Page MenuHomePhabricator
Create Task
Maniphest T251732

wikiworkshop.org has Facebook button, external statcounter, https to http redirect
Closed, ResolvedPublic
Actions

Description

https://wikiworkshop.org is hosted in WMF production but has a Facebook button, an external statcounter and redirects from https to http in some cases.

Details

Show related patches Customize query in gerrit

Related Objects

Event Timeline

There are a very large number of changes, so older changes are hidden. Show Older Changes
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptMay 4 2020, 8:42 AM
Dzahn renamed this task from wikiworkshop.org has Facebook button, external statcounter etc to wikiworkshop.org has Facebook button, external statcounter, https to http redirect.May 4 2020, 8:42 AM
Dzahn added projects: SRE, Traffic.
Dzahn added a project: Privacy Engineering.
Dzahn added a subscriber: Reedy.
gerritbot added a comment.May 4 2020, 8:44 AM

Change 593752 had a related patch set uploaded (by Dzahn; owner: Dzahn):
[research/wikiworkshop@master] remove Facebook button

https://gerrit.wikimedia.org/r/593752

gerritbot added a project: Patch-For-Review.May 4 2020, 8:44 AM

Change 593753 had a related patch set uploaded (by Dzahn; owner: Dzahn):
[research/wikiworkshop@master] remove statcounter

https://gerrit.wikimedia.org/r/593753

gerritbot added a comment.May 4 2020, 8:44 AM

Change 593751 had a related patch set uploaded (by Dzahn; owner: Dzahn):
[research/wikiworkshop@master] replace a http:// with a https:// link to the 2015 workshop

https://gerrit.wikimedia.org/r/593751

Dzahn added a comment.May 4 2020, 8:44 AM

curl -I https://wikiworkshop.org/2020
location: http://wikiworkshop.org/2020/

Peachey88 added a project: Research.May 4 2020, 8:51 AM
Aklapper added a project: Privacy.May 4 2020, 9:18 AM
• JFishback_WMF triaged this task as High priority.May 4 2020, 3:35 PM
• JFishback_WMF moved this task from Incoming to In Progress on the Privacy Engineering board.
gerritbot added a comment.May 10 2020, 2:25 PM

Change 593751 merged by Bmansurov:
[research/wikiworkshop@master] replace a http:// with a https:// link to the 2015 workshop

https://gerrit.wikimedia.org/r/593751

• bmansurov added subscribers: leila, • bmansurov.EditedMay 10 2020, 2:26 PM

@leila head's up that one of the patches is removing the Facebook button. Another is removing statcounter. We probably want to use https://wikitech.wikimedia.org/wiki/Tool:Event_Metrics instead. What do you think?

leila added a comment.May 11 2020, 6:38 PM

@bmansurov thanks for the heads up. those removals are fine. (and btw, I expect James Fishback to provide more update requests in the coming weeks per an internal thread to clean up such aspects of the site).

Re Event Metrics: sounds good to me if it's relatively straightforward for you to set up.

• ema moved this task from Backlog to Radar/Not for service by Traffic on the Traffic board.May 12 2020, 7:16 AM
Dzahn added a comment.May 12 2020, 12:53 PM

Thanks @leila ! I would be happy to merge my patches but i don't have +2 on that repo. There is no deployment needed since puppet will git pull automatically.

gerritbot added a comment.May 13 2020, 1:40 AM

Change 593752 merged by Bmansurov:
[research/wikiworkshop@master] remove Facebook button

https://gerrit.wikimedia.org/r/593752

gerritbot added a comment.May 13 2020, 1:40 AM

Change 593753 merged by Bmansurov:
[research/wikiworkshop@master] remove statcounter

https://gerrit.wikimedia.org/r/593753

• bmansurov mentioned this in rRWWS5a47edab2152: remove Facebook button.May 13 2020, 1:43 AM
• bmansurov mentioned this in rRWWS8f54476435cf: remove statcounter.
Maintenance_bot removed a project: Patch-For-Review.May 13 2020, 2:10 AM
gerritbot added a comment.May 13 2020, 12:14 PM

Change 596194 had a related patch set uploaded (by Dzahn; owner: Dzahn):
[research/wikiworkshop@master] remove more Facebook buttons in previous years

https://gerrit.wikimedia.org/r/596194

gerritbot added a project: Patch-For-Review.May 13 2020, 12:14 PM
gerritbot added a comment.May 13 2020, 12:16 PM

Change 596196 had a related patch set uploaded (by Dzahn; owner: Dzahn):
[research/wikiworkshop@master] remove tweet buttons

https://gerrit.wikimedia.org/r/596196

gerritbot added a comment.May 13 2020, 12:20 PM

Change 596198 had a related patch set uploaded (by Dzahn; owner: Dzahn):
[research/wikiworkshop@master] remove more stat counters

https://gerrit.wikimedia.org/r/596198

gerritbot added a comment.May 13 2020, 10:23 PM

Change 596194 merged by Bmansurov:
[research/wikiworkshop@master] remove more Facebook buttons in previous years

https://gerrit.wikimedia.org/r/596194

gerritbot added a comment.May 13 2020, 10:23 PM

Change 596196 merged by Bmansurov:
[research/wikiworkshop@master] remove Twitter script/buttons

https://gerrit.wikimedia.org/r/596196

gerritbot added a comment.May 13 2020, 10:24 PM

Change 596198 merged by Bmansurov:
[research/wikiworkshop@master] remove more stat counters

https://gerrit.wikimedia.org/r/596198

• bmansurov mentioned this in rRWWSda2abb4cbd15: remove more stat counters.May 13 2020, 10:24 PM
Maintenance_bot removed a project: Patch-For-Review.May 13 2020, 11:10 PM
• JFishback_WMF moved this task from In Progress to Waiting on the Privacy Engineering board.May 21 2020, 8:22 PM
Dzahn added a comment.May 22 2020, 8:17 AM

Is there a specific thing we are waiting for?

• JFishback_WMF subscribed.May 22 2020, 2:58 PM

The last things I see are:

  1. Remove as much of the YUI and Bootstrap CSS and JS as possible. We don't want to leave vulnerable libraries out there needlessly.
  2. Update what remains of those libraries to newest stable versions.
  3. There are several assets being hosted at stanford.edu that should either be removed if not needed, or moved into the repo so we host them

I pinged @leila about whether she wanted me to do that or she had someone else, but I haven't heard back (I think because of no-email Friday).

leila added a comment.May 22 2020, 3:22 PM

@bmansurov please check JFishback_WMF's comment above and make the changes requested.

gerritbot added a comment.May 24 2020, 4:20 PM

Change 598266 had a related patch set uploaded (by Bmansurov; owner: Bmansurov):
[research/wikiworkshop@master] Copy external assets to the repo

https://gerrit.wikimedia.org/r/598266

gerritbot added a project: Patch-For-Review.May 24 2020, 4:20 PM

Change 598266 merged by Bmansurov:
[research/wikiworkshop@master] Copy external assets to the repo

https://gerrit.wikimedia.org/r/598266

• bmansurov mentioned this in rRWWS7f193567f684: Copy external assets to the repo.May 24 2020, 4:34 PM
Maintenance_bot removed a project: Patch-For-Review.May 24 2020, 5:10 PM
gerritbot added a comment.May 24 2020, 5:11 PM

Change 598267 had a related patch set uploaded (by Bmansurov; owner: Bmansurov):
[research/wikiworkshop@master] 2015: remove YUI js and (most of) CSS

https://gerrit.wikimedia.org/r/598267

gerritbot added a project: Patch-For-Review.May 24 2020, 5:11 PM

Change 598267 merged by Bmansurov:
[research/wikiworkshop@master] 2015: remove YUI js and (most of) CSS

https://gerrit.wikimedia.org/r/598267

• bmansurov mentioned this in rRWWSb2f0700f7de6: 2015: remove YUI js and (most of) CSS.May 24 2020, 5:14 PM
gerritbot added a comment.May 24 2020, 6:01 PM

Change 598268 had a related patch set uploaded (by Bmansurov; owner: Bmansurov):
[research/wikiworkshop@master] WIP: Upgrade bootstrap

https://gerrit.wikimedia.org/r/598268

• bmansurov added a comment.May 24 2020, 6:02 PM

Just a little status update: I've removed YUI and working on upgrading bootstrap. Since a lot changed between versions 2 and 4, it'll take some time to fully upgrade years 2016 through 2020. I'll let you know when I'm done.

gerritbot added a comment.May 26 2020, 2:25 AM

Change 598268 merged by Bmansurov:
[research/wikiworkshop@master] 2016: Upgrade bootstrap

https://gerrit.wikimedia.org/r/598268

• bmansurov mentioned this in rRWWS1f90253f9cc2: 2016: Upgrade bootstrap.May 26 2020, 2:26 AM
Maintenance_bot removed a project: Patch-For-Review.May 26 2020, 3:10 AM
gerritbot added a comment.May 27 2020, 1:32 AM

Change 598895 had a related patch set uploaded (by Bmansurov; owner: Bmansurov):
[research/wikiworkshop@master] 2017: Upgrade bootstrap

https://gerrit.wikimedia.org/r/598895

gerritbot added a project: Patch-For-Review.May 27 2020, 1:32 AM

Change 598895 merged by Bmansurov:
[research/wikiworkshop@master] 2017: Upgrade bootstrap

https://gerrit.wikimedia.org/r/598895

• bmansurov mentioned this in rRWWSfc4dd637c9be: 2017: Upgrade bootstrap.May 27 2020, 1:34 AM
gerritbot added a comment.May 27 2020, 1:43 AM

Change 598896 had a related patch set uploaded (by Bmansurov; owner: Bmansurov):
[research/wikiworkshop@master] 2018: upgrade bootstrap

https://gerrit.wikimedia.org/r/598896

gerritbot added a comment.May 27 2020, 1:43 AM

Change 598896 merged by Bmansurov:
[research/wikiworkshop@master] 2018: upgrade bootstrap

https://gerrit.wikimedia.org/r/598896

gerritbot added a comment.May 27 2020, 2:00 AM

Change 598900 had a related patch set uploaded (by Bmansurov; owner: Bmansurov):
[research/wikiworkshop@master] 2019: Upgrade bootstrap

https://gerrit.wikimedia.org/r/598900

gerritbot added a comment.May 27 2020, 2:00 AM

Change 598900 merged by Bmansurov:
[research/wikiworkshop@master] 2019: Upgrade bootstrap

https://gerrit.wikimedia.org/r/598900

• bmansurov mentioned this in rRWWS2cfba8a48f15: 2019: Upgrade bootstrap.May 27 2020, 2:00 AM
Maintenance_bot removed a project: Patch-For-Review.May 27 2020, 2:10 AM
gerritbot added a comment.May 27 2020, 11:55 PM

Change 599143 had a related patch set uploaded (by Bmansurov; owner: Bmansurov):
[research/wikiworkshop@master] 2020: upgrade bootstrap

https://gerrit.wikimedia.org/r/599143

gerritbot added a project: Patch-For-Review.May 27 2020, 11:55 PM

Change 599143 merged by Bmansurov:
[research/wikiworkshop@master] 2020: upgrade bootstrap

https://gerrit.wikimedia.org/r/599143

• bmansurov added a comment.May 27 2020, 11:57 PM

@JFishback_WMF, issues mentioned at T251732#6158467 have been addressed.

• bmansurov mentioned this in rRWWS4bb3d14aa83b: 2020: upgrade bootstrap.May 27 2020, 11:57 PM
Maintenance_bot removed a project: Patch-For-Review.May 28 2020, 12:10 AM
• JFishback_WMF added a comment.May 28 2020, 7:21 PM

Looks good to me WRT Privacy. I think @Reedy also wanted to take a look at this for the appsec side.

• JFishback_WMF moved this task from Waiting to Completed on the Privacy Engineering board.Jun 1 2020, 2:44 PM
• JFishback_WMF added a project: Security-Team.
Reedy moved this task from Incoming to Our Part Is Done on the Security-Team board.EditedJun 18 2020, 3:21 PM

Minor issue (so to some extent, still a HTTPS to HTTP redirect), I going to https://wikiworkshop.org/2019 (and other older sites, rather than one with a trailing /) results in a 301 against a HTTP resource before being kicked back to HTTPS

Screenshot 2020-06-18 at 16.18.55.png (734×1 px, 357 KB)

404s from favicon.ico but that obviously doesn't matter

Other than that, LGTM

Reedy added a comment.Jun 18 2020, 3:24 PM
curl -I -L https://wikiworkshop.org/2019
HTTP/2 301 
date: Thu, 18 Jun 2020 15:17:14 GMT
server: Apache
location: http://wikiworkshop.org/2019/
content-length: 303
content-type: text/html; charset=iso-8859-1
vary: X-Forwarded-Proto
age: 332
x-cache: cp3064 miss, cp3062 hit/2
x-cache-status: hit-front
server-timing: cache;desc="hit-front"

HTTP/1.1 301 TLS Redirect
Date: Thu, 18 Jun 2020 15:22:46 GMT
Server: Varnish
X-Varnish: 816772390
X-Cache: cp3050 int
X-Cache-Status: int-front
Server-Timing: cache;desc="int-front"
Location: https://wikiworkshop.org/2019/
Content-Length: 0
Connection: keep-alive

HTTP/2 200 
date: Thu, 18 Jun 2020 15:17:14 GMT
server: Apache
last-modified: Thu, 28 May 2020 00:11:13 GMT
vary: Accept-Encoding
cache-control: max-age=3600, must-revalidate
content-type: text/html
etag: W/"9740-5a6aa2a9d38b2"
age: 331
x-cache: cp3058 miss, cp3062 hit/2
x-cache-status: hit-front
server-timing: cache;desc="hit-front"
accept-ranges: bytes
Reedy added a comment.Jun 18 2020, 3:26 PM

https://github.com/wikimedia/puppet/blob/58ac95353aca3f0925017407ddebc2d397cd9f2f/modules/profile/files/httpbb/test_miscweb.yaml#L89

assert_headers:
  Location: http://wikiworkshop.org/2020/

That's obviously wrong, even if the test is just confirming what happens now..

Vgutierrez subscribed.Jun 18 2020, 3:31 PM

that's interesting.. why we don't have HSTS headers for wikiworkshop.org?

sbassett moved this task from Our Part Is Done to Watching on the Security-Team board.May 17 2021, 6:19 PM
Dzahn added a comment.Sep 24 2021, 3:25 PM

@Vgutierrez This site was setup by Brandon. Could you maybe ask him about that last question?

BBlack subscribed.Sep 24 2021, 4:21 PM
In T251732#7376732, @Dzahn wrote:

@Vgutierrez This site was setup by Brandon. Could you maybe ask him about that last question?

I think this was just an oversight! Patch incoming for that part.

On the other redirects - the ones that read as 301 TLS Redirect that go in the http->https direction are from our generic Varnish coverage, while the downgrade ones are coming from something down in the applayer side.

gerritbot added a comment.Sep 24 2021, 4:21 PM

Change 723590 had a related patch set uploaded (by BBlack; author: BBlack):

[operations/puppet@production] Add wikiworkshop.org to HSTS regex

https://gerrit.wikimedia.org/r/723590

gerritbot added a project: Patch-For-Review.Sep 24 2021, 4:22 PM
gerritbot added a comment.Oct 29 2021, 3:04 PM

Change 723590 merged by BBlack:

[operations/puppet@production] Add wikiworkshop.org to HSTS regex

https://gerrit.wikimedia.org/r/723590

gerritbot added a comment.Dec 16 2021, 1:19 AM

Change 747658 had a related patch set uploaded (by Dzahn; author: Dzahn):

[operations/puppet@production] httpbb: miscweb: fix tests for wikiworkshop.org, update 2021 to 2022

https://gerrit.wikimedia.org/r/747658

gerritbot added a comment.Dec 16 2021, 1:21 AM

Change 747658 merged by Dzahn:

[operations/puppet@production] httpbb: miscweb: fix tests for wikiworkshop.org, update 2021 to 2022

https://gerrit.wikimedia.org/r/747658

• bmansurov added a comment.EditedApr 30 2022, 2:39 AM

@leila,

Remaining items:

  1. Implement https://wikitech.wikimedia.org/wiki/Tool:Event_Metrics. I looked more into it. Unfortunately, it does not fit our use case as it's tied to specific Wikimedia projects (Wikipedia, Wiktionary, and Wikivoyage). Before looking more into it, I was under the false impression that we could use it as a pageview counter.
  1. Resolve the https -> http redirect issue (who should look into it?) mentioned in:
In T251732#6235116, @Reedy wrote:

Minor issue (so to some extent, still a HTTPS to HTTP redirect), I going to https://wikiworkshop.org/2019 (and other older sites, rather than one with a trailing /) results in a 301 against a HTTP resource before being kicked back to HTTPS

gerritbot added a comment.May 5 2022, 5:17 PM

Change 789658 had a related patch set uploaded (by BBlack; author: BBlack):

[operations/puppet@production] Explicitly define wikiworkshop ServerName as HTTPS

https://gerrit.wikimedia.org/r/789658

BBlack added a comment.May 5 2022, 5:35 PM
In T251732#7892986, @bmansurov wrote:
  1. Resolve the https -> http redirect issue (who should look into it?) mentioned in:

I've uploaded a patch to the vhost's apache config that should probably fix that issue in the short term sense. Might need some review, as I wrote it blindly without testing anything and apache config minutia is not my strong suit, and I think this service has migrated to something k8s-based, but which I suspect shares this same config...

• bmansurov added a comment.May 7 2022, 4:19 AM

@BBlack thank you. Who would be a good person to review the patch? @Dzahn, would you be able to review the above patch? Thank you.

• bmansurov closed this task as Resolved.Jun 7 2022, 12:21 AM

It seems the majority of the issues described in the task have been resolved. Closing it for now. Feel free to re-open it.

sbassett moved this task from Watching to Our Part Is Done on the Security-Team board.Jun 7 2022, 1:43 AM
sbassett added a project: SecTeam-Processed.
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits