Page MenuHomePhabricator

Security review for WikibaseMediaInfo extension
Closed, ResolvedPublic


Please do a security of the WikibaseMediaInfo extension. It is needed for providing structured data to Wikimedia Commons in the future. It holds the new entity type (next to items and properties) that is going to handle structured data for multimedia files.

Project Information

Description of the tool/project

The MediaInfo extension provides the new entity type (next to the existing ones: item and property) that is going to handle structured data for multimedia files.

Description of how the tool will be used at WMF

It will be used to improve the storage and editing of meta data about files on Commons like "who took this picture", "which license is it under" and more.


libraries also used by Wikibase. See

Has this project been reviewed before?

Team-internal code review was done. No security review was done so far.

Working test environment for installation instructions for a test system


Wikidata team with primary contact Lydia Pintscher

Event Timeline

Restricted Application added a subscriber: Aklapper. · View Herald Transcript
Aklapper renamed this task from Security reveiw for WikibaseMediaInfo extension to Security review for WikibaseMediaInfo extension.Mar 6 2017, 9:05 PM
thiemowmde triaged this task as Medium priority.Mar 26 2017, 2:00 PM

Sorry I wasn't aware of the template. Fixing it now.

Bawolff claimed this task.
Bawolff moved this task from Scheduled to Waiting on the deprecated-security-team-reviews board.
Bawolff subscribed.

Sorry for the delay in reviewing this one.

Security review passed. There's not much to say. Most of the interface work is done by Wikibase, so there's not very much attack surface in this extension. Two minor comments unrelated to security that I have:

  • It doesn't matter, but it is kind of odd there is a special page alias file when there's no special pages.
  • The discussion tab on a MediaInfo page leads the the media info id number in the main namespace. This seems wrong. I would expect either there be no discussion tab in the media info view, or the media info namespace be similar to the annotations extension where it appears as if its attached to the file namespace and the talk tab goes back to the File_talk namespace.