Page MenuHomePhabricator
Create Task
Maniphest T301359

Prepare wmde.5 (1.36) minor / security release
Closed, ResolvedPublicSecurity
Actions

Description

From https://github.com/wmde/wikibase-release-pipeline/blob/main/docs/topics/release-overview.md

Details

SubjectRepoBranchLines +/-
RELEASE-NOTES-1.36 for wmde.5mediawiki/extensions/WikibaseREL1_36+7 -0
Customize query in gerrit

Related Objects
Search...

Event Timeline

Addshore created this task.Feb 9 2022, 3:00 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptFeb 9 2022, 3:00 PM
Addshore added a subtask: T301064: Publish maintenance releases of Wikibase including fixes to XSS vulnerabilities in the Query Service UI.Feb 9 2022, 3:01 PM
Addshore added a subtask: T297686: Wikidata Query UI lets users build links with arbitrary link text and javascript: URL.
Addshore added a subtask: T298839: XSS in WDQS query helper.
Addshore added a subtask: T298871: XSS in WDQS UI result view explore button.
Addshore added a subtask: T297002: Elasticsearch 6.5.4 docker image contains critical security issues.
Addshore added a subtask: T301065: Update Elasticsearch plugins in Wikibase container image releases.Feb 9 2022, 3:03 PM
Addshore updated the task description. (Show Details)Feb 9 2022, 3:11 PM
Addshore added a comment.Feb 9 2022, 3:14 PM

Draft PR started in the rel pipeline repo https://github.com/wmde/wikibase-release-pipeline/pull/303

Addshore updated the task description. (Show Details)Feb 9 2022, 3:23 PM
Addshore updated the task description. (Show Details)Feb 9 2022, 3:28 PM
Addshore updated the task description. (Show Details)
Addshore updated the task description. (Show Details)Feb 9 2022, 3:39 PM
Addshore renamed this task from Prepare wmde.5 (1.36) minor release to Prepare wmde.5 (1.36) minor / security release.Feb 9 2022, 3:45 PM
Addshore updated the task description. (Show Details)
Addshore updated the task description. (Show Details)Feb 9 2022, 5:26 PM
Addshore updated the task description. (Show Details)Feb 10 2022, 8:23 AM
gerritbot added a comment.Feb 10 2022, 8:26 AM

Change 761576 had a related patch set uploaded (by Addshore; author: Addshore):

[mediawiki/extensions/Wikibase@REL1_36] RELEASE-NOTES-1.36 for wmde.5

https://gerrit.wikimedia.org/r/761576

gerritbot added a project: Patch-For-Review.Feb 10 2022, 8:26 AM
Addshore updated the task description. (Show Details)Feb 10 2022, 8:26 AM
Addshore updated the task description. (Show Details)
Addshore updated the task description. (Show Details)
Addshore set Security to Software security bug.Feb 10 2022, 8:32 AM
Addshore added projects: Security, Security-Team.
Addshore changed the visibility from "Public (No Login Required)" to "Custom Policy".
Addshore changed the subtype of this task from "Task" to "Security Issue".

Moving to security issue status so that I can include some links to patches etc in here before actually making the release

Addshore removed a project: Security-Team.Feb 10 2022, 8:32 AM

Prep for pushing the query service UI patches to gerrit

git apply /mnt/c/Users/adam/Downloads/T297686.patch
git add ./*
git commit --author="Lucas Werkmeister <lucas.werkmeister@wikimedia.de>" -m "Fix building links with arbitrary link text and javascript: URL" -m "Bug: T297686
Bug: T301064"

git apply /mnt/c/Users/adam/Downloads/T298839.patch
git add ./*
git commit --author="Lucas Werkmeister <lucas.werkmeister@wikimedia.de>" -m "Fix queryhelper dropdown of filter and show inputs" -m "Bug: T298839
Bug: T301064"

git apply /mnt/c/Users/adam/Downloads/T298871.patch
git add ./*
git commit --author="Lucas Werkmeister <lucas.werkmeister@wikimedia.de>" -m "Fix result view explore button creation" -m "Bug: T298871
Bug: T301064"
Addshore updated the task description. (Show Details)Feb 10 2022, 8:34 AM
Addshore added a subscriber: Mohammed_Sadat_WMDE.
Addshore updated the task description. (Show Details)Feb 10 2022, 8:43 AM
Addshore updated the task description. (Show Details)Feb 10 2022, 9:00 AM
Addshore updated the task description. (Show Details)Feb 10 2022, 9:02 AM

Waiting to coordinate with Team A on pushing the query service UI patches to wdqs-ui in production now.
Then the ball will continue rolling.

Addshore added subscribers: karapayneWMDE, Lucas_Werkmeister_WMDE, Michael, ItamarWMDE.Feb 10 2022, 10:26 AM
Addshore updated the task description. (Show Details)Feb 10 2022, 11:29 AM
Addshore updated the task description. (Show Details)
Addshore updated the task description. (Show Details)Feb 10 2022, 2:30 PM
Addshore updated the task description. (Show Details)Feb 10 2022, 2:53 PM
Addshore updated the task description. (Show Details)Feb 10 2022, 3:01 PM

https://wikibase-product-testing.wmflabs.org/w/index.php?title=Main_Page&diff=113&oldid=85
https://github.com/wmde/wikibase-release-pipeline/runs/5141758887

Addshore updated the task description. (Show Details)Feb 10 2022, 6:07 PM
Addshore updated the task description. (Show Details)Feb 10 2022, 6:09 PM
Addshore updated the task description. (Show Details)Feb 10 2022, 6:14 PM
Addshore updated the task description. (Show Details)Feb 10 2022, 6:48 PM
Addshore updated the task description. (Show Details)Feb 10 2022, 6:51 PM

wmde.5 is published, and everywhere it needs to be

Now just pending communication, then I will open this task & all security tasks connected to this one.

Addshore updated the task description. (Show Details)Feb 10 2022, 6:53 PM
Addshore updated the task description. (Show Details)Feb 10 2022, 7:09 PM
Addshore changed the visibility from "Custom Policy" to "Public (No Login Required)".
Addshore moved this task from Doing to Done on the Wikibase Suite Team (Wikibase Suite Maintenance Releases Feb 2022) board.
Addshore closed subtask T301064: Publish maintenance releases of Wikibase including fixes to XSS vulnerabilities in the Query Service UI as Resolved.
Addshore closed this task as Resolved.Feb 10 2022, 7:12 PM
Addshore closed subtask T297686: Wikidata Query UI lets users build links with arbitrary link text and javascript: URL as Resolved.
Addshore closed subtask T298839: XSS in WDQS query helper as Resolved.
Addshore closed subtask T298871: XSS in WDQS UI result view explore button as Resolved.
Addshore closed subtask T297002: Elasticsearch 6.5.4 docker image contains critical security issues as Resolved.
Addshore closed subtask T301065: Update Elasticsearch plugins in Wikibase container image releases as Resolved.
Addshore mentioned this in T301663: Prepare wmde.6 (1.35) minor / security release.Feb 14 2022, 11:34 AM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL