia-office/2017/wikimedia-office.20…> * Next week’s RFC discussion: Handling of Imported Usernames <https://phabricator.wikimedia.org/T179832>. As always, the discussion will take place in the IRC channel #wikimedia-office on Wednesday - however, this time, it will be two hours earlier! Please join us at 12 noon PST / 21:00 CET / 20:00 UTC. You can also find our meeting minutes at <https://www.mediawiki.org/wiki/Wikimedia_Technical_Committee/Minutes> See also the TechCom RFC board <https://phabricator.wikimedia.org/tag/mediawiki-rfcs/>. -- Daniel Kinzler Principal Platform Engineer Wikimedia Deutschland Gesellschaft zur Förderung Freien Wissens e.V.

2 2

[MediaWiki-announce] Security release: 1.29.2 / 1.28.3 / 1.27.4
by Sam Reed 14 Nov '17

14 Nov '17

1 0

Discovery Weekly Update for the week starting 2017-10-30
by Chris Koerner 14 Nov '17

14 Nov '17

Hello there, This is the Discovery weekly update for the week starting 2017-10-30 _and_ 2017-11-06 - so the last two weeks. == Highlights == * Blog post about searching using dashes and exclamation points when they're not part of the expected search syntax (by Trey Jones): ''"So -happy to meet you: Advanced searching techniques on Wikimedia sites"''. [0] == Discussions== === Search === * Trey wrote a blog post about advanced searching techniques, particularly dealing with dashes and exclamation points when they are *not* search syntax. [0] * Trey finished an analysis of enabling mapping hiragana and katakana for English- and Japanese-language wikis. There was less enthusiasm for the mapping and more problems on the Japanese side, so it is not going to be deployed there at this time. However, we're looking to enable it for other languages. [1] * David finished up refactoring the Searcher class and the SearchContext to allow easy code reuse [2] * Eric fixed an issue with a searchmatch span that was altering searches [3] * Eric and David finished up the work needed for evaluating the training speed and accuracy for 1M and 30M sample training sets and updated the resource usage docs [4] * Stas enabled disambiguation page demoting in Wikidata search and fixed several regressions in prefix search [5] [6] [7] [8]. === Analysis === * Chelsy finished up the analysis of the A/B test to test relaxing the retrieval query filter and the report has been published [9] [10] * After the quarterly metrics meeting at the end of October, there was a follow-up question that Chelsy answered [11] * Mikhail and Gehel finished up the creation of a Puppet profile/role for doing R-based heavy stats/ML on Wikimedia Cloud [12] === Portal === * The Wikipedia.org portal page was updated with new translations and new stats on October 30, 2017 [13] [14] === WDQS === * Stas fixed bug in RDF formatting of coordinates [15] * Stas implemented ordinal variable in WDQS calls to MWAPI [16] [0] https://blog.wikimedia.org/2017/11/06/searching-techniques/ [1] https://phabricator.wikimedia.org/T176197 [2] https://phabricator.wikimedia.org/T178906 [3] https://phabricator.wikimedia.org/T178522 [4] https://phabricator.wikimedia.org/T170009 [5] https://phabricator.wikimedia.org/T148411 [6] https://phabricator.wikimedia.org/T179061 [7] https://phabricator.wikimedia.org/T179045 [8] https://phabricator.wikimedia.org/T179130 [9] https://phabricator.wikimedia.org/T177957 [10] https://analytics.wikimedia.org/datasets/discovery/reports/AB_test_to_test_… [11] https://phabricator.wikimedia.org/T179449 [12] https://phabricator.wikimedia.org/T178096 [13] https://phabricator.wikimedia.org/T142582 [14] https://phabricator.wikimedia.org/T128546 [15] https://phabricator.wikimedia.org/T179228 [16] https://phabricator.wikimedia.org/T177275 --- Subscribe to receive on-wiki (or opt-in email) notifications of the Discovery weekly update. https://www.mediawiki.org/wiki/Newsletter:Discovery_Weekly The archive of all past updates can be found on MediaWiki.org: https://www.mediawiki.org/wiki/Discovery/Status_updates Interested in getting involved? See tasks marked as "Easy" or "Volunteer needed" in Phabricator. [1] https://phabricator.wikimedia.org/maniphest/query/qW51XhCCd8.7/#R [2] https://phabricator.wikimedia.org/maniphest/query/5KEPuEJh9TPS/#R Yours, Chris Koerner Community Liaison Wikimedia Foundation

1 0

Tomorrow: Weekly Technical Advice IRC Meeting
by Michael Schönitzer 14 Nov '17

14 Nov '17

Sorry for cross-posting! Reminder: Technical Advice IRC meeting again **tomorrow, Wednesday 4-5 pm UTC** on #wikimedia-tech. The Technical Advice IRC meeting is open for all volunteer developers, topics and questions. This can be anything from "how to get started" over "who would be the best contact for X" to specific questions on your project. If you know already what you would like to discuss or ask, please add your topic to the next meeting: https://www.mediawiki.org/wiki/Technical_ Advice_IRC_Meeting This meeting is an offer by WMDE’s tech team. Hosts of tomorrows meeting are: @addshore & @CFisch_WMDE. Hope to see you there! Michi (for WMDE’s tech team) -- Michael F. Schönitzer Wikimedia Deutschland e.V. | Tempelhofer Ufer 23-24 | 10963 Berlin Tel. (030) 219 158 26-0 http://wikimedia.de Stellen Sie sich eine Welt vor, in der jeder Mensch an der Menge allen Wissens frei teilhaben kann. Helfen Sie uns dabei! http://spenden.wikimedia.de/ Wikimedia Deutschland - Gesellschaft zur Förderung Freien Wissens e.V. Eingetragen im Vereinsregister des Amtsgerichts Berlin-Charlottenburg unter der Nummer 23855 B. Als gemeinnützig anerkannt durch das Finanzamt für Körperschaften I Berlin, Steuernummer 27/681/51985.

1 0

Fwd: Security pre-release announcement: 1.29.2 / 1.28.3 / 1.27.4
by Sam Reed 13 Nov '17

13 Nov '17

Hi all, Tomorrow we will be issuing a security release to all supported branches of MediaWiki. The new releases will be: 1.29.2 1.28.3 1.27.4 This will resolve 9 issues in MediaWiki core. Fixes will be available in these respective release branches, the currently unreleased 1.30.0 and also master. Tarballs will be available for the above mentioned point releases as well. 1.28 was previously announced as end of life, but 1.28.3 will be the final security and maintenance release barring any unforeseen issues. This security release includes fixes for MediaWiki core. --- Sam Reed

1 0

New print to pdf feature for mobile web readers
by Olga Vasileva 13 Nov '17

13 Nov '17

The Readers web team will be deploying a new feature this week to make it easier to download PDF versions of articles on the mobile website. [0] Providing better offline functionality was one of the highlighted areas of focus based on the generative research done by the New Readers team in Mexico, Nigeria, and India. Over the past year, the New Readers and Readers Web teams created a prototype for mobile PDFs which was evaluated by user research and community feedback [1]. As the prototype evaluation received positive feedback and results, we went forward with development. [2] For the initial deployment, the feature will be available to Google Chrome browsers on Android with support for other mobile browsers to come in the future. For Chrome, the feature will use the native Android print functionality where users can choose to download a webpage as a PDF. Mobile print styles will be used for these PDFs to ensure optimal readability for smaller screens. [3] The feature will be available starting Wednesday, Nov 15. For more information, see the project page on MediaWiki.org. [0] [0] https://www.mediawiki.org/wiki/Reading/Web/Projects/Mobile_PDFs [1] https://meta.wikimedia.org/wiki/New_Readers/Offline [2] https://meta.wikimedia.org/wiki/New_Readers/Offline#Concept_testing_for_mob… [3] https://www.mediawiki.org/wiki/Reading/Web/Projects/Print_Styles#Mobile_Pri… -- Olga Vasileva // Product Manager // Reading Web Team https://wikimediafoundation.org/

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

Wikitech-l November 2017