Maniphest Search

Search
Use Results
Edit Query
Hide Query

Query

Assigned To

	N/A
	Informational
	Low
	Medium
	High
	Critical

Tasks (337)

T424116 ApiQueryOATH should add the same logs as VerifyOATHForUser
MediaWiki-extensions-OATHAuth
Product Safety and Integrity
Security
Patch-For-Review
Wed, Apr 22, 1:32 AM
T395459 Use OAuth rather than password-based login for Wikimedia mobile apps
MediaWiki-extensions-OAuth
Wikipedia-Android-App-Backlog
Wikipedia-iOS-App-Backlog
Security
Epic
MediaWiki-Platform-Team (Q3 Kanban Board)
Wed, Apr 22, 12:33 AM
Assigned: ArielGlenn
T420604 Deduplicate CSP between VCL and MediaWiki
Security-Team
Security
Product Safety and Integrity
2026-user-javascript-incident
ContentSecurityPolicy
SecTeam-Processed
Sustainability (Incident Followup)
Traffic
Patch-For-Review
Tue, Apr 21, 7:04 PM
Assigned: sbassett
T423180 Allow Wikifunctions-generated references to have links to non-Wikimedia sites (but not in general Wikifunctions output)
Wikifunctions
Security
Abstract Wikipedia team (26Q4 (Apr–Jun))
Essential-Work
WikiLambda
Security-Team
Product Safety and Integrity
Tue, Apr 21, 3:34 PM
T420607 Stop setting a report-only CSP
Security-Team
Security
Product Safety and Integrity
2026-user-javascript-incident
ContentSecurityPolicy
SecTeam-Processed
Sustainability (Incident Followup)
Mon, Apr 20, 10:31 PM
Assigned: sbassett
T423761 Application Security Review Request : Produnto extension
Application Security Reviews
Security
secscrum
Produnto
Mon, Apr 20, 6:00 PM
T218608 OAuth doesn't work when $wgBlockDisablesLogin is true
MediaWiki-extensions-OAuth
MediaWiki-Core-AuthManager
Security
Patch-Needs-Improvement
MediaWiki-Platform-Team (Q3 Kanban Board)
Mon, Apr 20, 2:50 PM
T197137 Editing sitewide JS/CSS pages should require elevated security
MediaWiki-User-Interface
MediaWiki-User-management
Security
2026-user-javascript-incident
Sat, Apr 18, 6:19 PM
T196386 MediaWiki should prevent username registration if the username previously existed
Security
Product Safety and Integrity
Patch-For-Review
MediaWiki-Platform-Team (Q3 Kanban Board)
MediaWiki-User-rename
MediaWiki-extensions-CentralAuth
Sat, Apr 18, 3:23 PM
Assigned: matmarex
T419336 CentralAuth lock bypass on usernames that have md5 collisions
Security
·
Security
MediaWiki-extensions-CentralAuth
SecTeam-Processed
Vuln-CryptoFailures
MediaWiki-Platform-Team (Q3 Kanban Board)
Patch-For-Review
Sat, Apr 18, 3:04 PM
Assigned: matmarex
T197160 All security-sensitive MediaWiki functionality should require elevated security
MediaWiki-Core-AuthManager
Epic
User-Tgr
Security
MediaWiki-Platform-Team (Radar)
Fri, Apr 17, 11:19 PM
T419353 $wgAllowSecuritySensitiveOperationIfCannotReauthenticate should depend on the provider
MediaWiki-Core-AuthManager
Security
MediaWiki-Platform-Team (Q3 Kanban Board)
Fri, Apr 17, 6:28 PM
T348752 Standard process for dealing with public OAuth consumer secrets
Security-Team
Security
Toolforge
Toolforge-standards-committee
cloud-services-team
SecTeam-Processed
Fri, Apr 17, 8:12 AM
T197153 Make some providers optional for reauthentication
MediaWiki-Core-AuthManager
User-Tgr
Security
MediaWiki-Platform-Team (Q3 Kanban Board)
Patch-Needs-Improvement
Fri, Apr 17, 6:31 AM
T207557 Don't count initial login as valid for any operation that requires reauth
Security
·
MediaWiki-Core-AuthManager
Restricted Project
Patch-For-Review
Security
Product Safety and Integrity
MediaWiki-Platform-Team (Radar)
Thu, Apr 16, 7:22 AM
Assigned: • Tgr
T206012 dont allow editing js and raw html messages over cors
MediaWiki-Action-API
Security
MW-Interfaces-Team
Product Safety and Integrity
Security-Team
2026-user-javascript-incident
Sustainability (Incident Followup)
Thu, Apr 16, 5:51 AM
T197136 Tie certain user rights to elevated security
MediaWiki-User-management
Security
Thu, Apr 16, 3:52 AM
T208667 Tie reauthentication (login with elevated security) to a specific security level
MediaWiki-Core-AuthManager
Security
MediaWiki-Platform-Team
Patch-Needs-Improvement
Wed, Apr 15, 12:11 AM
T71445 Implement a proper code-review process for MediaWiki JS/CSS pages on Wikimedia sites
WMF-General-or-Unknown
JavaScript
MediaWiki-extensions-Gadgets
Developer-Advocacy
Developer-Wishlist (2017)
Security
Tue, Apr 14, 4:42 PM
T419136 Application Security Review Request : Article Guidance
Application Security Reviews
Security
secscrum
Article-Guidance
SecTeam-Processed
Tue, Apr 14, 4:31 PM
Assigned: ASanford-WMF
T40417 MediaWiki's anonymous edit token leaves wiki installations (incl. Wikipedia) open to mass anonymous spam we can't block
MediaWiki-Core-AuthManager
Security
Vuln-CSRF
SecTeam-Processed
MediaWiki-Platform-Team
Patch-Needs-Improvement
Tue, Apr 14, 3:19 PM
T208668 Do not ask for password on reauthentication when 2FA is enabled
MediaWiki-Core-AuthManager
MediaWiki-extensions-OATHAuth
Security
Product Safety and Integrity
MediaWiki-Platform-Team (Radar)
Tue, Apr 14, 3:03 PM
T419152 Editing user JS/CSS pages of another user should require elevated security
MediaWiki-Core-AuthManager
Security
Product Safety and Integrity
2026-user-javascript-incident
Sustainability (Incident Followup)
MediaWiki-Platform-Team (Radar)
Tue, Apr 14, 2:16 PM
Assigned: Reedy
T393212 Investigate device bound sessions
Security
MediaWiki-Core-AuthManager
MediaWiki-Platform-Team
Product Safety and Integrity
Mon, Apr 13, 10:12 PM
T420601 Notify the owner of a user JS page when someone else edits it
Security-Team
Security
Product Safety and Integrity
2026-user-javascript-incident
SecTeam-Processed
Sustainability (Incident Followup)
good first task
Notifications (Echo)
Mon, Apr 13, 8:13 PM
Assigned: aranyap
T420951 Develop tooling to security-scan Site and User JavaScript and CSS
2026-user-javascript-incident
Security-Team
Security
SecTeam-Processed
WMF-General-or-Unknown
Mon, Apr 13, 5:14 PM
T420600 Add an edit tag when someone edits another user's user JS
Security-Team
Security
Product Safety and Integrity
2026-user-javascript-incident
SecTeam-Processed
Sustainability (Incident Followup)
good first task
MediaWiki-Change-tagging
Patch-For-Review
MW-1.46-notes (1.46.0-wmf.23; 2026-04-07)
Mon, Apr 13, 4:43 PM
Assigned: aranyap
T423047 Security Issue Access Request for Madalina
Security
Security-Team
Product Safety and Integrity
SecTeam-Processed
Mon, Apr 13, 4:36 PM
Assigned: aranyap
T150898 Force OATHAuth (2FA) for certain user groups in Wikimedia production and Beta wikis
MediaWiki-User-login-and-signup
Wikimedia-Site-requests
Stewards-and-global-tools
Security
Sustainability (Incident Followup)
User-notice
Mon, Apr 13, 12:33 PM
T189641 Service for checking the Pwned Passwords database
MediaWiki-Core-AuthManager
MediaWiki-User-login-and-signup
WMF-Legal
User-Tgr
Services (watching)
Platform Team Legacy (Watching / External)
Security
SecTeam-Processed
MediaWiki-Platform-Team (Radar)
Sat, Apr 11, 12:55 AM
T417598 Anonymous CORS is always enabled for the action API but disabled by default for the REST API, which is confusing
BUG REPORT
·
MediaWiki-REST-API
Security
MW-Interfaces-Team
Thu, Apr 9, 5:49 AM
T197150 User right changes should require elevated security
Feature
·
Stewards-and-global-tools
MediaWiki-extensions-CentralAuth
MediaWiki-User-management
Security
MediaWiki-Platform-Team
Thu, Apr 9, 12:54 AM
T419684 Add restrictive CSP to auth.wikimedia.org
MediaWiki-Platform-Team
MediaWiki-extensions-CentralAuth
Security
ContentSecurityPolicy
Wed, Apr 8, 6:54 PM
T413229 Application Security Review Request : WDQS database
Application Security Reviews
Security
secscrum
Wikidata-Query-Service
Wikidata
OKR-Work
SecTeam-Processed
Wed, Apr 8, 1:04 PM
Assigned: Mstyles
T28508 Content Security Policy (CSP)
MediaWiki-General
OKR-Work
Security-Team
Front-end-Standards-Group
ContentSecurityPolicy
Security
Epic
SecTeam-Processed
Tue, Apr 7, 10:17 PM
T143610 UploadBase::detectScript() is executed for partially uploaded files (verifyPartialFile()), not only complete ones (verifyFile()) which it expects, causing false positives
MediaWiki-Uploading
Multimedia
Security
Patch-Needs-Improvement
Fri, Apr 3, 9:02 PM
T381769 Potential RCE in Extension:ArticleFeedbackv5
Security
·
Security
ArticleFeedbackv5
affects-Miraheze
Fri, Apr 3, 2:25 PM
T100070 Allow CheckUsers to set User agent (UA)-based IP Blocks
Security
MediaWiki-Blocks
CheckUser
Product Safety and Integrity
Fri, Apr 3, 12:43 AM
T371814 [EPIC] Universal Security Dashboard
Security-Team
Security
Epic
Universal Security Dashboard
SecTeam-Processed
Thu, Apr 2, 3:50 PM
T203912 HotCat loads code that can be edited without editsitejs right
JavaScript
WMF-General-or-Unknown
Security
Thu, Apr 2, 9:16 AM
T421885 Application Security Review Request : WDQS proxy service (wdqs-proxy)
Application Security Reviews
Security
Wikidata-Query-Service
Wikidata Platform Team
secscrum
Wikidata
SecTeam-Processed
Wed, Apr 1, 5:06 PM
Assigned: mmartorana
T359634 Adopt Software Bill of Materials (SBOM) for MediaWiki
Security
Security-Team
SecTeam-Processed
MW-1.46-notes (1.46.0-wmf.21; 2026-03-24)
MediaWiki-General
Tue, Mar 31, 6:12 PM
T416746 Audit whether we can remove auto_increment primary key in favor of an existing field with unique index
Security
·
DBA
Security
SecTeam-Processed
Tue, Mar 31, 4:03 PM
T390386 Be able to force OATHAuth for certain global user groups
MediaWiki-extensions-OATHAuth
Security
Tue, Mar 31, 9:16 AM
T256535 Same-Origin policy prevents reading HTML pages cross-origin
MediaWiki-General
Security
Platform Team Workboards (External Code Reviews)
Patch-Needs-Improvement
Tue, Mar 31, 1:28 AM
T169027 Provide iframe sandboxing for rich-media extensions (defense in depth)
Multimedia
Commons
MediaWiki-File-management
Technical-Debt
Security
MW-1.42-notes (1.42.0-wmf.22; 2024-03-12)
Patch-Needs-Improvement
Tue, Mar 31, 12:43 AM
T327588 Consider adding more CSP directives to MediaWIki core
Feature
·
ContentSecurityPolicy
Security
MediaWiki-General
Patch-For-Review
Mon, Mar 30, 11:25 PM
T175146 JobQueue: Unify JobRunner entry points
MediaWiki-Configuration
MediaWiki-Core-JobQueue
TechCom-RFC (TechCom-RFC-Closed)
WMF-JobQueue
Platform Team Workboards (Initiatives)
MW-Interfaces-Team
Security
Patch-Needs-Improvement
Mon, Mar 30, 12:44 PM
Assigned: daniel
T365752 REST: Introduce support for private modules
MW-Interfaces-Team
Security
Patch-For-Review
Mon, Mar 30, 12:44 PM
Assigned: daniel
T208329 Gadget with SPARQL services collides with Content Security Policy?
Security-Team
Wikidata
Security
ContentSecurityPolicy
Mon, Mar 30, 10:04 AM
T421574 Check spamblacklist on page edit, and inform user if there's a positive match
Feature
·
SpamBlacklist
Security
Sun, Mar 29, 2:18 AM
T260637 Discuss future of BotPasswords/OAuth IP "restrictions"
Security
·
Security
MediaWiki-extensions-OAuth
MediaWiki-User-management
Platform Engineering
MediaWiki-Platform-Team
Thu, Mar 26, 11:51 PM
T360730 Avoid manual review of translations that include HTML tags with `style=""` attributes
BUG REPORT
·
affects-translatewiki.net
I18n
Math
WikimediaMessages
Security
PrivateDomains
SocialProfile
Video extension
Social-Tools
MW-1.42-notes (1.42.0-wmf.24; 2024-03-26)
Thu, Mar 26, 7:28 PM
T419623 Set up special logging/alerting when someone edits another user's JS
Security-Team
Security
Product Safety and Integrity
2026-user-javascript-incident
SecTeam-Processed
Sustainability (Incident Followup)
MediaWiki-General
User-notice
Wed, Mar 25, 11:41 AM
T421143 Add a test to the integration/config repo that validates whether entries on the CI allowlist are correctly formatted/escaped/etc.
Continuous-Integration-Config
Security
Tue, Mar 24, 4:54 PM
T224897 Popular OAuth consumers should have IP restrictions
MediaWiki-extensions-OAuth
Security
MediaWiki-Platform-Team
Tue, Mar 24, 10:45 AM
T208823 Support asynchronous reauthentication
MediaWiki-Core-AuthManager
User-Tgr
Security
MediaWiki-Platform-Team
Mar 23 2026, 3:58 PM
T322958 Investigate in sqlite setting PRAGMA trusted_schema=off in mediawiki core
SQLite
Security
MediaWiki-libs-Rdbms
Mar 22 2026, 5:18 AM
T420383 Require 2FA for all accounts on donatewiki and thankyouwiki
donate.wikimedia.org
Thank-You-Page
Security
Wikimedia-Site-requests
Mar 22 2026, 2:39 AM
T419347 Editing your own JS/CSS pages should maybe require elevated security
MediaWiki-Core-AuthManager
Security
2026-user-javascript-incident
MediaWiki-Platform-Team (Radar)
Sustainability (Incident Followup)
Mar 19 2026, 11:42 AM
T299855 XTools ArticleInfo gadget should not execute WMCS HTML
Security
·
Security
XTools
SecTeam-Processed
2026-user-javascript-incident
Sustainability (Incident Followup)
Mar 19 2026, 11:42 AM
T242089 Consider keeping user entered URL and removing tracking parameters
Citoid
Privacy Engineering
Security
Mar 17 2026, 12:24 PM
T187749 Make it possible to use code from an external repository for editor-controlled Javascript/CSS
MediaWiki-extensions-Gadgets
JavaScript
User-Tgr
MediaWiki-extension-requests
Wikimedia-Hackathon-2018
Wikimedia-Hackathon-2019
Security-Team
Security
Patch-Needs-Improvement
Mar 16 2026, 2:00 AM
T197087 Remove or limit ability to edit the user JS of another user who has higher privileges
MediaWiki-User-Interface
Security
Mar 15 2026, 7:02 PM
T210909 Introduce secure mode to MediaWiki
MediaWiki-Core-AuthManager
Security
MediaWiki-Platform-Team
Mar 15 2026, 6:58 PM
T101912 Network segmentation for WMF servers
Kubernetes
SRE
Security
Infrastructure-Foundations
Mar 15 2026, 1:49 PM
T302640 Harden Special:Random and API:Random to automatically adjust in certain ways during on-wiki incidents
Security
MediaWiki-Special-pages
MediaWiki-Action-API
SecTeam-Processed
MW-Interfaces-Team
Mar 15 2026, 8:02 AM
T123243 Ability to alert when we get a sudden increase in bad passwords for privileged accounts
Security
observability
Security-Team
Mar 13 2026, 3:58 PM
T208188 RFC: Partial opt-out method for Content security policy
Security-Team
ContentSecurityPolicy
Security
MediaWiki-General
Mar 13 2026, 6:46 AM
T345953 [L] 3d2png uses unsupported/unmaintained packages
3D
Security
Technical-Debt
Structured Data Engineering
Structured-Data-Backlog (Current Work)
Patch-For-Review
Mar 11 2026, 9:07 PM
Assigned: bvibber
T361328 Password to keystore of java certificates needs changing
Security
·
Security
SecTeam-Processed
Mar 11 2026, 3:14 PM
T366554 Views data integrity compromised by entity running up fake views
Security
·
Security
Pageviews-Anomaly
SecTeam-Processed
Data-Engineering
Mar 10 2026, 10:22 PM
T306211 Echo oneself using API
Feature
·
MediaWiki-Action-API
Growth-Team
Notifications (Echo)
Security
SecTeam-Processed
MW-1.43-notes (1.43.0-wmf.4; 2024-05-07)
Mar 10 2026, 4:23 PM
T168002 Deleted files can remain on swift due to race conditions
SRE
SRE-swift-storage
MediaWiki-Page-deletion
Multimedia
Commons
MediaWiki-File-management
Security
Mar 10 2026, 1:36 AM
T131723 Provide a mechanism to sanitise user-generated non-STL 3D files to meet security requirements
MediaWiki-File-management
Multimedia
Commons
Epic
3D
Security
Mar 9 2026, 9:52 PM
T208008 Consumer owner-only oauth proposals should require reauth
Security
·
MediaWiki-extensions-OAuth
Security
Sustainability (Incident Followup)
Patch-Needs-Improvement
MediaWiki-Platform-Team (Q3 Kanban Board)
Mar 9 2026, 3:52 PM
T390773 Split PrivateSettings into config and business logic
Security
Security-Team
Release-Engineering-Team
SecTeam-Processed
Mar 9 2026, 2:56 PM
T197130 Document MediaWiki elevated security feature
Documentation
Security
MediaWiki-User-management
Mar 7 2026, 8:12 PM
T197158 CheckUser should require elevated security
Stewards-and-global-tools
CheckUser
Security
Product Safety and Integrity
Mar 6 2026, 11:32 AM
T245873 Blacklist overwriting Special: namespace
BUG REPORT
·
MediaWiki-Special-pages
Security
affects-Miraheze
Mar 5 2026, 5:02 AM
T164189 Add a show password button
MediaWiki-User-login-and-signup
Design
Accessibility
Security
Codex
Design-System-Team
Mar 3 2026, 8:43 PM
T354577 Create Mediawiki "oversightprotect" action that suppresses usernames of all edits of a page
EventStreams
Event-Platform
Security
Data-Engineering
Privacy Engineering
User-DannyS712
MediaWiki-Page-protection
MediaWiki-Revision-deletion
Wikimedia-Hackathon-2024
Data-Engineering-Radar
Product Safety and Integrity
MW-Interfaces-Team
Mar 1 2026, 8:56 PM
T391784 Gradually isolate mediawiki authentication code and infrastructure
Epic
Security
MediaWiki-Core-AuthManager
MediaWiki-extensions-CentralAuth
Security-Team
SecTeam-Processed
MediaWiki-Platform-Team
ServiceOps new
Feb 26 2026, 5:16 PM
T395205 Do not exempt bots from EmailAuth checks on Wikimedia wikis
MediaWiki-extensions-EmailAuth
Security
User-notice
Patch-For-Review
MediaWiki-Platform-Team
Product Safety and Integrity
WikimediaCustomizations
Feb 26 2026, 3:07 PM
Assigned: • Tgr
T416204 Enable "Only allow secure two-factor methods" on GitHub
Wikimedia-GitHub
Security
Developer Productivity
Security-Team
SecTeam-Processed
Feb 24 2026, 2:45 AM
Assigned: Reedy
T417924 Account compromise alerts should ignore bot password login attempts
MediaWiki-Core-AuthManager
Security
MediaWiki-Platform-Team
Feb 23 2026, 3:52 PM
T44734 Non-admins can see contents of deleted pages when viewing abusefilter details
Vuln-Infoleak
AbuseFilter
Security
SecTeam-Processed
Feb 23 2026, 2:48 PM
T378157 SUL Integration for eventyay (Wikimania virtual event platform)
Security
SecTeam-Processed
MediaWiki-Platform-Team (Radar)
Traffic
Feb 18 2026, 7:19 PM
Assigned: ssingh
T406313 Create a security issue reporting template
Security-Team
Security
Phabricator
SecTeam-Processed
Feb 17 2026, 4:50 PM
T415286 Update security.txt (2026 edition)
Wikimedia-Site-requests
Security
Security-Team
Documentation
SecTeam-Processed
Feb 17 2026, 4:29 PM
Assigned: Reedy
T180896 Allow functionaries to reset second factor on low-risk accounts
MW-1.34-notes (1.34.0-wmf.1; 2019-04-16)
WMF-Legal
MediaWiki-extensions-OATHAuth
Security
Security-Team
SecTeam-Processed
Trust-and-Safety
Feb 8 2026, 2:53 PM
T395353 User cannot login with correct EmailAuth code many times in a row
MediaWiki-extensions-EmailAuth
Security
MW-1.45-notes (1.45.0-wmf.10; 2025-07-15)
Patch-For-Review
MW-1.46-notes (1.46.0-wmf.3; 2025-11-19)
Feb 1 2026, 11:53 AM
T361709 scap: Please provide a subcommand to deploy a new security patch in scap itself
Feature
·
Scap
Release-Engineering-Team (Yak Shaving 🐃🪒)
Security
Patch-For-Review
Jan 28 2026, 6:05 PM
T389526 Proposal: Add tag functionality and support for various models
Security-Team
Security
Universal Security Dashboard
Jan 26 2026, 7:18 PM
T389511 Draft phase II development decision overview / specification document
Security-Team
Security
Universal Security Dashboard
Jan 26 2026, 7:18 PM
T389510 Proposal: rename Universal Security Dashboard to Universal Security API
Security-Team
Security
Universal Security Dashboard
Jan 26 2026, 7:18 PM
T382536 Set up and automate scanning tool evaluation pipeline
Universal Security Dashboard
Security-Team
Security
Jan 26 2026, 7:18 PM
T389574 Implement cloning and scanning capabilities of celery tasks
Security-Team
Security
Universal Security Dashboard
Jan 26 2026, 7:18 PM
T382534 Set up a test environment to evaluate the products
Epic
Universal Security Dashboard
Security-Team
Security
Jan 26 2026, 7:18 PM
T388247 Develop a means for preventing developers from accidentally pushing embargoed security patches to gerrit
Security
Security-Team
Release-Engineering-Team
SecTeam-Processed
Gerrit
Jan 26 2026, 7:00 PM
T383724 Investigate using SonarCloud for USD
Epic
Universal Security Dashboard
Security-Team
Security
SecTeam-Processed
Jan 26 2026, 6:59 PM
T392542 Create Incident Runbooks
Security-Team
Security
SecTeam-Processed
Jan 26 2026, 6:58 PM
T382500 [EPIC] Select and Tune Security Tools for Universal Security Dashboard
Epic
Universal Security Dashboard
Security-Team
Security
SecTeam-Processed
Jan 26 2026, 6:54 PM
T382521 Customize osv-scanner and assess suitable coverage for USD
Epic
Universal Security Dashboard
Security-Team
Security
SecTeam-Processed
Jan 26 2026, 6:54 PM
T382523 Investigate semgrep commercial security rules and recommend configuration for USD
Epic
Universal Security Dashboard
Security-Team
Security
SecTeam-Processed
Jan 26 2026, 6:54 PM
T382525 Investigate suitability of semgrep supply chain (commercial version) for USD
Epic
Universal Security Dashboard
Security-Team
Security
SecTeam-Processed
Jan 26 2026, 6:53 PM
T379010 Design task/job queue for task runs for initial phase of project
Security-Team
Security
Universal Security Dashboard
SecTeam-Processed
Patch-For-Review
Jan 26 2026, 6:53 PM
T327286 Integrate In-App Internet censorship circumvention by domain fronting
Feature
·
Infrastructure Security
Privacy Engineering
Security
Traffic
Wikipedia-iOS-App-Backlog
Wikipedia-Android-App-Backlog
Jan 26 2026, 2:14 PM
T244788 Zotero puts raw JS/CSS code in reference template parameters / both citoid and zotero should validate fields to make sure this doesn't occur
Citoid
Security
Upstream
Jan 24 2026, 4:31 PM
T397924 Publish the public key for OAuth 2 access tokens
MediaWiki-extensions-OAuth
Security
Security-Team
MW-Interfaces-Team
MediaWiki-Platform-Team
SecTeam-Processed
Jan 23 2026, 9:57 PM
T406952 QueryAbuseLog API redacts information that can otherwise be seen through the UI
BUG REPORT
·
AbuseFilter
Security
Jan 23 2026, 8:55 AM
T275238 Disallow accessing multi-dimensional arrays through WebRequest::getArray()
MediaWiki-General
Security
Jan 22 2026, 2:32 PM
T413235 XSS Vulnerabilities in Frontend - Unsafe HTML Insertion
BUG REPORT
·
ISA
Vuln-XSS
SecTeam-Processed
Security
Jan 21 2026, 4:23 PM
T234674 Delete OAuth 2.0 access tokens on password change
Platform Team Workboards (User Stories)
Story
Core Platform Team Initiatives (MW REST API in PHP)
MediaWiki-extensions-OAuth
Security
MediaWiki-Platform-Team
Jan 21 2026, 1:28 PM
T269528 Write documentation on how to "reset" a BotPassword
MediaWiki-Core-AuthManager
MediaWiki-User-management
MediaWiki-Documentation
Documentation
Security
MediaWiki-Platform-Team
good first task
Patch-For-Review
Jan 20 2026, 9:14 PM
Assigned: Sanskardubeydev
T388476 CentralAuthSessionProvider::provideSessionInfo: token mismatch for {username}
BUG REPORT
·
MediaWiki-extensions-CentralAuth
Security
MediaWiki-Platform-Team
Jan 20 2026, 12:21 PM
T184208 Security checkup/reminder for verifying email and authentication details
Notifications (Echo)
MediaWiki-Core-AuthManager
Security-Team
Security
MediaWiki-Platform-Team
Jan 20 2026, 11:26 AM
T309772 npm audit reports several security issues with Service runner
BUG REPORT
·
service-runner
Security
MediaWiki-Engineering
Vuln-VulnComponent
Jan 17 2026, 3:09 PM
T335688 Add structure test for comparing foreign-resources.yaml and package[-lock].json
MediaWiki-ResourceLoader
MediaWiki-Core-Tests
Security
Developer Productivity
MediaWiki-Engineering-Group-onboarding
MediaWiki CodeJam Dec 2023
MediaWiki-Platform-Team
Jan 16 2026, 1:56 PM
T242661 Use __Host- prefixed cookies for MediaWiki session cookies
MediaWiki-Core-AuthManager
Security
MediaWiki-extensions-CentralAuth
MediaWiki-Platform-Team
Jan 16 2026, 1:56 PM
T100375 Improve user experience of Two-Factor process
MediaWiki-extensions-OATHAuth
Security
Epic
Jan 15 2026, 9:20 PM
T395204 MediaWiki should log request information (IP, user agent, referrer, HTTP method, etc) in a more uniform and predictable way
Security
MediaWiki-Debug-Logger
MediaWiki-User-login-and-signup
MW-1.45-notes (1.45.0-wmf.6; 2025-06-17)
MediaWiki-Platform-Team (Q3 Kanban Board)
Jan 15 2026, 9:36 AM
Assigned: • Tgr
T182535 Investigate maybe setting X-XSS-Protection header
WMF-General-or-Unknown
Security
Jan 14 2026, 8:08 PM
T411151 CommentParser::doWikiLinks should be able to operate safely on safe HTML
Security
·
Security
MediaWiki-Parser
SecTeam-Processed
Content-Transform-Team (Work In Progress)
Essential-Work
Jan 14 2026, 3:42 PM
T187669 Static PCRE ReDoS validator
MediaWiki-General
Security
Jan 13 2026, 8:35 AM
T386978 Blocked Wikidata user sockpuppets are doing automated misconduct with QuickStatements
BUG REPORT
·
Wikidata
Tools
Security
Jan 12 2026, 3:39 AM
T92298 Investigate our mitigation strategy for HTTPS response length attacks
HTTPS
SRE
Security
Traffic-Icebox
Privacy Engineering
Jan 11 2026, 8:26 PM
T321802 action=growthmentordashboardupdatedata ignores blocks
Security
·
Security
GrowthExperiments-Mentorship
Growth-Team
SecTeam-Processed
Vuln-MissingAuthz
Jan 8 2026, 1:33 PM
T406040 provide security.txt: information for security researchers
Wikibase Cloud
Security
Jan 5 2026, 3:00 PM
T40848 Security: CSS positioning can be used to break out of the content area
MediaWiki-User-Interface
TemplateStyles
User-Tgr
Security
Vuln-Misconfiguration
SecTeam-Processed
Jan 5 2026, 4:57 AM
T285329 Anyone can display whatever title they want using TemplateStyles
Security
·
MediaWiki-Parser
TemplateStyles
Security
SecTeam-Processed
Jan 5 2026, 4:56 AM
T307991 SecurityError: Attempt to use history.replaceState() more than 100 times per 30 seconds
PRODUCTION ERROR
·
Wikimedia-production-error
JavaScript
Vuln-DoS
Security
SecTeam-Processed
MediaViewer
Reader Growth Team
Dec 10 2025, 5:51 PM
T368344 Proposal: fail explicitly and revoke relevant API keys over plain-text HTTP connection for all Wikimedia APIs
MediaWiki-Action-API
MediaWiki-REST-API
RESTBase-API
Wikimedia Enterprise
HTTPS
Traffic
MW-Interfaces-Team
Security
Dec 8 2025, 3:51 AM
T394492 MobileFrontend should not use raw HTML messages
Security
MobileFrontend (MobileFrontend (Editor))
Dec 7 2025, 10:54 PM
T255370 Document best practices for user login for different types of applications if using 2FA
Security
MediaWiki-Core-AuthManager
Documentation
MediaWiki-Documentation
Core Platform Team Initiatives (API Gateway)
MediaWiki-extensions-OATHAuth
serviceops-deprecated
MediaWiki-Platform-Team (Radar)
Dec 5 2025, 6:05 PM
T380666 external links spoofing diff links?
Security
·
Security
SecTeam-Processed
MediaWiki-User-Interface
MediaWiki-Parser
Content-Transform-Team
Design-System-Team
Dec 3 2025, 3:01 PM
T411567 Make use of SensitiveParameter attribute to replace custom stack trace redaction
PHP 8.2 support
MediaWiki-General
Technical-Debt
Security
Dec 3 2025, 1:43 AM
T247490 HTTP MediaWiki API GET requests to Wikimedia wikis should not be redirected to HTTPS when they have a session cookie or Authorization header
Security
SRE
Traffic-Icebox
Dec 2 2025, 9:52 PM
T197577 Increase password policies for the 'steward' group
Vuln-Authn/Session
Stewards-and-global-tools
Wikimedia-Site-requests
Security
Trust-and-Safety
Nov 27 2025, 9:52 PM
T189531 All Wikimedia developer services should use single sign-on
Epic
WMF-General-or-Unknown
Wikimedia-Hackathon-2018
User-Tgr
Security
CAS-SSO
Nov 27 2025, 1:19 PM
T150902 SMS based 2FA
Feature
·
MediaWiki-extensions-OATHAuth
Security
SecTeam-Processed
Nov 23 2025, 9:54 PM
T409855 Document correct way to deploy security patches
Security
Scap
Nov 20 2025, 5:34 PM
T402089 Make LoginNotify cookie expiry longer than login cookie expiry (with "remember me")
MediaWiki-extensions-LoginNotify
Security
Community-Tech
Nov 16 2025, 7:20 PM
T402213 Add top octets or network hash to account name
Feature
·
Temporary accounts
Security
SecTeam-Processed
Product Safety and Integrity
PM
Nov 2 2025, 11:20 AM
T245110 Should per user `Echo-whitelist` pages be protected?
Security
·
User-DannyS712
Security
Notifications (Echo)
MediaWiki-User-management
Oct 27 2025, 11:52 PM
T332639 Make it more difficult to unintentionally paste secrets, passwords, and keys in Phabricator task descriptions, comments and pastes
Feature
·
SecTeam-Processed
Phabricator (Upstream)
Upstream
Security
Oct 22 2025, 8:40 PM
T241921 Fix Wikimedia captchas
Epic
Accessibility
UX-Debt
ConfirmEdit (CAPTCHA extension)
Stewards-and-global-tools
Security-Team
Security
Bot detection and mitigation
Oct 22 2025, 8:21 PM
Assigned: kostajh
T169328 Protect against PHP code execution via memcached/unserialize
Security
MediaWiki-libs-BagOStuff
Platform Team Workboards (Clinic Duty Team)
MW-1.37-notes (1.37.0-wmf.3; 2021-04-27)
MediaWiki-Platform-Team (Radar)
Oct 22 2025, 4:25 PM
T322704 Harden VisualEditor CE/UI against malicious data in DM
VisualEditor
Security
MW-1.40-notes (1.40.0-wmf.14; 2022-12-12)
MW-1.45-notes (1.45.0-wmf.25; 2025-10-28)
Oct 21 2025, 4:32 PM
T400736 MediaWiki core's UrlUtils does not handle alternative Unicode dot characters
BUG REPORT
·
MediaWiki-Internationalization
Security
Oct 16 2025, 2:35 PM
T406129 Prevent setting password to the same as the current password
Security
·
Security-Team
Security
MediaWiki-Core-AuthManager
MediaWiki-Platform-Team (Radar)
Oct 13 2025, 2:35 PM
T406130 Store users previous N passwords, and prevent reuse
MediaWiki-Core-AuthManager
Security
MediaWiki-Platform-Team (Radar)
Oct 13 2025, 2:35 PM
T209586 Make the stored session id be a hash of the used session id to isolate them
MediaWiki-Core-AuthManager
Security
Oct 13 2025, 1:17 PM
T176533 Re-enable stacktraces on Wikimedia wikis ($wgShowExceptionDetails = true);
Wikimedia-Site-requests
Security
Security-Team
MediaWiki-Debug-Logger
Oct 10 2025, 11:50 AM
T250131 Allow the owner to lock its former account if it has been compromised
Security
MediaWiki-extensions-CentralAuth
Trust-and-Safety
MediaWiki-Platform-Team (Radar)
Sep 29 2025, 2:49 PM
T404315 Multiblock page must not depend on possibly failing API request
BUG REPORT
·
Security
Multiblocks
Community-Tech
SecTeam-Processed
Sep 25 2025, 6:17 PM
T393085 Require email verification (sometimes) to enable 2FA
MediaWiki-extensions-OATHAuth
Security
Sep 17 2025, 9:31 AM
T261050 Frequent "Invalid CSRF token" errors on Wikimedia projects using Pywikibot since August 2020
Security
Pywikibot
MediaWiki-Action-API
Platform Engineering
MW-Interfaces-Team
Sep 7 2025, 3:29 PM
T196892 Raw HTML in page descriptions
MediaWiki-extensions-Wikibase-Client
Wikidata
Security
Documentation
Aug 25 2025, 11:42 AM
T357226 Maybe ban src() in inline CSS
BUG REPORT
·
Security
MediaWiki-Parser
Aug 4 2025, 12:16 AM
T374400 Support some concept of private or protected patchdemo wiki instances
Catalyst (PatchDemo)
Security
Aug 4 2025, 12:11 AM
T397734 Audit members of acl*security for more than 12 months of no activity (May 2026)
Security
Security-Team
SecTeam-Processed
Security-Audits
Jul 23 2025, 7:19 PM
T391674 @Maintenance_bot can't see/doesn't act on security tasks
Phabricator maintenance bot
Security
Jul 22 2025, 6:42 AM
T391544 Increase sessionstore storage capacity
Cassandra
Sustainability (Incident Followup)
SRE-OnFire
Security
MediaWiki-Platform-Team (Radar)
Jul 14 2025, 3:32 PM
T395374 Move T395073 captcha mitigation to a public repo
ConfirmEdit (CAPTCHA extension)
Security
MediaWiki-extensions-WikimediaEvents
Jul 8 2025, 8:18 PM
T275660 Proliferate foreign-resources.yaml in mediawiki extensions and skins
Security
JavaScript
MediaWiki-extensions-General
Jul 8 2025, 12:07 AM
T398463 Provide a hook for denying the loading of a wiki page as Javascript
JavaScript
Security
MediaWiki-General
Jul 2 2025, 9:43 PM
T381611 Run sanitization on data attribute before rendering via echarts
Security
Charts
Jun 17 2025, 3:20 PM
Assigned: Catrope
T381612 [Spike] Explore rendering chart into document fragment before adding to page
Spike
·
Charts
Security
Spike
Jun 17 2025, 1:09 PM
T380652 Implement an input sanitization layer before data processing / validation in the chart-renderer service
Charts
Security
Jun 17 2025, 1:09 PM
T290099 Create a "delete me" maintenance script for special user/data deletion requests
Security
Privacy
Privacy Engineering
Security-Team
MW-1.38-notes (1.38.0-wmf.2; 2021-09-28)
affects-Miraheze
MediaWiki-Maintenance-system
Jun 13 2025, 10:01 AM
T391632 Split privileged user groups to privileged / highly privileged
MediaWiki-User-management
Security
Jun 10 2025, 4:45 PM
Assigned: Mstyles
T159889 Per-consumer XFF trust settings
MediaWiki-extensions-OAuth
Security
Jun 3 2025, 11:04 AM
T122375 Segment sensitive data within WMF cluster (tracking)
Security
Epic
WMF-General-or-Unknown
Jun 2 2025, 12:08 PM
T392349 MediaWiki release tarballs should be bit-for-bit reproducible
MediaWiki-Releasing
Security
Jun 1 2025, 9:15 AM
T391269 Prevent Gerrit changes with top-level .patch files from being pushed
Security
Security-Team
Release-Engineering-Team
SecTeam-Processed
Gerrit
May 26 2025, 12:33 PM
T34716 $wgWhitelistRead leaks username data (Because it allows viewing old revisions and diffs)
Feature
·
MediaWiki-General
Vuln-Infoleak
Security
SecTeam-Processed
May 23 2025, 3:53 PM
T394105 Make EmailAuth an available 2fa method for various Wikimedia users
MediaWiki-extensions-EmailAuth
Security
May 16 2025, 11:17 AM
T209556 In AuthManager, avoid encrypted storage of the password in the session
MediaWiki-Core-AuthManager
Security
May 13 2025, 10:11 AM
T120532 Use user-specific passwords for accessing Analytics MariaDB replica databases
Security
Data-Persistence
Data-Platform-SRE
May 8 2025, 1:57 PM
T392812 Improve account security monitoring
MediaWiki-User-login-and-signup
Security
Security-Team
SecTeam-Processed
May 5 2025, 4:35 PM
T218449 Determine new password requirements for MediaWiki core
MediaWiki-User-login-and-signup
MediaWiki-Core-AuthManager
Security
May 2 2025, 1:07 PM
T392521 Create audit scripts and dashboards for Phabricator and related tools
Security
Security-Team
SecTeam-Processed
Apr 28 2025, 4:33 PM
T392811 Improve OpenSearch dashboards related to account security
Security
MediaWiki-User-login-and-signup
Apr 28 2025, 12:25 PM
T90300 Suppressed username shown on File pages
Multimedia
MediaWiki-File-management
MediaWiki-Action-API
Multimedia-Sprint-2015-03-25
MediaWiki-Revision-deletion
Datasets-General-or-Unknown
Vuln-Infoleak
Commons
Security-Team
Security
Apr 24 2025, 5:28 PM
T151408 Separate bot right for normal pages and interface (MediaWiki:) pages
MediaWiki-General
MediaWiki-Recent-changes
Security
MediaWiki-User-management
Moderator-Tools-Team
Apr 17 2025, 5:53 PM
T150903 Alert sre/security on many 2FA failures
MediaWiki-extensions-OATHAuth
Security
Sustainability (Incident Followup)
Apr 15 2025, 1:02 AM
T183420 Authentication data should not be available through the normal DB abstraction layer
MediaWiki-Core-AuthManager
Security
Apr 14 2025, 9:07 PM
T356768 DOM Clobbering Risk in WikiBooks
Security
·
Security-Team
Security
SecTeam-Processed
Vuln-XSS
Patch-For-Review
MW-1.42-notes (1.42.0-wmf.25; 2024-04-02)
Apr 8 2025, 7:29 PM
T366824 Add a changelog and apply a custom version number to our patched bundled Lua binaries
Security
·
Security-Team
Security
Scribunto
SecTeam-Processed
Apr 8 2025, 11:50 AM
T32018 Require some user groups to have a periodically confirmed valid email address
Feature
·
MediaWiki-User-management
Security
SecTeam-Processed
Apr 6 2025, 1:41 PM
T150589 Write a script to gather statistics on 2FA usage among functionaries
Feature
·
Security
Technical-Tool-Request
Mar 29 2025, 6:52 PM
T201784 Implement option "require two-factor authentication only for dangerous actions"
MediaWiki-Core-AuthManager
MediaWiki-extensions-OATHAuth
Security
Mar 29 2025, 3:45 PM
T304985 Throttling mitigations against password sprays attacks
Security
·
Security
MediaWiki-Core-AuthManager
SecTeam-Processed
Mar 27 2025, 12:34 PM
T134306 add automatic checks/test for suppressed content as a security measure
MediaWiki-Revision-deletion
MediaWiki-Core-Tests
Security
Mar 24 2025, 6:15 PM
T242058 Add some form of static analysis for package-lock.json
Continuous-Integration-Config
Security-Team
Security
Mar 19 2025, 2:51 PM
T382376 PageViewInfo caches errors due to the request limit which can lead to denial of service
BUG REPORT
·
Vuln-DoS
PageViewInfo
Security
Mar 19 2025, 6:20 AM
T158986 Migrate SHA-1 hashes to SHA-256 (tracking)
MediaWiki-General
Technical-Debt
Security
Mar 17 2025, 12:37 AM
T385965 Allow MediaWiki to run with ini_set and putenv disabled
Feature
·
MediaWiki-General
MediaWiki-libs-BagOStuff
MediaWiki-libs-RequestTimeout
Security
MediaWiki-Platform-Team (Radar)
Mar 13 2025, 1:43 PM
T368472 https://risk-calculator.toolforge.org/site/ssvc-calc/ loads JS from polyfill.io
Security
·
Security-Team
Security
wikimedia-risk-calculator
Tools
SecTeam-Processed
Feb 27 2025, 8:01 PM
Assigned: mmartorana
T303433 Allow Stewards to enable 'emergency CAPTCHAs' for anonymous IP edits
Security
Wikimedia-Site-requests
Platform Engineering
ConfirmEdit (CAPTCHA extension)
Sustainability (Incident Followup)
SecTeam-Processed
MediaWiki-extensions-CentralAuth
Stewards-and-global-tools
MW-1.39-notes (1.39.0-wmf.25; 2022-08-15)
MediaWiki-Platform-Team (Radar)
CommunityConfiguration-Adoption
Feb 18 2025, 12:50 AM
T153948 thumbnail script should respect imgAuthBeforeStream
Security
MediaWiki-Stakeholders-Group
MediaWiki-File-management
Feb 16 2025, 8:00 PM
T356971 Rename help key to help-raw in HTMLForm and deprecate old key name
Security
·
Security
Vuln-XSS
MediaWiki-HTMLForm
SecTeam-Processed
MW-1.43-notes (1.43.0-wmf.18; 2024-08-13)
MW-1.44-notes (1.44.0-wmf.12; 2025-01-14)
Jan 21 2025, 2:59 PM
T383794 Develop a lightweight python click cli for interaction with the USD REST API
Security-Team
Security
Epic
Universal Security Dashboard
SecTeam-Processed
Jan 15 2025, 4:12 PM
T264888 Review default ferm INPUT policy
User-jbond
netops
SRE
Security
Infrastructure-Foundations
Jan 13 2025, 11:14 AM
T357064 Use custom CDN if possible for Jupyter HTML exported notebooks
BUG REPORT
·
Data-Engineering-Jupyter
Data-Engineering
Security
Data-Platform-SRE
Data-Engineering-Radar
Jan 6 2025, 9:13 PM
T194606 It should be able to add a parameter to skip the form edit page and directly save the target text
MediaWiki-extensions-InputBox
Security
Dec 22 2024, 8:00 PM
T352227 Work around cache partitioning in iframe sandboxing
Performance Issue
Security
MediaWiki-General
Dec 11 2024, 2:21 AM
T378235 OpenBao evaluation
Infrastructure-Foundations
Security
SecTeam-Processed
Nov 18 2024, 3:20 PM
T378250 OpenBao audit logs
Infrastructure-Foundations
Security
SecTeam-Processed
Nov 18 2024, 7:45 AM
T378248 OpenBao high availability
Infrastructure-Foundations
Security
SecTeam-Processed
Nov 18 2024, 7:45 AM
T378247 OpenBao authentication methods
Infrastructure-Foundations
Security
SecTeam-Processed
Nov 18 2024, 7:45 AM
T378246 OpenBao unsealing
Infrastructure-Foundations
Security
SecTeam-Processed
Nov 18 2024, 7:45 AM
T378245 OpenBao installation & configuration
Infrastructure-Foundations
Security
SecTeam-Processed
Nov 18 2024, 7:44 AM
T378244 OpenBao storage engine
Infrastructure-Foundations
Security
SecTeam-Processed
Nov 18 2024, 7:44 AM
T378243 OpenBao secret engines
Infrastructure-Foundations
Security
SecTeam-Processed
Nov 18 2024, 7:44 AM
T378241 OpenBao human consumer
Infrastructure-Foundations
Security
SecTeam-Processed
Nov 18 2024, 7:43 AM
T378240 OpenBao Kubernetes consumer
Infrastructure-Foundations
Security
SecTeam-Processed
Nov 18 2024, 7:43 AM
T378249 OpenBao backups
Infrastructure-Foundations
Security
SecTeam-Processed
Nov 18 2024, 7:43 AM
T378237 OpenBao consumers
Infrastructure-Foundations
Security
SecTeam-Processed
Nov 18 2024, 7:42 AM
T378239 OpenBao Puppet consumer
Infrastructure-Foundations
Security
SecTeam-Processed
Nov 18 2024, 7:42 AM
T377222 Don’t use raw HTML messages in safe mode
Security
·
Security-Team
Security
MediaWiki-Internationalization
I18n
Vuln-Misconfiguration
Vuln-XSS
SecTeam-Processed
MW-1.44-notes (1.44.0-wmf.4; 2024-11-19)
Nov 14 2024, 3:01 PM
T299193 MediaWiki login failure due to race condition with session cookie
BUG REPORT
·
MediaWiki-Core-AuthManager
Security
Security-Team
SecTeam-Processed
Platform Engineering
MW-1.39-notes (1.39.0-wmf.12; 2022-05-16)
Growth-Team
Nov 11 2024, 5:22 AM
T304231 Take some pointers from GitHub security updates
Security
GitLab (Administration, Settings & Policy)
Infrastructure-Foundations
Puppet-Core
Bitu
Striker
Oct 30 2024, 3:32 PM
T255208 Catalog and evaluate methods of analysis for Wikimedia captcha performance
Security
Security-Team
ConfirmEdit (CAPTCHA extension)
observability
Oct 24 2024, 1:32 AM
T204615 Generate new Captcha word list for prod
ConfirmEdit (CAPTCHA extension)
WMF-General-or-Unknown
Security
Oct 24 2024, 1:28 AM
T285151 Increase min password length to 12 characters
Security
MediaWiki-User-login-and-signup
WMF-General-or-Unknown
Patch-Needs-Improvement
Oct 16 2024, 3:22 PM
T375537 Password Policy Updates wrt NIST SP 800-63
Security
Security-Team
SecTeam-Processed
MediaWiki-User-login-and-signup
Oct 16 2024, 3:13 PM
T181019 Consider using a single MediaWiki releases key instead of individual keys
MediaWiki-Releasing
Security
Oct 15 2024, 10:14 PM
T122248 Password/login related security issues (Tracking)
Tracking-Neverending
MediaWiki-User-login-and-signup
Security
Oct 10 2024, 8:56 PM
T376563 Publish public "Rules of Engagement" for security researchers and people reporting security vulnerabilities
Security
Security-Team
Documentation
SecTeam-Processed
Oct 7 2024, 4:18 PM
T180886 AuthManager special pages should honor $wgSecureLogin
MediaWiki-Core-AuthManager
Security
Sep 30 2024, 9:51 AM
T160387 Support Strict Secure Cookies
MediaWiki-Core-AuthManager
Security
Sep 30 2024, 9:51 AM
T285152 Set password max length at 128 characters
Security
MediaWiki-User-login-and-signup
Sep 24 2024, 4:39 PM
T214741 MediaWiki pages used in interface can be translated by non-admins
MediaWiki-extensions-Translate
Wikidata
Security
Sep 8 2024, 1:05 AM
T276761 Forms for adding cloud ssh keys should have a message not to add production keys
Striker
Security
Infrastructure-Foundations
Bitu
Sep 8 2024, 1:01 AM
T160529 Sender email spoofing
Wikimedia-Mailing-lists
Mail
SRE
Security
Infrastructure-Foundations
Aug 26 2024, 2:48 PM
T158989 Add img_sha256, related columns with SHA-256 hash of file
Technical-Debt
Multimedia
Commons
MediaWiki-File-management
Schema-change
Security
Jul 28 2024, 8:42 AM
T211403 Domains of most projects do not have DMARC policy
Mail
SRE
Infrastructure-Foundations
Security
Jun 3 2024, 4:31 PM
T255881 Enable wgBreakFrames across all projects
user-sbassett
Security-Team
Security
Wikimedia-Site-requests
May 23 2024, 4:34 PM
T302159 Security Issue Access Request for MarkAHershberger and Mglaser
Security
Security-Team
SecTeam-Processed
Apr 27 2024, 8:16 PM
T85756 Make (redacted) log_search table available on Wiki Replicas
DBA
Data-Services
Security
MediaWiki-Logevents
Mar 28 2024, 8:15 PM
T325229 add option to set cookies hostOnly property
Feature
·
Security
MediaWiki-General
Mar 27 2024, 11:29 AM
T203210 Extension:RSS shouldn't invent its own way to escape and parse things
MediaWiki-extensions-RSS
Technical-Debt
Security
Mar 17 2024, 3:56 AM
T294151 Reports that the ua-parser-js npm package has been "hijacked" into a coinminer (indirect dependency of Wikibase)
Security
·
Security
Wikidata-Bridge
Wikidata
[DEPRECATED] wdwb-tech
SecTeam-Processed
Mar 5 2024, 12:19 PM
T125289 Auth tokens should expire
MediaWiki-extensions-CentralAuth
MediaWiki-Core-AuthManager
Security
SecTeam-Processed
Mar 5 2024, 11:50 AM
T260201 Parsoid REST API may not check access permissions of user
Security
Security-Team
MW-1.36-notes (1.36.0-wmf.5; 2020-08-18)
Parsoid (Tracking)
Mar 1 2024, 3:22 PM
T116701 XMPReader::checkParseSafely requires allow_url_fopen to be set enabled
Security
XMPReader
Feb 17 2024, 11:43 PM
T150526 BotPasswords: grant all rights
MediaWiki-Core-AuthManager
Security
Jan 28 2024, 3:32 AM
T108237 Rate-limit media transcode resets in TMH
TimedMediaHandler-Transcode
Security
Nov 29 2023, 2:22 PM
T257988 Optional use of https://github.com/Khan/pygments-server
SyntaxHighlight
Security
Nov 27 2023, 10:14 PM
T149152 Diffusion 'view raw file' policy and behavior is unclear and inconsistent (PHP files displayed in browser; JS files offer downloading file)
Diffusion
Phabricator
Security
Nov 13 2023, 3:49 PM
T299629 Test disabling the captcha on some Wikimedia wikis
Wikimedia-Site-requests
Accessibility
Security
Security-Team
SecTeam-Processed
Nov 6 2023, 8:20 PM
T65598 Privacy issues with Gadget-GoogleTrans.js (calls out to google APIs)
Privacy
WMF-General-or-Unknown
Privacy Engineering
Security
Oct 24 2023, 4:03 PM
T348075 Ingest Cloud VPS audit logs into production logging pipeline
observability
Cloud-VPS
Security
Oct 18 2023, 2:06 PM
T260016 Request Security check of allowing editing from mirror/fork site
Chinese-Sites
Security
Privacy Engineering
Oct 16 2023, 6:58 AM
T348067 Add prefix to novaobserver password to make it obvious it's intended to be public
Security
·
Security
cloud-services-team
Cloud-VPS
Oct 12 2023, 8:18 AM
T230075 Setting up static maintenance page on Foundation servers for Foundation website
SRE
wikimediafoundation.org
Security
Traffic-Icebox
Oct 5 2023, 11:00 PM
T344019 Evaluate security threats involved with online voting
MediaWiki-extensions-SecurePoll
Security
Privacy
Sep 13 2023, 5:44 PM
T327195 Add foreign-resources.yaml to VisualEditor/VisualEditor
Security
JavaScript
VisualEditor
Sep 11 2023, 9:46 AM
T263711 Upgrade Mustache version from 3.0.1 to 4.01
Security
MediaWiki-HTML-Templating
Sep 5 2023, 6:13 PM
T308789 Determine CI best practices for service which connects to MySQL
Security-Team
Security
SecTeam-Processed
Data-Persistence (work done)
Release-Engineering-Team (Seen)
Aug 23 2023, 12:53 PM
T284274 action=history with a high limit like >= 2000, can be slow and might timeout
Security
·
Security
MediaWiki-Page-history
Vuln-DoS
Platform Team Workboards (Clinic Duty Team)
Wikimedia-Performance-publish
Aug 6 2023, 10:42 PM
T343572 Explicitly warn not to use RSA-SHA1 and recommend HMAC-SHA1 in mwoauth-consumer-rsakey-help
MediaWiki-extensions-OAuth
Security
Aug 4 2023, 11:15 PM
T285153 Verify we allow any printable Unicode character in a password
Security
MediaWiki-User-login-and-signup
MediaWiki-Core-AuthManager
Jul 13 2023, 4:11 PM
T165981 Implement a prototype JavaScript review system for MediaWiki
Wikimedia-Hackathon-2017
JavaScript
MediaWiki-extension-requests
Developer-Advocacy
Security
MediaWiki-Farmers
ShoutWiki
Brickimedia
Jul 11 2023, 5:16 PM
T240245 Create an SOP for handling of Cloud/Toolforge open vulnerability issues
Toolforge
Cloud-VPS
Security-Team
Security
Documentation
cloud-services-team
Jul 11 2023, 10:48 AM
T341498 #mediawiki_security cannot be accessed using Matrix as an IRC client
Matrix
Security
Jul 10 2023, 6:08 PM
T333722 Decommission #wikimedia-security IRC channel
Security
Security-Team
Jul 10 2023, 5:45 PM
Assigned: Reedy
T214636 Session cookie should have Secure and Domain flags
Quarry
Security
Jun 27 2023, 8:02 PM
T270286 Do a security review of the Widgets extension
MediaWiki-extensions-Widgets
Security
Jun 27 2023, 4:51 PM
T263220 Limit concurrency of DPL queries
DynamicPageList
Performance Issue
MW-1.36-notes (1.36.0-wmf.18; 2020-11-17)
Platform Team Workboards (Clinic Duty Team)
Sustainability (Incident Followup)
Vuln-DoS
Security
SecTeam-Processed
Wikimedia-Slow-DB-Query
serviceops-radar
SRE-Sprint-Week-Sustainability-March2023
Jun 23 2023, 3:45 PM
T338229 Add CSP headers for the linkrecommendation API sandbox
Add-Link-Structured-Task
Growth-Team
Security
ContentSecurityPolicy
Jun 8 2023, 9:18 PM
T264196 CSP blocking favicon.ico
ContentSecurityPolicy
Security
WMF-General-or-Unknown
Jun 7 2023, 7:47 PM
T268344 Implement SSH CA (certificate authority) for host keys?
Security
User-MoritzMuehlenhoff
cloud-services-team
Infrastructure-Foundations
Patch-For-Review
Jun 1 2023, 2:13 PM
T254477 Ferm sometimes (rarely) fails to reload
User-MoritzMuehlenhoff
Security
User-jbond
Infrastructure Security
May 23 2023, 11:05 AM
T108734 Backport security fixes to stable + LTS [non-bundled] extension branches
MediaWiki-Releasing
Security
Developer-Wishlist (2017)
May 18 2023, 12:09 PM
T335617 On postgresql $wgDBssl should make sslmode be 'verify-full' not 'required'
BUG REPORT
·
MediaWiki-libs-Rdbms
PostgreSQL
Security
May 1 2023, 7:18 PM
T163583 <video>/<source>/<track> sanitization for media
TimedMediaHandler
MediaWiki-Parser
MW-1.30-release-notes (WMF-deploy-2017-05-23_(1.30.0-wmf.2))
Security
Apr 9 2023, 8:30 PM
T332817 Improve awareness of sensitive content in helmfile output
Prod-Kubernetes
Security
Mar 29 2023, 10:16 PM
T224927 CentralNotice alerts: Investigate productionization and e-mail alerts
Fundraising-Backlog
MediaWiki-extensions-CentralNotice
Security
Mar 14 2023, 10:22 PM
T224926 CentralNotice alerts: Hide verbose output from pywikibot unless --debug flag used
Fundraising-Backlog
MediaWiki-extensions-CentralNotice
Security
Mar 14 2023, 10:22 PM
T224925 CentralNotice alerts: Implement alerts based on campaign and user
Fundraising-Backlog
MediaWiki-extensions-CentralNotice
Security
Mar 14 2023, 10:22 PM
T224699 CentralNotice alerts: Add error handling
Fundraising-Backlog
MediaWiki-extensions-CentralNotice
Security
Mar 14 2023, 10:22 PM
T224931 CentralNotice alerts: Specific alerts config for production monitoring
Fundraising-Backlog
MediaWiki-extensions-CentralNotice
FR-Q2-FY2019-20-cleanup-list
Security
Mar 14 2023, 10:22 PM
T224934 CentralNotice alerts: Include user info and other event data in alert
Fundraising-Backlog
MediaWiki-extensions-CentralNotice
Security
Mar 14 2023, 10:22 PM
T259210 LilyPond safe mode escape due to output-def-lookup and output-def-scope (CVE-2020-17354)
Security
·
Security-Team
Security
MediaWiki-extensions-Score
Mar 5 2023, 11:16 PM
T182213 [Clonable] replace wfMessage()->rawParams() with wfMessage()->plaintextParams() where applicable
good first task
Google-Code-in-2017
MediaWiki-extensions-General
MediaWiki-General
Google-Code-in-2018
Google-Code-in-2019
Security
Feb 27 2023, 6:09 PM
T214375 Update installer to check for an AES library
MediaWiki-Core-AuthManager
MediaWiki-Installer
Security
Dec 28 2022, 2:21 PM
T288975 Cookbook to reboot cassandra nodes
Security
SRE
User-razzi
Cassandra
Dec 14 2022, 3:26 PM
T271132 Ensure that all deployed nodejs services have regular dependency security scanning
serviceops-deprecated
Security
LibUp
Nov 15 2022, 9:06 AM
T210833 Filter potentially harmful PostScript commands in Commons upload/thumbor
SRE
serviceops-deprecated
Security
Thumbor
Nov 8 2022, 11:19 AM
T200766 Public monitoring of JS/CSS edits
Security
MediaWiki-General
MediaWiki-extension-requests
Oct 23 2022, 1:50 AM
T241039 Create an API for sending yourself an arbitrary HTML email
MediaWiki-Action-API
MediaWiki-Email
Security
Oct 15 2022, 5:50 PM
T265218 OAuth 2.0 Security Best Practices
MediaWiki-extensions-OAuth
Documentation
Security
API-Portal
Oct 11 2022, 8:13 PM
T209579 MediaWiki should log user out of all sessions when going to Special:Userlogout
MediaWiki-Core-AuthManager
Security
Sep 27 2022, 9:41 AM
T261225 Set strict CSP rule on Kibana logstash.wikimedia.org
Wikimedia-Logstash
Security
observability
Observability-Logging
Sep 21 2022, 10:57 AM
T257100 Set up automated/regular end-to-end testing of potential and past security issues
Security
·
Security
Technical-Tool-Request
Aug 16 2022, 7:28 PM
T158988 Migrate filearchive's fa_storage_key from SHA-1 to SHA-256
Technical-Debt
Multimedia
Commons
MediaWiki-Uploading
MediaWiki-Page-deletion
MediaWiki-File-management
Schema-change
Security
Jul 23 2022, 12:35 PM
T249011 If a PNG is embedded in an SVG file, show a more specific warning than "dangerous href link" when trying to upload
Commons
MediaWiki-Uploading
Security
Voice & Tone
May 13 2022, 3:16 PM
T177895 Allow logged in users to disable MediaWiki:Common.js and MediaWiki:Common.css
MediaWiki-Core-Preferences
Security
May 4 2022, 1:39 PM
T28227 Notify user by email when password changed
Feature
·
MediaWiki-User-login-and-signup
MediaWiki-Email
MediaWiki-Core-AuthManager
Security
SecTeam-Processed
Feb 4 2022, 12:24 PM
T297846 Add support for package versioning
MediaWiki-General
MediaWiki-Debian
Security
Dec 22 2021, 8:30 PM
T194398 Require elevated session security for giving elevated permissions
MediaWiki-extensions-OAuth
Security
Nov 3 2021, 7:10 PM
T224887 apache modsec rules deployment with scap
SRE
Security
Nov 3 2021, 7:08 PM
T124445 Design research support for two step authentication
MediaWiki-extensions-OATHAuth
Security
SecTeam-Processed
Oct 13 2021, 7:29 PM
T292971 Create a service to crawl external links and test them against known bad sites list
Feature
·
Security
Technical-Tool-Request
Oct 11 2021, 8:47 PM
T242821 Separate access to tools and test features from ability to view private filters
Security
·
User-DannyS712
MediaWiki-User-management
Security
AbuseFilter (Overhaul-2020)
MW-1.36-notes (1.36.0-wmf.32; 2021-02-23)
SecTeam-Processed
Oct 6 2021, 10:49 AM
T236701 Consider enforcing read permissions at the storage layer
MediaWiki-User-management
Platform Team Workboards (MW Expedition)
Security
Sep 19 2021, 8:22 AM
T257070 Standardise setup of Loggers
Security
·
Security
MediaWiki-Debug-Logger
Sep 16 2021, 2:02 PM
T176995 Monitor any sql syntax error issues, and send email alerting if they happen
User-chasemp
Security
Observability-Alerting
Aug 10 2021, 3:18 PM
T258322 Open redirect in wikis that use http://domain.tld/index.php format
Security
·
Security
MediaWiki-General
Platform Engineering
Vuln-OpenRedirect
SecTeam-Processed
Aug 4 2021, 6:39 PM
T139168 On SVG files' pages, put the bright orange warning telling them it's insecure, like we do for PDFs
Multimedia
Wikimedia-SVG-rendering
Security
May 2 2021, 5:23 PM
T204279 Fine-grained Sanitizer control
Parsoid
Security
Mar 16 2021, 7:33 PM
T117905 Put secret info into an object, so they don't appear in stack traces
MediaWiki-General
Security
Mar 3 2021, 9:50 PM
T214445 Support Sodium in MediaWiki session encryption
MediaWiki-Core-AuthManager
Security
Oct 16 2020, 5:02 PM
T202900 Content model based permission checks do not use the actual content model on undelete/import
MediaWiki-Core-Snapshots
MediaWiki-Page-deletion
Security
Sep 8 2020, 10:54 AM
T260080 $wgObjectCacheSessionExpiry is too short
MediaWiki-Core-AuthManager
Security
Aug 10 2020, 10:08 PM
T192207 Security related Static Analysis
MediaWiki-Codesniffer
Security-Team
Security
Jul 16 2020, 10:18 PM
T95829 In case of compromised wiki account, allow real user to override
MediaWiki-Core-AuthManager
MediaWiki-extensions-CentralAuth
Security
Apr 27 2020, 12:38 AM
T182198 Retrieve showing a "skin" property in "user_properties" table on DB replicas
Data-Services
Security-Team
Security
Apr 11 2020, 5:36 AM
T63087 Special:ImportTranslations allows to edit protected pages
MediaWiki-extensions-Translate
Security
Mar 24 2020, 12:35 AM
T67848 [SpamBlacklist] Do not include '(?:https?:)?\/\/+[a-z0-9_\-.]*' in whitelist regex
SpamBlacklist
Security
Feb 20 2020, 8:08 PM
T199020 installer by default does not create a new mysql user. should default to the more secure approach
MediaWiki-Installer
Security
Feb 20 2020, 8:08 PM
T197544 Make it possible to prefill Special:BotPasswords form
MediaWiki-Core-AuthManager
Huggle
Security
Feb 20 2020, 8:08 PM
T193552 Make installer grant only needed rights to db user
MediaWiki-Installer
Security
Feb 20 2020, 8:08 PM
T216653 Use data attributes instead of unsafe-inline var definitions within Quarry template files
Quarry
Security
Feb 20 2020, 8:08 PM
T126066 Edit history is not available to admins
Education-Program-Dashboard
WMF-Legal
Security
Feb 20 2020, 8:07 PM
T137016 Allow more than 1 password reset per 24 hours
MediaWiki-Core-AuthManager
Security
Feb 20 2020, 8:07 PM
T143015 Consider different "keep me logged in" login lengths for different user groups
MediaWiki-User-login-and-signup
Security
Feb 20 2020, 8:07 PM
T159611 thumb.php should use the ImgAuthBeforeStream hook
MediaWiki-File-management
Commons
Multimedia
Security
Feb 20 2020, 8:07 PM
T181690 Track external JS libraries in MediaWiki in a way that allows vulnerability detection
JavaScript
MediaWiki-General
Security
Feb 20 2020, 8:07 PM
T196602 Streamline MW security release process
MediaWiki-Releasing
Security-Team
Security
Feb 20 2020, 8:07 PM
T201166 Warn when using local consumers
MediaWiki-extensions-OAuth
Security
Feb 20 2020, 8:07 PM
T213010 Moves circumvent the requirement to have createpagemainns
MediaWiki-extensions-ArticleCreationWorkflow
Security
Feb 20 2020, 8:06 PM
T218926 MediaWiki-Vagrant complains about insecure NIC setting
MediaWiki-Vagrant
Security
Feb 20 2020, 8:06 PM
T223831 Wikidata Recoin statement publishing button disappears after subject has been selected
Wikidata
Wikidata.org
Security
Feb 20 2020, 8:06 PM

SearchUse ResultsEdit QueryHide Query

Tasks (337)

Search
Use Results
Edit Query
Hide Query