Wikitech-l September 2020

wikitech-l@lists.wikimedia.org

61 participants
65 discussions

MediaWiki Extensions and Skins Security Release Supplement (1.31.9/1.34.3/1.35.0)
by Scott Bassett 28 Sep '20

28 Sep '20

Greetings- With the security/maintenance release of MediaWiki 1.31.9/1.34.3/1.35.0 [0], we would also like to provide this supplementary announcement of MediaWiki extensions and skins with now-public Phabricator tasks, security patches and backports [1]: == MobileFrontend == + (T238075) - Alert group Cookie(s) without HttpOnly flag are set due to default configuration < https://gerrit.wikimedia.org/r/q/I8e84f1cbc8878974532b511cebd9de40c5de55c6 > == MobileFrontend == + (T262213, CVE-2020-26120) - XSS on Pages viewed within MobileFrontend extension < https://gerrit.wikimedia.org/r/q/I42e079bc875d17b336ab015f3678eaedc26e10ea > == CentralAuth == + (T260485, CVE-2020-25869) - CentralAuth uses wrong actor ID when locally suppressing the user < https://gerrit.wikimedia.org/r/q/Iaa886a1824e5a74f4501ca7e28917c780222aac0 > < https://gerrit.wikimedia.org/r/q/I2336954c665366a99f9995df9b08071d4de6db79 > == FileImporter == + (T262628, CVE-2020-26121) - FileImporter imports the file even when the target page is protected on Commons < https://gerrit.wikimedia.org/r/q/Ib852a96afc4dca10516d0510e69c10f9892b351b > The Wikimedia Security Team recommends updating these extensions and/or skins to the current master branch or relevant, supported release branch [2] as soon as possible. Some of the referenced Phabricator tasks above _may_ still be private. Unfortunately, when security issues are reported, sometimes sensitive information is exposed and since Phabricator is historical, we cannot make these tasks public without exposing this sensitive information. If you have any additional questions or concerns regarding this update, please feel free to contact security(a)wikimedia.org or file a security task within Phabricator [3]. [0] https://lists.wikimedia.org/pipermail/mediawiki-announce/2020-September/000… [1] https://phabricator.wikimedia.org/T256342 [2] https://www.mediawiki.org/wiki/Version_lifecycle [3] https://www.mediawiki.org/wiki/Reporting_security_bugs -- Scott Bassett sbassett(a)wikimedia.org

1 0

T254495 - wikibase/termbox
by Jared G. Blumer 28 Sep '20

28 Sep '20

Hi everyone, I'm a volunteer for QTE and was assigned the task of using eslint-config-wikimedia 0.16.x in all repositories with Selenium tests <https://phabricator.wikimedia.org/T254495#6497062> and updating .eslintrc.json files with the Selenium WDIO test suite. When updating the wikibase/termbox repo's eslint-config-wikimedia to its current 0.17.0 release and updating eslint to 7.10.0, I receive nearly 900 errors when running "npm run test:lint" Most errors are node/no-object-assign, node/no-missing-import, es/no-object-values. I understand that the node/no-missing-import errors are mostly coming from an issue with the module alias "@" defined in package.json but I'm not certain how to resolve this or proceed on the other errors. Does anyone have any advice? Thanks! Jared

1 0

MediaWiki 1.31.10 patching issues
by Sam Reed 25 Sep '20

25 Sep '20

Hello all, Sorry for the numerous emails on this usually quiet mailing list. It came to our attention that the 1.31.10 patch doesn't apply ontop of the 1.31.9 patch [1]. This was due to the diff patches being created ignoring whitespace, which we are slightly surprised this hasn't bitten us before. It has been fixed going forward. To that extent, if you have already applied mediawiki-1.31.9.patch.gz [2] and mediawiki-1.31.10.patch.gz [3] won't apply ontop of it, please use mediawiki-1.31.10-fixup.patch.gz [4] instead. The signature can be found at mediawiki-1.31.10-fixup.patch.gz.sig [5] for those who verify their downloaded files. If you haven't yet upgraded, I have re-issued the 1.31.9.patch [2] and 1.31.10.patch [3] to take account of the whitespace changes. So you can download those two patches fresh and they should apply as expected (i.e. follow the original instructions). If you require the old version of those patches, they can be found below: * mediawiki-1.31.10.patch.gz.old [6] * mediawiki-1.31.10.patch.gz.old.sig [7] * mediawiki-1.31.9.patch.gz.old [8] * mediawiki-1.31.9.patch.gz.old.sig [9] Once again I apologise for the inconvenience, but hopefully this resolves all outstanding issues. Thanks Sam [1] https://phabricator.wikimedia.org/T263866 [2] https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.9.patch.gz [3] https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.10.patch.gz [4] https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.10-fixup.patch… [5] https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.10-fixup.patch… [6] https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.10.patch.gz.old [7] https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.10.patch.gz.ol… [8] https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.9.patch.gz.old [9] https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.9.patch.gz.old…

1 0

Scrum of scrums/2020-09-23
by Deb Tankersley 25 Sep '20

25 Sep '20

Hello, This email contains updates for September 23, 2020. For the HTML version, see: https://www.mediawiki.org/wiki/Scrum_of_scrums/2020-09-23 Cheers, Deb ------------------------ *= 2020-09-23 =* == Product == === iOS native app === * Updates: ** Monitoring version [[phab:project/view/4661/|6.7.0]] in App Store *** Widgets v1 ** In code freeze on bug fix release [[phab:project/view/4831/|6.7.1]] *** Widgets bugs/polish and Chinese variant fix ** In development on [[phab:project/view/4992/|6.7.2]] *** Article as a Living Document experiment === Abstract Wikipedia === * Updates: ** [[metawiki:Abstract_Wikipedia/Wiki_of_functions_naming_contest|Community naming contest]] launched for what to call the central wiki of functions. ** Initial bootstrap ZType schemata content now [[phab:T260315|injected into the wiki on installation]]. ** Very basic first pass of the rich editing interface (in Vue) nearing completion. ** Some consideration of the needs for common widget library in Vue with WMDE colleagues. == Technology == === Engineering Productivity === ==== Quality and Test Engineering ==== * Blocked by: ** Wikidata: [https://github.com/wmde/wdio-wikibase/pull/25 Make wdio-wikibase work with wdio 6] === Site Reliability Engineering === * Updates: ** Working on etcd SLOs, api-gateway SLOs with PET, finalizing the TLS migration for all services. -- deb tankersley (she/her) sr program manager, engineering Wikimedia Foundation

1 0

TechCom Radar 2020-09-23
by Tim Starling 25 Sep '20

25 Sep '20

The minutes from TechCom's triage meeting on 2020-09-23. Present: Tim S, Dan A, Daniel K, Niklas L, Timo T. RFC: Parsoid Extension API * https://phabricator.wikimedia.org/T260714 * TS: on the basis of Subbu’s comment listing the different consultations, should go to last call. * TT: fine to put on last call * DK: no objections, doing * On Last Call to be approved on Oct 7. RFC: Associated namespaces * https://phabricator.wikimedia.org/T487 * DK: use cases mentioned easier to implement with MCR, suggest to close this RFC. * TT: some other theoretical use cases have also been covered by https://phabricator.wikimedia.org/T165149 * TT: decline with last call? * DK: wouldn’t be opposed to it if someone needed it or would do the work, but does have merit, just no buy-in. * TT: currently, if something doesn’t get resourced, it just stays in P1. * On Last Call to be declined on Oct 7. Next week IRC office hours No IRC discussion scheduled for next week. You can also find our meeting minutes on MediaWiki.org <https://www.mediawiki.org/wiki/Wikimedia_Technical_Committee/Minutes>. See also the TechCom RFC board <https://phabricator.wikimedia.org/tag/mediawiki-rfcs/> If you prefer you can subscribe to our newsletter <https://www.mediawiki.org/wiki/Newsletter:TechCom_Radar> on the wiki.

1 0

Maintenance release: 1.31.10 / 1.34.4
by Sam Reed 25 Sep '20

25 Sep '20

The 1.31.10 and 1.34.4 versions fix the issue with the backports in the 1.31.9 and the 1.34.3 releases. The patches linked here need applying on top of the previous patches for 1.31.9 and 1.34.3. See the previous email for those patches. The full downloads here contain all the previous fixes from the security and maintenance release. 1.35.0 will still be released tomorrow. Once again, I apologise for the inconvenience of the issues with the previous release. ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.10.tar.gz Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.31/mediawiki-core-1.31.10.tar.gz Patch to previous version (1.31.9): https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.10.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.31/mediawiki-core-1.31.10.tar.gz… https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.10.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.10.patch.gz.sig Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.34/mediawiki-1.34.4.tar.gz Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.34/mediawiki-core-1.34.4.tar.gz Patch to previous version (1.34.3): https://releases.wikimedia.org/mediawiki/1.34/mediawiki-1.34.4.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.34/mediawiki-core-1.34.4.tar.gz.… https://releases.wikimedia.org/mediawiki/1.34/mediawiki-1.34.4.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.34/mediawiki-1.34.4.patch.gz.sig Public keys: https://www.mediawiki.org/keys/keys.html

1 0

New CI Promote Step for Service Developers
by Jeena Huneidi 24 Sep '20

24 Sep '20

Hi Everyone, I'd like to announce a new CI feature for developers of services deployed to kubernetes! It's now possible for your helmfile values files to be automatically updated with new image versions after changes are merged to your service. You can read more about it and how to enable it here: https://phabricator.wikimedia.org/phame/post/view/208/ci_now_updates_your_d… If you have any questions or run into problems, please feel free to reach out to Release Engineering directly or on IRC at #wikimedia-releng. -- Jeena Huneidi Software Engineer, Release Engineering Wikimedia Foundation

2 1

Security and maintenance release: 1.31.9 / 1.34.3
by Sam Reed 24 Sep '20

24 Sep '20

I would like to announce the release of MediaWiki 1.34.3, and 1.31.9! These releases also serve as a maintenance release for these branches. While tarballs have already been uploaded, git tags will follow later on today. An "MediaWiki Extensions Security Release Supplement" email will follow this one. As mentioned in the pre-release announcement, this will potentially be the final release of the MediaWiki 1.34 branch, barring any unforeseen issues. For continued support in the future, you are advised to upgrade to MediaWiki 1.35 in the near future. The release announcement for MediaWiki 1.35 will follow this one before the end of day tomorrow. MediaWiki 1.35 will be supported until September 2023. == Security fixes == * (T232568, CVE-2020-25813) SECURITY: SpecialUserrights: If a viewer lacks `hideuser`, ignore hidden users. * (T255918, CVE-2020-25812) SECURITY: Unescaped message used in HTML on Special:Contributions. * (T256171, CVE-2020-25815) SECURITY: Unescaped message used in HTML within LogEventsList. * (T258763, CVE-2020-17367, CVE-2020-17368) SECURITY: Prevent invoking firejail's --output functionality. * (T86738, CVE-2020-25814) SECURITY: mediawiki.jqueryMsg: Sanitize URLs and 'style' attribute. * (T115888, CVE-2020-25828) SECURITY: mediawiki.js: Escape HTML in mw.message( ... ).parse(). * (T260485, CVE-2020-25869) SECURITY: ActorMigration: Load user from the correct database. * (T260485, CVE-2020-25869) SECURITY: ensure actor ID from correct wiki is used. * (T251661, CVE-2020-25827) SECURITY: TOTP throttle not enforced cross-wiki. == Links to all mentioned tasks == * https://phabricator.wikimedia.org/T232568 * https://phabricator.wikimedia.org/T255918 * https://phabricator.wikimedia.org/T256171 * https://phabricator.wikimedia.org/T258763 * https://phabricator.wikimedia.org/T86738 * https://phabricator.wikimedia.org/T115888 * https://phabricator.wikimedia.org/T260485 * https://phabricator.wikimedia.org/T251661 == Release notes == Full release notes for 1.31.9: https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_31/RELEASE-NOTES… https://www.mediawiki.org/wiki/Release_notes/1.31 Full release notes for 1.34.3: https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_34/RELEASE-NOTES… https://www.mediawiki.org/wiki/Release_notes/1.34 For information about how to upgrade, see <https://www.mediawiki.org/wiki/Manual:Upgrading> ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.9.tar.gz Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.31/mediawiki-core-1.31.9.tar.gz Patch to previous version (1.31.8): https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.9.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.31/mediawiki-core-1.31.9.tar.gz.… https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.9.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.9.patch.gz.sig Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.34/mediawiki-1.34.3.tar.gz Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.34/mediawiki-core-1.34.3.tar.gz Patch to previous version (1.34.2): https://releases.wikimedia.org/mediawiki/1.34/mediawiki-1.34.3.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.34/mediawiki-core-1.34.3.tar.gz.… https://releases.wikimedia.org/mediawiki/1.34/mediawiki-1.34.3.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.34/mediawiki-1.34.3.patch.gz.sig Public keys: https://www.mediawiki.org/keys/keys.html

1 1

Allow HTML email
by Tim Starling 24 Sep '20

24 Sep '20

* Should Mailman collapse multipart/alternative to its first part content? * Should Mailman convert text/html parts to plain text? This conversion happens after MIME attachments have been stripped. These mailman options are both enabled for this list. I would argue that they should both be disabled. It is nice to write emails with cutting-edge features like client-side word wrapping and links. Are there any objections to this change? -- Tim Starling

14 14

Security pre-release announcement: 1.31.9 / 1.34.3 / 1.35.0
by Sam Reed 23 Sep '20

23 Sep '20

Hi all, Tomorrow we will be issuing a security and maintenance release to all supported branches of MediaWiki. The new releases will be: - 1.34.3 - 1.31.9 This will resolve eight issues in MediaWiki core (two of which aren't applicable to MediaWiki 1.31), and also includes some fixes previously committed to git, including minor security and hardening patches along with bug fixes included for maintenance reasons. For those of you waiting on MediaWiki 1.35.0, this will also come either tomorrow, or at latest Friday (depending on CI load), including the security fixes applied to these other supported release branches. We thank you for your patience; the current global situation means things have taken longer than would have been expected, but it has meant more bug fixes being incorporated from testing across the board. It also meant not having a security 1.35.1 release followup only a couple of weeks after 1.35.0 coming out. Which, for many people would mean extra work to upgrade again, and it was decided to avoid this. We will make the fixes available in these respective release branches, and also master. Tarballs will be available for the above mentioned point releases as well. A summary of some of the security fixes that have gone into non-bundled MediaWiki extensions will also follow. As per the MediaWiki Version lifecycle [1], November 2020 is the scheduled EOL date for the REL1_34. 1.34.3 will therefore potentially be the final release of the MediaWiki 1.34 branch, barring any unforeseen issues. As per above, MediaWiki 1.35.0 will be released this week, and will be supported until at least September 2023, and would be the recommended upgrade path. [1] https://www.mediawiki.org/wiki/Version_lifecycle

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

Wikitech-l September 2020