Wikitech-l July 2022

wikitech-l@lists.wikimedia.org

36 participants
33 discussions

Volunteer needed for Wikitech project
by Steve Slevinski 19 Jul '22

19 Jul '22

Hi Wikitech list, We are looking for a co-maintainer for the SignWriting project. https://wikitech.wikimedia.org/wiki/Nova_Resource:Signwriting <https://wikitech.wikimedia.org/wiki/Nova_Resource:Signwriting> There are two server that power the sign language Wikipedia projects on incubator and the SignWriting keyboard by Yair Rand. These servers need to be migrated from Debian Stretch to Debian Bullseye (or Buster). https://phabricator.wikimedia.org/T306095 <https://phabricator.wikimedia.org/T306095> The migration should be relatively easy. Copy over the www directory. The only requirements should be Apache, PHP, GD Graphics Library and SQLite. Thanks! -Steve

1 0

Fwd: [breaking change] Upgrading to Elasticsarch 7.10 — breaking changes for Cloudelastic, API Feature Usage
by Mike Pham 19 Jul '22

19 Jul '22

Hi all, I originally sent this email out on 20 May, 2022, but it seems like it didn’t go out to everybody, unfortunately. We are beginning the process of undeploying API Feature Usage <https://phabricator.wikimedia.org/T313248> this week, and apologize for the confusion, and what is now short notice for those of you who were not aware of this announcement previously. Best, — *Mike Pham* (he/him) Sr Product Manager, Search Wikimedia Foundation <https://wikimediafoundation.org/> On 20May, 2022 at 10:18:44, Mike Pham (mpham(a)wikimedia.org) wrote: Hi all, The Wikimedia Foundation Search team is currently working on updating our Elasticsearch version to 7.10 <https://phabricator.wikimedia.org/T263142> from version 6.8.20. Our goal is to finish this work in the next couple of months. Being on the latest (license-compatible) version will help ensure the stability and reliability of our search infrastructure. This update will include 2 breaking changes: 1. Cloudelastic will be affected by breaking changes, with more details below. The interface might also change slightly. 1. https://www.elastic.co/guide/en/elasticsearch/reference/7.17/breaking-chang… 2. https://www.elastic.co/guide/en/elasticsearch/reference/7.10/migrating-7.10… 2. The API Feature Usage extension <https://www.mediawiki.org/wiki/Extension:ApiFeatureUsage>, whose functionality is unrelated to search, will no longer be supported. This low-usage extension is currently implemented in a complicated and brittle way that depends on Elasticsearch, which creates development drag on the Search team’s work in order to continuously maintain and upkeep. While in the short term API Feature Usage will be sunsetted, we recognize that it’s probably useful for some users, and we encourage others to continue to support and develop this extension in the longer term, without its brittle dependency on Elasticsearch. Though the Elasticsearch upgrade will provide overall net benefits, we recognize that these breaking changes will unfortunately affect some users, and appreciate your understanding as we improve our search infrastructure. Best, Search Platform — *Mike Pham* (he/him) Sr Product Manager, Search Wikimedia Foundation <https://wikimediafoundation.org/>

5 4

Abstract Schema: Milestone reached for WMF Deployed Extensions
by Der Umherirrende 15 Jul '22

15 Jul '22

4 3

Save the Date! Wikimania Hackathon August 12-14
by Haley Lepp 13 Jul '22

13 Jul '22

Hello everyone! Mark your calendars for the Wikimania Hackathon! The Wikimania 2022 Hackathon is a free, online event open to the general public to work together on technical projects, learn new skills, and meet other technical contributors. You can find more information about this on the Wikimania page <https://wikimania.wikimedia.org/wiki/2022:Hackathon>, which will continue to grow over the next few weeks. For more details, read below. *Schedule: * The Hackathon will take place virtually in three time blocks: 16- 22 UTC August 12 12-17 UTC August 13 A final showcase on August 14. *Format:* At the beginning of the event, anyone can present a technical project they plan to work on at the Pre-Event Showcase. This session will provide a space for people to find teams, brainstorm new ideas, and make plans for what to hack during the Hackathon. Throughout the following hours, there will be social sessions and training sessions run by the community, but the majority of the time will be spent hacking together. Attendees can also attend other Wikimania activities. At the end of the event, there will be a final showcase to present advances or new technical projects built during the Hackathon to all of Wikimania. *Accessibility:*If you have any accessibility or translation requests, please contact hlepp(a)wikimedia.org. Looking forward to spending time hacking together! Cheers, Haley and the WMF Developer Advocacy Team

1 0

Help +2 php 8.1 updates
by Mark A. Hershberger 12 Jul '22

12 Jul '22

MediaWiki devs, I've been running the test suite using PHP 8.1 and providing patches in Gerrit. I've gotten some feedback but I am hoping that I can get the requisite +2's to get these fixes incorporated into MediaWiki. I have several patches outstanding with no comments. If they could be +2'd that would be awesome. If they need more work before they're accepted, please let me know how they are lacking so that I can update them. Most of these can be found here: https://gerrit.wikimedia.org/r/q/topic:change-809720 Thanks! Mark. -- http://hexmode.com/ I cannot remember the books I've read any more than the meals I have eaten; even so, they have made me. -- Ralph Waldo Emerson

2 1

Maintenance release: MediaWiki 1.37.4
by Sam Reed 08 Jul '22

08 Jul '22

I would like to announce the availability of MediaWiki 1.37.4. This primarily fixes an issue identified in the MediaWiki 1.37.3 release. The incorrect version of guzzlehttp/guzzle was included in the tarball (and git repo) vendor, meaning that update.php would not run successfully. It also includes some minor backported fixes for PHP 8.1 support, which would reduce log spam when logging was enabled. These fixes will be included in later point releases for 1.35 and 1.38. === Changes since MediaWiki 1.37.3 === * Localisation updates. * (T311568) UploadBase::setTempFile() handle $tempPath being passed as null. * (T311559) SpecialListFiles: user parameter isn't always present. * (T311561) ImageListPager: Don't call htmlspecialchars() on null. * (T311920) SpecialBlockList: Prevent passing null to trim(). * (T311921) SpecialUserrights: Don't pass null to str_replace. * (T311570) SpecialWithoutInterwiki: Don't pass null through to Title::capitalize(). * (T311574, T311576) SpecialLinkSearch: Don't pass null through to the parser. * (T312059) Update guzzlehttp/guzzle to 7.4.5 in vendor. * (T296435, T297669) cache: Add four fields to LinkCache::getSelectFields. ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.4.tar.gz https://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.4.zip Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.37/mediawiki-core-1.37.4.tar.gz https://releases.wikimedia.org/mediawiki/1.37/mediawiki-core-1.37.4.zip Patch to previous version (1.37.3): https://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.4.patch.gz https://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.4.patch.zip GPG signatures: https://releases.wikimedia.org/mediawiki/1.37/mediawiki-core-1.37.4.tar.gz.… https://releases.wikimedia.org/mediawiki/1.37/mediawiki-core-1.37.4.zip.sig https://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.4.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.4.zip.sig https://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.4.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.4.patch.zip.sig Public keys: https://www.mediawiki.org/keys/keys.html

1 0

MediaWiki Extensions and Skins Security Release Supplement, 1.35.7/1.37.3/1.38.2
by Maryum Styles 06 Jul '22

06 Jul '22

Greetings- With the security/maintenance release of MediaWiki 1.35.7/1.37.3/1.38.2 [0], we would also like to provide this supplementary announcement of MediaWiki extensions and skins with now-public Phabricator tasks, security patches and backports [1]: == Create Redirect == + (T306174, CVE-2022-29547) - add to extension supplement for CreateRedirect Auth issues https://gerrit.wikimedia.org/r/q/I7b2069128b917aa1231ae4f9179557d696fdcae0 == Private Domains == + (T306290, CVE-2022-29903) - No anti-CSRF token in the edit form https://gerrit.wikimedia.org/r/c/mediawiki/extensions/PrivateDomains/+/7834… == Semantic Drilldown == + (T306463, CVE-2022-29904) - SQL injection https://gerrit.wikimedia.org/r/q/I99359ecb7c5c44acb1e3f43cbb41ba200067dca0 == Nimbus == + (T306815, CVE-2022-29907) - XSS via the "Advertise" link interface messages https://gerrit.wikimedia.org/r/c/mediawiki/skins/Nimbus/+/786959 == FanBoxes == + (T306741, CVE-2022-29905) - Classic CSRF in Special:UserBoxes https://gerrit.wikimedia.org/r/c/mediawiki/extensions/FanBoxes/+/786327 == QuizGame == + (T302199, CVE-2022-29906) - Administrative API module lets unauthenticated requests through https://gerrit.wikimedia.org/r/c/mediawiki/extensions/QuizGame/+/765651 == RSS == + (T307028, CVE-2022-29969) - XSS in Extension:RSS when $wgRSSAllowLinkTag = true; https://gerrit.wikimedia.org/r/c/mediawiki/extensions/RSS/+/787807 == Wikibase, WikibaseLexeme == + (T308659, CVE-2022-34750) - Validate lemma length in Special:NewLexeme(Alpha) and label/description/aliases length in Special:NewProperty https://gerrit.wikimedia.org/r/c/mediawiki/extensions/WikibaseLexeme/+/8092… The Wikimedia Security Team recommends updating these extensions and/or skins to the current master branch or relevant, supported release branch [2] as soon as possible. Some of the referenced Phabricator tasks above _may_ still be private. Unfortunately, when security issues are reported, sometimes sensitive information is exposed and since Phabricator is historical, we cannot make these tasks public without exposing this sensitive information. If you have any additional questions or concerns regarding this update, please feel free to contact security(a)wikimedia.org or file a security task within Phabricator [3]. [0] https://w.wiki/5QKY [1] https://phabricator.wikimedia.org/T305209 [2] https://www.mediawiki.org/wiki/Version_lifecycle [3] https://www.mediawiki.org/wiki/Reporting_security_bugs

1 0

3D models in Commons
by Strainu 05 Jul '22

05 Jul '22

Hey folks, I know it's a bit early in the fiscal year and that's probably why I can't find anything on wiki, but I understood that the new yearly plan puts a lot of emphasis on the multimedia features. Does that include making 3D models usable in our wikis? If there are planned projects related to that in this fiscal year, would it be possible to get a link to the project page? I'm asking because there are a lot of cool, freely licensed models out there just waiting to be imported... Thank you, Strainu

3 3

Talk to the Search Platform / Query Service Team—July 6th, 2022
by Trey Jones 05 Jul '22

05 Jul '22

The Search Platform Team <https://www.mediawiki.org/wiki/Wikimedia_Search_Platform> usually holds an open meeting on the first Wednesday of each month. Come talk to us about anything related to Wikimedia search, Wikidata Query Service (WDQS), Wikimedia Commons Query Service (WCQS), etc.! Feel free to add your items to the Etherpad Agenda for the next meeting. Details for our next meeting: Date: Wednesday, July 6th, 2022 Time: 15:00-16:00 UTC / 08:00-09:00 PDT / 11:00-12:00 EDT / 16:00-17:00 WAT / 17:00-18:00 CEST Etherpad: https://etherpad.wikimedia.org/p/Search_Platform_Office_Hours Google Meet link: https://meet.google.com/vgj-bbeb-uyi Join by phone: https://tel.meet/vgj-bbeb-uyi?pin=8118110806927 Hope to talk to you tomorrow! —Trey Trey Jones Staff Computational Linguist, Search Platform Wikimedia Foundation UTC–4 / EDT

1 0

Don't forgot, only 4 more days to become eligible to vote in Board elections
by K. Peachey 02 Jul '22

02 Jul '22

Hi all, Just a small reminder for any developers that they only have 4 more days to become eligible to vote in the 2022 WMF Board of Trustees election. Developers can confirm their eligibility by reviewing the below list: * are Wikimedia server administrators with shell access * or have made at least one merged commit to any Wikimedia repos on Gerrit, between 5 January 2022 and 5 July 2022. * or have made at least one merged commit to any repo in nonwmf-extensions or nonwmf-skins, between 5 January 2022 and 5 July 2022. * or have made at least one merged commit to any Wikimedia tool repo (for example magnustools) between 5 January 2022 and 5 July 2022. * or have made at least 300 edits before 5 July 2022, and 20 edits between 5 January 2022 and 5 July 2022, on Translatewiki. * or maintainers/contributors of any tools, bots, user scripts, gadgets, and Lua modules on Wikimedia wikis. * or have substantially engaged in the design and/or review processes of technical development related to Wikimedia. This list was copied from <https://meta.wikimedia.org/wiki/Wikimedia_Foundation_elections/2022/Voter_e…>. If you need help getting a patch(/s) merged in the next few days, don't hesitate to reach out to the community in the next few days on the mailing lists, other locations such as the various IRC channels or phabricator. Regards, p858snake/Peachey88

3 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

Wikitech-l July 2022