Wikitech-l December 2019

wikitech-l@lists.wikimedia.org

39 participants
58 discussions

MediaWiki Extensions and Skins Security Release Supplement
by Scott Bassett 19 Dec '19

19 Dec '19

Greetings- With the security/maintenance release of MediaWiki 1.31.6/1.32.6/1.33.2 [0], we would also like to provide this supplementary announcement of MediaWiki extensions and skins with now-public Phabricator tasks, security patches and backports [1]: == CheckUser == + (T234862, CVE-2019-18611) - Do not show oversighted edit summaries in CheckUser API <https://gerrit.wikimedia.org/r/q/Ie0aa0df2b3f03d8b910733f1b5e600a0dc978765> == AbuseFilter == + (T104807, CVE-2019-18612) - Older hidden versions of a currently-public AbuseFilter are exposed via diffs <https://gerrit.wikimedia.org/r/q/Ie23e8234ae550273bf3f6f9c5ac45b7fc54eec2a> + (T237887, CVE-2019-18987) - Old public versions of private filters are publicly viewable <https://gerrit.wikimedia.org/r/q/Ic12790bd33982473f77551bde9599ed083a3e1f1> == VisualEditor == + (T239209, CVE-2019-19708) - XSS in Visual Editor via Copy&Paste <https://gerrit.wikimedia.org/r/q/I1f99458fd2c4f6b2460dfe7a93b330ddee4400b6> == MinervaNeue skin == + (T240487, CVE requested) - XSS in MinervaNeue skin <https://gerrit.wikimedia.org/r/q/Ida471291f1698387a26736931ab17e6899e05b51> == LDAPAuthentication2 == + (T240338, No CVE requested) - LDAPAuthentication2 allows login with invalid password <https://gerrit.wikimedia.org/r/q/I7b125ab468ebc914b8a1c67ed0c03e3c2a20c6cd> The Wikimedia Security Team recommends updating these extensions and skins to the current master branch or relevant, supported release branch [2] as soon as possible. Some of the referenced Phabricator tasks above _may_ still be private. Unfortunately, when security issues are reported, sometimes sensitive information is exposed and since Phabricator is historical, we cannot make these tasks public without exposing this sensitive information. If you have any additional questions or concerns regarding this update, please feel free to contact security(a)wikimedia.org or file a security task within Phabricator [3]. [0] https://lists.wikimedia.org/pipermail/wikitech-l/2019-December/092886.html [1] https://phabricator.wikimedia.org/T234983 [2] https://www.mediawiki.org/wiki/Version_lifecycle [3] https://www.mediawiki.org/wiki/Reporting_security_bugs -- Scott Bassett sbassett(a)wikimedia.org

1 0

Re: [Wikitech-l] Wikimedia Café online meeting for December 2019
by Pine W 19 Dec '19

19 Dec '19

Hello colleagues, This is a reminder that the December 2019 Wikimedia Café meeting will start approximately one hour from now. Pine ( https://meta.wikimedia.org/wiki/User:Pine ) On Fri, Nov 29, 2019 at 10:50 PM Pine W <wiki.pine(a)gmail.com> wrote: > Hello colleagues, > > For the next Wikimedia Café online video meeting, agenda items include: > * Documentation for Wikitext <https://en.wikipedia.org/wiki/Help:Wikitext> > * The NavWiki <https://outreach.wikimedia.org/wiki/NavWiki> project > > Last month's Wikimedia Café had a problem with an inaccurate time > conversion from USA Eastern time to UTC. People attempted to join the > meeting at different times based on whether they referred to UTC or to US > Eastern time. I apologize for the error, and I think that it has been > corrected for December. > > The meeting style for the Café will emphasize discussion rather than > presentation. People are welcome to participate as listeners only if they > prefer. > > Please see the page on Meta > <https://meta.wikimedia.org/wiki/Wikimedia_Caf%C3%A9> for more > information about the Café. Please watch the page for any updates, > particularly to the schedule or the agenda. Signing up for the meeting is > optional, but is helpful to the organizers so that we can estimate how many > people will attend. Signing up for the meeting also informs us who we > should notify individually if there are significant changes, such as to the > schedule. > > If there are any problems with connecting to the meeting or if you have > any questions or comments then please write on the Meta talk page. > > Regards, > Pine > ( https://meta.wikimedia.org/wiki/User:Pine ) >

1 0

Security and maintenance release: 1.31.6 / 1.32.6 / 1.33.12
by Sam Reed 19 Dec '19

19 Dec '19

1 0

Announcing MediaWiki 1.34.0
by Sam Reed 19 Dec '19

19 Dec '19

I am happy to announce the availability of the general release of MediaWiki 1.34! While tarballs have already been uploaded, git tags will follow later on today. Thanks to everyone who helped out with this release, especially thanks to those who tested out the release candidates and provided feedback, as well as the developers who worked hard to get several important fixes merged in time for the 1.34 final release. To see what's changed in 1.34, see the release notes below. Please note that MediaWiki 1.34 no longer supports HHVM, and also the PHP version requirement has been raised from 7.0.13 in MediaWiki 1.33, to 7.2.9. As per the pre-release announcement, 1.34.0 includes some security fixes that weren't in 1.34.0-rc.0 or 1.34.0-rc.1. == Security fixes == * (T192134) Personal and site-wide CSS and JavaScript is loaded on Special:PasswordReset. * (T239466) Possible to circumvent title-blacklist (CVE-2019-19709). == Links to all mentioned tasks == * https://phabricator.wikimedia.org/T192134 * https://phabricator.wikimedia.org/T239466 MediaWiki 1.34 is due to be supported until the end of November 2020. ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.34/mediawiki-1.34.0.tar.gz Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.34/mediawiki-core-1.34.0.tar.gz Patch to previous version (1.34.0-rc.1): https://releases.wikimedia.org/mediawiki/1.34/mediawiki-1.34.0.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.34/mediawiki-core-1.34.0.tar.gz.… https://releases.wikimedia.org/mediawiki/1.34/mediawiki-1.34.0.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.34/mediawiki-1.34.0.patch.gz.sig Public keys: https://www.mediawiki.org/keys/keys.html Release Notes https://www.mediawiki.org/wiki/Release_notes/1.34

1 0

[Train] 1.35.0-wmf.11 status update
by Jeena Huneidi 19 Dec '19

19 Dec '19

The 1.35.0-wmf.11 version of MediaWiki is blocked[0]. The new version is deployed to group 0[1], but can proceed no further until these issues are resolved: * VisualEditor throwing "PHP Notice: Undefined index: etag" on officewiki as of wmf.11 - https://phabricator.wikimedia.org/T240961 * "BadMethodCallException: Sessions are disabled for this entry point" via GrowthExperiments - https://phabricator.wikimedia.org/T240997 Once these issues are resolved train can resume. If these issues are resolved on a Friday the train will resume Monday. Thank you for your help resolving these issues! -- Your humble train toiler [0]. <https://phabricator.wikimedia.org/T233859> [1]. <https://tools.wmflabs.org/versions/> -- Jeena Huneidi Software Engineer, Release Engineering Wikimedia Foundation

2 2

Adding a Citation on VE surface using SurfaceModel
by Egbe Eugene 19 Dec '19

19 Dec '19

Hi All, What is the best way to add a citation text on the VE surface? I have wikitext of the form <ref name=mediawiki>{{sample mediawiki |Path= http://localhost/myweb/otherprojects/mw/core/index.php/Main_Page#Getting |Title= Medaiwiki|Publisher = [[Wikimedia]] |Date= 17 June 2019|Arrival date= 12 May 2017 | Archive Path = mediawiki.org| Archive date = 4 September 2019 }} </ref> which when I paste, VE renders automatically. But when I write it as a string, it does not render on the surface. Thanks -- Eugene233

1 0

Security pre-release announcement: 1.30.6 / 1.32.6 / 1.33.2 / 1.34.0
by Sam Reed 18 Dec '19

18 Dec '19

Hi all, Tomorrow we will be issuing a security and maintenance release to all supported branches of MediaWiki. It will also coincide with the with formal release of 1.34.0, which has been a little bit delayed due to the US holidays and the Wikimedia Technical Conference whilst the last few couple of outstanding issues could be fixed. It also meant that a followup release to the REL1_34 branch wouldn't be needed only a couple of weeks after the 1.34.0 release was cut. The new releases will be: 1.34.0 1.33.2 1.32.6 1.31.6 This will resolve 1 issue in MediaWiki core (when running on older PHP versions), and also includes some fixes previously committed to git, such as minor security and hardening patches. Fixes will be available in these respective release branches, and also master. Tarballs will be available for the above mentioned point releases as well. 1.32.6 will also be the final release for 1.32 (barring any unforeseen issues), which is scheduled to become end of life in January 2020 [1]. If you're using 1.32, it is recommended that you upgrade to the latest point release of the 1.33 branch (1.33.2, to be released tomorrow) or 1.34.0 to carry on using a maintained and supported release. This security release includes fixes for MediaWiki core. A summary of some of the security fixes that have gone into non bundled MediaWiki extensions will also follow. [1] https://www.mediawiki.org/wiki/Version_lifecycle Thanks! Sam

1 0

Javascript Parse error on MW while using spread syntax
by Egbe Eugene 18 Dec '19

18 Dec '19

Hi All, I am using spread syntax on a array in javascript and it works fine on command line but when I paste the code in a MW js file, I get the error *'JavaScript parse error: Parse error: Missing ) in parenthetical' *on the line where I used the where I used the spread syntax. Please I need some help on this because I don't know how to go about it. Thanks, -- Eugene

2 2

WikimediaDebug v2 is here! – Staging, perf profiling, verbose log
by Krinkle 17 Dec '19

17 Dec '19

WikimediaDebug is a browser extension to help debug WMF wikis in production. [1] TL;DR: * The popup has been redesigned (including dark mode support). * Support for Beta Cluster (including XHGui). * A new "Inline profile" option. For more details and a general overview of how WikimediaDebug works: See https://phabricator.wikimedia.org/phame/live/7/post/183/ <https://phabricator.wikimedia.org/phame/live/7/post/183/wikimediadebug_v2_i…> -- Timo [1] Firefox: https://addons.mozilla.org/en-US/firefox/addon/wikimedia-debug-header/ Chrome: https://chrome.google.com/webstore/detail/wikimediadebug/binmakecefompkjggi…

2 1

[FYI] Data and statistics about Wikimedia's technical contributors (in Gerrit)
by Andre Klapper 16 Dec '19

16 Dec '19

Were you ever curious and wanted to know * the number of Gerrit patches written by volunteer authors in a year? * who are the most active patch authors in a Gerrit repository? * who are the latest new patch contributors across Gerrit? * who are the most active reviewers per Gerrit repository? * how long it takes on average until Gerrit patches get a first review? We have https://wikimedia.biterg.io/ for that (which is mostly about Gerrit), which recently received some new features, hence I felt that I should share this on wikitech-l@ as a heads-up for anyone interested. Its documentation at https://www.mediawiki.org/wiki/Community_metrics now covers how you could gather the data in the examples listed above. Any questions? Or do you miss something specific? Feel free to bring up your thoughts on the talk page: https://www.mediawiki.org/wiki/Talk:Community_metrics Thanks a lot! andre -- Andre Klapper (he/him) | Bugwrangler / Developer Advocate https://blogs.gnome.org/aklapper/

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

Wikitech-l December 2019