Security review for CollaborationKit
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	Harej
	Jun 21 2016, 4:45 PM

Description

Project Information

Name of tool/project: MediaWiki-extensions-CollaborationKit
Project home page: https://www.mediawiki.org/wiki/Extension:CollaborationKit
Name of team requesting review: WikiProject-X
Primary contact: @Harej
Target date for deployment: October 31, 2016
Link to code repository / patchset: https://gerrit.wikimedia.org/r/#/admin/projects/mediawiki/extensions/CollaborationKit
Programming Language(s) Used: PHP, CSS/LESS, JavaScript

Description of the tool/project

CollaborationKit creates specialized page content types that make it easier for Wikipedia editors to create and organize WikiProjects and other on-wiki collaborations.

Description of how the tool will be used at WMF

The extension will initially be launched on English Wikipedia, then eventually other language Wikipedias and other Wikimedia projects.

Dependencies

EventLogging
PageImages (optional)
CodeEditor (optional)

Has this project been reviewed before?

Not by the Wikimedia Foundation.

Working test environment

https://wpx.wmflabs.org/w/index.php

Post-deployment

Team responsible is WikiProject-X, with @Harej as primary point of contact.

Related Objects
Search...

Status	Assigned	Task
Resolved	Isarra	T116831 Women in Red workflow automation / optimization (tracking)
Declined	None	T106828 Make it easier for WikiProjects to shove long, narrow lists into columns
Declined	None	T106823 Discourage wikiprojects from shoving extra stuff into their headers
Resolved	Isarra	T97210 MediaWiki extension for WikiProjects / on-wiki working groups
Invalid	None	T137916 Detect CollaborationListContent pages and format output for those pages
Declined	None	T155680 Deploy CollaborationKit to all Wikipedias
Declined	None	T123028 Deploy CollaborationKit on English Wikipedia
Resolved	Reedy	T138326 Deploy CollaborationKit on Test Wikipedia
Resolved	None	T138325 Deploy CollaborationKit on Beta Wikipedia
Resolved	Reedy	T138324 Security review for CollaborationKit
Resolved	Bawolff	T136462 Create CollaborationListContent editor
Resolved	Bawolff	T135088 Implement CollaborationListContent content model
Resolved	Bawolff	T131720 Send content of lists through mw parser
Resolved	Bawolff	T139097 Create mass editing interface for lists
Resolved	Bawolff	T139249 Show changes button on edit page does not work when using a non-default format with a content model that supports multiple formats
Resolved	Bawolff	T139098 CollaborationLists: Image is not as optional as it should be
Resolved	Bawolff	T141073 Allow editing individual entries on CollaborationLists
Resolved	Bawolff	T141018 Special mode in list content model for membership lists
Resolved	Bawolff	T141108 Allow list-wide suppression of images
Resolved	Isarra	T136478 Implement CollaborationHubContent.php
Resolved	Isarra	T132091 Create and style overall layout for WikiProject pages
Resolved	Isarra	T131721 Implement table of contents for page-list type pages
Resolved	Isarra	T132092 Create breadcrumbs/tabs/links for collaborationhub subpage navigation
Resolved	Isarra	T131724 Add 'icon' field to json schema for use on main pages and as toc icons
Resolved	Isarra	T136785 Allow embedding pages of arbitrary content models in hub pages
Resolved	Isarra	T140176 Clean out excess list rendering junk from collaborationhubcontent
Declined	Isarra	T132012 Disable editsection links for wikitext content-type
Resolved	Isarra	T141007 Move icon info for subpage features into hub page
Declined	Isarra	T140186 Import php content variables (styles set in the json or from variable in the content handler) into less
Resolved	Harej	T123977 [Basic Functionality] Create editing interface for CollaborationHubContent content model
Declined	None	T132015 SpecialEditCollaborationHub: Support for creating CollaborationHub pages
Declined	None	T135101 Add minor edit and watch page checkboxes to specialeditcollabotationhub
Resolved	Bawolff	T131717 Show page namespaces and tools (cactions/whatever) for $1 on special:editcollaborationhub/$1
Declined	None	T131662 Editing previews for Special:EditCollaborationHub
Duplicate	None	T131474 Editing conflict handling in Special:EditCollaborationHub
Invalid	None	T131719 Saving wikitext content collaborationhub pages is oddly slow
Duplicate	None	T136477 Have Special:EditCollaborationHub create the page if the page title is non-existent
Resolved	Isarra	T136469 Clean up specialcreatecollaborationhub to be specifically about creating hub main pages
Resolved	Bawolff	T136465 Have CollaborationListContent and CollaborationHubContent fall back to JSON editor
Resolved	Isarra	T132184 Add support for arbitrary footer junk
Resolved	Isarra	T129240 Determine various modes of editing in CollaborationKit and design interfaces accordingly
Duplicate	Bawolff	T138012 Create CollaborationKit mainpage editor
Declined	Isarra	T138526 Mockup for CollaborationKit mainpage editor
Resolved	Bawolff	T138014 Implement editing functions within mainpage read mode
Declined	Bawolff	T138015 Create subpage editing mode in CollaborationKit
Resolved	Harej	T140165 Make fancy icon selection dialog for specialeditcollaborationkit
Resolved	Bawolff	T141011 Creation interface for subpage features
Resolved	Isarra	T141109 Determine UI for interface for creating subpage features
Resolved	Harej	T141037 Re-work editing and creation interface for collaboration kit to be based on EditPage
Resolved	Harej	T140995 specialcreatecollaborationhub: Sign up hub creator as first member of project
Resolved	Bawolff	T140191 Test EditPage to make sure it can handle CollaborationHub edit conflicts
Declined	None	T140188 Show diff button in specialeditcollaborationhub
Resolved	Isarra	T123972 [Basic Functionality] Develop content model for CollaborationKit extension
Resolved	Harej	T120928 Specify a proper JSON Schema for WikiProjects
Resolved	Bawolff	T129271 Functionality to partially transclude a page
Declined	None	T141072 Make CollaborationList icons flush
Resolved	Isarra	T141074 Fallback image (or blank space) on CollaborationLists when one is not specified or automatically retrieved
Resolved	Harej	T141004 Set allowed namespaces for collaborationhubs
Resolved	Harej	T140331 Add CollaborationKit to Translatewiki
Resolved	Isarra	T141006 Make sure everything is properly i18n-ized
Resolved	Isarra	T140170 Separate out collaborationhub ToC into its own class
Invalid	Bawolff	T136778 Make ToC rendering less stupid and update properly
Resolved	Isarra	T141008 Make ToC show up on all subpages of project hub and fetch all stuff from hub regardless of subpage type
Resolved	Bawolff	T141009 Add magic word to disable collabkit ToC

Event Timeline

Harej created this task.Jun 21 2016, 4:45 PM

Restricted Application added subscribers: Zppix, Aklapper. · View Herald TranscriptJun 21 2016, 4:46 PM

I am creating this task now because I hope to get it done during Q1 2016–17. The extension won't be ready for review until the blocker tasks are all done.

Harej added subtasks: T136462: Create CollaborationListContent editor, T135088: Implement CollaborationListContent content model, T136478: Implement CollaborationHubContent.php, T123977: [Basic Functionality] Create editing interface for CollaborationHubContent content model, T123972: [Basic Functionality] Develop content model for CollaborationKit extension.Jun 21 2016, 4:49 PM

Harej added a parent task: T138325: Deploy CollaborationKit on Beta Wikipedia.

Harej moved this task from Backlog to Release blockers on the MediaWiki-extensions-CollaborationKit board.Jun 21 2016, 4:52 PM

• dpatrick moved this task from Incoming to Scheduled on the deprecated-security-team-reviews board.Jul 6 2016, 5:12 PM

Harej created subtask T141072: Make CollaborationList icons flush.Jul 22 2016, 2:19 AM

Harej created subtask T141073: Allow editing individual entries on CollaborationLists.Jul 22 2016, 2:23 AM

Harej removed a subtask: T141073: Allow editing individual entries on CollaborationLists.Jul 22 2016, 2:26 AM

Harej created subtask T141074: Fallback image (or blank space) on CollaborationLists when one is not specified or automatically retrieved.Jul 22 2016, 2:31 AM

Harej added a subtask: T141008: Make ToC show up on all subpages of project hub and fetch all stuff from hub regardless of subpage type.Jul 22 2016, 1:40 PM

Harej added a subtask: T141004: Set allowed namespaces for collaborationhubs.Jul 22 2016, 1:43 PM

Harej added a subtask: T140994: Special:CreateCollaborationHub needs to create initial features as well as the main hub page.

Harej added a subtask: T140331: Add CollaborationKit to Translatewiki.Jul 22 2016, 1:47 PM

Harej removed a subtask: T140994: Special:CreateCollaborationHub needs to create initial features as well as the main hub page.Jul 22 2016, 1:59 PM

Harej closed subtask T141072: Make CollaborationList icons flush as Declined.Jul 22 2016, 3:37 PM

Harej removed a subtask: T141008: Make ToC show up on all subpages of project hub and fetch all stuff from hub regardless of subpage type.Jul 22 2016, 4:04 PM

Harej added a subtask: T140170: Separate out collaborationhub ToC into its own class.

Bawolff closed subtask T141074: Fallback image (or blank space) on CollaborationLists when one is not specified or automatically retrieved as Resolved.Jul 23 2016, 9:37 PM

Harej closed subtask T136462: Create CollaborationListContent editor as Resolved.Aug 25 2016, 7:26 PM

• dpatrick moved this task from Scheduled to Waiting/Blocked on the deprecated-security-team-reviews board.Aug 31 2016, 5:25 PM

Harej updated the task description. (Show Details)Sep 22 2016, 7:45 PM

Harej closed subtask T141004: Set allowed namespaces for collaborationhubs as Resolved.Sep 24 2016, 11:37 PM

Harej updated the task description. (Show Details)Sep 29 2016, 9:50 PM

Harej updated the task description. (Show Details)Sep 30 2016, 5:44 AM

Isarra closed subtask T140170: Separate out collaborationhub ToC into its own class as Resolved.Oct 4 2016, 8:57 PM

Harej closed subtask T136478: Implement CollaborationHubContent.php as Resolved.Oct 4 2016, 10:38 PM

• dpatrick changed the task status from Open to Stalled.Oct 14 2016, 5:58 PM

Harej updated the task description. (Show Details)Oct 27 2016, 8:05 PM

Harej closed subtask T123977: [Basic Functionality] Create editing interface for CollaborationHubContent content model as Resolved.Dec 16 2016, 9:25 AM

Harej updated the task description. (Show Details)Jan 17 2017, 6:11 AM

Harej closed subtask T140331: Add CollaborationKit to Translatewiki as Resolved.Jan 20 2017, 5:49 AM

This should be ready for review by the end of the week.

• dpatrick moved this task from Waiting/Blocked to Incoming on the deprecated-security-team-reviews board.Feb 14 2017, 9:21 PM

• dpatrick moved this task from Incoming to Scheduled on the deprecated-security-team-reviews board.Feb 22 2017, 6:37 PM

• dpatrick mentioned this in E501: Security review of CollaborationKit.Feb 22 2017, 6:46 PM

This is pretty much ready to go in terms of review. There are couple of unmerged patches but they're style-related and unlikely to affect the extensions' attack surface.

Reedy changed the task status from Stalled to Open.Feb 26 2017, 7:46 PM

Some misc cleanup being done tagged under T159076 for various (non security) issues noticed during looking around. Some useful improvements with documentation etc

Change 339964 had a related patch set uploaded (by Reedy):
CSS improvements according to PhpStorm

https://gerrit.wikimedia.org/r/339964

gerritbot added a project: Patch-For-Review.Feb 26 2017, 8:08 PM

Reedy mentioned this in rECKT0321ac1d5525: CSS improvements according to PhpStorm.Feb 26 2017, 8:08 PM

Reedy removed a project: Patch-For-Review.Feb 26 2017, 8:11 PM

Harej moved this task from Release blockers to In Progress on the MediaWiki-extensions-CollaborationKit board.Feb 26 2017, 9:39 PM

Reedy moved this task from Scheduled to In Progress on the deprecated-security-team-reviews board.Mar 7 2017, 2:45 PM

Reedy closed this task as Resolved.Mar 20 2017, 3:36 AM

Reedy claimed this task.

Reedy moved this task from In Progress to Waiting on the deprecated-security-team-reviews board.

Harej moved this task from In Progress to Done on the MediaWiki-extensions-CollaborationKit board.Mar 20 2017, 3:37 AM

sbassett moved this task from Waiting to Done on the deprecated-security-team-reviews board.Jul 9 2019, 8:22 PM