MediaWiki-l January 2025

3 participants
3 discussions

Magnolia677 deserved the death threats I made to her because she was attacking me and calling my edits stupid
by MidAtlanticBaby . 17 May '25

17 May '25

So apparently y'all care more about the people that hurt me than y'all care about me? So y'all are going to IGNORE THE FACT that Magnolia677 WENT OFF ON me because i was making a bunch of edits to Florida county articles that she and 3 other admins didnt like me making and then I got REPORTED by ANOTHER EDITOR to ANI for STANDING UP for myself against her ATTACKING me? And y'all are gonna ASSUME i made the death threats for no reason for my own fucking ENJOYMENT? Y'all are ALLOWED to be an asshole to me and im not supposed to be an asshole to you back? Do y'all not have any respect for other people or their emotions? Is that like y'all's GOAL, to MAKE people suffer for the rest of THEIR FUCKING LIFE when they get blocked on a wiki and they GET MAD about it and take it out RIGHTFULLY on the person that blocked them? Are y'all nothing but some sadistic ass racist ass motherfuckers who want everything to go THEIR WAY and who want to control OTHER PEOPLE'S emotions or how they feel about their block? Are y'all JUSTIFYING Magnolia's and Drmies' actions towards me because theyre white and I'M black?

2 1

[CheckUser] Proposal to sunset encrypted storage of EmailUser recipients
by Máté Szabó 22 Jan '25

22 Jan '25

To Whom It May Concern: Since 2012, the CheckUser extension has contained functionality to optionally store the encrypted recipients for emails that were sent via Special:EmailUser, if the operator set $wgCUPublicKey to a valid RSA public key. The encryption mechanism used by this logic is outdated and needs an update.[1] However, it's unclear if anybody is using this feature. It is not enabled in WMF production, and was implemented without a corresponding BZ reference. There is also no functionality in CheckUser that allows access to the stored data. If you are actively using this functionality and would like it to be retained, please leave a comment on the deprecation task T384460.[2] [1] https://phabricator.wikimedia.org/T384398 [2] https://phabricator.wikimedia.org/T384460 Yours faithfully, Máté Szabó (he/him/his) Senior Software Engineer, Trust & Safety Product Wikimedia Foundation

1 0

MediaWiki Extensions and Skins Security Release Supplement (1.39.11/1.41.5/1.42.4)
by Manfredi Martorana 14 Jan '25

14 Jan '25

Greetings- With the security/maintenance release of MediaWiki 1.39.11/1.41.5/1.42.4, we would also like to provide this supplementary announcement of MediaWiki extensions and skins with now-public Phabricator tasks, security patches and backports [1]: SocialProfile + (T373265 <https://phabricator.wikimedia.org/T373265>, CVE-2025-23074) - Special:EditProfile exposes the contents of profile fields marked "hidden"/friends or "friends of friends" when the privileged user isn't a friend of the user whose profile they edit(ed) https://gerrit.wikimedia.org/r/q/I4b77ced314bc6cea0ef3657a82e7467d3661fe2a GlobalBlocking + (T377855 <https://phabricator.wikimedia.org/T377855>, CVE-2025-23073) - API list=globalblocks can reveal IP of autoblock if username and IP are included in the bgtargets parameter https://gerrit.wikimedia.org/r/q/I2a2d32aedf6328be0a9f1b4e04a6567a25f19486 RefreshSpecial + (T378885 <https://phabricator.wikimedia.org/T378885>, CVE-2025-23072) - XSS in Special:RefreshSpecial https://gerrit.wikimedia.org/r/q/Ic9547e80a8296d707ad8a157eb8ba7aa26fb08dc DataTransfer + (T379749 <https://phabricator.wikimedia.org/T379749>, CVE-2025-23081) - Various security vulnerabilities in Extension:DataTransfer https://gerrit.wikimedia.org/r/q/I773c616db781d2f3f30893ad01ef503bf251a2b3 https://gerrit.wikimedia.org/r/q/I7c9de4c8dcdb3276ba923c6bc7c8eef3531324c7 https://gerrit.wikimedia.org/r/q/I9223c31f02f31f1e06e1a8cddf7d539cc8d3a3d9 https://gerrit.wikimedia.org/r/q/I5e1538a3bf66378810f905834c05626e1d2c82f0 https://gerrit.wikimedia.org/r/c/mediawiki/extensions/DataTransfer/+/1093931 https://gerrit.wikimedia.org/r/c/mediawiki/extensions/DataTransfer/+/1080451 OpenBadges + (T381220 <https://phabricator.wikimedia.org/T381220>, CVE-2025-23080) - XSSes in Special:BadgeView https://gerrit.wikimedia.org/r/q/Ic9448312fa7f1cbc8feac3f852bc8720568522e2 ArticleFeedbackv5 + (T381753 <https://phabricator.wikimedia.org/T381753>, CVE-2025-23079) - XSSes in Extension:ArticleFeedbackv5 https://gerrit.wikimedia.org/r/q/I6ee51c8b518bda41739fd666fa2891cc12e79ac3 BreadCrumbs2 + (T382043 <https://phabricator.wikimedia.org/T382043>, CVE-2025-23078) - XSS in BreadCrumbs2 https://gerrit.wikimedia.org/r/q/I7878f8f7bc067080f80427b90f8d85337f172711 The Wikimedia Security Team recommends updating these extensions and/or skins to the current master branch or relevant, supported release branch [2] as soon as possible. Some of the referenced Phabricator tasks above _may_ still be private. Unfortunately, when security issues are reported, sometimes sensitive information is exposed and since Phabricator is historical, we cannot make these tasks public without exposing this sensitive information. If you have any additional questions or concerns regarding this update, please feel free to contact security(a)wikimedia.org or file a security task within Phabricator [3]. [1] https://phabricator.wikimedia.org/T375631 [2] https://www.mediawiki.org/wiki/Version_lifecycle [3] https://www.mediawiki.org/wiki/Reporting_security_bugs

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

MediaWiki-l January 2025