October 2015 - MediaWiki-announce - lists.wikimedia.org

MediaWiki-announce October 2015

mediawiki-announce@lists.wikimedia.org

2 participants
4 discussions

by Gergo Tisza

Wikimedia has recently switched to HTTPS [1]; due to some unexpected problems this caused for third-party wikis, the domains used by the InstantCommons [2] feature continued to support HTTP. That ends now; in a few day, these connections will be redirected to HTTPS. MediaWiki was updated to correctly deal with this in 1.25.2, 1.24.3, and 1.23.10 [3]; if you use InstantCommons with an older version of MediaWiki, you should upgrade. The latest version (1.25.3, 1.24.4 and 1.23.11 [4]) includes some improvements to MediaWiki's HTTPS support on platforms where cURL is not available; if you are encountering problems, make sure you use this version. If you absolutely cannot upgrade, you can find workarounds in T102566 [5]. [1] http://blog.wikimedia.org/2015/06/12/securing-wikimedia-sites-with-https/ [2] https://www.mediawiki.org/wiki/InstantCommons [3] https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-August/000179… [4] https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-October/00018… [5] https://phabricator.wikimedia.org/T102566

8?years, 7?months

Extension Security Release: OAuth, Echo, PageTriage

by Chad

Hi all, In addition to the security release for MediaWiki core earlier today, I'd like to announce security fixes available for the following 3 extensions: * Extension:PageTriage - MediaWiki user Grunny discovered a DOM-based XSS in the way the extension handled page titles. < https://phabricator.wikimedia.org/T111029 > * Extension:Echo - Internal review discovered that Echo could display deleted or suppressed usernames when the username was previously used to Thank users. < https://phabricator.wikimedia.org/T110553 > * Extension:OAuth - Wikipedia user Sitic discovered that the OAuth extension did not correctly enforce the IP restrictions of a Consumer when using previously negotiated credentials. < https://phabricator.wikimedia.org/T103022 > * Extension:OAuth - Wikipedia user Sitic discovered that OAuth would accept a valid signature from any Consumer when checking the authorization signature. This allowed a registered Consumer who gained access to another Consumer's users access tokens and secrets to use those credentials. < https://phabricator.wikimedia.org/T103023 > ********************************************************************** Extension:PageTriage ********************************************************************** Information and Download: https://www.mediawiki.org/wiki/Extension:PageTriage ********************************************************************** Extension:Echo ********************************************************************** Information and Download: https://www.mediawiki.org/wiki/Extension:Echo ********************************************************************** Extension:OAuth ********************************************************************** Information and Download: https://www.mediawiki.org/wiki/Extension:OAuth None of these extensions are bundled but they are in use on Wikimedia sites hence the announcement. Fixes are in all supported branches in Git and are thus available from ExtensionDistributor. -Chad

8?years, 7?months

Security Release: 1.25.3, 1.24.4 and 1.23.11

by Chad

I would like to announce the release of MediaWiki 1.25.3, 1.24.4, and 1.23.11. These releases fix five security issues in core, in addition to other bug fixes. Download links are given at the end of this email == Security fixes == * Wikipedia user RobinHood70 reported two issues in the chunked upload API. The API failed to correctly stop adding new chunks to the upload when the reported size was exceeded (T91203), allowing a malicious users to upload add an infinite number of chunks for a single file upload. Additionally, a malicious user could upload chunks of 1 byte for very large files, potentially creating a very large number of files on the server's filesystem (T91205). < https://phabricator.wikimedia.org/T91203 > < https://phabricator.wikimedia.org/T91205 > * Internal review discovered that it is not possible to throttle file uploads. < https://phabricator.wikimedia.org/T91850 > * Internal review discovered a missing authorization check when removing suppression from a revision. This allowed users with the 'viewsuppressed' user right but not the appropriate 'suppressrevision' user right to unsuppress revisions. < https://phabricator.wikimedia.org/T95589 > * Richard Stanway from teamliquid.net reported that thumbnails of PNG files generated with ImageMagick contained the local file path in the image metadata. < https://phabricator.wikimedia.org/T108616 > == Bug Fixes in 1.25.3 == * Fix having multiple callbacks for a single hook. < https://phabricator.wikimedia.org/T98975 > * maintenance/refreshLinks.php did not always remove all links pointing to nonexistent pages. < https://phabricator.wikimedia.org/T107632 > * $wgEmergencyContact and $wgPasswordSender now use their default value if set to an empty string. < https://phabricator.wikimedia.org/T104142 > * Provide fallbacks for use of mb_convert_encoding() in HtmlFormatter. It was causing an error when accessing the api help page if the mbstring PHP extension was not installed. < https://phabricator.wikimedia.org/T62174 > * Confirmation emails would sometimes contain invalid codes. < https://phabricator.wikimedia.org/T105896 > * Fixed edit stash inclusion queries. < https://phabricator.wikimedia.org/T105597 > == Bug Fixes in 1.24.4 == * Minimal PSR-3 debug logger to support backports from 1.25+. < https://phabricator.wikimedia.org/T91653 > * Fix indexing of moved pages with PostgreSQL. Requires running update.php to fix. < https://phabricator.wikimedia.org/T68650 > == Release notes == Full release notes for 1.25.3: < https://www.mediawiki.org/wiki/Release_notes/1.25 > Full release notes for 1.24.4: < https://www.mediawiki.org/wiki/Release_notes/1.24 > Full release notes for 1.23.11: < https://www.mediawiki.org/wiki/Release_notes/1.23 > For information about how to upgrade, see < https://www.mediawiki.org/wiki/Manual:Upgrading > ********************************************************************** 1.25.3 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.25/mediawiki-1.25.3.tar.gz https://releases.wikimedia.org/mediawiki/1.25/mediawiki-core-1.25.3.tar.gz Patch to previous version: https://releases.wikimedia.org/mediawiki/1.25/mediawiki-1.25.3.patch.gz https://releases.wikimedia.org/mediawiki/1.25/mediawiki-i18n-1.25.3.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.25/mediawiki-1.25.3.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.25/mediawiki-1.25.3.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.25/mediawiki-core-1.25.3.tar.gz.… https://releases.wikimedia.org/mediawiki/1.25/mediawiki-i18n-1.25.3.patch.g… Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** 1.24.4 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.24/mediawiki-1.24.4.tar.gz https://releases.wikimedia.org/mediawiki/1.24/mediawiki-core-1.24.4.tar.gz Patch to previous version: https://releases.wikimedia.org/mediawiki/1.24/mediawiki-1.24.4.patch.gz https://releases.wikimedia.org/mediawiki/1.24/mediawiki-i18n-1.24.4.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.24/mediawiki-1.24.4.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.24/mediawiki-1.24.4.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.24/mediawiki-core-1.24.4.tar.gz.… https://releases.wikimedia.org/mediawiki/1.24/mediawiki-i18n-1.24.4.patch.g… Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** 1.23.11 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.11.tar.gz https://releases.wikimedia.org/mediawiki/1.23/mediawiki-core-1.23.11.tar.gz Patch to previous version: https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.11.patch.gz https://releases.wikimedia.org/mediawiki/1.23/mediawiki-i18n-1.23.11.patch.… GPG signatures: https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.11.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.11.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.23/mediawiki-core-1.23.11.tar.gz… https://releases.wikimedia.org/mediawiki/1.23/mediawiki-i18n-1.23.11.patch.… Public keys: https://www.mediawiki.org/keys/keys.html -Chad

8?years, 7?months

Announcement: Security Release Tomorrow

by Chad

Hi all, Tomorrow we will be issuing a security release to all supported branches of MediaWiki. The new releases will be: 1.25.3 1.24.4 1.23.11 Fixes will be available in these respective release branches, the unreleased 1.26.x branch, and master. Tarballs will be available for the above mentioned point releases as well. This security release will encompass core only, no bundled extensions are affected. -Chad

8?years, 7?months

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

MediaWiki-announce October 2015