User Details
- User Since
- Oct 7 2014, 2:31 PM (320 w, 4 d)
- Availability
- Available
- LDAP User
- Umherirrender
- MediaWiki User
- Umherirrender [ Global Accounts ]
Today
WebRequest::getRequestId() is using $_SERVER['UNIQUE_ID'] which means the return could contain user input?
Yesterday
13:49:09 includes/jobqueue/utils/BacklinkJobUtils.php:102 SecurityCheck-SQLInjection Calling method \BacklinkCache::partition() in \BacklinkJobUtils::partitionBacklinkJob that outputs using tainted argument #1 (`$params['table']`). (Caused by: includes/cache/BacklinkCache.php +443) (Caused by: includes/jobqueue/utils/BacklinkJobUtils.php +90)
Not sure if related, but also related to types:
13:49:09 includes/GlobalFunctions.php:913 PhanRedundantCondition Redundant attempt to cast $wgDebugRawPage of type true to truthy
13:49:09 includes/GlobalFunctions.php:1310 PhanRedundantCondition Redundant attempt to cast $wgShowHostnames of type true to truthy
13:49:09 includes/user/User.php:316 PhanImpossibleCondition Impossible attempt to cast $wgFullyInitialised of type ?''|?'0'|?0|?0.0|?array{}|?false to truthy
13:49:09 includes/user/User.php:338 PhanImpossibleCondition Impossible attempt to cast $wgFullyInitialised of type ?''|?'0'|?0|?0.0|?array{}|?false to truthy
13:49:09 includes/user/User.php:494 PhanImpossibleCondition Impossible attempt to cast $wgFullyInitialised of type ?''|?'0'|?0|?0.0|?array{}|?false to truthy
13:49:09 includes/user/User.php:775 UnusedPluginSuppression Plugin BuiltinSuppressionPlugin suppresses issue PhanImpossibleCondition on this line but this suppression is unused or suppressed elsewhere
13:49:09 includes/user/User.php:824 UnusedPluginSuppression Plugin BuiltinSuppressionPlugin suppresses issue PhanRedundantCondition on this line but this suppression is unused or suppressed elsewhere
13:49:09 includes/user/User.php:1489 PhanImpossibleCondition Impossible attempt to cast $wgFullyInitialised of type ?''|?'0'|?0|?0.0|?array{}|?false to truthyThat possible could be set to false for all tests in core, because it always triggers https connection.
This is about phan in the config, not in taint-check (even there are bundled)
Tue, Nov 24
Mon, Nov 23
Sun, Nov 22
Sat, Nov 21
Such a feature would also be helpful for core and should be usable by the extensions.
Fri, Nov 20
One issue seems fixed with newer taint - https://gerrit.wikimedia.org/r/c/mediawiki/extensions/RSS/+/642406
There is a nowiki around everything, see T245922
This can have a big impact, I was playing with it in https://gerrit.wikimedia.org/r/c/mediawiki/core/+/618757
Thu, Nov 19
Who can do this task? Is there a list of people we could link from here to get attention?
The following repositories have some kind of error (as of now).
Can you also look at https://libraryupgrader2.wmcloud.org/r/mediawiki/extensions/EventLogging where the web ui crashed?
This looks like T14974
It seems not linked from anywhere or I missed it.
But thanks for the link
Wed, Nov 18
Tue, Nov 17
Should be checked as well: MediaWiki.Commenting.FunctionDocumentation.NotPunctuationReturnType/MediaWiki.Commenting.FunctionDocumentation.NotPunctuationParamName
Fri, Nov 13
Why this needs special handling when Special:MovePage also does not take account of the cascade on inital view?
Wed, Nov 11
Maybe you want the Extension:InputBox with the preload options. Just type in the new page name and click to have the content preloaded.
To be remove: Checks for extension_loaded( 'intl' ) and the phan-stub for intl seems useless as well.
Fri, Nov 6
Have tested with the new version 33.0.0 and it works. Can you update the patch set to see if it also works with CI?
Service NullRevisionCreator is using a database connection to DB_MASTER, pass just the load balancer and instance the connection when needed? Special:SpecialPages is supposed to be "read only" and not touching the master
For #2 there was a change with https://gerrit.wikimedia.org/r/c/mediawiki/extensions/AbuseFilter/+/622418 to use a message localizer to avoid global state on parse.
For #3 there was a change with https://gerrit.wikimedia.org/r/c/mediawiki/extensions/AbuseFilter/+/622415 to use the LinkRenderer from the LogFormatter
Thu, Nov 5
Should/Could you tag them as Wikimedia-production-error ? Or there are not production errors like the tag handled?
Wed, Nov 4
The only place where 'LinksUpdate::doUpdate' is in use is:
Empty list from api could be coming since https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Echo/+/619570 - because IS_MULTI also includes empty list (even when required)
HTTP request blocked: https://onionoo.torproject.org/details?type=relay&running=true&flag=Exit by TorExitNodes::fetchExitNodesFromOnionooServer. Use MockHttpTrait.
If you need an example: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/TocTree/+/639188
Tue, Nov 3
upstream reported - https://github.com/squizlabs/PHP_CodeSniffer/issues/3157
There is a GlobalIdGenerator in core, which could be used for UUIDs
There are too much cases where the use of ReflectionClass is still valid and not possible to replace with TestingAccessWrapper, so just decline the idea to document the fact.
Mon, Nov 2
There is also User::resetTokenFromOption, but the function is not deprecated.