See https://zero.wikimedia.org/wiki/Special:ZeroPortal
Caused by T156184 which disallows <html> in system messages. Zerowiki is using a mix of Lua, templates and system messages to build the portal.
Description
Description
Details
Details
| Project | Branch | Lines +/- | Subject | |
|---|---|---|---|---|
| operations/mediawiki-config | master | +5 -1 | Harden zerowiki config (no raw html, no transclude NS_ZERO) |
Related Objects
Related Objects
- Mentioned In
- T156184: Make rawHTML mode not apply to system messages
- Mentioned Here
- T156184: Make rawHTML mode not apply to system messages
Event Timeline
Comment Actions
Thanks - it has improved.
I went in having signed in earlier and see another HTML warning. I'm attaching a screenshot.
Comment Actions
I think I've fixed all of them.
There are some remaining usages of <html>, but it appears to all be on pages that are not used ( https://zero.wikimedia.org/w/index.php?search=insource%3A%2F%5C%3Chtml%5C%3E%2F&title=Special:Search&profile=advanced&fulltext=1&ns0=1&ns1=1&ns2=1&ns3=1&ns4=1&ns5=1&ns7=1&ns8=1&ns9=1&ns10=1&ns11=1&ns12=1&ns13=1&ns14=1&ns15=1&ns480=1&ns481=1&ns486=1&ns487=1&ns828=1&ns829=1&ns2300=1&ns2301=1&ns2302=1&ns2303=1&searchToken=epk6y0uo8q72i26rqwim69knr ).
@DFoy If indeed there is no longer any raw html usages on zero.wikimedia.org, would it be ok if I totally disabled raw html on that wiki (In order to reduce attack surface)?
Comment Actions
@DFoy / @dr0ptp4kt : ping - would it be ok if I disabled raw html on zero wiki and transclusions from the Data namespace. I think this will make the wiki much more secure and shouldn't negatively effect anything - but if it does we could revert.
Comment Actions
This week is already becoming kind of insane due to events on frwiki. How about we do this on monday
Comment Actions
Sorry for the delay, we will do this soon: https://gerrit.wikimedia.org/r/#/c/354113/
Comment Actions
Mentioned in SAL (#wikimedia-operations) [2017-05-17T13:23:49Z] <dereckson@tin> Synchronized wmf-config/InitialiseSettings.php: Harden zerowiki config (T162771) (duration: 00m 41s)
Comment Actions
@DFoy: Its live now. I tested myself and I didn't see any problems, let me know if you encounter any.
Comment Actions
I checked and there is a problem with the testing timer. I'm attaching a screenshot. If you need credentials to access, please contact me outside of Phabricator.
Comment Actions
I checked and there is a problem with the testing timer. I'm attaching a screenshot. If you need credentials to access, please contact me outside of Phabricator.
Whoops, must of missed that. Should be fixed now. Anything else?
Comment Actions
@DFoy: Could you please answer Brian's question to clarify whether this task is solved or if more work is needed?
Comment Actions
@DFoy: Could you please answer Brian's question to clarify whether this task is solved or if more work is needed?