Maniphest T359025

Setting for $wgServer in LocalSettings.php in our Wikibase Image may be insecure
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	lojo_wmde
	Mar 4 2024, 9:02 AM

Tags

Referenced Files

None

Subscribers

Description

Situation: In the documentation for https://www.mediawiki.org/wiki/Manual:$wgServer it states that "MediaWiki formerly tried to autodetect the name of the server, however this was vulnerable to cache poisoning attacks, and informally deprecated in 1.18. It was fully removed in MediaWiki 1.34.". However, we are still using an auto-detection method in the default LocalSettings.php in our Wikibase Image (see https://github.com/search?q=repo%3Awmde%2Fwikibase-release-pipeline%20wgServer&type=code).

Solution: Replace the autodetect setting with a passthrough of the env var we use in the image to indicate the address of the Wikibase/MediaWiki server (i.e. WIKIBASE_HOST?). Ref: https://phabricator.wikimedia.org/T357971 and https://phabricator.wikimedia.org/T315916

Related Objects

Mentioned Here: T315916: Wikibase: Quick-statements behind reverse proxy
T357971: Refactor Example *_HOST and *_PORT env var naming and use

Event Timeline

lojo_wmde created this task.Mar 4 2024, 9:02 AM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptMar 4 2024, 9:02 AM

lojo_wmde moved this task from Inbox to Prioritised + Refined on the Wikibase Suite Team board.Mar 4 2024, 9:03 AM

darthmon_wmde moved this task from Prioritised + Refined to Sprint-∞ on the Wikibase Suite Team board.Apr 29 2024, 11:35 AM

darthmon_wmde edited projects, added Wikibase Suite Team (Sprint-∞); removed Wikibase Suite Team.

lojo_wmde changed the task status from Open to In Progress.Tue, May 14, 6:11 AM

lojo_wmde claimed this task.

lojo_wmde moved this task from To do to Doing on the Wikibase Suite Team (Sprint-∞) board.

lojo_wmde moved this task from Doing to In Review on the Wikibase Suite Team (Sprint-∞) board.

PR: https://github.com/wmde/wikibase-release-pipeline/pull/665

roti_WMDE closed this task as Resolved.Tue, May 14, 12:47 PM

roti_WMDE moved this task from In Review to Done on the Wikibase Suite Team (Sprint-∞) board.

darthmon_wmde moved this task from Sprint-∞ to Archive (closed) on the Wikibase Suite Team board.Wed, May 15, 5:13 PM

darthmon_wmde edited projects, added Wikibase Suite Team; removed Wikibase Suite Team (Sprint-∞).