Wikitech-l July 2022

wikitech-l@lists.wikimedia.org

36 participants
39 discussions

Help +2 php 8.1 updates
by Mark A. Hershberger 12 Jul '22

12 Jul '22

MediaWiki devs, I've been running the test suite using PHP 8.1 and providing patches in Gerrit. I've gotten some feedback but I am hoping that I can get the requisite +2's to get these fixes incorporated into MediaWiki. I have several patches outstanding with no comments. If they could be +2'd that would be awesome. If they need more work before they're accepted, please let me know how they are lacking so that I can update them. Most of these can be found here: https://gerrit.wikimedia.org/r/q/topic:change-809720 Thanks! Mark. -- http://hexmode.com/ I cannot remember the books I've read any more than the meals I have eaten; even so, they have made me. -- Ralph Waldo Emerson

2 1

Maintenance release: MediaWiki 1.37.4
by Sam Reed 08 Jul '22

08 Jul '22

I would like to announce the availability of MediaWiki 1.37.4. This primarily fixes an issue identified in the MediaWiki 1.37.3 release. The incorrect version of guzzlehttp/guzzle was included in the tarball (and git repo) vendor, meaning that update.php would not run successfully. It also includes some minor backported fixes for PHP 8.1 support, which would reduce log spam when logging was enabled. These fixes will be included in later point releases for 1.35 and 1.38. === Changes since MediaWiki 1.37.3 === * Localisation updates. * (T311568) UploadBase::setTempFile() handle $tempPath being passed as null. * (T311559) SpecialListFiles: user parameter isn't always present. * (T311561) ImageListPager: Don't call htmlspecialchars() on null. * (T311920) SpecialBlockList: Prevent passing null to trim(). * (T311921) SpecialUserrights: Don't pass null to str_replace. * (T311570) SpecialWithoutInterwiki: Don't pass null through to Title::capitalize(). * (T311574, T311576) SpecialLinkSearch: Don't pass null through to the parser. * (T312059) Update guzzlehttp/guzzle to 7.4.5 in vendor. * (T296435, T297669) cache: Add four fields to LinkCache::getSelectFields. ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.4.tar.gz https://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.4.zip Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.37/mediawiki-core-1.37.4.tar.gz https://releases.wikimedia.org/mediawiki/1.37/mediawiki-core-1.37.4.zip Patch to previous version (1.37.3): https://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.4.patch.gz https://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.4.patch.zip GPG signatures: https://releases.wikimedia.org/mediawiki/1.37/mediawiki-core-1.37.4.tar.gz.… https://releases.wikimedia.org/mediawiki/1.37/mediawiki-core-1.37.4.zip.sig https://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.4.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.4.zip.sig https://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.4.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.4.patch.zip.sig Public keys: https://www.mediawiki.org/keys/keys.html

1 0

MediaWiki Extensions and Skins Security Release Supplement, 1.35.7/1.37.3/1.38.2
by Maryum Styles 06 Jul '22

06 Jul '22

Greetings- With the security/maintenance release of MediaWiki 1.35.7/1.37.3/1.38.2 [0], we would also like to provide this supplementary announcement of MediaWiki extensions and skins with now-public Phabricator tasks, security patches and backports [1]: == Create Redirect == + (T306174, CVE-2022-29547) - add to extension supplement for CreateRedirect Auth issues https://gerrit.wikimedia.org/r/q/I7b2069128b917aa1231ae4f9179557d696fdcae0 == Private Domains == + (T306290, CVE-2022-29903) - No anti-CSRF token in the edit form https://gerrit.wikimedia.org/r/c/mediawiki/extensions/PrivateDomains/+/7834… == Semantic Drilldown == + (T306463, CVE-2022-29904) - SQL injection https://gerrit.wikimedia.org/r/q/I99359ecb7c5c44acb1e3f43cbb41ba200067dca0 == Nimbus == + (T306815, CVE-2022-29907) - XSS via the "Advertise" link interface messages https://gerrit.wikimedia.org/r/c/mediawiki/skins/Nimbus/+/786959 == FanBoxes == + (T306741, CVE-2022-29905) - Classic CSRF in Special:UserBoxes https://gerrit.wikimedia.org/r/c/mediawiki/extensions/FanBoxes/+/786327 == QuizGame == + (T302199, CVE-2022-29906) - Administrative API module lets unauthenticated requests through https://gerrit.wikimedia.org/r/c/mediawiki/extensions/QuizGame/+/765651 == RSS == + (T307028, CVE-2022-29969) - XSS in Extension:RSS when $wgRSSAllowLinkTag = true; https://gerrit.wikimedia.org/r/c/mediawiki/extensions/RSS/+/787807 == Wikibase, WikibaseLexeme == + (T308659, CVE-2022-34750) - Validate lemma length in Special:NewLexeme(Alpha) and label/description/aliases length in Special:NewProperty https://gerrit.wikimedia.org/r/c/mediawiki/extensions/WikibaseLexeme/+/8092… The Wikimedia Security Team recommends updating these extensions and/or skins to the current master branch or relevant, supported release branch [2] as soon as possible. Some of the referenced Phabricator tasks above _may_ still be private. Unfortunately, when security issues are reported, sometimes sensitive information is exposed and since Phabricator is historical, we cannot make these tasks public without exposing this sensitive information. If you have any additional questions or concerns regarding this update, please feel free to contact security(a)wikimedia.org or file a security task within Phabricator [3]. [0] https://w.wiki/5QKY [1] https://phabricator.wikimedia.org/T305209 [2] https://www.mediawiki.org/wiki/Version_lifecycle [3] https://www.mediawiki.org/wiki/Reporting_security_bugs

1 0

3D models in Commons
by Strainu 05 Jul '22

05 Jul '22

Hey folks, I know it's a bit early in the fiscal year and that's probably why I can't find anything on wiki, but I understood that the new yearly plan puts a lot of emphasis on the multimedia features. Does that include making 3D models usable in our wikis? If there are planned projects related to that in this fiscal year, would it be possible to get a link to the project page? I'm asking because there are a lot of cool, freely licensed models out there just waiting to be imported... Thank you, Strainu

3 3

Talk to the Search Platform / Query Service Team—July 6th, 2022
by Trey Jones 05 Jul '22

05 Jul '22

The Search Platform Team <https://www.mediawiki.org/wiki/Wikimedia_Search_Platform> usually holds an open meeting on the first Wednesday of each month. Come talk to us about anything related to Wikimedia search, Wikidata Query Service (WDQS), Wikimedia Commons Query Service (WCQS), etc.! Feel free to add your items to the Etherpad Agenda for the next meeting. Details for our next meeting: Date: Wednesday, July 6th, 2022 Time: 15:00-16:00 UTC / 08:00-09:00 PDT / 11:00-12:00 EDT / 16:00-17:00 WAT / 17:00-18:00 CEST Etherpad: https://etherpad.wikimedia.org/p/Search_Platform_Office_Hours Google Meet link: https://meet.google.com/vgj-bbeb-uyi Join by phone: https://tel.meet/vgj-bbeb-uyi?pin=8118110806927 Hope to talk to you tomorrow! —Trey Trey Jones Staff Computational Linguist, Search Platform Wikimedia Foundation UTC–4 / EDT

1 0

Don't forgot, only 4 more days to become eligible to vote in Board elections
by K. Peachey 02 Jul '22

02 Jul '22

Hi all, Just a small reminder for any developers that they only have 4 more days to become eligible to vote in the 2022 WMF Board of Trustees election. Developers can confirm their eligibility by reviewing the below list: * are Wikimedia server administrators with shell access * or have made at least one merged commit to any Wikimedia repos on Gerrit, between 5 January 2022 and 5 July 2022. * or have made at least one merged commit to any repo in nonwmf-extensions or nonwmf-skins, between 5 January 2022 and 5 July 2022. * or have made at least one merged commit to any Wikimedia tool repo (for example magnustools) between 5 January 2022 and 5 July 2022. * or have made at least 300 edits before 5 July 2022, and 20 edits between 5 January 2022 and 5 July 2022, on Translatewiki. * or maintainers/contributors of any tools, bots, user scripts, gadgets, and Lua modules on Wikimedia wikis. * or have substantially engaged in the design and/or review processes of technical development related to Wikimedia. This list was copied from <https://meta.wikimedia.org/wiki/Wikimedia_Foundation_elections/2022/Voter_e…>. If you need help getting a patch(/s) merged in the next few days, don't hesitate to reach out to the community in the next few days on the mailing lists, other locations such as the various IRC channels or phabricator. Regards, p858snake/Peachey88

3 2

Neuer Baustein "AhG"
by Siegfried Schmitt 02 Jul '22

02 Jul '22

Der neue Baustein {{AhG}} soll anzeigen, an welchen Stellen in der Wikipedia gerade eine Ad-hoc-Gruppe aktiv ist. Eine Ad-hoc-Gruppe kann als eine Art "task force police" verstanden werden, also eine schnelle Eingreiftruppe, die problematische Texte bearbeitet. Jeder Autor sollte diese "Vorlage:AhG" an beliebigen Stellen in der Wikipedia einsetzen können, sobald er ein Problem erkannt hat, das er nicht alleine lösen kann. Das Bildschirmfoto im Anhang zeigt die Anwendung des neuen Bausteines "AhG" auf einer typischen Seite, die dringend überarbeitet werden muß. Jeder Admin kann den Baustein einsetzen, um schnell ein Einsatzkommando zusammenzustellen. Grüße Siegfried -- Siegfried Schmitt Mathystr. 14-16 76133 Karlsruhe GERMANY Telefon: +49 721 358577 Mobilfunk: +49 1515 7525144 Siegfried.Schmitt(a)web.de

2 4

Feedback needed: Draft gadget/user script policy
by Jon Robson 02 Jul '22

02 Jul '22

[If you don't write gadgets, user scripts or work on MediaWiki code feel free to ignore this message] Hey all! Given the hackathon this weekend, now seemed like a good idea to talk about us having a policy for code we write for gadget and user scripts developers and as gadget and user script developers. TDLR: I am proposing a policy to guide developers and authors of these kinds of scripts. I would like people to read through my first draft <https://www.mediawiki.org/wiki/User:Jdlrobson/Extension:Gadget/Policy#Polic…> [1] and give me feedback on the talk page. Please feel free to share on wiki. *What is being proposed* A policy page that would be editable on wiki and linked to from the editing interfaces on gadgets, to guide both parties on how to write code that's sustainable and less prone to breakage. *Why is this needed?* Despite gadgets and user scripts (which will be referred from now on as wiki-based code) being a key component of MediaWiki projects, up until now frontend APIs (e.g. how wiki-based code should interact with source control provided code) have been ill-defined leading to misunderstandings between engineers and wiki-based code developers when wiki-based code break. This also leads to code rot, where developers do not feel empowered to make changes as it's unclear how their changes will impact wiki-based code developers. On top of this, when wiki-based code breaks it's not clear who can and will fix them. To solve this a policy I have been pushing for some time to make the contract between MediaWiki developers and wiki-based code developers explicit and less confusing. I hope on the long run a policy would restore trust and good faith between the two parties. *How can you help?* To contribute to the policy please use the discussion page to raise concerns, suggestions, removals or additions. *What's the deadline?* I'd like to have all feedback gathered by 30th May 2022 [1] https://www.mediawiki.org/wiki/User:Jdlrobson/Extension:Gadget/Policy#Polic…

1 1

Phabricator monthly statistics - 2022-06
by aklapper＠wikimedia.org 01 Jul '22

01 Jul '22

Hi Community Metrics team, This is your automatic monthly Phabricator statistics mail. Accounts created in (2022-06): 260 Active Maniphest users (any activity) in (2022-06): 994 Task authors in (2022-06): 531 Users who have closed tasks in (2022-06): 296 Projects which had at least one task moved from one column to another on their workboard in (2022-06): 312 Tasks created in (2022-06): 2127 Tasks closed in (2022-06): 1819 Open and stalled tasks in total: 49899 * Only open tasks in total: 48989 * Only stalled tasks in total: 910 Median age in days of open tasks by priority: Unbreak now: 30 Needs Triage: 785 High: 1166 Normal: 1706 Low: 2360 Lowest: 2470 (How long tasks have been open, not how long they have had that priority) Active Differential users (any activity) in (2022-06): 12 To see the names of the most active task authors: * Go to https://wikimedia.biterg.io/ * Choose "Phabricator > Overview" from the top bar * Adjust the time frame in the upper right corner to your needs * See the author names in the "Submitters" panel TODO: Numbers which refer to closed tasks might not be correct, as described in https://phabricator.wikimedia.org/T1003 . Yours sincerely, Fab Rick Aytor (via community_metrics.sh on phab1001 at Fri 01 Jul 2022 12:00:22 AM UTC)

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

Wikitech-l July 2022