Maniphest Advanced Search

Advanced Search
Use Results
Edit Query
Hide Query

Query

Assigned To

	N/A
	Informational
	Low
	Medium
	High
	Critical

Tasks (100)

T380666 external links spoofing diff links?
Security
·
Security
SecTeam-Processed
MediaWiki-Engineering
MediaWiki-User-Interface
MediaWiki-Parser
Content-Transform-Team
Wed, Nov 27, 2:00 PM
T380014 Onboard Jimmy Ly to the Security Team
Security-Team
Security Team AppSec
SecTeam-Processed
Tue, Dec 3, 9:15 PM
Assigned: mmartorana
T379010 Design task/job queue for task runs for initial phase of project
Security-Team
Security
Universal Security Dashboard
SecTeam-Processed
Tue, Nov 26, 5:06 PM
T378157 SUL Integration for eventyay (Wikimania virtual event platform)
Security
SecTeam-Processed
MediaWiki-Platform-Team (Radar)
Oct 29 2024, 5:42 PM
T376563 Publish public "Rules of Engagement" for security researchers and people reporting security vulnerabilities
Security
Security-Team
Documentation
SecTeam-Processed
Oct 7 2024, 4:18 PM
T372022 Decide if AccountVanishRequests locks should be shown by StewardBot
stewardbots
Stewards-and-global-tools
Security-Team
SecTeam-Processed
Sep 5 2024, 6:32 PM
T367817 Investigate Dagster packaging, install, security monitoring.
Security Preview
Privacy Engineering
SecTeam-Processed
Jul 3 2024, 5:15 PM
T366554 Views data integrity compromised by entity running up fake views
Security
·
Security
Pageviews-Anomaly
SecTeam-Processed
Data Products
Oct 24 2024, 2:31 PM
T363589 Migrate foreign-resources files to CDX SBOM format
Security
Security-Team
MediaWiki-General
SecTeam-Processed
MediaWiki-core-Hackathon-2024
Wikimedia-Hackathon-2024
MW-1.43-notes (1.43.0-wmf.18; 2024-08-13)
Patch-For-Review
MW-1.44-notes (1.44.0-wmf.3; 2024-11-12)
Sat, Nov 30, 12:32 PM
Assigned: Tgr
T360721 Update the image used by the python-bandit appsec include
GitLab-Application-Security-Pipeline
Security
Security-Team
SecTeam-Processed
user-sbassett
Mar 28 2024, 10:29 PM
Assigned: sbassett
T359634 Adopt Software Bill of Materials (SBOM) for MediaWiki
Security
Security-Team
SecTeam-Processed
Oct 22 2024, 8:57 AM
T354832 Create a special throttling class for "rogue proxies" IPs
iPoid-Service
Security-Team
Trust and Safety Product Team
MediaWiki-Platform-Team
MediaWiki-extensions-CentralAuth
SecTeam-Processed
Jan 29 2024, 2:06 PM
T348780 Integrate a risk factor related to how many production projects an extension or skin is deployed
production-risk-assessment
Security-Team
Security Team AppSec
Security
Code-Health
SecTeam-Processed
Patch-For-Review
Mar 13 2024, 6:53 PM
Assigned: Mstyles
T348237 Combining throttling edit filters causes multiple false positives for single IP edits
Security
·
AbuseFilter
SecTeam-Processed
Oct 8 2024, 11:18 PM
T345445 Attempt to improve test coverage checks within test_coverage.py
production-risk-assessment
Security
Code-Health
SecTeam-Processed
Oct 12 2023, 4:07 PM
T342177 [EPIC] Application Security Pipeline Components for Gitlab - Phase 2 Work
GitLab-Application-Security-Pipeline
Security
Security-Team
SecTeam-Processed
user-sbassett
Epic
Jul 22 2024, 4:53 PM
Assigned: sbassett
T329121 Allow the Wikidata Query Builder to be embedded in an iframe
Wikidata Query Builder
Wikidata
Wikidata Dev Team
User-ItamarWMDE
Security-Team
SecTeam-Processed
Jan 7 2024, 2:52 AM
T328667 Add --pause-after-testserver-sync option to deploy_security.py
Release-Engineering-Team
Security-Team
SecTeam-Processed
Mar 14 2023, 11:58 PM
T308789 Determine CI best practices for service which connects to MySQL
Security-Team
Security
SecTeam-Processed
Data-Persistence (work done)
Release-Engineering-Team (Seen)
Aug 23 2023, 12:53 PM
T307991 SecurityError: Attempt to use history.replaceState() more than 100 times per 30 seconds
Security
·
Wikimedia-production-error
MediaWiki-Recent-changes
JavaScript
Vuln-DoS
Security
SecTeam-Processed
Sep 13 2024, 5:42 PM
T306211 Echo oneself using API
Feature
·
Growth-Team
MediaWiki-Action-API
Notifications
Security
SecTeam-Processed
MW-1.43-notes (1.43.0-wmf.4; 2024-05-07)
May 10 2024, 10:38 AM
T304985 Throttling mitigations against password sprays attacks
Security
·
Security
MediaWiki-Core-AuthManager
SecTeam-Processed
Apr 4 2022, 3:40 PM
T302640 Harden Special:Random and API:Random to automatically adjust in certain ways during on-wiki incidents
Security
MediaWiki-Special-pages
MediaWiki-Action-API
SecTeam-Processed
Oct 26 2024, 4:16 PM
T299351 Configuration variable to disable the "content was" on deletion pages
MediaWiki-Page-deletion
SecTeam-Processed
Sat, Nov 23, 9:27 PM
T289373 Create maintenance script to add/remove global blocks
Security
·
Security
GlobalBlocking
SecTeam-Processed
User-Tks4Fish
Patch-For-Review
Sep 12 2024, 3:41 PM
Assigned: Dreamy_Jazz
T285998 Growth experiments includes user email in Javascript on every page
GrowthExperiments-Help panel
Privacy
Growth-Team
SecTeam-Processed
Dec 9 2021, 2:13 PM
T285329 Anyone can display whatever title they want using TemplateStyles
Security
·
MediaWiki-Parser
TemplateStyles
Security
SecTeam-Processed
Nov 16 2023, 6:35 AM
T275047 Create webpack security standard for MediaWiki development
Security-Team
Documentation
SecTeam-Processed
JavaScript
Front-end-Standards-Group
Dec 15 2022, 11:36 PM
T273842 Notifications were updated even though session had expired
Growth-Team
Notifications
MediaWiki-Core-AuthManager
Growth-Team-Filtering
SecTeam-Processed
Sep 3 2024, 5:21 PM
T299193 MediaWiki login failure due to race condition with session cookie
BUG REPORT
·
MediaWiki-Core-AuthManager
Security
Security-Team
SecTeam-Processed
Platform Engineering
MW-1.39-notes (1.39.0-wmf.12; 2022-05-16)
Growth-Team
Mon, Nov 11, 5:22 AM
T145915 OATHAuth OTP shouldn't be stored in cleartext in the DB
MediaWiki-extensions-OATHAuth
Security
Sustainability (Incident Followup)
SecTeam-Processed
Patch-Needs-Improvement
May 16 2024, 5:04 PM
T88044 Make rollback use POST instead of GET (use AJAX in GUI)
MediaWiki-Page-diffs
User-notice
MediaWiki-Page-history
Vuln-Misconfiguration
SecTeam-Processed
Mar 28 2024, 6:15 PM
T40848 Security: CSS positioning can be used to break out of the content area
MediaWiki-User-Interface
TemplateStyles
User-Tgr
Security
Vuln-Misconfiguration
SecTeam-Processed
Sep 10 2023, 5:09 PM
T379009 As a user I should be able to perform CRUD operations via the django REST API for various mutable objects
Security-Team
Security
Universal Security Dashboard
SecTeam-Processed
user-sbassett
Fri, Nov 22, 9:36 PM
Assigned: sbassett
T379007 Discuss best authn/z methods for initial phase of application development
Security-Team
Security
Universal Security Dashboard
SecTeam-Processed
Fri, Nov 22, 9:35 PM
Assigned: mmartorana
T379005 Discuss and determine django ORM structure for initial application
Security-Team
Security
Universal Security Dashboard
SecTeam-Processed
Patch-For-Review
Tue, Dec 3, 9:14 PM
Assigned: mmartorana
T378250 OpenBao audit logs
Infrastructure-Foundations
Security
SecTeam-Processed
Mon, Nov 18, 7:45 AM
T378249 OpenBao backups
Infrastructure-Foundations
Security
SecTeam-Processed
Mon, Nov 18, 7:43 AM
T378248 OpenBao high availability
Infrastructure-Foundations
Security
SecTeam-Processed
Mon, Nov 18, 7:45 AM
T378247 OpenBao authentication methods
Infrastructure-Foundations
Security
SecTeam-Processed
Mon, Nov 18, 7:45 AM
T378246 OpenBao unsealing
Infrastructure-Foundations
Security
SecTeam-Processed
Mon, Nov 18, 7:45 AM
T378245 OpenBao installation & configuration
Infrastructure-Foundations
Security
SecTeam-Processed
Mon, Nov 18, 7:44 AM
T378244 OpenBao storage engine
Infrastructure-Foundations
Security
SecTeam-Processed
Mon, Nov 18, 7:44 AM
T378243 OpenBao secret engines
Infrastructure-Foundations
Security
SecTeam-Processed
Mon, Nov 18, 7:44 AM
T378241 OpenBao human consumer
Infrastructure-Foundations
Security
SecTeam-Processed
Mon, Nov 18, 7:43 AM
T378240 OpenBao Kubernetes consumer
Infrastructure-Foundations
Security
SecTeam-Processed
Mon, Nov 18, 7:43 AM
T378239 OpenBao Puppet consumer
Infrastructure-Foundations
Security
SecTeam-Processed
Mon, Nov 18, 7:42 AM
T378237 OpenBao consumers
Infrastructure-Foundations
Security
SecTeam-Processed
Mon, Nov 18, 7:42 AM
T378235 OpenBao evaluation
Infrastructure-Foundations
Security
SecTeam-Processed
Mon, Nov 18, 3:20 PM
T373933 Evaluate publishing our PHP packages directly to Packagist.org
MediaWiki-Engineering
Security-Team
Librarization
SecTeam-Processed
Content-Transform-Team
MW-Interfaces-Team
MediaWiki-Platform-Team (Radar)
Tue, Nov 19, 4:22 PM
T371814 [EPIC] Universal Security Dashboard
Security-Team
Security
Epic
user-sbassett
Universal Security Dashboard
SecTeam-Processed
Fri, Nov 22, 9:35 PM
T367818 [Trino] Investigate install, operation and maintenance, and security monitoring.
Security Preview
Privacy Engineering
SecTeam-Processed
fundraising-tech-ops
Oct 18 2024, 7:24 PM
Assigned: Jgreen
T367123 [minIO] Investigate packaging, install, security monitoring.
Security Preview
Privacy Engineering
SecTeam-Processed
fundraising-tech-ops
BDC-Implementation
Data-Platform-SRE
Tue, Nov 26, 9:31 PM
Assigned: Jgreen
T366824 Add a changelog and apply a custom version number to our patched bundled Lua binaries
Security
·
Security-Team
Security
Scribunto
SecTeam-Processed
Jun 29 2024, 4:42 PM
T366818 Add documentation for Wikimedia Risk Calculator on mediawiki.org
wikimedia-risk-calculator
Security
Security-Team
Documentation
SecTeam-Processed
Jun 18 2024, 1:57 PM
Assigned: mmartorana
T366005 Remove docroot/wikimediafoundation.org/ folder from mediawiki-config
Security
Wikimedia-Apache-configuration
Security-Team
SecTeam-Processed
Patch-For-Review
Infrastructure-Foundations
Aug 17 2024, 12:15 AM
Assigned: mmartorana
T361482 Issues changing password & logging in (primarily with Android Wikipedia mobile app)
Security
·
Mobile
Wikipedia-Android-App-Backlog
SecTeam-Processed
May 31 2024, 3:07 PM
T343366 [EPIC] Production Risk Assessment Work - Phase 2
production-risk-assessment
Security-Team
Security Team AppSec
Security
Code-Health
SecTeam-Processed
user-sbassett
Epic
Apr 15 2024, 8:03 PM
Assigned: sbassett
T335892 Get stats on Gadgets and Users scripts loading third-party resources
tech-decision-forum
Privacy Engineering
SecTeam-Processed
affects-Miraheze
WMF-General-or-Unknown
Fri, Nov 22, 10:31 PM
Assigned: sguebo_WMF
T332003 Evaluate StopForumSpam operations in es.wikiversity
Security-Team
MediaWiki-extensions-StopForumSpam
Stewards-and-global-tools
SecTeam-Processed
user-sbassett
Spanish-Sites
Nov 28 2023, 8:01 PM
T319318 Update and restructure public-facing wikimedia security documentation
Security-Team
Documentation
SecTeam-Processed
user-sbassett
Oct 12 2023, 8:46 PM
T314352 Investigate proof-of-work captchas for Wikimedia sites
ConfirmEdit (CAPTCHA extension)
Security-Team
Vuln-DoS
SecTeam-Processed
Oct 24 2024, 1:22 AM
T303433 Allow Stewards to enable 'emergency CAPTCHAs' for anonymous IP edits
Security
Wikimedia-Site-requests
Platform Engineering
ConfirmEdit (CAPTCHA extension)
Sustainability (Incident Followup)
SecTeam-Processed
MediaWiki-extensions-CentralAuth
Stewards-and-global-tools
MW-1.39-notes (1.39.0-wmf.25; 2022-08-15)
MediaWiki-Platform-Team (Radar)
Sat, Nov 23, 10:46 PM
T299629 Test disabling the captcha on some Wikimedia wikis
Wikimedia-Site-requests
Accessibility
Security
Security-Team
SecTeam-Processed
Nov 6 2023, 8:20 PM
T296847 Third-party resources policy
tech-decision-forum
Privacy Engineering
SecTeam-Processed
Dec 17 2023, 6:15 AM
Assigned: sguebo_WMF
T279120 Make index.php?action=raw CDN cacheable for both logged-in and logged-out for import script use case
MediaWiki-General
Patch-For-Review
User-ArielGlenn
SecTeam-Processed
Wikimedia-Performance-recommendation
Wikimedia-Hackathon-2024
MediaWiki-core-Hackathon-2024
Apr 23 2024, 4:51 PM
T272297 User script on user subpage doesn't work after user rename
Vuln-DoS
MediaWiki-General
MediaWiki-User-rename
JavaScript
MediaWiki-extensions-CentralAuth
Patch-For-Review
Security-Team
SecTeam-Processed
Oct 29 2024, 4:36 PM
T263220 Limit concurrency of DPL queries
DynamicPageList
Performance Issue
MW-1.36-notes (1.36.0-wmf.18; 2020-11-17)
Platform Team Workboards (Clinic Duty Team)
Sustainability (Incident Followup)
Vuln-DoS
Security
SecTeam-Processed
Wikimedia-Slow-DB-Query
serviceops-radar
SRE-Sprint-Week-Sustainability-March2023
Jun 23 2023, 3:45 PM
T203129 Define Suppress grants
MediaWiki-General
User-Rxy
WMF-Legal
Privacy
Trust-and-Safety
Platform Engineering
Privacy Engineering
SecTeam-Processed
Patch-Needs-Improvement
Apr 2 2023, 11:56 PM
T189943 Reveal email recipient's username in checkuser query results
Stewards-and-global-tools
CheckUser
Privacy
WMF-Legal
Privacy Engineering
SecTeam-Processed
Mar 20 2024, 4:33 PM
T180896 Allow functionaries to reset second factor on low-risk accounts
MW-1.34-notes (1.34.0-wmf.1; 2019-04-16)
WMF-Legal
Trust-and-Safety
MediaWiki-extensions-OATHAuth
Security
Security-Team
SecTeam-Processed
Dec 30 2023, 2:57 PM
T124445 Design research support for two step authentication
MediaWiki-extensions-OATHAuth
Security
SecTeam-Processed
Oct 13 2021, 7:29 PM
T36958 User-level gadgets (aka "Gadgets 3.0")
JavaScript
MediaWiki-extensions-Gadgets
Proposal
MediaWiki-ResourceLoader
Security-Team
SecTeam-Processed
MediaWiki-Platform-Team (Radar)
Patch-Needs-Improvement
Sep 10 2024, 3:07 PM
T28227 Notify user by email when password changed
Feature
·
MediaWiki-User-login-and-signup
MediaWiki-Email
MediaWiki-Core-AuthManager
Security
SecTeam-Processed
Feb 4 2022, 12:24 PM
T377222 Don’t use raw HTML messages in safe mode
Security
·
Security-Team
Security
MediaWiki-Internationalization
I18n
Vuln-Misconfiguration
Vuln-XSS
SecTeam-Processed
MW-1.44-notes (1.44.0-wmf.4; 2024-11-19)
Thu, Nov 14, 3:01 PM
T375537 Password Policy Updates wrt NIST SP 800-63
Security
Security-Team
SecTeam-Processed
MediaWiki-User-login-and-signup
Oct 16 2024, 3:13 PM
T368224 Audit members of acl*security for more than 12 months of no activity (May 2025)
Phabricator
Security-Team
SecTeam-Processed
Jun 24 2024, 4:16 PM
T363182 Create a proof-of-concept rapid risk assessment tool
Security-Team
Security Team AppSec
SecTeam-Processed
Apr 29 2024, 4:12 PM
Assigned: Mstyles
T361328 Password to keystore of java certificates needs changing
Security
·
Security
SecTeam-Processed
serviceops
Jul 8 2024, 12:36 PM
T358728 Solve OSV Double-Pipeline Problem without Requiring Many Default Rules
Release-Engineering-Team
Release Pipeline
Security-Team
SecTeam-Processed
Mar 7 2024, 5:02 PM
T356971 Rename help key to help-raw in HTMLForm and deprecate old key name
Security
·
Security
Vuln-XSS
MediaWiki-HTMLForm
SecTeam-Processed
MW-1.43-notes (1.43.0-wmf.18; 2024-08-13)
Patch-For-Review
Wed, Dec 4, 2:22 AM
T356768 DOM Clobbering Risk in WikiBooks
Security
·
Security-Team
Security
SecTeam-Processed
Vuln-XSS
Patch-For-Review
MW-1.42-notes (1.42.0-wmf.25; 2024-04-02)
May 14 2024, 5:33 PM
Assigned: sbassett
T348752 Standard process for dealing with public OAuth consumer secrets
Security-Team
Security
Toolforge
Toolforge-standards-committee
cloud-services-team
SecTeam-Processed
Sep 18 2024, 2:32 PM
T332639 Make it more difficult to unintentionally paste secrets, passwords, and keys in Phabricator task descriptions, comments and pastes
Feature
·
SecTeam-Processed
Phabricator (Upstream)
Upstream
May 12 2024, 1:04 PM
T317595 Investigate: Can we load the Create account / Login forms in a modal from an article page?
Spike
·
IPBee (IP-Blocked Editor Experience)
SecTeam-Processed
Jul 22 2024, 6:23 PM
Assigned: STran
T302159 Security Issue Access Request for MarkAHershberger and Mglaser
Security
Security-Team
SecTeam-Processed
Apr 27 2024, 8:16 PM
T294151 Reports that the ua-parser-js npm package has been "hijacked" into a coinminer (indirect dependency of Wikibase)
Security
·
Security
Wikidata-Bridge
Wikidata
[DEPRECATED] wdwb-tech
SecTeam-Processed
Mar 5 2024, 12:19 PM
T264798 CentralAuth should not emit central cookies when creating a local session
MediaWiki-extensions-CentralAuth
Security-Team
SecTeam-Processed
Platform Engineering (Icebox)
Sustainability (Incident Followup)
Mar 5 2024, 11:42 AM
T264131 Experiment with package publishing workflows on GitLab
GitLab-Test
User-brennen
GitLab (Integrations)
SecTeam-Processed
Release-Engineering-Team (Priority Backlog 📥)
Jun 17 2024, 8:54 PM
T258322 Open redirect in wikis that use http://domain.tld/index.php format
Security
·
Security
MediaWiki-General
Platform Engineering
Vuln-OpenRedirect
SecTeam-Processed
Aug 4 2021, 6:39 PM
T254698 Disallow external JavaScripts at svwiki
ContentSecurityPolicy
Wikimedia-Site-requests
SecTeam-Processed
Jul 5 2022, 2:22 PM
T240870 Audit the WMF LDAP group and limit its permissions
LDAP
SecTeam-Processed
Infrastructure-Foundations
Nov 4 2022, 1:39 PM
T214579 Some very specific Maniphest search queries by RelEng, Sec Team and WMCS are global and shown for all users
Phabricator
Developer Productivity
SecTeam-Processed
Release-Engineering-Team (Seen)
Jul 13 2023, 5:34 PM
T189641 Service for checking the Pwned Passwords database
MediaWiki-Core-AuthManager
MediaWiki-User-login-and-signup
WMF-Legal
User-Tgr
Services (watching)
Platform Team Legacy (Watching / External)
Security
SecTeam-Processed
Dec 13 2023, 3:24 AM
T125289 Auth tokens should expire
MediaWiki-extensions-CentralAuth
MediaWiki-Core-AuthManager
Security
SecTeam-Processed
Mar 5 2024, 11:50 AM
T101017 Early security release access for Lcawte (ShoutWiki)
WMF-Legal
ShoutWiki
SecTeam-Processed
Jun 3 2024, 5:28 PM
T321802 action=growthmentordashboardupdatedata ignores blocks
Security
·
Security
GrowthExperiments-Mentorship
Growth-Team
SecTeam-Processed
Vuln-MissingAuthz
Jul 4 2024, 6:01 PM
T299855 XTools ArticleInfo gadget should not execute WMCS HTML
Security
·
Security
XTools
SecTeam-Processed
Jan 24 2022, 10:35 PM
T242821 Separate access to tools and test features from ability to view private filters
Security
·
User-DannyS712
MediaWiki-User-management
Security
AbuseFilter (Overhaul-2020)
MW-1.36-notes (1.36.0-wmf.32; 2021-02-23)
SecTeam-Processed
Oct 6 2021, 10:49 AM
T150902 SMS based 2FA
Feature
·
MediaWiki-extensions-OATHAuth
Security
SecTeam-Processed
Nov 30 2023, 5:57 PM

Advanced SearchUse ResultsEdit QueryHide Query

Tasks (100)

Advanced Search
Use Results
Edit Query
Hide Query