Maniphest Advanced Search

Advanced Search
Use Results
Edit Query
Hide Query

Query

Assigned To

	N/A
	Informational
	Low
	Medium
	High
	Critical

Tasks (294)

T329114 Security Issue Access Request for TheresNoTime
Security
Security-Team
Tue, Feb 7, 10:54 PM
T328568 Add eslint-plugin-security as a plugin to eslint-wikimedia-config
JavaScript
Security-Team
Security
SecTeam-Processed
user-sbassett
Tue, Feb 7, 2:08 PM
T328163 Application Security Review Request : VueTest extension (proposed for beta cluster deployment only)
Application Security Reviews
Security
secscrum
Mon, Feb 6, 4:22 PM
T328127 Analyze possible bot traffic for enwiki article Index (statistics), Index & XXX:_Return_of_Xander_Cage
Wikipedia-iOS-App-Backlog
Security
Pageviews-Anomaly
Vuln-Infoleak
Data-Engineering-Planning
Data Pipelines
SecTeam-Processed
Wikipedia-Android-App-Backlog (Android Release FY2022-23)
iOS Release FY2022-23
Product-Analytics (Kanban)
Tue, Feb 7, 6:03 PM
Assigned: SNowick_WMF
T327807 Application Security Review Request : Vector 2022
Application Security Reviews
Security
secscrum
Readers-Web-Backlog
Thu, Jan 26, 5:56 PM
T327588 Consider adding more CSP directives to MediaWIki core
Feature
·
ContentSecurityPolicy
Security
MediaWiki-General
Sat, Jan 21, 10:36 PM
T327195 Add foreign-resources.yaml to VisualEditor/VisualEditor
Security
JavaScript
VisualEditor
Tue, Jan 17, 8:04 PM
T326946 CVE-2020-36649: PapaParse copy in VisualEditor
Security
·
Security-Team
Security
VisualEditor
Vuln-VulnComponent
SecTeam-Processed
Editing-team (Kanban Board)
MW-1.40-notes (1.40.0-wmf.21; 2023-01-30)
Mon, Jan 30, 6:11 PM
T326867 CheckUser API can expose suppressed information for log events
BUG REPORT
·
Security
Vuln-Infoleak
SecTeam-Processed
CheckUser
Tue, Feb 7, 10:34 AM
T326866 Special:Investigate can expose suppressed information for log events
BUG REPORT
·
Security
Vuln-Infoleak
Anti-Harassment
SecTeam-Processed
CheckUser
Tue, Feb 7, 10:34 AM
T326865 Special:CheckUser can expose suppressed information for log events
BUG REPORT
·
Security
Vuln-Infoleak
SecTeam-Processed
CheckUser
Tue, Feb 7, 10:34 AM
T325558 Application Security Review Request: Swagger UI
Application Security Reviews
Security
secscrum
Tue, Jan 17, 10:45 AM
Assigned: Mstyles
T325251 complex content in MediaWiki:Vector-intro-page breaks MediaWiki
Security
·
Security
Vector (legacy skin)
SecTeam-Processed
Vuln-DoS
Jan 3 2023, 5:12 PM
Assigned: Reedy
T325235 Support Github login in Gitlab
Wikimedia-GitHub
Security
Release-Engineering-Team
GitLab (Auth & Access)
Thu, Feb 2, 2:43 AM
T325229 add option to set cookies hostOnly property
Feature
·
Security
MediaWiki-General
Dec 16 2022, 6:18 PM
T324989 Application Security Review Request : OurWorldInData
Application Security Reviews
Security
secscrum
Wed, Feb 8, 9:25 AM
Assigned: sbassett
T324710 Application Security Review Request: Device analytics
Application Security Reviews
Security
secscrum
API Platform
Wed, Feb 1, 8:31 PM
Assigned: Mstyles
T324536 Application Security Review Request: RealMe
Application Security Reviews
Security
secscrum
RealMe
Jan 4 2023, 5:27 PM
Assigned: mmartorana
T322958 Investigate in sqlite setting PRAGMA trusted_schema=off in mediawiki core
SQLite
Security
MediaWiki-General
Nov 25 2022, 10:33 AM
T322704 Harden VisualEditor CE/UI against malicious data in DM
VisualEditor
Security
MW-1.40-notes (1.40.0-wmf.14; 2022-12-12)
Wed, Feb 1, 3:13 PM
T321802 action=growthmentordashboardupdatedata ignores blocks
Security
·
Security
GrowthExperiments-MentorDashboard
GrowthExperiments-Mentorship
Growth-Team
SecTeam-Processed
Vuln-MissingAuthz
Nov 16 2022, 2:25 PM
T321458 Allow Javascript files from Wikimedia GitLab to be loaded as scripts in Wikimedia wikis
Feature
·
Security
Security-Team
MediaWiki-extensions-Gadgets
Release-Engineering-Team
GitLab
Wed, Feb 1, 5:46 PM
T318622 Bodh Toolforge OAuth consumer was world-readable
Toolforge
Security
Vuln-Infoleak
Tool-bodh
Dec 15 2022, 11:35 PM
T318345 Disable insecure rsa-ssh public key signature algorithm
Infrastructure-Foundations
Patch-For-Review
Security
cloud-services-team
Wed, Jan 18, 6:37 PM
T317362 Move cloud-wide root keys to the main puppet repo
Cloud-VPS
Security
cloud-services-team
Wed, Jan 18, 6:37 PM
T309997 Implement an outdated modules check for golang
Security-Team
Security Team AppSec
Security
Jun 6 2022, 4:38 PM
Assigned: mmartorana
T309772 npm audit reports several security issues with Service runner
BUG REPORT
·
service-runner
Security
CX-cxserver
Jun 5 2022, 6:09 AM
T309655 Disable php-composer-security-docker emails to security-admin-feed@lists
Security
Security-Team
user-sbassett
Nov 18 2022, 6:30 PM
Assigned: sbassett
T308789 Determine CI best practices for service which connects to MySQL
Security-Team
Security
Security-API-Service
SecTeam-Processed
Release-Engineering-Team
Data-Persistence (work done)
Jul 6 2022, 4:57 PM
T307991 SecurityError: Attempt to use history.replaceState() more than 100 times per 30 seconds
Security
·
Wikimedia-production-error
MediaWiki-Recent-changes
Growth-Team
JavaScript
Vuln-DoS
Security
SecTeam-Processed
Dec 15 2022, 11:35 PM
T307523 Investigate container scanning options within the context of the Gitlab appsec pipeline
Security-Team
Security Team AppSec
Security
GitLab (CI & Job Runners)
SecTeam-Processed
May 9 2022, 4:22 PM
T306211 Echo oneself using API
Feature
·
MediaWiki-Action-API
Growth-Team
Notifications
Security
SecTeam-Processed
Dec 1 2022, 3:23 PM
Assigned: Reedy
T305727 Improve service and extension documentation and related configuration guidelines
Security-Team
Security
SecTeam-Processed
Documentation
Security-API-Service
Patch-For-Review
Jun 9 2022, 9:33 PM
Assigned: Mstyles
T305724 Investigate database data invalidation questions and chunked/timed API to MySQL/MariaDB ETL
Security-Team
Security
SecTeam-Processed
Security-API-Service
Apr 12 2022, 6:49 PM
T305700 Enabling CORS for raw file URLs
Security
SecTeam-Processed
Release-Engineering-Team (Priority Backlog 📥)
Upstream
GitLab (Infrastructure)
Dec 15 2022, 11:35 PM
T305114 Set up MariaDB for Security API
Security-Team
Security
SecTeam-Processed
Security-API-Service
Dec 16 2022, 2:55 PM
T305083 Better support branches and add support for mw core to the phan-taint-check gitlab appsec template
Security-Team
Security Team AppSec
Security
GitLab (CI & Job Runners)
SecTeam-Processed
Apr 4 2022, 3:41 PM
T304985 Throttling mitigations against password sprays attacks
Security
·
Security
MediaWiki-Authentication-and-authorization
SecTeam-Processed
Apr 4 2022, 3:40 PM
T304737 Evaluate and confirm potential licensing issues for gitlab appsec pipeline tools
Security-Team
Security Team AppSec
Security
GitLab (CI & Job Runners)
SecTeam-Processed
Software-Licensing
Release-Engineering-Team (Radar)
user-sbassett
Jul 20 2022, 4:55 PM
Assigned: sbassett
T304231 Take some pointers from GitHub security updates
Security
Horizon
wikitech.wikimedia.org
SRE
GitLab (Administration, Settings & Policy)
Apr 18 2022, 7:02 PM
T303433 Allow Stewards to enable 'emergency CAPTCHAs' for anonymous IP edits
Security
Wikimedia-Site-requests
SRE
Platform Engineering
ConfirmEdit (CAPTCHA extension)
Sustainability (Incident Followup)
SecTeam-Processed
MediaWiki-extensions-CentralAuth
Stewards-and-global-tools
Patch-For-Review
MW-1.39-notes (1.39.0-wmf.25; 2022-08-15)
Oct 19 2022, 1:02 PM
Assigned: Zabe
T302640 Harden Special:Random and API:Random to automatically adjust in certain ways during on-wiki incidents
Security
MediaWiki-Special-pages
MediaWiki-Action-API
SecTeam-Processed
Mar 8 2022, 6:24 PM
T302472 Application Security Review Request : Abstract Wikipedia function-schemata
Application Security Reviews
Security
secscrum
user-sbassett
Nov 21 2022, 9:09 PM
Assigned: sbassett
T302159 Security Issue Access Request for MarkAHershberger and Mglaser
Security
Security-Team
SecTeam-Processed
Jun 9 2022, 4:27 PM
T299855 XTools ArticleInfo gadget should not execute WMCS HTML
Security
·
Security
XTools
SecTeam-Processed
Jan 24 2022, 10:35 PM
T299629 Test disabling the captcha on some Wikimedia wikis
Wikimedia-Site-requests
Accessibility
Security
Security-Team
SecTeam-Processed
May 4 2022, 12:46 PM
T299193 MediaWiki login failure due to race condition with session cookie
BUG REPORT
·
MediaWiki-Authentication-and-authorization
Security
Security-Team
SecTeam-Processed
Platform Engineering
MW-1.39-notes (1.39.0-wmf.12; 2022-05-16)
Patch-Needs-Improvement
Growth-Team
Oct 17 2022, 7:57 AM
T297846 Add support for package versioning
MediaWiki-General
MediaWiki-Debian
Security
Dec 22 2021, 8:30 PM
T297791 Authentication and Authorization Experiment
Security
·
Security-Team
Security
Foundational Technology Requests
SecTeam-Processed
Authentication-Experiments-2022
Tue, Jan 24, 2:36 PM
Assigned: DAbad
T295508 Research best ways to pass certain credentials to external services within application security-related ci templates
Security-Team
Security Team AppSec
Security
GitLab (CI & Job Runners)
SecTeam-Processed
Mar 25 2022, 8:22 PM
T294782 Build data feed consumption tool
Security-Team
Security
Security-API-Service
May 31 2022, 7:28 PM
Assigned: STran
T294399 Path Traversal Vulnerabilities in Vite
Application Security Reviews
Security
Oct 27 2021, 7:31 PM
T294397 Drop writeapi MediaWiki right
MediaWiki-Action-API
MediaWiki-REST-API
MediaWiki-User-management
Security
Dec 15 2022, 11:35 PM
T294396 XSS vulnerabilities in the Vite server package
Application Security Reviews
Security
Oct 27 2021, 7:30 PM
T294151 Reports that the ua-parser-js npm package has been "hijacked" into a coinminer (indirect dependency of Wikibase)
Security
·
Security
Wikidata-Bridge
Wikidata
wdwb-tech
SecTeam-Processed
Feb 16 2022, 5:35 PM
T293419 Prepare service for beta cluster deployment
Security-Team
Security
SecTeam-Processed
Security-API-Service
May 31 2022, 7:17 PM
T293138 Create Risk Rating Calculator for Security Reviews / Gitlab AppSec CI
Security-Team
Security Team AppSec
Security
Security Risk Management
SecTeam-Processed
Mar 25 2022, 8:23 PM
T292971 Create a service to crawl external links and test them against known bad sites list
Feature
·
Security
Technical-Tool-Request
Oct 11 2021, 8:47 PM
T290917 New Service Request Security API Gateway
Security-Team
Security
user-sbassett
Security-API-Service
Dec 14 2022, 11:58 AM
T290493 Cross Origin Resource Sharing Misconfiguration | Lead to sensitive information. in "diff.wikimedia.org"
Security
·
Security
SecTeam-Processed
Diff-blog
Privacy
Privacy Engineering
Feb 16 2022, 5:36 PM
Assigned: JFishback_WMF
T290099 Create a "delete me" maintenance script for special user/data deletion requests
Security
Privacy
Privacy Engineering
Security-Team
MW-1.38-notes (1.38.0-wmf.2; 2021-09-28)
affects-Miraheze
Aug 15 2022, 1:19 PM
T290065 Look at pam-duress authentication module
Security
Infrastructure-Foundations
User-jbond
Sep 1 2021, 12:55 PM
Assigned: jbond
T289373 Create maintenance script to add/remove global blocks
Security
·
Security
GlobalBlocking
SecTeam-Processed
Patch-For-Review
User-Tks4Fish
Feb 2 2022, 7:56 PM
Assigned: Tks4Fish
T289290 Design and Build Application Security Pipeline Components for Gitlab
Security-Team
Security Team AppSec
Security
GitLab (CI & Job Runners)
Sep 19 2022, 6:52 PM
Assigned: sbassett
T288975 Cookbook to reboot cassandra nodes
Security
SRE
User-razzi
Cassandra
Dec 14 2022, 3:26 PM
T288401 Document foreign-resources.yaml on mediawiki.org
Security
JavaScript
Documentation
MediaWiki-extensions-General
May 13 2022, 11:40 AM
T288201 Re-enable var() in inline CSS
Feature
·
MediaWiki-Parser
Security
Platform Engineering
MW-1.39-notes (1.39.0-wmf.27; 2022-08-29)
Aug 24 2022, 8:30 AM
T286958 Document long-term requirements for GitLab job runners
User-brennen
Release-Engineering-Team (Seen)
GitLab (CI & Job Runners)
Security
SecTeam-Processed
Nov 10 2021, 3:35 PM
T286416 21 public Python tool configuration files
Security
·
Security
Toolforge
Vuln-Infoleak
SecTeam-Processed
cloud-services-team
Wed, Jan 18, 6:40 PM
T285329 Anyone can display whatever title they want using TemplateStyles
Security
·
MediaWiki-Parser
TemplateStyles
Security
SecTeam-Processed
Dec 15 2022, 11:35 PM
T285154 Make it possible to temporarily view the typed masked password
Security
MediaWiki-User-login-and-signup
Accessibility
Dec 15 2022, 11:35 PM
T285153 Verify we allow any printable Unicode character in a password
Security
MediaWiki-User-login-and-signup
MediaWiki-Authentication-and-authorization
Dec 15 2022, 11:35 PM
T285152 Set password max length at 128 characters
Security
MediaWiki-User-login-and-signup
Dec 15 2022, 11:35 PM
T285151 Increase min password length to 12 characters
Security
MediaWiki-User-login-and-signup
WMF-General-or-Unknown
Patch-For-Review
Sun, Jan 22, 9:49 PM
T284873 Regression: CentralAuth Lock+Suppress is issuing local blocks without autoblock
Security
·
Security
MediaWiki-extensions-CentralAuth
Regression
Stewards-and-global-tools
SecTeam-Processed
Platform Team Workboards (MW Expedition)
Patch-For-Review
MW-1.39-notes (1.39.0-wmf.21; 2022-07-18)
Aug 30 2022, 11:54 PM
Assigned: Zabe
T284274 action=history with a high limit like >= 2000, can be slow and might timeout
Security
·
Security
MediaWiki-Page-history
Vuln-DoS
Platform Team Workboards (Clinic Duty Team)
Performance-Team-publish
Performance-Team (Radar)
Oct 3 2022, 8:47 PM
T283456 OAuth identfy endpoint should not expose unconfirmed email address
MediaWiki-extensions-OAuth
Security
Patch-For-Review
Jul 19 2022, 12:17 AM
T279683 Investigate iptables replacements
SRE
Security
User-MoritzMuehlenhoff
Apr 29 2021, 2:50 PM
T276761 Special:NovaKey should have a message not to add production keys
MediaWiki-extensions-OpenStackManager
Striker
Security
Mar 8 2021, 4:55 PM
T275660 Proliferate foreign-resources.yaml in mediawiki extensions and skins
Security
JavaScript
MediaWiki-extensions-General
Dec 15 2022, 11:36 PM
T275238 Disallow accessing multi-dimensional arrays through WebRequest::getArray()
MediaWiki-General
Security
Oct 21 2022, 2:23 PM
T271132 Ensure that all deployed nodejs services have regular dependency security scanning
serviceops
Security
LibUp
Nov 15 2022, 9:06 AM
T270286 Do a security review of the Widgets extension
MediaWiki-extensions-Widgets
Security
Jan 17 2021, 8:57 PM
T269528 Write documentation on how to "reset" a BotPassword
MediaWiki-Authentication-and-authorization
MediaWiki-User-management
MediaWiki-Documentation
Documentation
Security
Dec 11 2020, 12:39 AM
T268344 Implement SSH CA (certificate authority) for host keys?
Security
User-MoritzMuehlenhoff
cloud-services-team
Infrastructure-Foundations
Tue, Jan 24, 10:01 AM
T265590 ulog: filter out diffscan from ulog
User-jbond
SRE
Security
Observability-Logging
Aug 18 2021, 2:32 PM
Assigned: jbond
T265218 OAuth 2.0 Security Best Practices
MediaWiki-extensions-OAuth
Documentation
Security
API-Portal
Oct 11 2022, 8:13 PM
T264888 Review default ferm INPUT policy
User-jbond
netops
SRE
Security
Patch-For-Review
Infrastructure-Foundations
Tue, Feb 7, 10:19 PM
T264196 CSP blocking favicon.ico
ContentSecurityPolicy
Security
WMF-General-or-Unknown
Sep 30 2020, 2:32 PM
T263927 MediaWiki user and password fields should have the proper autocomplete value
MediaWiki-User-login-and-signup
Security
Platform Team Workboards (External Code Reviews)
MW-1.36-notes (1.36.0-wmf.20; 2020-12-01)
Patch-For-Review
MW-1.35-notes
Aug 14 2022, 3:00 PM
T263711 Upgrade Mustache version from 3.0.1 to 4.01
Security
MediaWiki-HTML-Templating
Mar 16 2021, 4:34 PM
T263220 Limit concurrency of DPL queries
DynamicPageList (Wikimedia)
Patch-For-Review
Performance Issue
MW-1.36-notes (1.36.0-wmf.18; 2020-11-17)
Platform Team Workboards (Clinic Duty Team)
Sustainability (Incident Followup)
Vuln-DoS
Security
SecTeam-Processed
Wikimedia-Slow-DB-Query
serviceops-radar
Dec 15 2022, 10:03 AM
T261225 Set strict CSP rule on Kibana logstash.wikimedia.org
Wikimedia-Logstash
Security
observability
Observability-Logging
Sep 21 2022, 10:57 AM
T261050 Frequent "Invalid CSRF token" errors on Wikimedia projects using Pywikibot since August 2020
Security
Pywikibot
MediaWiki-Action-API
Platform Engineering
Jul 22 2022, 6:09 AM
T260201 Parsoid REST API may not check access permissions of user
Security
Security-Team
MW-1.36-notes (1.36.0-wmf.5; 2020-08-18)
Parsoid (Tracking)
Jun 12 2021, 11:50 AM
T260080 $wgObjectCacheSessionExpiry is too short
MediaWiki-Authentication-and-authorization
Security
Aug 10 2020, 10:08 PM
T260016 Request Security check of allowing editing from mirror/fork site
Chinese-Sites
Security
Privacy Engineering
Dec 12 2020, 12:16 PM
T259210 LilyPond safe mode escape due to output-def-lookup and output-def-scope (CVE-2020-17354)
Security
·
Security-Team
Security
MediaWiki-extensions-Score
Sat, Jan 21, 11:06 AM
T258322 Open redirect in wikis that use http://domain.tld/index.php format
Security
·
Security
MediaWiki-General
Platform Engineering
Vuln-OpenRedirect
SecTeam-Processed
Aug 4 2021, 6:39 PM
T257988 Optional use of https://github.com/Khan/pygments-server
SyntaxHighlight
Security
Nov 29 2022, 1:07 PM
T257100 Set up automated/regular end-to-end testing of potential and past security issues
Security
·
Security
Technical-Tool-Request
Aug 16 2022, 7:28 PM
T257070 Standardise setup of Loggers
Security
·
Security
MediaWiki-Debug-Logger
Sep 16 2021, 2:02 PM
T256535 Same-Origin policy prevents reading HTML pages cross-origin
MediaWiki-General
Patch-For-Review
Security
Platform Team Workboards (External Code Reviews)
Aug 11 2020, 3:02 PM
T255881 Enable wgBreakFrames across all projects
user-sbassett
Security-Team
Security
Wikimedia-Site-requests
Aug 22 2022, 4:44 PM
T255370 Document best practices for user login if user is using 2FA
Security
MediaWiki-Authentication-and-authorization
Documentation
MediaWiki-Documentation
Platform Team Initiatives (API Gateway)
MediaWiki-extensions-OATHAuth
Feb 17 2022, 3:34 PM
T255208 Catalog and evaluate methods of analysis for Wikimedia captcha performance
Security
Security-Team
ConfirmEdit (CAPTCHA extension)
user-sbassett
observability
Aug 22 2022, 4:45 PM
T254477 Ferm sometimes (rarely) fails to reload
SRE
User-MoritzMuehlenhoff
Security
User-jbond
Jun 1 2021, 2:41 PM
T250131 Allow the owner to lock its former account if it has been compromised
Security
MediaWiki-extensions-CentralAuth
Trust-and-Safety
Dec 7 2021, 11:22 PM
T249513 CSP report-uri is deprecated
MediaWiki-General
NewFunctionality-Worktype
Front-end-Standards-Group
ContentSecurityPolicy
Security
Technical-Debt
Nov 3 2021, 7:01 PM
T249011 If a PNG is embedded in an SVG file, show a more specific warning than "dangerous href link" when trying to upload
Commons
MediaWiki-Uploading
Security
Voice & Tone
May 13 2022, 3:16 PM
T247490 HTTP MediaWiki API GET requests to Wikimedia wikis should not be redirected to HTTPS when they have a session cookie or Authorization header
Security
SRE
Traffic-Icebox
Sep 1 2021, 11:21 PM
T245873 Blacklist overwriting Special: namespace
BUG REPORT
·
MediaWiki-Special-pages
Security
affects-Miraheze
Dec 15 2022, 11:36 PM
T245110 Should per user `Echo-whitelist` pages be protected?
Security
·
User-DannyS712
Security
Notifications
MediaWiki-User-management
Growth-Team
Growth-Team-Filtering
Nov 3 2021, 7:01 PM
T244788 Zotero puts raw JS/CSS code in reference template parameters / both citoid and zotero should validate fields to make sure this doesn't occur
Citoid
Security
Upstream
Feb 20 2020, 8:05 PM
T244691 WikiVoyage nearby articles map layer loads a JS file from toolforge
Privacy
Privacy Engineering
Security
Maps (Kartographer)
SecTeam-Processed
Apr 14 2022, 9:41 AM
T242821 Separate access to tools and test features from ability to view private filters
Security
·
User-DannyS712
MediaWiki-User-management
Security
AbuseFilter (Overhaul-2020)
MW-1.36-notes (1.36.0-wmf.32; 2021-02-23)
SecTeam-Processed
Oct 6 2021, 10:49 AM
T242661 Use __Host- prefixed cookies for MediaWiki session cookies
MediaWiki-Authentication-and-authorization
Security
Nov 3 2021, 7:20 PM
T242089 Consider keeping user entered URL and removing tracking parameters
Citoid
Privacy Engineering
Security
Jan 14 2021, 7:19 PM
T242058 Add some form of static analysis for package-lock.json
Continuous-Integration-Config
Security-Team
Security
Jul 6 2022, 5:32 PM
T241921 Fix Wikimedia captchas
Epic
Accessibility
UX-Debt
ConfirmEdit (CAPTCHA extension)
Stewards-and-global-tools
Security-Team
Security
Sun, Jan 29, 9:41 PM
T241039 Create an API for sending yourself an arbitrary HTML email
MediaWiki-Action-API
MediaWiki-Email
Security
Oct 15 2022, 5:50 PM
T240245 Create an SOP for handling of Cloud/Toolforge open vulnerability issues
Toolforge
Cloud-VPS
Security-Team
Security
Documentation
cloud-services-team
Wed, Jan 18, 6:40 PM
T239355 Deprecate phabricator's fixed_settings.yaml (in puppet) and just use phabricator's built in configuration tools
Phabricator
User-MModell
Security
Release-Engineering-Team (Seen)
Apr 28 2021, 5:34 PM
T236701 Consider enforcing read permissions at the storage layer
MediaWiki-User-management
Platform Team Workboards (MW Expedition)
Security
Sep 19 2021, 8:22 AM
T234987 Increase pbkdf2 parameter strengths (2019)
MediaWiki-Authentication-and-authorization
Wikimedia-Site-requests
Security
Oct 18 2022, 4:00 AM
T230075 Setting up static maintenance page on Foundation servers for Foundation website
SRE
wikimediafoundation.org
Security
Traffic-Icebox
Sep 1 2021, 11:21 PM
T224934 CentralNotice alerts: Include user info and other event data in alert
Fundraising-Backlog
MediaWiki-extensions-CentralNotice
Security
Jul 2 2021, 5:15 AM
T224931 CentralNotice alerts: Specific alerts config for production monitoring
Fundraising-Backlog
MediaWiki-extensions-CentralNotice
FR-Q2-FY2019-20-cleanup-list
Security
Jul 2 2021, 5:15 AM
T224927 CentralNotice alerts: Investigate productionization and e-mail alerts
Fundraising-Backlog
MediaWiki-extensions-CentralNotice
Security
Jul 2 2021, 5:15 AM
T224926 CentralNotice alerts: Hide verbose output from pywikibot unless --debug flag used
Fundraising-Backlog
MediaWiki-extensions-CentralNotice
Security
Jul 2 2021, 5:16 AM
T224925 CentralNotice alerts: Implement alerts based on campaign and user
Fundraising-Backlog
MediaWiki-extensions-CentralNotice
Security
Jul 2 2021, 5:16 AM
T224897 Popular OAuth consumers should have IP restrictions
MediaWiki-extensions-OAuth
Security
Feb 20 2020, 8:06 PM
T224887 apache modsec rules deployment with scap
SRE
Security
Nov 3 2021, 7:08 PM
T224699 CentralNotice alerts: Add error handling
Fundraising-Backlog
MediaWiki-extensions-CentralNotice
Security
Jul 2 2021, 5:16 AM
T224059 Should https://meta.wikimedia.org/wiki/Special:Contact/Stewards require a login
Stewards-and-global-tools
MediaWiki-extensions-ContactPage
Security
Dec 21 2022, 10:58 PM
T223831 Wikidata Recoin statement publishing button disappears after subject has been selected
Wikidata
Wikidata.org
Security
Feb 20 2020, 8:06 PM
T220703 Increase the max length of URL to be shortened
MediaWiki-extensions-UrlShortener
Wikimedia-Site-requests
Security
Patch-For-Review
Wikidata
wdwb-tech
Nov 16 2021, 8:39 PM
T220481 Reenable l10update in production
MediaWiki-extensions-LocalisationUpdate
Security
Release-Engineering-Team (Radar)
May 18 2022, 1:35 PM
T218926 MediaWiki-Vagrant complains about insecure NIC setting
MediaWiki-Vagrant
Security
Feb 20 2020, 8:06 PM
T218608 OAuth doesn't work when $wgBlockDisablesLogin is true
MediaWiki-extensions-OAuth
MediaWiki-Authentication-and-authorization
Security
cloud-services-team
Wed, Jan 18, 6:40 PM
T218449 Determine new password requirements for MediaWiki core
MediaWiki-User-login-and-signup
MediaWiki-Authentication-and-authorization
Security
Feb 20 2020, 8:06 PM
T217351 Require original source file(s) to be committed with minified files
Security-Team
JavaScript
Security
Documentation
Sep 2 2021, 4:53 PM
T216682 Switch WMF production to Argon2 password hashes
MediaWiki-User-login-and-signup
Security
Oct 17 2022, 8:34 AM
T216653 Use data attributes instead of unsafe-inline var definitions within Quarry template files
Quarry
Security
Feb 20 2020, 8:08 PM
T214741 MediaWiki pages used in interface can be translated by non-admins
MediaWiki-extensions-Translate
Wikidata
Security
Aug 5 2022, 4:50 PM
T214636 Session cookie should have Secure and Domain flags
Quarry
Security
Feb 20 2020, 8:08 PM
T214445 Support Sodium in MediaWiki session encryption
MediaWiki-Authentication-and-authorization
Security
Oct 16 2020, 5:02 PM
T214375 Update installer to check for an AES library
MediaWiki-Authentication-and-authorization
MediaWiki-Installer
Security
Dec 28 2022, 2:21 PM
T213010 Moves circumvent the requirement to have createpagemainns
MediaWiki-extensions-ArticleCreationWorkflow
Security
Feb 20 2020, 8:06 PM
T210909 Introduce secure mode to MediaWiki
MediaWiki-Authentication-and-authorization
Security
Jul 14 2022, 7:01 PM
T210833 Filter potentially harmful PostScript commands in Commons upload/thumbor
SRE
serviceops
Security
Thumbor
Nov 8 2022, 11:19 AM
T209586 Make the stored session id be a hash of the used session id to isolate them
MediaWiki-Authentication-and-authorization
Security
Nov 3 2021, 7:12 PM
T209579 MediaWiki should log user out of all sessions when going to Special:Userlogout
MediaWiki-Authentication-and-authorization
Security
Sep 27 2022, 9:41 AM
T209556 In AuthManager, avoid encrypted storage of the password in the session
MediaWiki-Authentication-and-authorization
Security
Nov 3 2021, 7:12 PM
T208823 Support asynchronous reauthentication
MediaWiki-Authentication-and-authorization
User-Tgr
Security
Sep 26 2022, 5:51 PM
T208668 Do not ask for password on reauthentication when 2FA is enabled
MediaWiki-Authentication-and-authorization
MediaWiki-extensions-OATHAuth
Security
Oct 16 2020, 5:02 PM
T208667 Tie reauthentication (login with elevated security) to a specific security level
MediaWiki-Authentication-and-authorization
Patch-For-Review
Security
Feb 20 2020, 8:06 PM
T208528 Create fab task to deploy jenkins job to either ci-jenkins or releases-jenkins
MediaWiki-Releasing
Security
Release-Engineering-Team (Seen)
Apr 20 2021, 3:23 PM
T208527 Create jenkins job to build MediaWiki tarball releases
MediaWiki-Releasing
Security
Release-Engineering-Team (Seen)
Jun 10 2021, 8:45 AM
T208477 Move "privileged account' concept into MediaWiki core
MediaWiki-Authentication-and-authorization
MediaWiki-Debug-Logger
Patch-For-Review
Security-Team
Security
Jun 28 2021, 1:33 PM
T208329 Gadget with SPARQL services collides with Content Security Policy?
Security-Team
Wikidata
Security
May 17 2021, 4:18 PM
T208188 RFC: Partial opt-out method for Content security policy
Security-Team
TechCom
TechCom-RFC
ContentSecurityPolicy
Platform Team Workboards (Clinic Duty Team)
Security
Privacy Engineering
Dec 23 2022, 12:30 AM
T208008 Consumer owner-only oauth proposals should require reauth
Security
·
MediaWiki-extensions-OAuth
Patch-For-Review
Security
Sustainability (Incident Followup)
Oct 13 2021, 8:01 PM
T207739 Access requests process: Consideration of 'indirect' sudo rules via e.g. keyholder
SRE
Security
Feb 20 2020, 8:06 PM
T206970 Investigate using simple grep to check js for raw html messages
Security-Team
Security
Feb 20 2020, 8:08 PM
T204615 Generate new Captcha word list for prod
ConfirmEdit (CAPTCHA extension)
WMF-General-or-Unknown
Security
Oct 16 2020, 5:02 PM
T204279 Fine-grained Sanitizer control
Parsoid
Security
Mar 16 2021, 7:33 PM
T203912 HotCat loads code that can be edited without editsitejs right
JavaScript
WMF-General-or-Unknown
Security
Nov 3 2021, 7:12 PM
T203210 Extension:RSS shouldn't invent its own way to escape and parse things
MediaWiki-extensions-RSS
Technical-Debt
Security
Apr 27 2022, 5:57 PM
T202900 Content model based permission checks do not use the actual content model on undelete/import
MediaWiki-Core-Snapshots
MediaWiki-Page-deletion
Security
Sep 8 2020, 10:54 AM
T202028 CentralAuth fails when using "site isolation" in Google Chrome and Chromium or "first-party isolation" in Firefox
MediaWiki-extensions-CentralAuth
Browser-Support-Google-Chrome
Browser-Support-Firefox
Security
Jan 5 2023, 12:48 AM
T201784 Implement option "require two-factor authentication only for dangerous actions"
MediaWiki-Authentication-and-authorization
MediaWiki-extensions-OATHAuth
Security
Mar 3 2022, 5:50 AM
T201779 Have a check to prevent non-existent accounts from being added to LDAP groups
SRE
LDAP
Security
User-MoritzMuehlenhoff
Infrastructure-Foundations
Jan 5 2023, 11:56 AM
T201166 Warn when using local consumers
MediaWiki-extensions-OAuth
Security
Feb 20 2020, 8:07 PM
T201052 Local interface-admin need to be sysop for some operations
Trust-and-Safety
MediaWiki-General
Security
Oct 8 2021, 5:13 PM
T200997 Add raw HTML messages in WMF-deployed extensions to $wgRawHtmlMessages
MediaWiki-Internationalization
I18n
MW-1.32-notes (WMF-deploy-2018-10-16 (1.32.0-wmf.26))
Security
Jun 7 2021, 2:41 PM
T200766 Public monitoring of JS/CSS edits
Security
MediaWiki-General
MediaWiki-extension-requests
Oct 23 2022, 1:50 AM
T199055 &banner causes CSP warning
MediaWiki-extensions-CentralNotice
User-revi
Fundraising-Backlog
Security
Fundraising Tech - Chaos Crew
Patch-For-Review
Jan 2 2023, 6:21 PM
Assigned: AndyRussG
T199020 installer by default does not create a new mysql user. should default to the more secure approach
MediaWiki-Installer
Security
Feb 20 2020, 8:08 PM
T198813 Integrate MFA into Gerrit
Gerrit
Upstream
Security
Release-Engineering-Team (Seen)
Apr 20 2021, 3:23 PM
T198138 Disable agent forwarding for Cloud VPS
Security
Cloud-VPS
Patch-For-Review
Jan 5 2023, 2:03 PM
T197577 Increase password policies for the 'steward' group
Vuln-Authn/Session
Stewards-and-global-tools
Wikimedia-Site-requests
Trust-and-Safety
Security
Feb 27 2021, 2:21 PM
T197544 Make it possible to prefill Special:BotPasswords form
MediaWiki-Authentication-and-authorization
Huggle
Security
Feb 20 2020, 8:08 PM
T197160 All security-sensitive MediaWiki functionality should require elevated security
MediaWiki-Authentication-and-authorization
Epic
User-Tgr
Security
May 10 2022, 6:58 AM
T197158 CheckUser should require elevated security
Stewards-and-global-tools
CheckUser
Security
Jan 6 2023, 11:38 PM
T197153 Make some providers optional for reauthentication
MediaWiki-Authentication-and-authorization
Patch-For-Review
User-Tgr
Security
Feb 20 2020, 8:07 PM
T197150 User right changes should require elevated security
Feature
·
Stewards-and-global-tools
MediaWiki-extensions-CentralAuth
MediaWiki-User-management
Security
Nov 21 2022, 2:52 PM
T197137 Editing sitewide JS/CSS pages should require elevated security
MediaWiki-Interface
MediaWiki-User-management
Security
Dec 10 2021, 10:38 AM
T197136 Tie certain user rights to elevated security
MediaWiki-User-management
Security
Jul 9 2020, 9:28 PM
T197130 Document MediaWiki elevated security feature
Documentation
MediaWiki-General
Security
Feb 20 2020, 8:07 PM
T197087 Remove or limit edituserjs and similar rights from users with "higher" access than the editor
MediaWiki-Interface
Security
Feb 20 2020, 8:07 PM
T196892 Raw HTML in page descriptions
Mobile-Content-Service
MediaWiki-extensions-WikibaseClient
Wikidata
Product-Infrastructure-Team-Backlog-Deprecated
Security
Nov 3 2021, 7:22 PM
T196602 Streamline MW security release process
MediaWiki-Releasing
Security-Team
Security
Feb 20 2020, 8:07 PM
T194606 It should be able to add a parameter to skip the form edit page and directly save the target text
MediaWiki-extensions-InputBox
Security
Dec 21 2021, 10:20 AM
T194398 Require elevated session security for giving elevated permissions
MediaWiki-extensions-OAuth
Security
Nov 3 2021, 7:10 PM
T193552 Make installer grant only needed rights to db user
MediaWiki-Installer
Security
Feb 20 2020, 8:08 PM
T192207 Security related Static Analysis
MediaWiki-Codesniffer
Security-Team
Security
Jul 16 2020, 10:18 PM
T189641 Service for checking the Pwned Passwords database
MediaWiki-Authentication-and-authorization
MediaWiki-User-login-and-signup
WMF-Legal
User-Tgr
Services (watching)
Platform Team Legacy (Watching / External)
Security
SecTeam-Processed
Nov 21 2021, 1:57 AM
T189531 All Wikimedia developer services should use single sign-on
Epic
WMF-General-or-Unknown
Wikimedia-Hackathon-2018
User-Tgr
Security
CAS-SSO
Infrastructure-Foundations
Apr 20 2022, 10:51 AM
T187749 Make it possible to use code from an external repository for editor-controlled Javascript/CSS
MediaWiki-extensions-Gadgets
JavaScript
User-Tgr
MediaWiki-extension-requests
Wikimedia-Hackathon-2018
Wikimedia-Hackathon-2019
Security-Team
Security
Patch-Needs-Improvement
Dec 5 2022, 11:50 AM
T187669 Static PCRE ReDoS validator
MediaWiki-General
Security
Jul 1 2020, 8:50 AM
T184432 Add .mw-numlink class to numlinks at Special:Whatlinkshere
MediaWiki-Special-pages
Security
Aug 4 2022, 8:35 PM
T184208 Security checkup/reminder for verifying email and authentication details
Notifications
MediaWiki-Authentication-and-authorization
Growth-Team
Security-Team
Security
Growth-Team-Filtering
May 25 2021, 9:09 PM
T183420 Authentication data should not be available through the normal DB abstraction layer
MediaWiki-Authentication-and-authorization
Security
Oct 16 2020, 5:02 PM
T182536 Fix security issues found in Graphs extension during review of vega 2
MediaWiki-extensions-Graph
Security
MW-1.38-notes (1.38.0-wmf.19; 2022-01-24)
Oct 29 2022, 11:30 PM
T182535 Investigate maybe setting X-XSS-Protection header
WMF-General-or-Unknown
Security
Feb 20 2020, 8:07 PM
T182213 [Clonable] replace wfMessage()->rawParams() with wfMessage()->plaintextParams() where applicable
good first task
Google-Code-in-2017
MediaWiki-extensions-General
MediaWiki-General
Google-Code-in-2018
Google-Code-in-2019
Security
Feb 20 2020, 8:08 PM
T182198 Retrieve showing a "skin" property in "user_properties" table on DB replicas
Data-Services
Security-Team
Security
Apr 11 2020, 5:36 AM
T181690 Track external JS libraries in MediaWiki in a way that allows vulnerability detection
JavaScript
MediaWiki-General
Security
Feb 20 2020, 8:07 PM
T181317 Streamline process for uploading private files to public tasks
Phabricator
Security
Jun 3 2022, 2:01 AM
T181034 Require email address to register on Beta Cluster
Beta-Cluster-Infrastructure
Privacy
WMF-Legal
Security
Privacy Engineering
Sep 17 2020, 4:38 AM
T181019 Consider using a single MediaWiki releases key instead of individual keys
MediaWiki-Releasing
Security
May 22 2020, 8:16 PM
T180896 Allow functionaries to reset second factor on low-risk accounts
MW-1.34-notes (1.34.0-wmf.1; 2019-04-16)
WMF-Legal
Trust-and-Safety
MediaWiki-extensions-OATHAuth
Security
Security-Team
SecTeam-Processed
Oct 7 2022, 3:48 AM
T180886 AuthManager special pages should honor $wgSecureLogin
MediaWiki-Authentication-and-authorization
Security
Feb 20 2020, 8:07 PM
T180278 Expand our usage of FriendsOfPHP/security-advisories
Continuous-Integration-Config
Librarization
Composer
Security-Team
Security
Jun 1 2022, 8:32 AM
T178010 missing character equivalencies: ÈÉÊẼÌÍÏÓÒÔÕ∅Q̃ÚŰÜŨ
AntiSpoof
Equivset
Security
Patch-For-Review
Jul 29 2022, 3:06 AM
T177895 Allow logged in users to disable MediaWiki:Common.js and MediaWiki:Common.css
MediaWiki-Core-Preferences
Security
May 4 2022, 1:39 PM
T176995 Monitor any sql syntax error issues, and send email alerting if they happen
User-chasemp
Security
Observability-Alerting
Aug 10 2021, 3:18 PM
T176533 Re-enable stacktraces on Wikimedia wikis ($wgShowExceptionDetails = true);
Wikimedia-Site-requests
Security
Security-Team
Jun 28 2022, 9:49 AM
T172584 Securing external binaries run by MediaWiki
WMF-General-or-Unknown
SRE
MediaWiki-Shell
Security
Sustainability (Incident Followup)
Jan 6 2023, 12:08 PM
T171563 Only allow MediaWiki, Gadget, and User namespace pages to be treated as JS or CSS (no project namespace, etc.)
JavaScript
MediaWiki-Page-protection
Security
Oct 21 2022, 4:28 PM
T169328 Protect against PHP code execution via memcached/unserialize
Patch-For-Review
Security
MediaWiki-libs-ObjectCache
Platform Team Workboards (Clinic Duty Team)
MW-1.37-notes (1.37.0-wmf.3; 2021-04-27)
Performance-Team (Radar)
Jan 26 2022, 11:48 PM
Assigned: daniel
T169027 Provide iframe sandboxing for rich-media extensions (defense in depth)
Multimedia
Commons
MediaWiki-File-management
Technical-Debt
Security
Feb 20 2020, 8:07 PM
T166622 Allow all users on all wikis to use OATHAuth
Wikimedia-Site-requests
MediaWiki-extensions-OATHAuth
Trust-and-Safety
Security-Team
Security
Goal
Mon, Jan 30, 6:52 PM
T165981 Implement a prototype JavaScript review system for MediaWiki
Wikimedia-Hackathon-2017
JavaScript
MediaWiki-extension-requests
Developer-Advocacy
Security
Jun 11 2021, 12:00 AM
T164189 Add a show password button
MediaWiki-User-login-and-signup
Design
Accessibility
Security
Wikimedia Design Style Guide
Aug 1 2021, 9:41 AM
T163583 <video>/<source>/<track> sanitization for media
Patch-For-Review
TimedMediaHandler
MediaWiki-Parser
MW-1.30-release-notes (WMF-deploy-2017-05-23_(1.30.0-wmf.2))
Security
Feb 18 2022, 6:34 PM
T160529 Sender email spoofing
Wikimedia-Mailing-lists
Mail
SRE
Security
Infrastructure-Foundations
Dec 6 2021, 6:07 PM
T160387 Support Strict Secure Cookies
MediaWiki-Authentication-and-authorization
Security
Feb 20 2020, 8:07 PM
T159889 Per-consumer XFF trust settings
MediaWiki-extensions-OAuth
Security
Apr 22 2020, 10:31 AM
T159611 thumb.php should use the ImgAuthBeforeStream hook
Commons
MediaWiki-File-management
Multimedia
Security
Feb 20 2020, 8:07 PM
T158989 Add img_sha256, related columns with SHA-256 hash of file
Technical-Debt
Multimedia
Commons
MediaWiki-File-management
Schema-change
Security
Jul 23 2022, 12:34 PM
T158988 Migrate filearchive's fa_storage_key from SHA-1 to SHA-256
Technical-Debt
Multimedia
Commons
MediaWiki-Uploading
MediaWiki-Page-deletion
MediaWiki-File-management
Schema-change
Security
Jul 23 2022, 12:35 PM
T158986 Migrate SHA-1 hashes to SHA-256 (tracking)
MediaWiki-General
Technical-Debt
Security
Jul 23 2022, 12:34 PM
T156445 Streamline/automate MW tarball security release process
MediaWiki-Releasing
Security
Release-Engineering-Team (Seen)
Apr 20 2021, 3:23 PM
T153948 thumbnail script should respect imgAuthBeforeStream
MediaWiki-General
Security
Jun 19 2020, 4:30 PM
T153691 Strengthen two factor authentication by making it concurrent instead of sequential during the authentication process
MediaWiki-extensions-OATHAuth
MediaWiki-Authentication-and-authorization
Security
Feb 20 2020, 8:07 PM
T153454 Enable BotPasswords (or similar feature) for web/interactive access
MediaWiki-Authentication-and-authorization
Security
Jun 6 2020, 9:07 AM
T152972 Accessing private information through SecurePoll should be logged
MediaWiki-extensions-SecurePoll
Stewards-and-global-tools
Security
Platform Engineering (Icebox)
Jul 29 2022, 10:15 PM
T152926 Set channel cmode +S for wikimedia private IRC-Channels
Privacy
Security
wikimedia-irc-libera
Dec 30 2021, 8:33 PM
T151408 Separate bot right for normal pages and interface (MediaWiki:) pages
MediaWiki-General
MediaWiki-Recent-changes
Growth-Team
Security
MediaWiki-User-management
Growth-Team-Filtering
Jul 3 2022, 12:27 AM
T151011 Add password generator to account creation / password change form
MediaWiki-User-login-and-signup
User-Tgr
Security
Feb 20 2020, 8:08 PM
T150903 Alert ops/security on many 2FA failures
MediaWiki-extensions-OATHAuth
Security
Sustainability (Incident Followup)
Mar 1 2022, 8:50 AM
T150902 SMS based 2FA
Feature
·
MediaWiki-extensions-OATHAuth
Security
SecTeam-Processed
Wed, Feb 1, 4:46 PM
T150898 Force OATHAuth (2FA) for certain user groups in Wikimedia production
MediaWiki-User-login-and-signup
Wikimedia-Site-requests
Stewards-and-global-tools
Security
Sustainability (Incident Followup)
Sun, Feb 5, 3:37 PM
T150647 Deploy EncryptedPassword to Wikimedia Sites
Wikimedia-Site-requests
Security-Team
Security
Sustainability (Incident Followup)
Sep 28 2021, 9:28 PM
T150526 BotPasswords: grant all rights
MediaWiki-Authentication-and-authorization
Security
Oct 16 2020, 5:01 PM
T149152 Diffusion 'view raw file' policy and behavior is unclear and inconsistent (PHP files displayed in browser; JS files offer downloading file)
Diffusion
Phabricator
Security
May 6 2022, 2:45 PM
T145915 OATHAuth OTP shouldn't be stored in cleartext in the DB
MediaWiki-extensions-OATHAuth
Security
Sustainability (Incident Followup)
SecTeam-Processed
Patch-For-Review
Jul 5 2022, 5:45 AM
Assigned: Legoktm
T143610 UploadBase::detectScript() is executed for partially uploaded files (verifyPartialFile()), not only complete ones (verifyFile()) which it expects, causing false positives
MediaWiki-Uploading
Multimedia
Security
Feb 20 2020, 8:08 PM
T143015 Consider different "keep me logged in" login lengths for different user groups
MediaWiki-User-login-and-signup
Security
Feb 20 2020, 8:07 PM
T141490 Deploy improved FancyCaptcha
Wikimedia-Site-requests
Security
ConfirmEdit (CAPTCHA extension)
Nov 3 2020, 9:56 AM
T139168 On SVG files' pages, put the bright orange warning telling them it's insecure, like we do for PDFs
Multimedia
Wikimedia-SVG-rendering
Security
May 2 2021, 5:23 PM
T137016 Allow more than 1 password reset per 24 hours
MediaWiki-Authentication-and-authorization
Security
Feb 20 2020, 8:07 PM
T136101 Rethink AuthManager::securitySensitiveOperationStatus
MediaWiki-Authentication-and-authorization
Security
Oct 16 2020, 5:02 PM
T134306 add automatic checks/test for suppressed content as a security measure
MediaWiki-Revision-deletion
MediaWiki-Core-Tests
Security
Feb 20 2020, 8:07 PM
T131723 Provide a mechanism to sanitise user-generated non-STL 3D files to meet security requirements
MediaWiki-File-management
Multimedia
Commons
Epic
3D
Security
Mar 12 2020, 12:35 PM
T131183 Remove $wgApiFrameOptions = 'SAMEORIGIN' override for enwiki (English Wikipedia)
WMF-General-or-Unknown
Security
Jul 19 2022, 4:50 AM
T126066 Edit history is not available to admins
Education-Program-Dashboard
WMF-Legal
Security
Feb 20 2020, 8:07 PM
T125289 Auth tokens should expire
MediaWiki-extensions-CentralAuth
MediaWiki-Authentication-and-authorization
Security
SecTeam-Processed
Feb 22 2021, 7:12 PM
T124445 Design research support for two step authentication
MediaWiki-extensions-OATHAuth
Security
SecTeam-Processed
Oct 13 2021, 7:29 PM
T123243 Ability to alert when we get a sudden increase in bad passwords for privileged accounts
Security
observability
Security-Team
Mar 8 2022, 12:58 AM
T122375 Segment sensitive data within WMF cluster (tracking)
Security
Epic
WMF-General-or-Unknown
Nov 20 2020, 8:05 AM
T122248 Password/login related security issues (Tracking)
Tracking-Neverending
MediaWiki-User-login-and-signup
Security
Sep 2 2021, 4:56 PM
T120532 Use user-specific passwords for accessing EventLogging database
SRE
Security
Feb 20 2020, 8:07 PM
T118774 No way to force a user to change their password if it's invalid
MediaWiki-User-login-and-signup
MW-1.33-notes (1.33.0-wmf.21; 2019-03-12)
Security
SecTeam-Processed
Oct 13 2021, 7:28 PM
T117905 Put secret info into an object, so they don't appear in stack traces
MediaWiki-General
Security
Mar 3 2021, 9:50 PM
T116701 XMPReader::checkParseSafely requires allow_url_fopen to be set enabled
Security
XMPReader
Oct 24 2022, 2:40 PM
T108734 Backport security fixes to stable + LTS [non-bundled] extension branches
MediaWiki-Releasing
Security
Feb 20 2020, 8:08 PM
T108237 Rate-limit media transcode resets in TMH
TimedMediaHandler-Transcode
Security
Feb 20 2020, 8:08 PM
T101912 Network segmentation for WMF servers
Kubernetes
SRE
Security
Infrastructure-Foundations
Jan 6 2023, 12:14 PM
T100375 Improve user experience of Two-Factor process
MediaWiki-extensions-OATHAuth
Security
Sep 26 2022, 6:11 PM
T100070 Allow CheckUsers to set User agent (UA)-based IP Blocks
MediaWiki-extension-requests
Security
MediaWiki-Blocks
Apr 25 2020, 6:22 PM
T95829 In case of compromised wiki account, allow real user to override
MediaWiki-Authentication-and-authorization
MediaWiki-extensions-CentralAuth
Security
Apr 27 2020, 12:38 AM
T92298 Investigate our mitigation strategy for HTTPS response length attacks
HTTPS
SRE
Security
Traffic-Icebox
Privacy Engineering
Nov 27 2022, 11:29 PM
T90300 Suppressed username shown on File pages
Multimedia
MediaWiki-File-management
MediaWiki-Action-API
Multimedia-Sprint-2015-03-25
MediaWiki-Revision-deletion
Datasets-General-or-Unknown
MediaWiki-Core-Snapshots
Vuln-Infoleak
Commons
Security-Team
Security
Mon, Jan 23, 8:06 PM
T85756 Make (redacted) log_search table available on Wiki Replicas
DBA
Data-Services
MediaWiki-General
Security
Nov 24 2021, 7:57 PM
T71445 Implement a proper code-review process for MediaWiki JS/CSS pages on Wikimedia sites
WMF-General-or-Unknown
JavaScript
MediaWiki-extensions-Gadgets
Developer-Advocacy
Developer-Wishlist (2017)
Security
Oct 24 2022, 7:20 AM
T67848 [SpamBlacklist] Do not include '(?:https?:)?\/\/+[a-z0-9_\-.]*' in whitelist regex
SpamBlacklist
Security
Feb 20 2020, 8:08 PM
T65598 Privacy issues with Gadget-GoogleTrans.js (calls out to google APIs)
Privacy
WMF-General-or-Unknown
Privacy Engineering
Security
Mon, Jan 23, 8:07 PM
Assigned: sguebo_WMF
T63087 Special:ImportTranslations allows to edit protected pages
MediaWiki-extensions-Translate
Security
Mar 24 2020, 12:35 AM
T46151 Password recovery form has odd results if only one field is filled out
MediaWiki-User-login-and-signup
Security
Feb 20 2020, 8:08 PM
T45646 "MediaWiki:Copyright" message allows raw HTML
MediaWiki-General
Vuln-XSS
MW-1.32-notes (WMF-deploy-2018-08-28 (1.32.0-wmf.19))
Security
Jan 8 2023, 6:09 AM
T44734 Non-admins can see contents of deleted pages when viewing abusefilter details
Vuln-Infoleak
AbuseFilter
Security
Patch-For-Review
Aug 26 2022, 8:45 PM
T40848 Security: CSS positioning can be used to break out of the content area
MediaWiki-Interface
TemplateStyles
User-Tgr
Security
Vuln-Misconfiguration
SecTeam-Processed
Dec 1 2022, 8:44 AM
T40417 MediaWiki's anonymous edit token leaves wiki installations (incl. Wikipedia) open to mass anonymous spam we can't block
TechCom-RFC
MediaWiki-Authentication-and-authorization
Security
Patch-Needs-Improvement
Feb 21 2022, 5:16 AM
T40113 Improve malicious PDF detection
Feature
·
MediaWiki-Uploading
Multimedia
Security
Feb 4 2022, 11:14 AM
T36257 XSS vulnerability scanner false positives
MediaWiki-Action-API
Vuln-XSS
Security
Feb 5 2021, 11:59 AM
T34716 $wgWhitelistRead leaks username data (Because it allows viewing ?action=history)
Feature
·
MediaWiki-General
Vuln-Infoleak
Security
Oct 27 2022, 8:23 PM
T32018 Require some user groups to have a periodically confirmed valid email address
Feature
·
MediaWiki-User-management
Security
Platform Engineering
Feb 4 2022, 11:02 AM
T28508 Content Security Policy (CSP)
MediaWiki-General
NewFunctionality-Worktype
Security-Team
Front-end-Standards-Group
ContentSecurityPolicy
Security
Dec 16 2022, 11:10 AM
T28227 Notify user by email when password changed
Feature
·
MediaWiki-User-login-and-signup
MediaWiki-Email
MediaWiki-Authentication-and-authorization
Security
SecTeam-Processed
Feb 4 2022, 12:24 PM
T16534 New informational security message for user .js pages
Feature
·
MediaWiki-Interface
Security
Feb 4 2022, 11:01 AM
T6845 CAPTCHA doesn't work for people with visual impairments
WCAG-Level-A
Design
Accessibility
ConfirmEdit (CAPTCHA extension)
Security
Readers-Web-Backlog
Platform Engineering
Nov 23 2022, 10:22 AM
Assigned: DrMel

Advanced SearchUse ResultsEdit QueryHide Query

Tasks (294)

Advanced Search
Use Results
Edit Query
Hide Query