Transition Technology: Ticket Query

#665: Wagn "Problem Loading Page" error

chris — Mon, 06 Jan 2014 14:02:00 GMT

Bug report from Tom:

I've encountered a problem when trying to set up new accounts: I get a 'Problem Loading Page' error when it tries to load http://localhost:3000/wagn/Invite_Success. This seems to be explained at http://wagn.org/Special_Urls_and_Ports - which I am hoping falls under your area of responsibility as I'm not sure how to do it myself,! But let me know if not...

#668: Wagn transition_mod

chris — Sat, 11 Jan 2014 08:52:25 GMT

Email from Ethan via Tom:

I was doing some work on wagn mods today and I realized that I'd created a mod (as in "modification" or "module", whichever you like) for the transition site that probably never survived the move to the new server.

Looking at https://patterns.transitionresearchnetwork.org/Building_Resilience confirmed this for me. The confidence shows up as the words "2 stars" rather than actual star images. That's one thing the mod does. The other has to do with reducing visual redundancy (recurring names) in pattern summaries.

I've attached the mod file here. Unless you've gotten creative with your configuration, you should be able to stick this file in local/mods and restart the server and have that fixed. Let me know if any of this doesn't make sense.

#691: Upgrade Wagn hosting for patterns site

chris — Fri, 21 Feb 2014 16:53:43 GMT

The http://patterns.transitionresearchnetwork.org/ site is running using a development set up and the webrick server falls over every now and then, so the plan is to upgrade to a production style setup.

References:

ticket:635 webrick server problems
wiki:TransitionResearchWagn documentation
ticket:561 the last install
http://wagn.org/installation

#553: Invalid response from server ERROR message

ed — Tue, 28 May 2013 15:13:43 GMT

Trying to add a user. Get error message: "Received an Invalid response from the server" then served a blank screen. Same with project profile:

https://www.transitionnetwork.org/admin/user/user/create https://www.transitionnetwork.org/node/add/project-profile

This has also happened for a user trying to add a project.

Ed can add an event and blog post, ingredient, panel page.

#560: Install drupal-based project management system onto our servers

ed — Tue, 11 Jun 2013 17:00:28 GMT

Please can you install a suitable project management drupal-based tool onto the suitable server? I am thinking of Open Atrium. It's for staff and partners to use for management stuff (ie not a ticketing system or mediawiki).

Open Atrium?

Can you let me know how long it would take to install to a point where I can manage it and get a pilot project up and running?

#562: Users being subscribed to widgets newsletter on registratoin

ed — Mon, 17 Jun 2013 15:11:22 GMT

Ed added new users to system via user-->add user. They are being automatically subscribed to the widget owners newsletter. Please investigate and stop this.

#565: Blogs breadcrumbs incorrect on listings views

ed — Tue, 25 Jun 2013 13:21:56 GMT

Blogs breadcrumbs are wrong at main all blogs view and one author's full list view: https://www.transitionnetwork.org/blog https://www.transitionnetwork.org/blogs/ed-mitchell

Jim can you sort this in under 15 minutes (which is what you have left)

#566: Profile photo does not work

ed — Wed, 26 Jun 2013 14:17:35 GMT

Using this user account: https://www.transitionnetwork.org/users/patricia-benson https://www.transitionnetwork.org/people/patricia-benson

I can't get the photo to sit correctly. I have already deleted her first user account as the first photo she put in was sideways - the system presented that the right size, but sideways. Then I couldn't get the system to forget the original photo so had to delete the account and start again. Now I've tried adding bigger, smaller pictures and they all come out far too big - the system is enlarging them up to wider than the space alloted.

Very odd. Too tired and busy to do this now - will revisit in July after holiday.

#579: Special email alert for Rob Hopkins blog posts on TN.org

ed — Mon, 12 Aug 2013 13:49:30 GMT

Can we create a specific email alert for new blog posts from Rob Hopkins' blog (/blogs/rob-hopkins)?
Can Ed do this?
See below:

Proposed new alert: ~

From: [Rob Hopkins at Transition Network <site@…>] Subject: New blog post from Rob Hopkins' Transition Culture To: [subscriber email] Reply to: [<site@…>]

Hello. I've written a new blog Transition Culture blog post

You can read it and leave comments here: [LINK]

[BLOG POST TITLE] [LINE BREAK - FULL CLEAR LINE] [BLOG POST TEASER] [LINE BREAK - FULL CLEAR LINE]

Best regards, Rob

-- [TN EMAIL SUBSCRIPTION AUTO-BLURB] This is an automatic message from Transition Network To manage your subscriptions, browse to http://www.transitionnetwork.org/user/285/notifications You can unsubscribe at http://www.transitionnetwork.org/notifications/unsubscribe/subscription/...

#600: Numbers missing from Initiatives search page

ed — Mon, 30 Sep 2013 11:46:20 GMT

When users do a search on /initiatives we are missing a number which pertains to the results of the report:

It should say "XXX initiatives match your search criteria"

The XXX bit is missing

please check and resolve

#601: TTech Meeting 3rd October 2013

chris — Thu, 03 Oct 2013 09:03:42 GMT

This is a ticket for notes and times for the online meeting held on 3rd October 2013.

The ticket for the last meeting is ticket:585

#609: Videos not showing if added via video link

ed — Tue, 15 Oct 2013 08:33:43 GMT

e.g. of project profile: https://www.transitionnetwork.org/projects/new-forest-transition-school-community-energy-saving-project

none showing on video page: https://www.transitionnetwork.org/video

#630: Archiving Transition Town Totnes site

ed — Mon, 25 Nov 2013 11:54:35 GMT

Please estimate to archive TTT site as per conversation with Ed:

convert to html
host on Penguin (incl. any likely issues for Penguin doing this)
any ongoing maintenance

Then Ed will discuss with Frances at TTT as per agreement with Chris

#643: Add paginator for /films view

ed — Mon, 09 Dec 2013 11:40:08 GMT

Please add pages links for this view: https://www.transitionnetwork.org/admin/build/views/edit/Films?destination=films#views-tab-page_1

10 per page should do it

#684: Adding Paul and Nick to Transition Network on github.org

chris — Thu, 23 Jan 2014 10:42:23 GMT

It looks like Ed and Jim are the only one with permissions to add members to Transition Network on GitHub as they are listed as owners and the rest of us are members.

Paul and Nick can you post you account names to this ticket so you can be added?

Jim could you make me and/or Ben owners as well so we can add people?

#705: Create a contents page on TransitionCulture.org Wordpress site

ed — Wed, 26 Mar 2014 15:33:43 GMT

Create a contents page on TC.org to see a listing of all the blog posts. Mike suggests: "use category post list widget to pull in the titles and then use widgetise pages to add widget to a standard page.:

Sam to follow up. MAX time: 1 hour.

#728: Re-patch location module

sam — Tue, 20 May 2014 12:53:16 GMT

Bugger just realised that I didn't finish the pull request into the main branch: https://trac.transitionnetwork.org/trac/ticket/681

So the location module patch is not on the live site.

I have now done the patch correctly I think: https://github.com/transitionnetwork/transitionnetwork.org-d6.profile/pull/2

Shall I additionally add the patch to the live site using Drush as I did before?

Thanks

Sam

#744: Add CSS Injector module to the D6 mix

annesley — Thu, 19 Jun 2014 10:50:03 GMT

CSS Injector module allows admin dynamic adding of CSS in to a live production server without code updates. this is to respond quickly to client needs whilst implementing the requests in the correct place in the themes on the next promotion from dev.

#815: Security updates need to be applied for a couple of contributed modules:

paul — Tue, 16 Dec 2014 13:45:16 GMT

DBTNG Hierarchical Select

#826: Switching MX records from United to Google

ed — Thu, 15 Jan 2015 17:15:41 GMT

TN are switching the MX records from United to Google on Friday 23/1/15.

Will this affect the website/Web Architects in any way that we need to plan for in advance? Scripts, web forms etc? Anything you can think of?

#494: Email account for TRAC

ed — Thu, 21 Feb 2013 10:16:37 GMT

Set up: 'trac@…' Password: going to Chris separately Secure SSL/TLS Settings Username: trac@… Password: Use the email account’s password. Incoming Server: mail.xssl.net IMAP: Port 993 POP3: Port 995 Outgoing Server: mail.xssl.net SMTP: Port 465 Authentication is required for IMAP, POP3, and SMTP.

#534: Add accounts for Ben

chris — Fri, 26 Apr 2013 17:16:23 GMT

Ben is a new member of the TTech team and accounts need setting up for him, this is a ticket to track the time taken to do this.

#546: Trac documentation

chris — Wed, 08 May 2013 18:47:09 GMT

Better documentation of things like how to set billing times etc

#597: Default owner for tickets

chris — Tue, 17 Sep 2013 08:04:58 GMT

Ben reported that the default owner for tickets is laura and that this should be changed.

#611: Adding Trac Account for Alan

chris — Thu, 17 Oct 2013 12:55:21 GMT

Alan, the other sysadmin at Webarchitects is in a better position than me to help with some of the more complex sysadmin issues so I hope it's OK that I have added an account for him here following the wiki:TracUserAdmin notes.

He is looking at helping with these tickets:

ticket:599 Server time drift
ticket:555 Load spikes causing the TN site to be stopped for 15 min at a time
ticket:593 Migrating Puffin to a ZFS file server

I don't expect he will be recording much time, I hope that is OK, he already has sudo access to all the servers.

#642: Trac "databasee is locked" errors in /var/log/messages

chris — Sat, 07 Dec 2013 13:46:43 GMT

I have just noticed these errors in /var/log/messages on wiki:PenguinServer:

Dec  1 23:09:00 penguin <11>Trac[chrome] ERROR: Error with navigation contributor TimingEstimationAndBillingPage: OperattionalError: database is locked
Dec  1 23:09:00 penguin <11>Trac[chrome] ERROR: Error with navigation contributor AdminModule: OperationalError: databasse is locked
Dec  1 23:09:00 penguin <11>Trac[chrome] ERROR: Error with navigation contributor SearchModule: OperationalError: databaase is locked
Dec  1 23:09:00 penguin <11>Trac[chrome] ERROR: Error with navigation contributor QueryModule: OperationalError: databasse is locked
Dec  1 23:09:00 penguin <11>Trac[chrome] ERROR: Error with navigation contributor ReportModule: OperationalError: databaase is locked
Dec  1 23:09:00 penguin <11>Trac[chrome] ERROR: Error with navigation contributor RoadmapModule: OperationalError: databbase is locked
Dec  1 23:09:00 penguin <11>Trac[chrome] ERROR: Error with navigation contributor TicketModule: OperationalError: databaase is locked
Dec  1 23:09:00 penguin <11>Trac[chrome] ERROR: Error with navigation contributor TimelineModule: OperationalError: dataabase is locked
Dec  1 23:09:00 penguin <11>Trac[chrome] ERROR: Error with navigation contributor BrowserModule: OperationalError: databbase is locked
Dec  1 23:09:00 penguin <11>Trac[chrome] ERROR: Error with navigation contributor WikiModule: OperationalError: databaseeis locked

There are lots more of these, including some from this morning.

Trac still seems to be working OK so I don't know how significant they are.

#682: Create Trac & Wiki account for Paul

sam — Wed, 22 Jan 2014 12:39:18 GMT

Hi it looks like i@… will be joining us to pick up some of Jim's role as he moves on.

Chris could you create a trac & Wiki account for him please?

His email is; i@…

Thanks

Sam

#822: Create TRAC id for Ade

ed — Wed, 07 Jan 2015 09:54:13 GMT

name: ade email: adestuart@…

#842: Trac fetchmail

chris — Thu, 02 Apr 2015 12:54:11 GMT

There is a new SSL/TLS certificate at mail.webarch.net so these steps need following: wiki:TransitionTrac#Fetchmail

#572: Design changes for homepage and TC section

ed — Wed, 17 Jul 2013 14:17:25 GMT

Design changes for TN homepage and TC section done by Ben to be part of maintenance budget.

list here: https://docs.google.com/spreadsheet/ccc?key=0An7ZaZdq6UfJdDhxS0JxbXZLYnhLRkN4X3h5aVV3R1E#gid=0

#592: Many panes on homepage are in italics

ed — Wed, 11 Sep 2013 07:29:50 GMT

they shouldn't be, but they are: ingredient of the day latest tc post featured training why do transition featured resrouce featured project social reporters all automated listings at bottom

please resolve - ben are you around to do this or is it more suitable to ask jim atm?

#371: Piwik Hosting

chris — Mon, 05 Dec 2011 21:34:51 GMT

Another option to consider for Piwik would be be to use a instance on another server, and there happens to be one here that could be used:

https://stats.webarch.net/

Could this be considered?

#382: Measurement and tracking requirements for TN and PSE

ed — Tue, 13 Dec 2011 04:57:12 GMT

to list the measurement and tracking requirements for TN and PSE so that we can assess piwik vs google and decide which way to go.

#495: Replace Google Analytics with Piwki

ed — Thu, 21 Feb 2013 10:20:25 GMT

Unless we see any issue, turn GA off on 01/03/13. Use Piwik instead.

#556: Upgrade Piwik to version 1.12

chris — Thu, 30 May 2013 21:40:48 GMT

A new version of Piwik came out today with some interesting looking features:

#660: Piwik 2.0

chris — Tue, 17 Dec 2013 09:36:18 GMT

The new version of Piwik will be out soon, the Piwik 2.0 Release Candidate just came out.

This ticket has beed created to document the upgrade.

#664: Upgrade Piwik to 2.0.2

chris — Tue, 24 Dec 2013 14:35:06 GMT

This is a bugfix version which fixes 3 issues, see http://piwik.org/changelog/piwik-2-0-1/

Upgrade notes are here, wiki:PiwikServer#Updates

#672: Upgrade to Piwik 2.0.3

chris — Mon, 13 Jan 2014 10:13:00 GMT

From the Piwik changelog:

Piwik 2.0.3 is a bug-fix release. To ensure the highest quality and reliability for your Piwik 2.0 setup, we have fixed all known major bugs, as well as made some small improvements.

...

We highly recommend that you upgrade your server to Piwik 2.0.3 today to benefit from the latest improvements.

#697: Piwik 2.1 upgrade for stats.transitionnetwork.org

chris — Tue, 04 Mar 2014 07:37:11 GMT

Full details on the piwik blog:

Piwik 2.1 is the first release after our 2.0 release and it reflects the new direction Piwik is moving in: better performance, more reliability and a better overall open platform!

#720: Upgrade to Piwik 2.2.0

chris — Thu, 17 Apr 2014 07:51:50 GMT

From the Changelog, http://piwik.org/changelog/piwik-2-2-0/

Piwik 2.2.0 is a major new release. This release is rated critical. Please update now.

We highly recommend that you upgrade your server to Piwik 2.2.0 today to benefit from design, performance and security improvements in this release.

Piwik 2.2 helps you focus on your data

All reports: display as much text as possible before the label becomes truncated (useful when you want to see more data at a glance without having to hover to view the full label)
Make Datatables more readable and flatter – we have removed some borders.
On the dashboard, the Data Tables and graph icons are now hidden by default and are now available by clicking on the widget footer.
New features

Event Tracking: track your custom events with Piwik. An event is defined by a Category, an Action, an optional Name and an optional Value. Event Tracking is a powerful feature which can be used for many purposes! http://piwik.org/docs/event-tracking/
Site Search reports are now available in Scheduled email reports and on Piwik Mobile
New Websites Groups (available on request) functionality now allows you to group a cluster of websites in the All Websites Dashboard.
Security fixes: we would like to warmly thank Security researchers Mateusz Goik and Vivek S. Jadhav for responsibly reporting two XSS security issues in Piwik which are now fixed in 2.2.0.
API breaking change for Plugins developers
Deprecated the function Schema::dropTables() and DbHelper::dropTables, for the new Db::dropTables()
Removed the code that was deprecated in 2.1.0. Learn more http://piwik.org/blog/2014/02/piwik-2-1-changes-plugin-developers/

#726: Upgrade to Piwik 2.2.1

chris — Tue, 06 May 2014 11:14:05 GMT

Piwik 2.2.1 is a new minor release which brings more stability to the platform.

http://piwik.org/changelog/piwik-2-2-1/

#729: Upgrade to Piwik 2.2.2

chris — Fri, 23 May 2014 08:21:12 GMT

2.2.2 came out on 8th May, not sure why I missed this at the time, the change log is here: http://piwik.org/changelog/piwik-2-2-2/

The last upgrade was 2.2.1 ticket:726 and the upgrade notes are at wiki:PiwikServer#Updates

#732: Upgrade Piwik to 2.3.0

chris — Tue, 27 May 2014 09:21:24 GMT

Piwik 2.3.0 is a new major release of Piwik!

http://piwik.org/changelog/piwik-2-3-0/

#752: Piwik 2.4.0 Update

chris — Thu, 03 Jul 2014 09:24:13 GMT

Piwik 2.4.0 is a new major release of Piwik! This release is rated critical. Please update now.

Security fixes

We would like to warmly thank Security researchers Aron Molnar (XSEC infosec GmbH) for reporting a XSS vulnerability which we have fixed in 2.4.0. We also thank Andrea Palazzo and Jose Luis Zayas for their security recommendations which are now implemented in 2.4.0.

http://piwik.org/changelog/piwik-2-4-0/

#756: Piwik 2.4.1 Update

chris — Fri, 11 Jul 2014 13:21:34 GMT

From the Changelog:

Piwik 2.4.1 is a new minor release of Piwik fixing a few bugs found by the community after the major 2.4.0 release.

#776: Piwik 2.0.5

chris — Sat, 16 Aug 2014 07:55:49 GMT

New version of Piwik, not a security update so no urgent need to upgrade unless there is some new required feature:

http://piwik.org/changelog/piwik-2-5-0/

#782: Piwik 2.6.1

chris — Fri, 05 Sep 2014 07:15:03 GMT

New Piwik, changes: http://piwik.org/changelog/piwik-2-6-1/

#791: Piwik 2.7.0

chris — Thu, 25 Sep 2014 17:29:12 GMT

The changelog for 2.7.0 contains:

Piwik 2.7.0 is a new major release of Piwik!

What’s new in 2.7.0?

In this release we have packed several major new features and many small improvements. The new features in this release are: User ID, New Pivot Table feature for Events reports, new plugin to count users visiting several of your websites, new Content Tracking plugin, new Browser language Report listing the user language codes, and more (see below the list of all issues that were closed in this release).

63 tickets have been closed by 15 contributors!

Database upgrade

Note: This release contains major database upgrades and upgrading your database will take a long time if you have a lot of data in your database.
Exceptionally when you upgrade your Piwik to 2.7.0 you will run through the Upgrade screen twice (instead of only once as usual). If you use the command line you will have to execute the command ‘./console core:update’ twice. This is expected and normal behavior for this release.
-> Check out this CHANGELOG.md file (in the root of Piwik) to see all changes to the platform and APIs.

https://github.com/piwik/piwik/blob/master/CHANGELOG.md#piwik-platform-changelog

#796: Piwik 2.8.0

chris — Tue, 14 Oct 2014 09:20:54 GMT

Piwik 2.8.0 is a new major release of Piwik. In this release we have focused on reliability, usability and security. 57 tickets have been closed by 12 contributors!

This release is rated critical.

http://piwik.org/changelog/piwik-2-8-0/

#800: Piwik 2.8.1

chris — Wed, 22 Oct 2014 09:28:26 GMT

Piwik 2.8.1 is a new minor release of Piwik! In this release we have focused on reliability and bug fixing. 28 tickets have been closed by 7 contributors!

Security fixes

The Piwik team warmly thank security researcher Dingjie Yang for responsibly disclosing a XSS vulnerability occurring in older Internet Explorer browsers.

http://piwik.org/changelog/piwik-2-8-1/

#801: Piwik 2.8.3

chris — Thu, 23 Oct 2014 10:05:14 GMT

New version of Piwik today:

Piwik 2.8.3 is a new minor release of Piwik, fixing an issue discovered in Piwik 2.8.3. 2 tickets have been closed by 2 contributors!

http://piwik.org/changelog/piwik-2-8-3/

And yesterday:

Piwik 2.8.2 is a new minor release of Piwik, fixing an issue affecting some users of Nginx. 6 tickets have been closed by 5 contributors!

http://piwik.org/changelog/piwik-2-8-2/

#807: Piwik 2.9.0

chris — Fri, 14 Nov 2014 10:56:27 GMT

New version of Piwik:

Piwik 2.9.0 is a new major release of Piwik! In this release we have focused on reliability and stability. 58 tickets have been closed by more than 8 contributors!

http://piwik.org/changelog/piwik-2-9-0/

#810: Piwik 2.9.1

chris — Thu, 20 Nov 2014 14:58:20 GMT

From the changelog:

Piwik 2.9.1 is a new minor release of Piwik. In this release we have fixed a few minor issues reported in 2.9.0.

#817: Piwik 2.10.0

chris — Thu, 18 Dec 2014 11:40:50 GMT

From the changelog:

Note: Piwik 2.10.0 is not released yet – we expect a release around December 25th.

Piwik 2.10.0 is a new major release of Piwik! In this release we have focused on improving performance, adding several features to the Log Analytics tool and fixed dozens of bugs to improve your Piwik experience. Almost 100 issues were closed by 11 contributors!

#823: Pwiki 2014 annual report

chris — Wed, 07 Jan 2015 12:19:55 GMT

Ed would like a some PDF reports of Transition Network site usage for 2014 from Piwik.

#832: Piwik 2.11.0

chris — Wed, 18 Feb 2015 13:11:58 GMT

The Changelog for 2.11.0, which came out on February 16, 2015 contains:

Piwik 2.11.0 is a new major release of Piwik!

In this release we have focused on overall reliability, improved Performance, improved Accessibility for visually impaired users, and also we have re-organised the User and Admin Menus for hopefully a better experience. There are even some very interesting new features such as a new icon available in most reports (check it out and let us know what you think!).

128 tickets have been closed by more than 17 contributors, our record number of contributors in one release. Thank you to everyone who participated in this release by reporting or fixing a bug or a new feature.

#833: Piwik 2.11.1

chris — Mon, 23 Feb 2015 11:23:59 GMT

Out today, from the changelog:

Piwik 2.11.1 is a new minor release of Piwik. It is a follow up to last week’s major 2.11.0 release. It includes a few bug fixes, in particular a performance regression introduced in 2.11.0. 16 tickets have been closed by 5 contributors!

#835: Piwik 2.11.2

chris — Wed, 04 Mar 2015 09:59:13 GMT

From the changelog:

Piwik 2.11.2 is a new minor release of Piwik. In this release we have fixed a few issues that were reported in Piwik 2.11.0 and 2.11.1. 16 tickets have been closed by 8 contributors!

#838: Piwik 2.12.0

chris — Mon, 23 Mar 2015 10:14:04 GMT

From the Piwik 2.12.0 announcement:

Piwik 2.12.0 is a new major release of Piwik! In this release we have focused on security, performance, and data quality improvements.

What’s new?

Loading reports in the UI will be faster overall, as well as custom date range reports and archiving. There were improvements made in both memory and CPU usage.

When you create a new website in Piwik, it will now show instructions and display the Javascript Tracking code instead of the dashboard, as long as no data has been tracked.

There is a new data quality tool: a console command to geo-locate any past visits which don’t have geo-location data.

There are also important security improvements such as the one-click update which will now be done over secure connection HTTPS, or the fact that the token_auth will be removed from all of the log outputs.

If you use the “Make it flat” feature, you may have noticed it was slow on large datasets: from Piwik 2.12.0 the Flattened reports will now render quickly even on the largest datasets (“Make it flat” is available via the bottom right icon in most reports).

There are also several other bug fixes and improvements: 49 tickets have been closed by 7 contributors! (see the list of issues below)

#840: Piwik 2.12.1

chris — Tue, 31 Mar 2015 16:31:12 GMT

From the changelog:

Piwik 2.12.1 is a new minor release of Piwik, a follow up to 2.12.0 major release.

In this release we have focused on fixing a regression in the Visitor Log as well as other smaller fixes.

11 tickets have been closed by 5 contributors!

#848: Piwik 2.13.0

chris — Mon, 27 Apr 2015 09:56:54 GMT

From the Changelog:

We are proud to announce Piwik 2.13.0: a new major release of Piwik!

What’s new?

In this release we have focused on improving performance and making Piwik much faster at loading and archiving reports. The dashboard and All websites dashboard will load faster than ever before! This is especially visible if you measure many websites (hundreds of thousands) within your Piwik, the improved Websites Manager will now let you search for websites and page through the list, and the ‘All Websites’ dashboard will now load correctly.

Performance was not our only focus and we also improved the usability and design of some parts of Piwik (such as the Updater and maintenance mode, with more design updates coming in the next releases). Log Analytics, a very popular tool within the Piwik community, has received several improvements. Many other small bugs were closed, and a XSS security bug was reported and fixed in this release.

96 tickets have been closed by 8 contributors!

#850: Piwik 2.13.1

chris — Fri, 08 May 2015 10:25:43 GMT

The changelog:

Piwik 2.13.1, a new minor release of Piwik, has been released!

What’s new?

We are releasing 2.13.1 shortly after 2.13.0 to address a few small bugs that were reported by the community. This release also includes a Tracking API performance improvements as well as other minor improvements listed below.

#861: Piwik 2.14.0

chris — Wed, 24 Jun 2015 09:04:46 GMT

From the Changelog:

We are proud to announce Piwik 2.14.0: a new major release of Piwik!

What’s new?

[…]

More than 120 tickets have been closed by 13 contributors!

Security release

This release is rated critical.

Three security issues have been fixed. We are grateful for security researchers who responsibly disclosed these security issues to us: Abdullah Hussam Gazi (CSRF issue) and Dmitriy Shcherbatov (two XSS issues).

Database upgrade

This release does not contain any major database upgrade.

Platform Changes

Piwik is an open analytics platform. In an effort to help Piwik developers learn about improvements and changes in the core APIs, we document the changes since the last release.

In this 2.14.0 release there are breaking changes, New features, Library updates, New commmands.

#866: Piwik 2.14.1

chris — Fri, 17 Jul 2015 08:41:34 GMT

The changelog:

What’s new in Piwik 2.14.1?

In this release we have focused on fixing a few regressions reported in the last major release Piwik 2.14.0, as well as 27 other small improvements. As always we – the Piwik team – are very interested to hear your feedback!

27 tickets have been closed by 6 contributors.

#867: Piwik 2.14.2

chris — Mon, 27 Jul 2015 11:18:26 GMT

The Changelog:

What’s new in Piwik 2.14.2?

In this release we have focused on fixing a few regressions reported in the last major release Piwik 2.14.0, as well as 15 other small improvements. As always we – the Piwik team – are very interested to hear your feedback!

15 tickets have been closed by 6 contributors.

#869: Piwik 2.14.3

chris — Mon, 24 Aug 2015 12:00:58 GMT

The Piwik Changelog 2.14.3 contains:

Piwik 2.14.3 is a new minor release of Piwik.

What’s new?

This release addresses a regression introduced in 2.14.2 that prevents users from installing Piwik in some cases.

11 tickets have been closed by 5 contributors!

#880: Piwik 2.15.0

chris — Fri, 16 Oct 2015 09:04:00 GMT

The Piwik 2.15.0 changelog:

We are proud to announce Piwik 2.15.0 Release Candidate: a new major release of Piwik!

What’s new?

Piwik 2.15.0 is our Long Term Support release for Piwik 2.X. This release aims to be outstanding from a performance, security, and reliability point of view. It also includes a beautiful new design which lets you focus on your data, and a new awesome search bar to lets you easily navigate to any menu, website or segment in your Piwik dashboards. For administrators and power user, this release includes new diagnostic tools, logging messages, a new Log viewer plugin, and better overall performance and scalability. There are dozens other improvements, see the full list below. Piwik 2.15.0 is built to last.

Security release

This release is rated critical.

We are grateful for Security researchers who disclosed security issues privately to the Piwik Security Response team: Elamaran Venkatraman, Egidio Romano and Dmitriy Shcherbatov. The following vulnerabilities were fixed: XSS, CSRF, possible file inclusion in older PHP versions (low impact), possible Object Injection Vulnerability (low impact).

Database upgrade

This release does not contain any major database upgrade.

Platform Changes

Piwik is an open analytics platform. In an effort to help Piwik developers learn about improvements and changes in the core APIs, we document the changes since the last release.

In this 2.15.0 release there are API deprecations, New features, New APIs, New commmands, Internal API changes.

Read more in Platform Changelog for Developers to see all changes to the platform and APIs (you can also find it in the CHANGELOG.md in the root of your Piwik)

#902: Piwik 2.16.0

chris — Sun, 07 Feb 2016 10:41:47 GMT

From the changelog:

What’s new?

Piwik 2.16.0 is a release which includes more than 250 closed issues. To learn about the most important and visible changes, read our blog post: What’s new in Piwik 2.16.0?

This release is our Long Term Support release.

263 tickets have been closed by more than 30 contributors!

#910: Piwik 2.16.1

chris — Tue, 12 Apr 2016 10:29:09 GMT

The changelog:

Security release

This release is rated critical.

#538: intransitionmovie.com checks and updates

chris — Tue, 30 Apr 2013 20:02:03 GMT

The http://www.intransitionmovie.com/ site has been migrated to wiki:ParrotServer, the DNS might not have yet updated for everybody.

Laura -- could you check that the site is working OK if you get a chance, especially the ecommerce elements?

There are some outstanding updates, WordPress is version 3.3.2 need updating to 3.5.1 and there are 12 plugins with updates available:

18 installed plugins:
 UA affiliates
 UA affiliates-woocommerce-light
 UA akismet
  A backupwordpress
 UI bad-behavior
 UA bwp-minify
  A contact-form-7
 UA event-o-matic
  A transposh-translation-filter-for-wordpress
 UA usernoise
  A woocommerce
 UA woocommerce-export-csv
  A woocommerce-currency-converter
 UA woocommerce-dynamic-pricing
  A woocommerce-delivery-notes
 UA woocommerce-shipping-table-rate
 UA wp-customer-reviews
 UI wp-super-cache
Legend: A = Active, I = Inactive, U = Update Available

I'm happy to do all these updates but I wouldn't know what exactly to check to see that the updates don't break anything -- would Laura be able to help with a quick check that updates haven't broken anything?

#539: REconomy site migration and updates

chris — Wed, 01 May 2013 10:01:00 GMT

This ticket is to keep track of the tasks undertaken and the time spent on the migration of the http://www.reconomy.org/ site to wiki:ParrotServer.

#542: Parrot RAM

chris — Wed, 01 May 2013 20:35:50 GMT

I'm concerned that wiki:ParrotServer might not be able to cope with load spikes due to it only having 1GB of RAM, these are the Munin graphs we need to key an eye on:

If the server runs out of RAM it will basically stop responding.

#550: Transition Town Totnes migration

chris — Sun, 19 May 2013 14:59:44 GMT

It has been agreed to migrate Transition Town Totnes, http://transitiontowntotnes.org/ to wiki:ParrotServer and this ticket has been created to record this process and the time spent on it and the documentation of the migration.

There is also an issue regarding what, if anything, to do with the old Drupal site at http://archive.transitiontowntotnes.org/

#577: Transition Streets Wordpress Migration

chris — Tue, 06 Aug 2013 21:28:25 GMT

This is a ticket to document the migration of the Transition Totnes http://www.transitionstreets.org.uk/ wiki:WordPress site to wiki:ParrotServer.

#583: tmp files on parrot exceeded inode limit

ed — Mon, 02 Sep 2013 12:28:46 GMT

Users are attempting to purchase a DVD and the cart always zeros out even after attempts to update cart etc.

Laura suggests that this may be a server issue and to start with Chris:

The prob could v likely be on the hosting side, so be worth contacting Chris first (and mention can add to cart all okay when logged in, view cart and alter and get to billing page, so could be a session setting that's changed) -

Does the server have disk space left on /tmp. Session data is most likely written there. (sometimes this cart faff issue can happen because of that.)

Are the PHP Session settings correct/ have they changed recently? Chris can fix this if needing a tweakette in php.ini or other places in the underworld of those types of files.

DB could potentially need check/repair.

Another one is the shop element relies on cookies so if a user has set browser to not accept cookies may poss not work! (but think thats something not to think about here, as I tested as both logged in and logged out with cookies set to work on my browser, logged out got the 'cart empty' faff factor like other users will be getting.)

If Chris can't spot the bug (does sound server side and sessions related from a quick test here, haven't looked at the server logs, but if get a mo later will see if I can), poss good to chat and I can think some more on it, but first thoughts alert me mostly to server side, sometimes a roll back to php 5.2 clicks things back into place (but shouldn't be needed). Be good to see if there is a correlation with any server changes/tweaks happening around same timing that the cart stopped working. Keep me in the loop if it is a server fix-y thing as always interested to hear results on bug fixing on sites.

#594: WordPress 3.6.1 Maintenance and Security Release

chris — Wed, 11 Sep 2013 22:05:01 GMT

The following is from http://wordpress.org/news/2013/09/wordpress-3-6-1/

WordPress 3.6.1 is also a security release for all previous WordPress versions and we strongly encourage you to update your sites immediately. It addresses three issues fixed by the WordPress security team:

Block unsafe PHP unserialization that could occur in limited situations and setups, which can lead to remote code execution. Reported by Tom Van Goethem.
Prevent a user with an Author role, using a specially crafted request, from being able to create a post “written by” another user. Reported by Anakorn Kyavatanakij.
Fix insufficient input validation that could result in redirecting or leading a user to another website. Reported by Dave Cummo, a Northrup Grumman subcontractor for the U.S. Centers for Disease Control and Prevention.
Additionally, we’ve adjusted security restrictions around file uploads to mitigate the potential for cross-site scripting.

#631: Move Transition Culture onto PARROT

ed — Mon, 25 Nov 2013 11:57:44 GMT

We are about to move TC onto PARROT. List of likely actions here:

Ed speak to Simon (move the host, keep the developer if poss)
Chris speak to Simon about TC issues - traffic, size etc.
analyse TC traffic and DB size
prepare PARROT
move TC

Chris thinks we'll need to up PARROT to VPS2 + 2 GB RAM

#656: Spam being sent out via Transition Culture

chris — Sat, 14 Dec 2013 14:48:21 GMT

I'm getting several of thee day day:

From: Mail Delivery System <Mailer-Daemon@parrot.webarch.net>
Date: Sat, 14 Dec 2013 13:21:02 +0000
To: tc@parrot.webarch.net
Subject: Mail delivery failed: returning message to sender
This message was created automatically by mail delivery software.
A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:
  inxzkysnf@gmail.com
    SMTP error from remote mail server after RCPT TO:<inxzkysnf@gmail.com>:
    host gmail-smtp-in.l.google.com [173.194.78.26]:
    550-5.1.1 The email account that you tried to reach does not exist. Please try
    550-5.1.1 double-checking the recipient's email address for typos or
    550-5.1.1 unnecessary spaces. Learn more at
    550 5.1.1 http://support.google.com/mail/bin/answer.py?answer=6596 l11si2175565wjw.16 - gsmtp
------ This is a copy of the message, including all the headers. ------
Return-path: <tc@parrot.webarch.net>
Received: from tc (uid=1011)
        by parrot.webarch.net with local (Exim 4.80)
        (envelope-from <tc@parrot.webarch.net>)
        id 1Vrp9L-0002BF-Kf
        for inxzkysnf@gmail.com; Sat, 14 Dec 2013 13:20:56 +0000
To: inxzkysnf@gmail.com
Subject: Thanks for your message
X-PHP-Originating-Script: 1011:lib_nonajax.php
From: robjhopkins@gmail.com
Reply-To: robjhopkins@gmail.com
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----MIME_BOUNDRY_main_message"
Message-Id: <E1Vrp9L-0002BF-Kf@parrot.webarch.net>
Date: Sat, 14 Dec 2013 13:20:55 +0000
This is a multi-part message in MIME format.
------MIME_BOUNDRY_main_message
Content-Type: text/plain; charset="UTF-8"; format=flowed
Content-Transfer-Encoding: quoted-printable
Dear timberland france,
Thank you for your message on the Transition Culture website - I will get back to you as soon as possible.
------MIME_BOUNDRY_main_message
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><BODY>
<div style=3D"font:normal 1em arial; margin-top:10px"><p><strong>Dear timberland france,</strong></p>
<p>Thank you for your message on the Transition Culture website - I will get back to you as soon as possible.
<div style=3D"width:80%; background:#f4faff ; color:#aaa; font-size:11px; padding:10px; margin-top:20px"><strong>This is an automatic
+confirmation message. 14 December, 2013.</strong></div></div></BODY></HTML>

It appears to be spam sent fro the Transition Culture WordPress site to a Gnmail user who doesn't exist.

It appears, from the email headers that this form is being used for the spamming /home/tc/sites/default/wp-content/plugins/contactforms/lib_nonajax.php.

This needs some more investigation.

#687: Set up cert expiry date checking for all SSL certs

chris — Mon, 03 Feb 2014 13:35:01 GMT

Last month the *.transitionnetwork.org cert expired before it was replaced with a new one and users therefore got warnings for around half a day, see ticket:685.

A script to check the expiry dates was set up on wiki:PuffinServer on ticket:685#comment:9 and this ticket is to document setting this up for wiki:PenguinServer and wiki:ParrotServer.

#695: File upload problem with TTT WordPress site

chris — Sun, 02 Mar 2014 19:46:50 GMT

Laura has reported:

Had a report this evening that the TTT website isn't letting any uploads happen (adding of a new plugin by another admin, and also media/image uploads not being able to uploaded - no real error message as such just doesn't upload).

I just logged in quickly to see if I could upload a pic to test and wouldn't upload. Just wanted to check if anything had changed server side re permissions.

#696: Disk space error on parrot for TTT site

chris — Mon, 03 Mar 2014 10:51:46 GMT

Email from Laura:

Message appearing at top of ttt website when I just took a look-

Warning: session_start():
open(/home/ttt/tmp/sess_mnme76d2k5s6vopk5u1it126p5, O_RDWR) failed: No
space left on device (28) in
/home/ttt/sites/default/wp-content/plugins/tt-resource-database/participants-database.php
on line 2534

and something in the sidebar -

Warning: call_user_func_array() expects parameter 1 to be a valid
callback, array must have exactly two members in
/home/ttt/sites/default/wp-includes/plugin.php on line 199

#699: Update Core & Plugins on transitionculture.org

sam — Mon, 10 Mar 2014 11:46:33 GMT

This site needs an update.

I'll do a database backup then update it.

#709: Reconomy sites appears to be sending out spam

chris — Fri, 28 Mar 2014 18:48:53 GMT

This failed email has just been returned:

From: Mail Delivery System <Mailer-Daemon@parrot.webarch.net>
Date: Fri, 28 Mar 2014 18:14:32 +0000
To: recon@parrot.webarch.net
Subject: Mail delivery failed: returning message to sender
This message was created automatically by mail delivery software.
A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:
  fionaward@transitionnetwork.org
    SMTP error from remote mail server after end of data:
    host mx1.spamfiltering.com [72.249.150.158]: 550 An address in this message (at sleepingteensex . com) is listed on
+sbl-multi.rbl.spamrl.com. Please organise removal and retry.
------ This is a copy of the message, including all the headers. ------
Return-path: <recon@parrot.webarch.net>
Received: from recon (uid=1006)
        by parrot.webarch.net with local (Exim 4.80)
        (envelope-from <recon@parrot.webarch.net>)
        id 1WTbIM-0001Sz-6R
        for fionaward@transitionnetwork.org; Fri, 28 Mar 2014 18:14:22 +0000
To: fionaward@transitionnetwork.org
Subject: roulette89
X-PHP-Originating-Script: 1006:class-phpmailer.php
Date: Fri, 28 Mar 2014 18:14:22 +0000
From: casino10 <fmzsb@www.reconomy.org>
Message-ID: <28cbb75557094e41d2f5e7e070dcd660@www.reconomy.org>
X-Priority: 3
X-Mailer: PHPMailer 5.2.4 (http://code.google.com/a/apache-extras.org/p/phpmailer/)
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Content-Type: text/plain; charset=UTF-8
From: casino10 <fmzsb@www.reconomy.org>
Subject: roulette89
Message Body:
интернет казино игровые автоматы рулетка зарубежный <a href= http://pobedim11.sleepingteensex.com/item280.html >можно ли играть в
+игровые автоматы в интернете на деньги</a> игровые автоматы через интернет 3g еще <a href= http://pobedim11.sleepingteensex.com >Новый
+Игровой Автомат</a> казино интернет казань.
--
This mail is sent via contact form on REconomy http://www.reconomyproject.org

#710: Incorrect email address for Sam on Transition Culture

chris — Tue, 01 Apr 2014 12:01:47 GMT

I'm seeing quite a few emails like this:

From: Mail Delivery System <Mailer-Daemon@parrot.webarch.net>
Date: Tue, 01 Apr 2014 08:04:28 +0100
To: tc@parrot.webarch.net
Subject: Mail delivery failed: returning message to sender
This message was created automatically by mail delivery software.
A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:
  samrossiter@transitionentwork.org
    Unrouteable address
------ This is a copy of the message, including all the headers. ------
Return-path: <tc@parrot.webarch.net>
Received: from tc (uid=1011)
        by parrot.webarch.net with local (Exim 4.80)
        (envelope-from <tc@parrot.webarch.net>)
        id 1WUskG-0005Rv-Sa
        for samrossiter@transitionentwork.org; Tue, 01 Apr 2014 08:04:28 +0100
To: samrossiter@transitionentwork.org
Subject: [Wordfence Alert] Problems found on Transition Culture
X-PHP-Originating-Script: 1011:class-phpmailer.php
Date: Tue, 1 Apr 2014 07:04:28 +0000
From: WordPress <wordpress@transitionculture.org>
Message-ID: <11e64e1b3cdb24f69d0069ecdc224524@transitionculture.org>
X-Priority: 3
X-Mailer: PHPMailer 5.2.4 (http://code.google.com/a/apache-extras.org/p/phpmailer/)
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Content-Type: text/plain; charset=UTF-8
Wordfence found the following new issues on "Transition Culture".
NOTE: Upgrading to the paid version of Wordfence gives you two factor authentication (sign-in via cellphone)
and country blocking which are both effective methods to block attacks.
You can also schedule when your scans occur with Wordfence Premium.
Click here to sign-up for the Premium version of Wordfence now.
https://www.wordfence.com/wordfence-signup/
Alert generated at Tuesday 1st of April 2014 at 08:04:28 AM
Critical Problems:
* The Plugin "Spam Destroyer" needs an upgrade.

#718: REconomy site showing adverts randomly

ed — Thu, 10 Apr 2014 08:19:34 GMT

Load http://www.reconomy.org and the first time you get it, and other times at random and you get spam.

URGENT check please - on REconomy and all WP sites...

#749: Probs with REconomy site again - compromised?

chris — Thu, 26 Jun 2014 11:18:01 GMT

Email from Laura:

Looks like REconomy website has been compromised again.

Fi contacted this morning via email to say she's received a batch of 'new post' notifications on exceedingly old posts, so I logged into the site to check things out. I noted the footer wasn't correct on the site too displaying 'proudly powered by wordpress' rather than the widgets.

Had a whizz through folders/files via sftp to see any recent changes to files - and in the Reconomy theme files the 404.php and footer.php had been changed with a copy of the default wp twenty something one and base code 64 along the top. The footer was changed on 23/6 at 21.46, and I should have remembered when the 404 was changed before overwriting it - either the same date or time or on the 20/6. I've reinstated the correct files (but have downloaded a copy of the rogue 404 and footer files before replacing them with the correct ones if you wanted a copy for any purpose, though want to nuke these asap from my machine!)

Unlike the last time, no extra 'odd plugins' seem to have been added, nor anything odd by a (very) quick scan in wp-content/uploads folders and sub-folders.

Not sure how this has happened again, be good to know if you can spot anything your side, esp how these attacks happen especially incase I need to do something with the theme files (eg could it be some form of injection attack via the comments form somehow? Can't see how, but just wondering how these things tend to happen!). (do you think the file perms okay on the theme files, maybe worth a check too?). People can't register for an account on the website any longer, new users are added manually (been the case for some while now to stop spam signups)

All wp core is up-to date btw, and I've updated a couple of plugins whilst in there today.

And a follow up:

Following on from previous message just now, and quite poss unrelated altogether to the current site issue, looking at some of their blog posts on the site such as this one - http://www.reconomy.org/get-your-oats-here/, trackbacks come from a scraper type site eg - http://500biz.com/realwealth/get-your-oats-here-community-support-helps-new-enterprise-transform-local-food-supply-chain/ which seems to reprint reconomys posts.

#778: need access to Parrot

annesley — Wed, 27 Aug 2014 12:16:39 GMT

i need a publicly available WordPress demo install to play with. should this be on Parrot? what (sub)domain can i use?

#811: WordPress critical security release

chris — Thu, 20 Nov 2014 20:25:07 GMT

From the blog:

WordPress 4.0.1 is now available. This is a critical security release for all previous versions and we strongly encourage you to update your sites immediately.

Sites that support automatic background updates will be updated to WordPress 4.0.1 within the next few hours. If you are still on WordPress 3.9.2, 3.8.4, or 3.7.4, you will be updated to 3.9.3, 3.8.5, or 3.7.5 to keep everything secure. (We don’t support older versions, so please update to 4.0.1 for the latest and greatest.)

WordPress versions 3.9.2 and earlier are affected by a critical cross-site scripting vulnerability, which could enable anonymous users to compromise a site.

#829: Creation of web space request

ade — Mon, 02 Feb 2015 10:11:03 GMT

Hi Chris, As discussed, can you please set up some webspace on Penguin? If you could also set up a sub-domain of 'projects' and confirm the FTP access details?

Many thanks Ade

#891: Issue with TTT and REconomy websites after upgrade to WP 4.4

chris — Thu, 17 Dec 2015 11:18:38 GMT

Email from Laura:

Just to let you know there's a bit of an oddity going on with both the TTT and Reconomy websites.

I upgraded to WP 4.4 after running full tests on my local copies here, and for some odd reason images aren't showing on the site. If you try to open an image in the browser eg https://www.reconomy.org/wp-content/uploads/2015/10/hubs-logos-landscape.jpg takes you to the - "Server error! The server encountered an internal error and was unable to complete your request Either the server is overloaded or there was an error in a CGI script. Please return to the front page of the site."

I've updated over 20 sites over the past few days (!) and these are the only two this has happened on. There are a few discussions here, (and have tried the temp fix of various functions.php tweaks in the theme files to see if that helps, but it doesn't)... https://wordpress.org/support/topic/after-upgrade-to-44-media-files-are-not-showing and even though sites are not appearing to use SSL wondering if related somehow to that or other? Has this happened to any other WP 4.4 sites on your servers?

I'll let TTT and REconomy know their site has been updated, but there is a glitch at present.

I've also added Wordfence to the sites too as there are swathes of brute force attacks happening on lots of WP sites everywhere currently and this plugin seems to help somewhat currently. I don't think it's the Wordfence plugin, as disabled it to test the missing images issue.

#911: Disk space for /home on Parrot is running out

chris — Mon, 30 May 2016 20:58:53 GMT

Getting this alert from ParrotServer every 5 mins:

transitionnetwork.org :: parrot.transitionnetwork.org :: Disk usage in percent
        WARNINGs: /home is 96.06 (outside range [:96]).
        OKs: /run/shm is 0.00, /run is 0.09, /dev is 0.00, / is 95.94, / is 95.94, /run/lock is 0.00.

#921: HTTP_PROXY env var vulnerability

chris — Tue, 19 Jul 2016 12:34:30 GMT

See https://httpoxy.org/

#532: Upgrade to Mediawiki 1.19.5

chris — Mon, 15 Apr 2013 13:40:34 GMT

New version out tonight:

This is a notice that on Monday, April 15th between 20:00-21:00 UTC (1-2pm PDT) Wikimedia Foundation will release security updates for current and supported branches of the MediaWiki software. Downloads and patches will be available at that time, with the git repositories updated later that afternoon. CVSS scores are between 4.3 and 7.1, most users will want to update.

http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-April/000126.html

#536: Upgrade Mediawiki to 1.19.6

chris — Mon, 29 Apr 2013 20:35:32 GMT

A new version of Mediawiki is due out tomorrow:

This is a notice that on Tuesday, April 30th between 20:00-21:00 UTC (1-2pm PDT) Wikimedia Foundation will release security updates for current and supported branches of the MediaWiki software. Downloads and patches will be available at that time, with the git repositories updated later that afternoon.

http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-April/000128.html

The upgrade should simply be a matter of following the steps taken last time, see ticket:532#comment:2

#551: Mediawiki 1.19.7 upgrade

chris — Tue, 21 May 2013 08:25:51 GMT

From MediaWiki-announce:

This is a notice that on Tuesday, May 21st between 20:00-21:00 UTC (1-2pm PDT) Wikimedia Foundation will release security updates for current and supported branches of the MediaWiki software. Downloads and patches will be available at that time, with the git repositories updated later that afternoon. Although MediaWiki does not have the vulnerable feature enabled by default, most wiki using common advanced features will want to patch for this issue.

#595: Upgrade Mediawiki to 1.19.8 from 1.19.7

chris — Wed, 11 Sep 2013 22:18:05 GMT

From https://git.wikimedia.org/blob/mediawiki%2Fcore.git/REL1_19/RELEASE-NOTES-1.19

MediaWiki 1.19.8

This is a security and maintenance release of the MediaWiki 1.19 branch.

Changes since 1.19.7

SECURITY: Sanitize ResourceLoader exception messages
SECURITY: Token-getting functions will fail when using jsonp callbacks.
SECURITY: Fix extension detection with 2 .'s
Allow a string other than '*' as condition for DatabaseBase::delete()
Purge upstream caches when deleting file assets.
jquery.tablesorter: Add missing dependency on jquery.mwExtension

#620: Upgrade MediaWiki to 1.19.9

chris — Fri, 15 Nov 2013 14:57:58 GMT

See the announcement email:

I would like to announce the release of MediaWiki 1.21.3, 1.20.8 and
1.19.9. These releases fix 2 security related bugs that could affect users
of MediaWiki. Download links are given at the end of this email.
* Kevin Israel (Wikipedia user PleaseStand) identified and reported two
vectors for injecting Javascript in CSS that bypassed MediaWiki's blacklist
(CVE-2013-4567, CVE-2013-4568).
<https://bugzilla.wikimedia.org/show_bug.cgi?id=55332>
* Internal review while debugging a site issue discovered that MediaWiki
and the CentralNotice extension were incorrectly setting cache headers when
a user was autocreated, causing the user's session cookies to be cached,
and returned to other users (CVE-2013-4572).
<https://bugzilla.wikimedia.org/show_bug.cgi?id=53032>
Additionally, the following extensions have been updated to fix security
issues:
* CleanChanges: MediaWiki steward Teles reported that revision-deleted IP's
are not correctly hidden when this extension is used (CVE-2013-4569).
<https://bugzilla.wikimedia.org/show_bug.cgi?id=54294>
* ZeroRatedMobileAccess: Tomasz Chlebowski reported an XSS vulnerability
(CVE-2013-4573).
<https://bugzilla.wikimedia.org/show_bug.cgi?id=55991>
* CentralAuth: MediaWiki developer Platonides reported a login CSRF in
CentralAuth (CVE-2012-5394).
<https://bugzilla.wikimedia.org/show_bug.cgi?id=40747>
Full release notes for 1.21.3:
<https://www.mediawiki.org/wiki/Release_notes/1.21>
Full release notes for 1.20.8:
<https://www.mediawiki.org/wiki/Release_notes/1.20>
Full release notes for 1.19.9:
<https://www.mediawiki.org/wiki/Release_notes/1.19>
For information about how to upgrade, see
<https://www.mediawiki.org/wiki/Manual:Upgrading>

The steps followed for the last upgrade can be followed again, see ticket:595 and see also the documentation at wiki:PenguinServer#wiki.transitionnetwork.org

#669: Mediawiki upgrade to 1.19.10

chris — Sat, 11 Jan 2014 09:00:24 GMT

Email from Mediawiki:

This is a notice that on Tuesday, January 14th between 00:00-01:00 UTC (*Monday* January 13th, 4-5pm PST) Wikimedia Foundation will release security updates for current and supported branches of the MediaWiki software, as well as several extensions. Downloads and patches will be available at that time.

#686: MediaWiki 1.19.11 Update

chris — Wed, 29 Jan 2014 09:53:13 GMT

On the MediaWiki-announce list:

I would like to announce the release of MediaWiki 1.22.2, 1.21.5 and 1.19.11.

Your MediaWiki installation is affected by a remote code execution vulnerability if you have enabled file upload support for DjVu (natively supported by MediaWiki) or PDF files (in combination with the PdfHandlerxtension). Neither file type is enabled by default in MediaWiki installations. If you are affected, we strongly urge you to update immediately.

Affected supported versions: All

Security fixes

Netanel Rubin from Check Point discovered a remote code execution vulnerability in MediaWiki's thumbnail generation for DjVu files. Internal review also discovered similar logic in the PdfHandler extension, which could be exploited in a similar way. (CVE-2014-1610) https://bugzilla.wikimedia.org/show_bug.cgi?id=60339
Bug Fixes in 1.22.2

(bug 58253) Check for very old PCRE versions in installer and updater
(bug 60054) Make WikiPage::$mPreparedEdit public
Full release notes for 1.19.9:

https://www.mediawiki.org/wiki/Release_notes/1.19

#694: Mediawiki 1.19.12 upgrade

chris — Fri, 28 Feb 2014 09:03:20 GMT

On the MediaWiki-announce list:

I would like to announce the release of MediaWiki 1.22.3, 1.21.6 and 1.19.12. These releases fix a number of security related bugs that could affect users of MediaWiki. In addition, MediaWiki 1.22.3 is a maintenance release. It fixes several bugs. You can consult the RELEASE-NOTES-1.22 file for the full list of changes in this version. Download links are given at the end of this email.

Security fixes

(bug 60771) SECURITY: Disallow uploading SVG files using non-whitelisted namespaces. Also disallow iframe elements. User will get an error including the namespace name if they use a non- whitelisted namespace.
(bug 61346) SECURITY: Make token comparison use constant time. It seems like our token comparison would be vulnerable to timing attacks. This will take constant time.
(bug 61362) SECURITY: API: Don't find links in the middle of api.php links.

#700: Mediawiki 1.19.13

chris — Wed, 12 Mar 2014 11:06:44 GMT

From the MediaWiki-announce list:

I would like to announce the release of MediaWiki 1.22.4, 1.21.7 and 1.19.13. Other than the security fix included in 1.19.13, these releases simply fix the bundled version of the tarball. Download links are given at the end of this email.

Security fix backported to 1.19

(bug 61362) SECURITY: API: Don't find links in the middle of api.php links.
Fixes made in all tarballs

The correct branch of each extensions git repository (e.g. REL1_19 for 1.19.13) was used.