iBet uBet web content aggregator. Adding the entire web to your favor.
iBet uBet web content aggregator. Adding the entire web to your favor.



Link to original content: http://phabricator.wikimedia.org/p/Yaron_Koren/
♟ Yaron_Koren
Page MenuHomePhabricator

Yaron_Koren (Yaron Koren)
User

Today

  • Clear sailing ahead.

Tomorrow

  • Clear sailing ahead.

Saturday

  • Clear sailing ahead.

User Details

User Since
Nov 14 2014, 3:01 AM (523 w, 6 d)
Availability
Available
LDAP User
Yaron Koren
MediaWiki User
Unknown

Recent Activity

Tue, Nov 26

Yaron_Koren added a comment to T380561: Special:Packages is broken in Page Exchange 0.7.1.

@labster, @Vedmaka - any thoughts on this? Is there some version of MediaWiki where this code actually works?

Tue, Nov 26, 3:54 PM · MediaWiki-extensions-PageExchange

Mon, Nov 25

Yaron_Koren added a comment to T380656: Special:ReplaceText has white text on a white background in dark mode.

Thank you, @SomeRandomDeveloper, for the patch, and all the analysis! This is an improvement to the code, even outside of fixing dark mode.

Mon, Nov 25, 3:37 PM · patch-welcome, dark-mode, MediaWiki-extensions-ReplaceText
Yaron_Koren closed T380191: PageForms AutoeditAPI: Use of MediaWiki\EditPage\EditPage::internalAttemptSave was deprecated in MediaWiki 1.43 as Resolved.

@Paladox - thank you for the fix! (And @Nikerabbit - thank you for the bug report.) I assume this can be closed now.

Mon, Nov 25, 3:12 PM · affects-translatewiki.net, MediaWiki-extensions-Page_Forms

Fri, Nov 22

Yaron_Koren added a comment to T380561: Special:Packages is broken in Page Exchange 0.7.1.

That's interesting that you didn't see any error messages on Special:Packages. I see (well, saw) two problems in the code:

  • On line 28, MediaWikiServices::getNamespaceInfo() should be MediaWikiServices::getInstance()->getNamespaceInfo() (this is what broke the page for me)
  • On line 41, $namespace === (string)(int)$namespace is called without $namespace having been set.
Fri, Nov 22, 4:12 PM · MediaWiki-extensions-PageExchange
Yaron_Koren created T380561: Special:Packages is broken in Page Exchange 0.7.1.
Fri, Nov 22, 6:30 AM · MediaWiki-extensions-PageExchange

Thu, Nov 21

Yaron_Koren merged T380470: Warning: Uninitialized string offset 96 in includes/PF_FormPrinter.php on line 1041 into T377307: No newline before {{{for template}}} or {{{end template}}} tags leads to PHP warning.
Thu, Nov 21, 2:31 PM · MediaWiki-extensions-Page_Forms
Yaron_Koren merged task T380470: Warning: Uninitialized string offset 96 in includes/PF_FormPrinter.php on line 1041 into T377307: No newline before {{{for template}}} or {{{end template}}} tags leads to PHP warning.
Thu, Nov 21, 2:30 PM · MediaWiki-extensions-Page_Forms
Yaron_Koren added a comment to T380470: Warning: Uninitialized string offset 96 in includes/PF_FormPrinter.php on line 1041.

This might be the same sort of bug as T377307 - some newlines in the form definition might be helpful. Or maybe you just need an {{{end template}}} tag?

Thu, Nov 21, 2:06 PM · MediaWiki-extensions-Page_Forms

Mon, Nov 18

Yaron_Koren moved T380223: Getting SMW property values leads to "Table name component contains unexpected quote or dot character" error in MW 1.42 from Backlog to Semantic MediaWiki on the MediaWiki-extensions-Page_Forms board.
Mon, Nov 18, 8:16 PM · MediaWiki-extensions-Page_Forms
Yaron_Koren renamed T380223: Getting SMW property values leads to "Table name component contains unexpected quote or dot character" error in MW 1.42 from Table name component contains unexpected quote or dot character to Getting SMW property values leads to "Table name component contains unexpected quote or dot character" error in MW 1.42.
Mon, Nov 18, 8:15 PM · MediaWiki-extensions-Page_Forms
Yaron_Koren added a comment to T380223: Getting SMW property values leads to "Table name component contains unexpected quote or dot character" error in MW 1.42.

What versions of Page Forms and Semantic MediaWiki are you running? Most importantly, does your SMW code already include that fix?

Mon, Nov 18, 7:56 PM · MediaWiki-extensions-Page_Forms
Yaron_Koren added a comment to T379945: Uploadable form simple upload arrangement of buttons looks strange.

@Huajing - I tried this out on the Vector skin (with MW 1.43) and it displays fine for me, more or less. Could this problem be due to the BlueSpice skin you are using? Have you tried it with any other skin?

Mon, Nov 18, 3:58 PM · Patch-For-Review, MediaWiki-extensions-Page_Forms

Wed, Nov 13

Yaron_Koren renamed T358629: Two tables with identically-named Coordinates fields cannot be joined on from Two tables wth identically-named Coordinates fields cannot be joined on to Two tables with identically-named Coordinates fields cannot be joined on.
Wed, Nov 13, 3:30 PM · MediaWiki-extensions-Cargo
Yaron_Koren renamed T358629: Two tables with identically-named Coordinates fields cannot be joined on from Improper handling of Coord in "join on" queries to Two tables wth identically-named Coordinates fields cannot be joined on.
Wed, Nov 13, 3:30 PM · MediaWiki-extensions-Cargo
Yaron_Koren moved T358629: Two tables with identically-named Coordinates fields cannot be joined on from Backlog to Queries on the MediaWiki-extensions-Cargo board.
Wed, Nov 13, 6:39 AM · MediaWiki-extensions-Cargo
Yaron_Koren added a comment to T358629: Two tables with identically-named Coordinates fields cannot be joined on.

Great! Of course, the underlying bug remains.

Wed, Nov 13, 6:38 AM · MediaWiki-extensions-Cargo

Tue, Nov 12

Yaron_Koren added a comment to T379228: Wikieditor layout broken in a form under MW-1.43.0.

Okay - that's surprising, but good to hear! If it does come back up, it would seem to make sense to file it as an SMW bug report.

Tue, Nov 12, 4:21 PM · MediaWiki-extensions-Page_Forms

Mon, Nov 11

Yaron_Koren added a comment to T379228: Wikieditor layout broken in a form under MW-1.43.0.

Did you mean that the problem happens when class="formtable" is set, or when it's not set? I can't reproduce the problem either way, by the way - or when width="100%" is set. Still it would be good to try to isolate the problem on your wiki.

Mon, Nov 11, 10:29 PM · MediaWiki-extensions-Page_Forms

Sun, Nov 10

Yaron_Koren added a comment to T358629: Two tables with identically-named Coordinates fields cannot be joined on.

My guess is that you've uncovered a bug in Cargo - and that the validation code is getting confused due to the fact that both the Roller_Coasters and Roller_Coaster_Past_Locations tables contain a field named "Coord". Obviously that should not be a problem, but apparently it is. Maybe it's rare for two different tables that both contain a coordinates field to get joined on (and even rarer for both fields to be named the same thing), which would explain why this hasn't come up before.

Sun, Nov 10, 9:48 PM · MediaWiki-extensions-Cargo

Fri, Nov 8

Yaron_Koren added a comment to T379228: Wikieditor layout broken in a form under MW-1.43.0.

Where is height: 100%; coming from?

Fri, Nov 8, 5:26 PM · MediaWiki-extensions-Page_Forms
Yaron_Koren created T379394: VEForAll should not require "visualeditor-enable" user preference?.
Fri, Nov 8, 5:19 PM · MediaWiki-extensions-VEForAll
Yaron_Koren closed T379226: Visual Editor not loading in a form under MW-1.43.0 as Invalid.

It's great that we were able to diagnose the issue. That's a fair point, though... let me close this bug report, and create a new one for that.

Fri, Nov 8, 5:12 PM · MediaWiki-extensions-Page_Forms
Yaron_Koren added a comment to T379228: Wikieditor layout broken in a form under MW-1.43.0.

I can't reproduce this problem. What skin are you using? Or does it happen with every skin?

Fri, Nov 8, 1:53 AM · MediaWiki-extensions-Page_Forms
Yaron_Koren added a comment to T379226: Visual Editor not loading in a form under MW-1.43.0.

@Jongfeli - I can't replicate this problem, at least with MW 1.43.0-alpha. Do you have the following two lines in LocalSettings.php?

Fri, Nov 8, 1:34 AM · MediaWiki-extensions-Page_Forms

Wed, Nov 6

Yaron_Koren renamed T377307: No newline before {{{for template}}} or {{{end template}}} tags leads to PHP warning from No newline before [[[for template}}} or {[[end template]] to No newline before {{{for template}}} or {{{end template}}} tags leads to PHP warning.
Wed, Nov 6, 2:48 PM · MediaWiki-extensions-Page_Forms
Yaron_Koren renamed T377307: No newline before {{{for template}}} or {{{end template}}} tags leads to PHP warning from Warning: Uninitialized string offset to No newline before [[[for template}}} or {[[end template]].
Wed, Nov 6, 2:47 PM · MediaWiki-extensions-Page_Forms
Yaron_Koren added a comment to T377307: No newline before {{{for template}}} or {{{end template}}} tags leads to PHP warning.

Okay - it's good to know that having a single newline works. I'll rename this bug report, now that it's clearer what is going on.

Wed, Nov 6, 2:46 PM · MediaWiki-extensions-Page_Forms

Tue, Nov 5

Yaron_Koren added a comment to T377307: No newline before {{{for template}}} or {{{end template}}} tags leads to PHP warning.

Okay, thanks. The fact that VisualEditor is still not working for you when the warnings go away would seem to indicate that this is two, or three, separate bugs. I'll just focus on the "string offset" warning, since that is the title of this task - if you want help with the VisualEditor or WikiEditor issues, please create separate tasks for them.

Tue, Nov 5, 3:27 PM · MediaWiki-extensions-Page_Forms

Mon, Nov 4

Yaron_Koren added a comment to T377307: No newline before {{{for template}}} or {{{end template}}} tags leads to PHP warning.

@Jongfeli - sorry for the long delay. I can't tell if this is one bug, or more than one. Does this warning occur for every from, or just one of them? It sounds like the problem is an unclosed "{{{", but I'm not sure.

Mon, Nov 4, 8:54 PM · MediaWiki-extensions-Page_Forms
Yaron_Koren closed T378723: The autocomplete feature fails for tokens fields populated with a concept as Resolved.

@BertrandGorge - thanks for the fix! I checked in this code - I assume this issue can be closed now.

Mon, Nov 4, 8:49 PM · MediaWiki-extensions-Page_Forms

Sun, Nov 3

Yaron_Koren added a comment to T378723: The autocomplete feature fails for tokens fields populated with a concept.

Alright. It looks like two easy solutions exist: removing $substring from the getMaxValuesToRetrieve() call, or removing the setLimit() call altogether. Have you tried either one on your wiki? Do you know for sure if either one works? Is one better than the other?

Sun, Nov 3, 9:53 PM · MediaWiki-extensions-Page_Forms

Thu, Oct 31

Yaron_Koren added a comment to T378723: The autocomplete feature fails for tokens fields populated with a concept.

What about just removing that $query->setLimit() line altogether? Does it work in that case? Or does a limit need to be set?

Thu, Oct 31, 4:30 PM · MediaWiki-extensions-Page_Forms

Oct 24 2024

Yaron_Koren closed T370868: PHP Deprecated: abs(): Passing null to parameter #1 ($num) of type int|float is deprecated as Resolved.

I assume this is fixed now.

Oct 24 2024, 9:41 PM · MediaWiki-extensions-ReplaceText, affects-translatewiki.net

Oct 17 2024

Yaron_Koren added a comment to T370868: PHP Deprecated: abs(): Passing null to parameter #1 ($num) of type int|float is deprecated.

Okay, I was able to reproduce the problem by adding that $wgHiddenPrefs line - and then fixed it by adding the additional $ignoreHidden argument. So I just checked this fix in. Thanks for finding the solution! Hopefully this works for you.

Oct 17 2024, 3:21 PM · MediaWiki-extensions-ReplaceText, affects-translatewiki.net

Oct 16 2024

Yaron_Koren added a comment to T370868: PHP Deprecated: abs(): Passing null to parameter #1 ($num) of type int|float is deprecated.

Would that change work? Looking at the code, it looks like getIntOption() just calls intval() on the output of getOption(). Which would set $cw to 0 instead of null - which would get rid of this error message, but is not ideal either.

Oct 16 2024, 2:42 PM · MediaWiki-extensions-ReplaceText, affects-translatewiki.net

Oct 15 2024

Yaron_Koren closed T376526: The intro and outro aren't parsed properly when format is template as Resolved.

Great!

Oct 15 2024, 4:01 PM · MediaWiki-extensions-Cargo

Oct 14 2024

Yaron_Koren added a comment to T376526: The intro and outro aren't parsed properly when format is template.

Okay, I was wondering why the lack of smartParse() would cause HTML to get over-escaped, but your explanation made more sense. Thanks for figuring out the version issue. I just checked in what I think is a fix - please let me know if it works for you, in place of the smartParse() changes.

Oct 14 2024, 6:32 PM · MediaWiki-extensions-Cargo
Yaron_Koren added a comment to T376526: The intro and outro aren't parsed properly when format is template.

@Taylan - sorry for the delay. What you are advocating for is basically a return to the default behavior - which was changed in 2021 with this commit:

Oct 14 2024, 3:14 PM · MediaWiki-extensions-Cargo
Yaron_Koren closed T376997: Creation of dynamic property MediaWiki\Title\Title::$approvedRevID is deprecated as Resolved.

@Paladox - thanks for pointing this out. It turned out to be unnecessary code anyway. I think this is fixed now.

Oct 14 2024, 2:27 PM · PHP 8.2 support, MediaWiki-extensions-Approved-Revs

Oct 10 2024

Yaron_Koren closed T376549: Error: Call to a member function addModules() on null as Resolved.

Okay, hopefully it works across all versions now!

Oct 10 2024, 6:11 PM · PHP 8.1 support, MediaWiki-extensions-Cargo
Yaron_Koren closed T376778: __NOEDITSECTION__ breaks tabs in MW 1.43 as Resolved.

Sorry about the problem; I think is now fixed. Feel free to re-open if not.

Oct 10 2024, 5:23 PM · MediaWiki-extensions-HeaderTabs
Yaron_Koren renamed T364581: Add "include timezone" parameter to datetimepicker input from Add "timezone" parameter to datetimepicker input to Add "include timezone" parameter to datetimepicker input .
Oct 10 2024, 5:21 PM · MediaWiki-extensions-Page_Forms
Yaron_Koren renamed T364581: Add "include timezone" parameter to datetimepicker input from datetimepicker ignores timezone to Add "timezone" parameter to datetimepicker input .
Oct 10 2024, 5:21 PM · MediaWiki-extensions-Page_Forms
Yaron_Koren closed T372609: Tokens input no longer allows new values in 5.8 as Resolved.

Great!

Oct 10 2024, 5:20 PM · MediaWiki-extensions-Page_Forms

Oct 9 2024

Yaron_Koren added a comment to T372609: Tokens input no longer allows new values in 5.8.

By the way, there is now a newer version of Page Forms, 5.8.1. If you can try this with the newer code, that would be helpful.

Oct 9 2024, 6:37 PM · MediaWiki-extensions-Page_Forms

Oct 7 2024

Yaron_Koren added a comment to T376549: Error: Call to a member function addModules() on null.

Actually - having looked more at the code, I may have found a fix that works for all MW versions. Could you try putting in the following change?

Oct 7 2024, 2:04 AM · PHP 8.1 support, MediaWiki-extensions-Cargo
Yaron_Koren added a comment to T376549: Error: Call to a member function addModules() on null.

Okay. That's unfortunate - I just tried, and it it looks like, with MW 1.43, the exact opposite problem happens: getParser() works fine, but using getParserFactory() leads to that "Call to a member function addModules() on null" error. Evidently there was some rearrangement of the setting of ParserOutput between MW 1.42 and 1.43. I don't know what the best solution for this is.

Oct 7 2024, 1:06 AM · PHP 8.1 support, MediaWiki-extensions-Cargo

Oct 6 2024

Yaron_Koren added a comment to T376549: Error: Call to a member function addModules() on null.

Hi - what version of Cargo? For what it's worth, the current/old code works fine me, on MW 1.43.

Oct 6 2024, 11:33 PM · PHP 8.1 support, MediaWiki-extensions-Cargo

Oct 2 2024

Yaron_Koren added a comment to T376241: ExternalData is no longer usable when using the new database schema.

@BlankEclair - thank you for the analysis, and the fix!

Oct 2 2024, 1:39 PM · affects-Miraheze, MediaWiki-extensions-ExternalData

Oct 1 2024

Yaron_Koren added a comment to T371081: HeaderTabs breaks on MediaWiki 1.42.

@BlankEclair - thanks for reporting/analyzing this issue, and sorry about the long delay. I believe this is finally fixed now.

Oct 1 2024, 4:43 PM · MediaWiki-extensions-HeaderTabs

Sep 23 2024

Yaron_Koren closed T375358: Extension:DataTransfer uses vulnerable version of `phpoffice/phpspreadsheet` as Resolved.

Done! Thank you for the patch. Feel free to cherry-pick it to whatever branches you want, and I will approve it.

Sep 23 2024, 3:34 PM · MediaWiki-extensions-DataTransfer, Security, Security-Team

Sep 18 2024

Yaron_Koren added a comment to T372609: Tokens input no longer allows new values in 5.8.

Okay, that's too bad. I still think there's a chance that switching to the latest code will fix the problem - in large part because I can't reproduce this issue. Perhaps this will have to wait until the next version of Page Forms comes out in order to test it, though.

Sep 18 2024, 9:02 PM · MediaWiki-extensions-Page_Forms
Yaron_Koren closed T371607: Dependency issue in RL module `ext.pageforms.ooui.combobox` as Resolved.

@Osnard - thank you for the fix!

Sep 18 2024, 2:44 PM · MediaWiki-extensions-Page_Forms

Sep 17 2024

Yaron_Koren closed T307069: ReplaceText jobs sometimes fail when User::getName() returns null as Resolved.

I'm closing this, on the assumption that this was indeed fixed. If it's still an issue, of course feel free to re-open this task.

Sep 17 2024, 8:44 PM · Language-Team (Language-2022-July-September), MediaWiki-User-management, MediaWiki-extensions-ReplaceText, affects-translatewiki.net

Sep 16 2024

Yaron_Koren closed T374322: Error messages from "#cargo_declare:" are not fully localizable as Resolved.

@Rye_Greenwood - thanks for pointing out the problem. I think this is fixed now.

Sep 16 2024, 2:56 PM · I18n, MediaWiki-extensions-Cargo
Yaron_Koren added a comment to T372609: Tokens input no longer allows new values in 5.8.

@Virenerus - sorry for the delay, and the bug. I think there's a good chance that this recent commit fixes the problem:

Sep 16 2024, 1:20 PM · MediaWiki-extensions-Page_Forms

Sep 13 2024

Yaron_Koren closed T374413: ContentHandler::getContentText is deprecated as Resolved.
Sep 13 2024, 4:06 AM · MediaWiki-extensions-Cargo

Sep 11 2024

Yaron_Koren added a comment to T374413: ContentHandler::getContentText is deprecated.

Okay, good to know. Right, you could check for "instanceof TextContent" instead - presumably it's the same thing.

Sep 11 2024, 5:16 AM · MediaWiki-extensions-Cargo

Sep 10 2024

Yaron_Koren added a comment to T374413: ContentHandler::getContentText is deprecated.

@Samwilson - thanks for pointing this out, or rather re-pointing this out. I don't know if you remember, but a few months ago you created a patch to remove the ContentHandler::getContentText() calls:

Sep 10 2024, 4:31 PM · MediaWiki-extensions-Cargo

Sep 9 2024

Yaron_Koren added a comment to T373683: Cargo _categories field of PageData not getting updated after page edit.

That's strange, then - those were my two guesses about what was going wrong. So, I have no idea. I'm glad you found a fix for it, but that particular code change should not be necessary. (And it's not necessary on my wiki.) Barring any further information, I don't know how to proceed on this one. Maybe someone else has some idea...

Sep 9 2024, 4:28 PM · MediaWiki-extensions-Cargo

Sep 5 2024

Yaron_Koren added a comment to T373683: Cargo _categories field of PageData not getting updated after page edit.

Okay, thanks for trying the update. I have two questions: does the category that you set the page to actually exist, i.e. has a blue link to it? And if you go to Special:CargoTables, does a replacement table row appear for _pageData?

Sep 5 2024, 5:11 PM · MediaWiki-extensions-Cargo
Yaron_Koren closed T370022: Version `4.3.5` of `smarty/smarty` library in Extension:Widgets library has CVE-2024-35226 as Resolved.

I think this can be closed.

Sep 5 2024, 1:06 PM · SecTeam-Processed, Vuln-VulnComponent, Patch-For-Review, MediaWiki-extensions-Widgets, Security, Security-Team

Sep 4 2024

Yaron_Koren closed T373955: Fix Table Output format as Resolved.

Thanks for the fix!

Sep 4 2024, 5:11 PM · MediaWiki-extensions-Page_Forms

Sep 3 2024

Yaron_Koren closed T356436: Improve InlineComments extension as Resolved.

I'm happy to say that this is now completed! Many thanks to @Jayanthvikashs for all the work on accomplishing this. Thanks also to @Solaris22 for one element of it (T355950), and to @Rockingpenny4 for the valuable idea of being able to edit previous comments.

Sep 3 2024, 5:07 PM · MediaWiki-extensions-InlineComments, Google-Summer-of-Code (2024)
Yaron_Koren closed T358890: Deleting the last inline comments should restore the page to default display as Resolved.

This was fixed with the changes in https://gerrit.wikimedia.org/r/1048022 .

Sep 3 2024, 5:04 PM · Patch-For-Review, MediaWiki-extensions-InlineComments
Yaron_Koren closed T359771: GSoC 2024 proposal - Improve InlineComments extension as Resolved.

Done!

Sep 3 2024, 4:58 PM · MediaWiki-extensions-InlineComments, Google-Summer-of-Code (2024)
Yaron_Koren closed T359771: GSoC 2024 proposal - Improve InlineComments extension, a subtask of T356436: Improve InlineComments extension, as Resolved.
Sep 3 2024, 4:58 PM · MediaWiki-extensions-InlineComments, Google-Summer-of-Code (2024)
Yaron_Koren added a comment to T359501: Calendar display format broken due to removal of Fancybox library.

@FrozenPlum - note that this bug is in the calendar display within Page Forms, which is a fairly obscure feature; my guess is that what you're using is instead the calendar query format in either Cargo or Semantic MediaWiki.

Sep 3 2024, 2:03 AM · MediaWiki-extensions-Page_Forms

Aug 30 2024

Yaron_Koren added a comment to T373683: Cargo _categories field of PageData not getting updated after page edit.

That's a somewhat old version of Cargo, and I think the handling of page data has changed since then. Could you try upgrading to the latest version?

Aug 30 2024, 3:03 PM · MediaWiki-extensions-Cargo

Aug 22 2024

Yaron_Koren added a comment to T372984: warning for preg_match_all in ReplaceText.

That's good to hear!

Aug 22 2024, 1:31 AM · MediaWiki-extensions-ReplaceText

Aug 20 2024

Yaron_Koren added a comment to T372211: CVE-2024-47847: Various XSSes found in Cargo.

Great!

Aug 20 2024, 3:26 PM · MediaWiki-extensions-Cargo, Vuln-XSS, affects-Miraheze, Security, Security-Team

Aug 19 2024

Yaron_Koren added a comment to T372211: CVE-2024-47847: Various XSSes found in Cargo.

It never ends! Thank you for your continued patience. I think I've fixed everything now with d60319b19027 and 59af70a2ec87, but I'm looking forward to finding out...

Aug 19 2024, 4:14 PM · MediaWiki-extensions-Cargo, Vuln-XSS, affects-Miraheze, Security, Security-Team
Yaron_Koren added a comment to T372211: CVE-2024-47847: Various XSSes found in Cargo.

Thanks for pointing out these problems. Clearly I was over-optimistic before! I believe I've now taken care of the remiaining issues in dfe25479c450 and 8ca19783349d - though of course I could be wrong.

Aug 19 2024, 1:27 PM · MediaWiki-extensions-Cargo, Vuln-XSS, affects-Miraheze, Security, Security-Team

Aug 16 2024

Yaron_Koren added a comment to T372211: CVE-2024-47847: Various XSSes found in Cargo.

Sorry - by "JS-related issues", I meant issues where the fix needs to be in the JavaScript code, rather than in PHP.

Aug 16 2024, 3:00 PM · MediaWiki-extensions-Cargo, Vuln-XSS, affects-Miraheze, Security, Security-Team

Aug 15 2024

Yaron_Koren added a comment to T372211: CVE-2024-47847: Various XSSes found in Cargo.

Here's another change, which I think fixes issues 14 and 15, and also some new long-overdue i18n messages: 62b150dca2bb

Aug 15 2024, 9:07 PM · MediaWiki-extensions-Cargo, Vuln-XSS, affects-Miraheze, Security, Security-Team
Yaron_Koren added a comment to T372211: CVE-2024-47847: Various XSSes found in Cargo.

@BlankEclair - thank you for this very detailed analysis, and the video, and the patch! This is extremely helpful. (And I had no idea that there were this many unescaped messages and other strings!) Unfortunately, I didn't see the patch until now - by which time I had already written up fixes on my own for most of these issues. Although in many cases our fixes are (as maybe could be expected) very similar to one another's, and in some cases your fixes are a little more elegant. Anyway, I'm going through the issues piecemeal, and here is the first of my changes:

Aug 15 2024, 4:30 PM · MediaWiki-extensions-Cargo, Vuln-XSS, affects-Miraheze, Security, Security-Team

Aug 14 2024

Yaron_Koren closed T372209: CVE-2024-47846: Special:DeleteCargoTable and Special:SwitchCargoTable have no CSRF protection as Resolved.

@BlankEclair - thank you for the patch, the explanation, and that very illustrative example! I just checked in your fix, here:

Aug 14 2024, 3:57 PM · SecTeam-Processed, Vuln-CSRF, MediaWiki-extensions-Cargo, Security, Security-Team

Aug 12 2024

Yaron_Koren added a comment to T372209: CVE-2024-47846: Special:DeleteCargoTable and Special:SwitchCargoTable have no CSRF protection.

@BlankEclair - thank you for this patch. Any security leak is bad, so I plan to check this fix in, but I just want to make sure I understand this problem, because it seems surprisingly minor. A malicious user can convince an administrator that the admin deleted or switched a Cargo table, where in actuality nothing was done?

Aug 12 2024, 3:04 PM · SecTeam-Processed, Vuln-CSRF, MediaWiki-extensions-Cargo, Security, Security-Team

Aug 6 2024

Yaron_Koren closed T371748: Error in Special:Drilldown when number range is negative as Resolved.

I'm amazed that this never came up before! I guess people don't enter negative numbers that often. Anyway, @KGello - thanks for pointing out the problem.

Aug 6 2024, 8:08 PM · MediaWiki-extensions-Cargo

Aug 5 2024

Yaron_Koren closed T371751: CargoPageValues uses deprecated Linker::tocIndent() as Resolved.

@Samwilson - thank you for pointing out this problem. I believe it's fixed now...

Aug 5 2024, 4:50 PM · MediaWiki-extensions-Cargo

Jul 31 2024

Yaron_Koren added a comment to T371246: Cargo: Empty strings stored in tables will cause Special:Drilldown to ignore the column.

Oh! That's quite surprising, given that (as you pointed out) the Postgres drilldown query checks for both blank and null.

Jul 31 2024, 2:05 PM · MediaWiki-extensions-Cargo

Jul 30 2024

Yaron_Koren added a comment to T371246: Cargo: Empty strings stored in tables will cause Special:Drilldown to ignore the column.

Why do you need to change the PostgreSQL query at all? I thought it was only the MySQL/MariaDB query that was the issue.

Jul 30 2024, 1:55 PM · MediaWiki-extensions-Cargo
Yaron_Koren added a comment to T371246: Cargo: Empty strings stored in tables will cause Special:Drilldown to ignore the column.

Actually, thinking more about it now - unlike with #cargo_store, with the Lua equivalent, you really can tell whether a value was intended to be blank or null. So perhaps the value should not be changed - and the Special:Drilldown SQL query should just be changed to match the Postgres version, as you suggested.

Jul 30 2024, 12:40 AM · MediaWiki-extensions-Cargo

Jul 29 2024

Yaron_Koren added a comment to T371246: Cargo: Empty strings stored in tables will cause Special:Drilldown to ignore the column.

Okay, this is interesting. I had forgotten this, but #cargo_store, when it takes in a blank value, changes it to null before storing it to the DB. It appears that, now that storage can be called from Lua, this code should be duplicated, or moved, somewhere else - around here in storeAllData() might make the most sense, since there is a loop that already cycles through all the field values.

Jul 29 2024, 10:47 PM · MediaWiki-extensions-Cargo

Jul 25 2024

Yaron_Koren closed T368812: Blocked users cannot view comments as Resolved.
Jul 25 2024, 1:12 PM · MediaWiki-extensions-InlineComments

Jul 24 2024

Yaron_Koren added a comment to T370868: PHP Deprecated: abs(): Passing null to parameter #1 ($num) of type int|float is deprecated.

Somehow, for you, this line:

Jul 24 2024, 8:46 PM · MediaWiki-extensions-ReplaceText, affects-translatewiki.net

Jul 23 2024

Yaron_Koren updated the task description for T370828: Make pencil icon bold on hover.
Jul 23 2024, 9:55 PM · MediaWiki-extensions-InlineComments
Yaron_Koren added a comment to T369843: InlineComments: add Echo notification if thread you created is replied to, or closed.

@Rishi2108 - sorry for the delay. That's great to hear! Are there specific extensions you know about and are interested in? Or are there specific technologies (PHP, JavaScript, Vue, SQL) that you want more experience with?

Jul 23 2024, 9:41 PM · MediaWiki-extensions-InlineComments
Yaron_Koren created T370828: Make pencil icon bold on hover.
Jul 23 2024, 9:30 PM · MediaWiki-extensions-InlineComments
Yaron_Koren created T370827: Don't display pencil icon on old revisions.
Jul 23 2024, 9:29 PM · MediaWiki-extensions-InlineComments

Jul 22 2024

Yaron_Koren closed T370632: CVE-2024-47849: Cargo: Backticks can allow the usage of not-allowed SQL functions as Resolved.

Fixed in 5e94b1625258. Thanks for pointing this out! I had no idea you could put function names inside backticks.

Jul 22 2024, 4:03 PM · Vuln-Inject, SecTeam-Processed, MediaWiki-extensions-Cargo, affects-Miraheze, Security

Jul 19 2024

Yaron_Koren closed T369843: InlineComments: add Echo notification if thread you created is replied to, or closed as Resolved.
Jul 19 2024, 2:11 AM · MediaWiki-extensions-InlineComments
Yaron_Koren updated subscribers of T369843: InlineComments: add Echo notification if thread you created is replied to, or closed.

@Jayanthvikashs - thank you for fixing this!

Jul 19 2024, 2:11 AM · MediaWiki-extensions-InlineComments

Jul 17 2024

Yaron_Koren closed T369296: Inline comments displayed on old revisions of pages should not be selectable as Resolved.
Jul 17 2024, 2:55 PM · MediaWiki-extensions-InlineComments

Jul 16 2024

Yaron_Koren added a comment to T369794: [JS] Nested For Templates bug.

That does seem to work, yes! I'm indeed quite surprised. If you create a patch to fix the JS bug you talked about, I would be happy to check it in.

Jul 16 2024, 9:59 PM · MediaWiki-extensions-Page_Forms
Yaron_Koren closed T369437: CargoUtils - processing of coordinates with a degree equals to zero as Resolved.
Jul 16 2024, 9:58 PM · MediaWiki-extensions-Cargo

Jul 15 2024

Yaron_Koren created T370102: Ignore hidden users in InlineComments @-mentions.
Jul 15 2024, 8:27 PM · MediaWiki-extensions-InlineComments
Yaron_Koren added a comment to T370022: Version `4.3.5` of `smarty/smarty` library in Extension:Widgets library has CVE-2024-35226.

Yes, sounds good.

Jul 15 2024, 5:53 PM · SecTeam-Processed, Vuln-VulnComponent, Patch-For-Review, MediaWiki-extensions-Widgets, Security, Security-Team

Jul 12 2024

Yaron_Koren added a comment to T369794: [JS] Nested For Templates bug.

What do you mean by the "backend code" - the PHP code that displays the forms? If so, I would be surprised if the current code can handle parsing pages that contain two or more levels of nesting - though I could be wrong. Do you know definitely that this works?

Jul 12 2024, 2:22 PM · MediaWiki-extensions-Page_Forms

Jul 11 2024

Yaron_Koren created T369843: InlineComments: add Echo notification if thread you created is replied to, or closed.
Jul 11 2024, 4:21 PM · MediaWiki-extensions-InlineComments