July 2021 - MediaWiki-l - lists.wikimedia.org

MediaWiki-l July 2021

mediawiki-l@lists.wikimedia.org

10 participants
9 discussions

Lis tes messages avant qu'ils ne soient effaces!

by Badoo

Lis ton message de Nganguem Victor avant qu'il ne soit efface! Pour lire ton message, suis simplement ce lien: http://eu1.badoo.com/chatnoirxx/in/p4hxwt052ok/?lang_id=6 D'autres personnes sont aussi presentes: Oded (Tel Aviv, Israel) Priya (Udaipur, Inde) RajaYogi BK (Udaipur, Inde) Karuna (Udaipur, Inde) Chika Reginald Onyia (Pnompen', Cambodge) ...Qui d'autre? http://eu1.badoo.com/chatnoirxx/in/p4hxwt052ok/?lang_id=6 Les liens ne fonctionnent pas dans ce message? Copie les dans la barre d'adresse de ton navigateur. Tu as recu cet email suite a un message envoye par Nganguem Victor de notre systeme. S'il s'agit d'une erreur, ignore simplement cet email. La requete sera alors effacee du systeme. Amuse-toi bien ! L'equipe Badoo Courrier automatique de Badoo suite a l'envoi d'un message a ton attention sur Badoo. Les reponses ne sont ni stockees, ni traitees. Si tu ne veux plus recevoir de message de Badoo, fais-le nous savoir: http://eu1.badoo.com/impersonation.phtml?lang_id=6&mail_code=65&email=media…

5?months

Noisy Mediawiki 1.34.4 upgrade

by Jeffrey Walton

Hi Everyone, During a Mediawiki 1.34.3 to Mediawiki 1.34.4 upgrade... When updating vendor components using 'php -d extension=phar.so composer.phar update': Package wikimedia/password-blacklist is abandoned, you should avoid using it. Use wikimedia/common-passwords instead. Package jakub-onderka/php-parallel-lint is abandoned, you should avoid using it. Use php-parallel-lint/php-parallel-lint instead. Package jakub-onderka/php-console-color is abandoned, you should avoid using it. Use php-parallel-lint/php-console-color instead. Package jakub-onderka/php-console-highlighter is abandoned, you should avoid using it. Use php-parallel-lint/php-console-highlighter instead. Package phpunit/php-token-stream is abandoned, you should avoid using it. No replacement was suggested. Package phpunit/phpunit-mock-objects is abandoned, you should avoid using it. No replacement was suggested. I don't add things to vendor/, and I did not install packages like password-blacklist or php-parallel-lint. It looks like these are part of a Mediawiki installation. /var/www/html/wiki# find . -name password-blacklist ./vendor/wikimedia/password-blacklist /var/www/html/wiki# find . -name php-parallel-lint ./vendor/jakub-onderka/php-parallel-lint Jeff

2?years, 6?months

Replacing jQuery's hasClass() in MW extension JS code

by Yaron Koren

Hi, I've been trying to get rid of the ESLint warnings for the JavaScript code in some of my extensions, when they go through Jenkins validation. One warning that appears fairly often is this one: Where possible, maintain application state in JS to avoid slower DOM queries no-jquery/no-class-state I'm not sure if this is a warning that's specific to Wikimedia code, but doing a web search on it brings up this Wikimedia help page as the only real result: https://github.com/wikimedia/eslint-plugin-no-jquery/blob/master/docs/rules… This page is rather confusing. It says that the warning comes when calling either hasClass() or toggleClass() on a jQuery element. That part makes sense, but then the suggested alternatives are strange. The page says that the following are some examples of bad code: $( 'div' ).hasClass(); $div.hasClass(); In their place, it suggests the following: hasClass(); [].hasClass(); div.hasClass(); Can anyone explain this? As far as I'm aware, hasClass() is only defined in jQuery - and there, only as a method for variables representing jQuery elements. So what do those "recommended" lines mean? And in general, what is the best way to determine whether some element on the page has a certain class? -Yaron -- WikiWorks · MediaWiki Consulting · http://wikiworks.com

2?years, 9?months

MediaWiki Language Extension Bundle 2021.07 release

by Kartik Mistry

Hello all, I would like to announce the release of MediaWiki Language Extension Bundle 2021.07. This bundle is compatible with MediaWiki 1.35 or above and requires PHP 7.2 or above. Next MLEB is expected to be released in 3 months. If there are very important bug fixes, we will do an intermediate release. Please give us your feedback at [[ Talk:MLEB|https://www.mediawiki.org/wiki/Talk:MLEB]] . * Download: https://translatewiki.net/mleb/MediaWikiLanguageExtensionBundle-2021.07.tar… * sha256sum: f7cd8113c095375be51464429dff04c8fa5bb88bc22ba3d780bf5698668e52c5 * Signature: https://translatewiki.net/mleb/MediaWikiLanguageExtensionBundle-2021.07.tar… Quick links: * Installation instructions are at: https://www.mediawiki.org/wiki/MLEB * Announcements of new releases will be posted to a mailing list: https://lists.wikimedia.org/mailman/listinfo/mediawiki-i18n * Report bugs to: https://phabricator.wikimedia.org/project/view/1464/ Release notes for each extension are below. -- Kartik Mistry == Babel, cldr, CleanChanges and LocalisationUpdate == * Localisation and maintenance updates. == Translate == * '''BREAKING CHANGE''': Translate extension now requires MediaWiki 1.35 or above. * When translating in Page mode, modifying and publishing a message causes its to become empty ({{phab|T270819}}) * '''SECURITY''': Enhance validation and logging for AggregateGroups API deletions ({{phab|T282932}}) * Make Special:PageTranslation work with ONLY_FULL_GROUP_BY ({{gerrit|701871}}) * '''BREAKING CHANGE''': Remove TranslateMessageGroupPathVariables hook ({{gerrit|701678}}) * GettextFFS: Only allow pot mode for source language ({{phab|T230361}}) * Translation page deletion should not clear metadata ({{gerrit|694306}}) * Added content model and handler for translatable modules ({{gerrit|638528}}, {{phab|T271406}}) * Allow showing yearly stats in Special:TranslationStats ({{phab|T281244}}) * '''BREAKING CHANGE''': Remove Validator and LegacyValidatorAdapter ({{gerrit|685438}}) * Improve display of very long insertables ({{gerrit|685805}}) * Fix "Translation units to be deleted appear with unit ID -1 on Special:PageTranslation" ({{phab|T283971}}) * Localisation updates. === Configuration variable changes === To address voice and tone issues in the Translate extension ({{phab|T277965}}) the following configuration variable names have been renamed: * <code>TranslateBlacklist</code> → <code>TranslateDisabledTargetLanguages</code> * <code>TranslateAuthorBlacklist</code> → <code>TranslateAuthorExclusionList</code> * <code>TranslateCheckBlacklist</code> → <code>TranslateValidationExclusionFile</code> ''The old variables will be supported for MLEB 2021.07 release but removed in the MLEB 2021.10 release.'' If you have defined [[Help:Extension:Translate/Group_configuration|message groups]] defined with <code>LANGUAGE</code> attributes, <code>whitelist/blacklist</code> have been changed to <code>include/exclude</code> == UniversalLanguageSelector == * '''BREAKING CHANGE''': UniversalLanguageSelector extension now requires MediaWiki 1.35 or above. * MODERN VECTOR: Position language menu below language button ({{phab|T276248}}) * Update jquery.uls and jquery.ime from upstream * Fix "Suggested language list not available for ULS version in new language button". ({{phab|T282037}}) * MODERN VECTOR: Fix "ULS settings window can’t be opened with the preferences link on new Vector". ({{phab|T282956}}) * Fix "ULS preferences tool link cannot be opened when compact languages disabled" ({{phab|T286574}}) * Localisation updates. -- Kartik Mistry | ??????? ???????? kartikm.wordpress.com

2?years, 10?months

Problems with the OAuth extension

by ferdinando traversa

Hi everyone, I'm experiencing this problem with the OAuth extension and I don't have any clues! https://phabricator.wikimedia.org/T286769 Any ideas? Thanks in advance. Cheers, Ferdinando

2?years, 10?months

GPL violation (bilibili)

by dianliang233＠qq.com

Dear MW developers, I recently found a wiki farm owned by bilibili.com (one of the largest online video and game company) called "BWIKI" which is apparently using a set of heavily modified MW environment. However, it doesn't seem to be open-sourced, which is a obvious GPL violation. I tried to contact them but, so far, I haven't received an reply. Although I am not a MW contributor, I think it is my duty to report this illegal action. Thanks for developing such a useful software. Dianlaing233 URL: https://wiki.biligame.com/wiki/ Special:Version: https://wiki.biligame.com/wiki/Special:Version

2?years, 10?months

Need assistance upgrading from 1.31.6 -> 1.36.1

by Gautam Parthasarathy

Hi all, I am trying to update my MediaWiki server that is running the versions of software that are attached in the PDF. Can someone please help me figure out how to upgrade from 1.31.6 to 1.36.1 without breaking any of the dependencies? Thank you! Gautam Parthasarathy System Administrator, Streamline Healthcare Solutions 608-381-0807 | gautam.parthasarathy(a)streamlinehealthcare.com streamlinehealthcare.com < https://www.facebook.com/streamlinehealthcaresolutions/ > < https://www.linkedin.com/company/streamline-healthcare-solutions-llc/ > < https://twitter.com/StreamlineHCSol/ > < https://www.youtube.com/channel/UCn6aLr9zfswagoX6Tu9rF8g > Book my calendar! < https://www.cloudhq.net/meeting/dtqH6Pp2otgQpf8LdNeI >

2?years, 11?months

MediaWiki Extensions and Skins Security Release Supplement (1.31.15/1.35.3/1.36.1)

by Scott Bassett

Greetings- With the security/maintenance release of MediaWiki 1.31.15/1.35.3/1.36.1 [0], we would also like to provide this supplementary announcement of MediaWiki extensions and skins with now-public Phabricator tasks, security patches and backports [1]: == SocialProfile == + (T281043, CVE-2021-36130) - Stored XSS in various SystemGifts-related special pages < https://gerrit.wikimedia.org/r/q/Id915eba45497a1a0dc1c4e00818a2fd4c0ce55d3 > == SportsTeams == + (T281196, CVE-2021-36131) - Stored XSS in SportsTeams' Special:SportsTeamsManager & Special:UpdateFavoriteTeams < https://gerrit.wikimedia.org/r/691913 > == FileImporter == + (T280590, CVE-2021-36132) - Special:ImportFile does not check permissions from own config FileImporterRequiredRight < https://gerrit.wikimedia.org/r/q/I8ff2a67abd2c118a3469e4410eac2a451bfa76c3 > == ManageWiki == + (T281417, CVE-2021-29483) - 'wikiconfig' API leaked private config variables < https://github.com/miraheze/ManageWiki/security/advisories/GHSA-jmc9-rv2f-g… > == CentralAuth == + (T260865, CVE-2021-36125) - Very long usernames can cause an infinite loop when loading Special:GlobalRenameRequest < https://gerrit.wikimedia.org/r/q/I97d8b3236b5abed8ba9a9c4d3ab5050c2e782c22 > + (T281972, CVE-2021-36128) - Disable autoblocks for CentralAuth-issued suppression blocks < https://gerrit.wikimedia.org/r/q/I15d14c88a1e30df92c470bc191c4ee573172d4d1 > + (T285190, CVE-2021-36127) - Special:GlobalUserRights reveals existence of globally suppressed users < https://gerrit.wikimedia.org/r/q/I4e4dbcad61e1d4f6fd8b038bf63d19c69081a8ec > == Translate == + (T282932, CVE-2021-36129) - Aggregategroups Action API module allows deleting translatable page metadata for any group without trace < https://gerrit.wikimedia.org/r/q/I3619a7e88c2eb979babb7b027d4fdbfabc0af792 > == AbuseFilter == + (T284364, CVE-2021-36126) - Bad english MediaWiki:Abusefilter-blocker breaks filters < https://gerrit.wikimedia.org/r/q/I9e9f44b7663e810de70fb9ac7f6760f83dd4895b > The Wikimedia Security Team recommends updating these extensions and/or skins to the current master branch or relevant, supported release branch [2] as soon as possible. Some of the referenced Phabricator tasks above _may_ still be private. Unfortunately, when security issues are reported, sometimes sensitive information is exposed and since Phabricator is historical, we cannot make these tasks public without exposing this sensitive information. If you have any additional questions or concerns regarding this update, please feel free to contact security(a)wikimedia.org or file a security task within Phabricator [3]. [0] https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikime… [1] https://phabricator.wikimedia.org/T279733 [2] https://www.mediawiki.org/wiki/Version_lifecycle [3] https://www.mediawiki.org/wiki/Reporting_security_bugs -- Scott Bassett sbassett(a)wikimedia.org

2?years, 11?months

MediaWiki Stakeholders' Group meeting

by Bryan Hilderbrand

There will be a MediaWiki Stakeholders' Group [0] meeting this Friday (01JUL) at 15:30-16:30 GMT / 08:30-09:30 PDT / 11:30-12:30 EDT / 17:30-18:30 CET / 15:30-16:30 UTC. Meeting information is linked at [1]. Topics of discussion will be: 1) MediaWiki News * What's new in MediaWiki * Voting for the WMF board of trustees * CTO change * Developer Portal update 2) How to battle spam in community wikis * Jeffrey Wang from MyWikis will be discussing solutions to spam in community run wikis Feel free to come and listen, ask some questions, or add a topic to the Etherpad [2]. [0] https://www.mediawiki.org/wiki/MediaWiki_Stakeholders%27_Group [1] https://mwstake.org/mwstake/wiki/Event:138 [2] https://etherpad.wikimedia.org/p/mwstake-2021-07 ~Bryan Hilderbrand

2?years, 11?months

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

MediaWiki-l July 2021