<?xml version="1.0"?>
<rss xmlns:dc="http://purl.org/dc/elements/1.1/" version="2.0">
  <channel>
    <title>Transition Technology: Ticket #841: Mediawiki 1.23.9</title>
    <link>http://localhost:8080/trac/ticket/841</link>
    <description>&lt;p&gt;
Email on &lt;a class="ext-link" href="https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-March/000175.html"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;the announcements list&lt;/a&gt;:
&lt;/p&gt;
&lt;blockquote class="citation"&gt;
&lt;p&gt;
I would like to announce the release of &lt;a class="wiki" href="http://localhost:8080/trac/wiki/MediaWiki"&gt;MediaWiki&lt;/a&gt; 1.24.2, 1.23.9 and 1.19.24. These releases fix 10 security issues, in addition to other bug fixes. Download links are given at the end of this email.
&lt;/p&gt;
&lt;h2 id="Securityfixes"&gt;Security fixes&lt;/h2&gt;
&lt;ul&gt;&lt;li&gt;iSEC Partners discovered a way to circumvent the SVG MIME blacklist for embedded resources (iSEC-WMF1214-11). This allowed an attacker to embed JavaScript in the SVG. The issue was additionally identified by Mario Heiderich / Cure53. MIME types are now whitelisted.  &lt;a class="ext-link" href="https://phabricator.wikimedia.org/T85850"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://phabricator.wikimedia.org/T85850&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;&lt;a class="wiki" href="http://localhost:8080/trac/wiki/MediaWiki"&gt;MediaWiki&lt;/a&gt; user Bawolff pointed out that the SVG filter to prevent injecting JavaScript using animate elements was incorrect.  &lt;a class="ext-link" href="https://phabricator.wikimedia.org/T86711"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://phabricator.wikimedia.org/T86711&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;&lt;a class="wiki" href="http://localhost:8080/trac/wiki/MediaWiki"&gt;MediaWiki&lt;/a&gt; user Bawolff reported a stored XSS vulnerability due to the way attributes were expanded in &lt;a class="wiki" href="http://localhost:8080/trac/wiki/MediaWiki"&gt;MediaWiki&lt;/a&gt;'s Html class, in combination with LanguageConverter substitutions.  &lt;a class="ext-link" href="https://phabricator.wikimedia.org/T73394"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://phabricator.wikimedia.org/T73394&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;Internal review discovered that &lt;a class="wiki" href="http://localhost:8080/trac/wiki/MediaWiki"&gt;MediaWiki&lt;/a&gt;'s SVG filtering could be bypassed with entity encoding under the Zend interpreter. This could be used to inject JavaScript. This issue was also discovered by Mario Gomes from Beyond Security.  &lt;a class="ext-link" href="https://phabricator.wikimedia.org/T88310"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://phabricator.wikimedia.org/T88310&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;iSEC Partners discovered a XSS vulnerability in the way api errors were reflected when running under HHVM versions before 3.6.1 (iSEC-WMF1214-8).  &lt;a class="wiki" href="http://localhost:8080/trac/wiki/MediaWiki"&gt;MediaWiki&lt;/a&gt; now detects and mitigates this issue on older versions of HHVM.  &lt;a class="ext-link" href="https://phabricator.wikimedia.org/T85851"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://phabricator.wikimedia.org/T85851&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;Internal review and iSEC Partners discovered (iSEC-WMF1214-1) that &lt;a class="wiki" href="http://localhost:8080/trac/wiki/MediaWiki"&gt;MediaWiki&lt;/a&gt; versions using PBKDF2 for password hashing (the default since 1.24) are vulnerable to DoS attacks using extremely long passwords.  &lt;a class="ext-link" href="https://phabricator.wikimedia.org/T64685"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://phabricator.wikimedia.org/T64685&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;iSEC Partners discovered that &lt;a class="wiki" href="http://localhost:8080/trac/wiki/MediaWiki"&gt;MediaWiki&lt;/a&gt;'s SVG and XMP parsing, running under HHVM, was susceptible to "Billion Laughs" DoS attacks (iSEC-WMF1214-13).  &lt;a class="ext-link" href="https://phabricator.wikimedia.org/T85848"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://phabricator.wikimedia.org/T85848&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;Internal review found that &lt;a class="wiki" href="http://localhost:8080/trac/wiki/MediaWiki"&gt;MediaWiki&lt;/a&gt; is vulnerable to "Quadratic Blowup" DoS attacks, under both HHVM and Zend PHP.  &lt;a class="ext-link" href="https://phabricator.wikimedia.org/T71210"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://phabricator.wikimedia.org/T71210&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;iSEC Partners discovered a way to bypass the style filtering for SVG files (iSEC-WMF1214-3). This could violate the anonymity of users viewing the SVG.  &lt;a class="ext-link" href="https://phabricator.wikimedia.org/T85349"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://phabricator.wikimedia.org/T85349&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;iSEC Partners reported that the &lt;a class="wiki" href="http://localhost:8080/trac/wiki/MediaWiki"&gt;MediaWiki&lt;/a&gt; feature allowing a user to preview another user's custom JavaScript could be abused for privilege escalation (iSEC-WMF1214-10). This feature has been removed.  &lt;a class="ext-link" href="https://phabricator.wikimedia.org/T85855"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://phabricator.wikimedia.org/T85855&lt;/a&gt;
&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;
Additionally, the following extensions have been updated to fix security issues:
&lt;/p&gt;
&lt;ul&gt;&lt;li&gt;Extension:Scribunto - &lt;a class="wiki" href="http://localhost:8080/trac/wiki/MediaWiki"&gt;MediaWiki&lt;/a&gt; user Jackmcbarn discovered that function names were not sanitized in Lua error backtraces, which could lead to XSS.  &lt;a class="ext-link" href="https://phabricator.wikimedia.org/T85113"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://phabricator.wikimedia.org/T85113&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;Extension:!CheckUser - iSEC Partners discovered that the CheckUser extension did not prevent CSRF attacks on the form allowing checkusers to look up sensitive information about other users (iSEC-WMF1214-6). Since the use of CheckUser is logged, the CSRF could be abused to defame a trusted user or flood the logs with noise.  &lt;a class="ext-link" href="https://phabricator.wikimedia.org/T85858"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://phabricator.wikimedia.org/T85858&lt;/a&gt;
&lt;/li&gt;&lt;/ul&gt;&lt;h2 id="Bugfixes"&gt;Bug fixes&lt;/h2&gt;
&lt;h3 id="a1.24"&gt;1.24&lt;/h3&gt;
&lt;ul&gt;&lt;li&gt;Fix case of SpecialAllPages/SpecialAllMessages in SpecialPageFactory to fix loading these special pages when $wgAutoloadAttemptLowercase is false.
&lt;/li&gt;&lt;li&gt;(bug T76254) Fix deleting of pages with PostgreSQL. Requires a schema change and running update.php to fix.
&lt;/li&gt;&lt;/ul&gt;&lt;h3 id="a1.231.24"&gt;1.23 &amp;amp; 1.24&lt;/h3&gt;
&lt;ul&gt;&lt;li&gt;(bug T70087) Fix Special:ActiveUsers page for installations using PostgreSQL.
&lt;/li&gt;&lt;/ul&gt;&lt;hr /&gt;
&lt;p&gt;
Full release notes:
&lt;/p&gt;
&lt;ul&gt;&lt;li&gt;&lt;a class="ext-link" href="https://www.mediawiki.org/wiki/Release_notes/1.24"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.mediawiki.org/wiki/Release_notes/1.24&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;&lt;a class="ext-link" href="https://www.mediawiki.org/wiki/Release_notes/1.23"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.mediawiki.org/wiki/Release_notes/1.23&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;&lt;a class="ext-link" href="https://www.mediawiki.org/wiki/Release_notes/1.19"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.mediawiki.org/wiki/Release_notes/1.19&lt;/a&gt;
&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;
Download:
&lt;/p&gt;
&lt;ul&gt;&lt;li&gt;&lt;a class="ext-link" href="http://download.wikimedia.org/mediawiki/1.24/mediawiki-1.24.2.tar.gz"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;http://download.wikimedia.org/mediawiki/1.24/mediawiki-1.24.2.tar.gz&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;&lt;a class="ext-link" href="http://download.wikimedia.org/mediawiki/1.23/mediawiki-1.23.9.tar.gz"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;http://download.wikimedia.org/mediawiki/1.23/mediawiki-1.23.9.tar.gz&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;&lt;a class="ext-link" href="http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.24.tar.gz"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.24.tar.gz&lt;/a&gt;
&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;
Patch to previous version:
&lt;/p&gt;
&lt;ul&gt;&lt;li&gt;&lt;a class="ext-link" href="http://download.wikimedia.org/mediawiki/1.24/mediawiki-1.24.2.patch.gz"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;http://download.wikimedia.org/mediawiki/1.24/mediawiki-1.24.2.patch.gz&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;&lt;a class="ext-link" href="http://download.wikimedia.org/mediawiki/1.23/mediawiki-1.23.9.patch.gz"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;http://download.wikimedia.org/mediawiki/1.23/mediawiki-1.23.9.patch.gz&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;&lt;a class="ext-link" href="http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.24.patch.gz"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.24.patch.gz&lt;/a&gt;
&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;
GPG signatures:
&lt;/p&gt;
&lt;ul&gt;&lt;li&gt;&lt;a class="ext-link" href="http://download.wikimedia.org/mediawiki/1.24/mediawiki-1.24.2.tar.gz.sig"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;http://download.wikimedia.org/mediawiki/1.24/mediawiki-1.24.2.tar.gz.sig&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;&lt;a class="ext-link" href="http://download.wikimedia.org/mediawiki/1.24/mediawiki-1.24.2.patch.gz.sig"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;http://download.wikimedia.org/mediawiki/1.24/mediawiki-1.24.2.patch.gz.sig&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;&lt;a class="ext-link" href="http://download.wikimedia.org/mediawiki/1.23/mediawiki-1.23.9.tar.gz.sig"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;http://download.wikimedia.org/mediawiki/1.23/mediawiki-1.23.9.tar.gz.sig&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;&lt;a class="ext-link" href="http://download.wikimedia.org/mediawiki/1.23/mediawiki-1.23.9.patch.gz.sig"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;http://download.wikimedia.org/mediawiki/1.23/mediawiki-1.23.9.patch.gz.sig&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;&lt;a class="ext-link" href="http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.24.tar.gz.sig"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.24.tar.gz.sig&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;&lt;a class="ext-link" href="http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.24.patch.gz.sig"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.24.patch.gz.sig&lt;/a&gt;
&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;
Extensions:
&lt;/p&gt;
&lt;ul&gt;&lt;li&gt;&lt;a class="ext-link" href="http://www.mediawiki.org/wiki/Extension:Scribunto"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;http://www.mediawiki.org/wiki/Extension:Scribunto&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;&lt;a class="ext-link" href="http://www.mediawiki.org/wiki/Extension:CheckUser"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;http://www.mediawiki.org/wiki/Extension:CheckUser&lt;/a&gt;
&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;
Public keys:
&lt;/p&gt;
&lt;ul&gt;&lt;li&gt;&lt;a class="ext-link" href="https://www.mediawiki.org/keys/keys.html"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.mediawiki.org/keys/keys.html&lt;/a&gt;
&lt;/li&gt;&lt;/ul&gt;&lt;/blockquote&gt;
</description>
    <language>en-us</language>
    <image>
      <title>Transition Technology</title>
      <url>/trac/chrome/site/TransitionNetwork-Logo-Web-Small.jpg</url>
      <link>http://localhost:8080/trac/ticket/841</link>
    </image>
    <generator>Trac 0.12.5</generator>
    <item>
      
        <dc:creator>chris</dc:creator>

      <pubDate>Wed, 01 Apr 2015 20:59:13 GMT</pubDate>
      <title>hours, status, totalhours changed; resolution set</title>
      <link>http://localhost:8080/trac/ticket/841#comment:1</link>
      <guid isPermaLink="false">http://localhost:8080/trac/ticket/841#comment:1</guid>
      <description>
          &lt;ul&gt;
            &lt;li&gt;&lt;strong&gt;hours&lt;/strong&gt;
                changed from &lt;em&gt;0.0&lt;/em&gt; to &lt;em&gt;0.25&lt;/em&gt;
            &lt;/li&gt;
            &lt;li&gt;&lt;strong&gt;status&lt;/strong&gt;
                changed from &lt;em&gt;new&lt;/em&gt; to &lt;em&gt;closed&lt;/em&gt;
            &lt;/li&gt;
            &lt;li&gt;&lt;strong&gt;resolution&lt;/strong&gt;
                set to &lt;em&gt;fixed&lt;/em&gt;
            &lt;/li&gt;
            &lt;li&gt;&lt;strong&gt;totalhours&lt;/strong&gt;
                changed from &lt;em&gt;0.0&lt;/em&gt; to &lt;em&gt;0.25&lt;/em&gt;
            &lt;/li&gt;
          &lt;/ul&gt;
        &lt;p&gt;
Following the &lt;a class="wiki" href="http://localhost:8080/trac/wiki/MediaWiki#Updates"&gt;wiki:MediaWiki#Updates&lt;/a&gt; notes:
&lt;/p&gt;
&lt;pre class="wiki"&gt;sudo -i
cd /web/wiki.transitionnetwork.org
export MW="1.23.9"
wget https://releases.wikimedia.org/mediawiki/1.23/mediawiki-$MW.tar.gz -O mediawiki-$MW.tar.gz
wget https://releases.wikimedia.org/mediawiki/1.23/mediawiki-$MW.tar.gz.sig -O mediawiki-$MW.tar.gz.sig
  gpg --verify mediawiki-$MW.tar.gz.sig
  gpg: Signature made Tue Mar 31 18:57:22 2015 BST using DSA key ID 62D84F01
  gpg: Good signature from "Chris Steipp &amp;lt;csteipp@wikimedia.org&amp;gt;"
  gpg: WARNING: This key is not certified with a trusted signature!
  gpg:          There is no indication that the signature belongs to the owner.
  Primary key fingerprint: 1624 32D9 E81C 1C61 8B30  1EEC EE1F 6634 62D8 4F01
tar -zxvf mediawiki-$MW.tar.gz
rsync -av mediawiki-$MW/ www/
chown root:root -R www/
chown -R www-data:www-data www/cache/
chown -R www-data:www-data www/images/
cd www/maintenance/
php update.php
cd /web/wiki.transitionnetwork.org
rm mediawiki-$MW.tar.gz mediawiki-$MW.tar.gz.sig
rm -rf mediawiki-$MW
&lt;/pre&gt;&lt;p&gt;
Checked the site is working and the version via &lt;a class="ext-link" href="https://wiki.transitionnetwork.org/Special:Version"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://wiki.transitionnetwork.org/Special:Version&lt;/a&gt; all is good, closing.
&lt;/p&gt;
      </description>
      <category>Ticket</category>
    </item><item>
      
        <dc:creator>chris</dc:creator>

      <pubDate>Wed, 01 Apr 2015 21:01:34 GMT</pubDate>
      <title>status changed; resolution deleted</title>
      <link>http://localhost:8080/trac/ticket/841#comment:2</link>
      <guid isPermaLink="false">http://localhost:8080/trac/ticket/841#comment:2</guid>
      <description>
          &lt;ul&gt;
            &lt;li&gt;&lt;strong&gt;status&lt;/strong&gt;
                changed from &lt;em&gt;closed&lt;/em&gt; to &lt;em&gt;reopened&lt;/em&gt;
            &lt;/li&gt;
            &lt;li&gt;&lt;strong&gt;resolution&lt;/strong&gt;
                &lt;em&gt;fixed&lt;/em&gt; deleted
            &lt;/li&gt;
          &lt;/ul&gt;
        &lt;p&gt;
Sorry the VisualEditor is generating this error:
&lt;/p&gt;
&lt;blockquote class="citation"&gt;
&lt;p&gt;
Error loading data from server: parsoidserver-http-request-error: MWHttpRequest error. Would you like to retry?
&lt;/p&gt;
&lt;/blockquote&gt;
&lt;p&gt;
When testing the "edit" link from the &lt;a class="ext-link" href="https://wiki.transitionnetwork.org/Sandbox"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://wiki.transitionnetwork.org/Sandbox&lt;/a&gt; page... investigating...
&lt;/p&gt;
      </description>
      <category>Ticket</category>
    </item><item>
      
        <dc:creator>chris</dc:creator>

      <pubDate>Wed, 01 Apr 2015 21:17:51 GMT</pubDate>
      <title>hours, totalhours changed</title>
      <link>http://localhost:8080/trac/ticket/841#comment:3</link>
      <guid isPermaLink="false">http://localhost:8080/trac/ticket/841#comment:3</guid>
      <description>
          &lt;ul&gt;
            &lt;li&gt;&lt;strong&gt;hours&lt;/strong&gt;
                changed from &lt;em&gt;0.0&lt;/em&gt; to &lt;em&gt;0.25&lt;/em&gt;
            &lt;/li&gt;
            &lt;li&gt;&lt;strong&gt;totalhours&lt;/strong&gt;
                changed from &lt;em&gt;0.25&lt;/em&gt; to &lt;em&gt;0.5&lt;/em&gt;
            &lt;/li&gt;
          &lt;/ul&gt;
        &lt;p&gt;
For some reason Parsiod settings for the external Parsoid instance, see &lt;a class="ext-link" href="https://docs.webarch.net/wiki/MediaWiki#VisualEditor"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://docs.webarch.net/wiki/MediaWiki#VisualEditor&lt;/a&gt; in LocalSettings.php which were documented as being changed on &lt;a class="closed ticket" href="http://localhost:8080/trac/ticket/799#comment:11" title="maintenance: MediaWiki Visual Editor broken from Parsoid update (closed: fixed)"&gt;ticket:799#comment:11&lt;/a&gt; appear to have not been changed, these things needed changing:
&lt;/p&gt;
&lt;pre class="wiki"&gt;$wgVisualEditorParsoidURL = 'http://parsoid.webarch.net:8142';
$wgVisualEditorParsoidPrefix = 'wiki.transitionnetwork.org';
//require_once("$IP/extensions/Parsoid/Parsoid.php");
&lt;/pre&gt;&lt;p&gt;
I also checked to see if the VisualEditor needed updating, it didn't.
&lt;/p&gt;
&lt;pre class="wiki"&gt;cd /web/wiki.transitionnetwork.org/www/extensions/VisualEditor
git pull
&lt;/pre&gt;&lt;p&gt;
And the VisualEditor is now working fine, so closing again.
&lt;/p&gt;
      </description>
      <category>Ticket</category>
    </item><item>
      
        <dc:creator>chris</dc:creator>

      <pubDate>Wed, 01 Apr 2015 21:25:07 GMT</pubDate>
      <title>status changed; resolution set</title>
      <link>http://localhost:8080/trac/ticket/841#comment:4</link>
      <guid isPermaLink="false">http://localhost:8080/trac/ticket/841#comment:4</guid>
      <description>
          &lt;ul&gt;
            &lt;li&gt;&lt;strong&gt;status&lt;/strong&gt;
                changed from &lt;em&gt;reopened&lt;/em&gt; to &lt;em&gt;closed&lt;/em&gt;
            &lt;/li&gt;
            &lt;li&gt;&lt;strong&gt;resolution&lt;/strong&gt;
                set to &lt;em&gt;fixed&lt;/em&gt;
            &lt;/li&gt;
          &lt;/ul&gt;
      </description>
      <category>Ticket</category>
    </item>
 </channel>
</rss>