Page MenuHomePhabricator

ashley (Jack Phoenix)
Senior Software Developer

Today

  • No visible events.

Tomorrow

  • No visible events.

Tuesday

  • No visible events.

User Details

User Since
Oct 4 2014, 1:59 PM (593 w, 19 h)
Availability
Available
IRC Nick
ashley
LDAP User
Jack Phoenix
MediaWiki User
Jack Phoenix [ Global Accounts ]

I've been developing MediaWiki since 2008, maintaining social tools as well as a few other extensions and skins.

Since 2013 I've had +2 rights to mediawiki/skins/* repositories.

I'm also a staff member at ShoutWiki, a wiki hosting service.

Recent Activity

Mon, Feb 9

ashley closed T413867: Enable Special:Mute by default and remove $wgEnableSpecialMute/$wgEnableUserEmailMuteList feature flags as unnecessary as Resolved.
Mon, Feb 9, 10:09 AM · MW-1.46-notes (1.46.0-wmf.15; 2026-02-10), MediaWiki-Special-pages

Sat, Jan 24

ashley moved T414876: ImageRating failing to list newest images when they are unrated from Backlog to ImageRating on the Social-Tools board.
Sat, Jan 24, 2:48 PM · Social-Tools, ImageRating
ashley moved T414874: ImageRating incompatible with MediaWiki 1.45's new categorylinks schema from Backlog to ImageRating on the Social-Tools board.
Sat, Jan 24, 2:48 PM · Social-Tools, affects-Miraheze, ImageRating

Sun, Jan 18

ashley added a comment to T414876: ImageRating failing to list newest images when they are unrated.

I'm not sure if this counts as a real bug since it's assumed that ImageRating only shows pages (in NS_FILE) which have the VoteNY star rating tag (<vote type=1 />) in them. Perhaps the UI/i18n could be made clearer to indicate that "newest" doesn't mean "newest uploads" but rather "newest uploads which have been tagged as rateable" or somesuch...

Sun, Jan 18, 12:52 AM · Social-Tools, ImageRating
ashley added a comment to T414874: ImageRating incompatible with MediaWiki 1.45's new categorylinks schema.

Per discussion at T412781: MediaWiki 1.45 incompatibility of BlogPage due to Categorylinks cl_to removal in 1.45, this is known but not a super high priority issue at the moment. Patches welcome, though! (As long as they retain MW 1.43 compatibility, per mw:Social tools/MediaWiki compatibility).

Sun, Jan 18, 12:49 AM · Social-Tools, affects-Miraheze, ImageRating

Jan 7 2026

ashley added a comment to T413927: Add a config option to disable private messages in UserBoard.

Also, one more thing I forgot...there's some UserBoard code in /extensions/SocialProfile/UserProfile/includes/UserProfilePage.php, function getUserBoard. As per the FIXME comment there, it's almost identical to some code in the UserBoard directory. That said, the code in UserProfilePage controls the message board shown on social profile pages, and it includes the message type selector, which the very least should not show the "private [message]" option in its drop-down menu if the backend is configured to not allow private messaging.

Jan 7 2026, 4:20 AM · Social-Tools, affects-Miraheze, SocialProfile
ashley moved T413927: Add a config option to disable private messages in UserBoard from Backlog to SocialProfile on the Social-Tools board.
Jan 7 2026, 4:07 AM · Social-Tools, affects-Miraheze, SocialProfile
ashley added a comment to T413927: Add a config option to disable private messages in UserBoard.

If only we had such speedy merges for MW core patches, then people might be actually incentivized to contribute more to core ;-)

Jan 7 2026, 4:06 AM · Social-Tools, affects-Miraheze, SocialProfile

Jan 6 2026

ashley moved T413867: Enable Special:Mute by default and remove $wgEnableSpecialMute/$wgEnableUserEmailMuteList feature flags as unnecessary from To triage to Other special pages on the MediaWiki-Special-pages board.
Jan 6 2026, 11:20 AM · MW-1.46-notes (1.46.0-wmf.15; 2026-02-10), MediaWiki-Special-pages
ashley created T413867: Enable Special:Mute by default and remove $wgEnableSpecialMute/$wgEnableUserEmailMuteList feature flags as unnecessary.
Jan 6 2026, 11:20 AM · MW-1.46-notes (1.46.0-wmf.15; 2026-02-10), MediaWiki-Special-pages

Jan 4 2026

ashley created T413734: Special:Mute: When the special page is accessed directly without a username, show a form for looking up a user name instead of an error message.
Jan 4 2026, 11:28 PM · MediaWiki-Special-pages

Dec 27 2025

ashley closed T318890: Remove use of User::isBlockedGlobally in Comments extension as Resolved.

Fixed now that https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Comments/+/1221102 got merged.

Dec 27 2025, 3:48 AM · Product Safety and Integrity, Social-Tools, MediaWiki-extensions-Comments, MediaWiki-Blocks
ashley moved T288596: Extension: Comments: Auto-activate comments on all talk pages from Backlog to Feature Request on the MediaWiki-extensions-Comments board.
Dec 27 2025, 3:42 AM · Social-Tools, MediaWiki-extensions-Comments
ashley moved T232217: Comments should allow comment box to be moved to top of comments section from Backlog to Feature Request on the MediaWiki-extensions-Comments board.
Dec 27 2025, 3:42 AM · Patch-For-Review, affects-Miraheze, Social-Tools, MediaWiki-extensions-Comments
ashley moved T195348: Unregistered commenters should be able to provide a display name (like in WordPress) from Backlog to Feature Request on the MediaWiki-extensions-Comments board.
Dec 27 2025, 3:41 AM · Social-Tools, MediaWiki-extensions-Comments
ashley moved T413527: "Comments.Comment_IP isn't in GROUP BY SELECT" when using MariaDB with Strict Mode enabled from Backlog to Bugs on the MediaWiki-extensions-Comments board.
Dec 27 2025, 3:41 AM · Social-Tools, MediaWiki-extensions-Comments
ashley moved T413527: "Comments.Comment_IP isn't in GROUP BY SELECT" when using MariaDB with Strict Mode enabled from Backlog to Comments on the Social-Tools board.
Dec 27 2025, 3:41 AM · Social-Tools, MediaWiki-extensions-Comments

Dec 21 2025

ashley moved T412781: MediaWiki 1.45 incompatibility of BlogPage due to Categorylinks cl_to removal in 1.45 from Backlog to Bugs on the BlogPage board.
Dec 21 2025, 2:21 AM · Patch-For-Review, Social-Tools, BlogPage
ashley moved T412781: MediaWiki 1.45 incompatibility of BlogPage due to Categorylinks cl_to removal in 1.45 from Backlog to BlogPage on the Social-Tools board.
Dec 21 2025, 2:20 AM · Patch-For-Review, Social-Tools, BlogPage

Dec 20 2025

ashley closed T152363: Replace SiteMetrics' usage of the Google Chart API as Resolved.

Calling an external service, even if not a proprietary one, isn't still ideal, but in the strictest sense of how this task is worded, this is now done that SiteMetrics uses QuickCharts instead and it actually displays some output, once again.

Dec 20 2025, 11:04 PM · Technical-Debt, Social-Tools, SiteMetrics
ashley closed T157984: Cannot accept account request if 'real name' is a hidden preference as Resolved.
Dec 20 2025, 7:55 PM · MediaWiki-extensions-ConfirmAccount

Dec 17 2025

ashley updated subscribers of T412781: MediaWiki 1.45 incompatibility of BlogPage due to Categorylinks cl_to removal in 1.45.

Thanks for the report. This is sorta known (to me), but there wasn't a ticket for BlogPage prior to this, let alone any of the other extensions also impacted by this change.

Dec 17 2025, 5:27 AM · Patch-For-Review, Social-Tools, BlogPage

Dec 1 2025

ashley closed T136525: Create better source code documentation for MediaWikiChat extension as Resolved.

"Improve documentation" type tasks are basically neverending...but I'm still gonna close this.

Dec 1 2025, 9:32 PM · Documentation, MediaWikiChat, Brickimedia

Nov 30 2025

ashley closed T373263: Drop unused fields from the user_profile table as Resolved.
Nov 30 2025, 2:12 PM · Social-Tools, Technical-Debt, SocialProfile

Nov 28 2025

ashley closed T265807: CI failures related to SocialProfile affecting other repositories for patches being submitted on the REL1_34 and REL1_35 branch, but not master as Declined.

Closing this because MW 1.35 reached its end-of-life in December 2023.

Nov 28 2025, 7:34 PM · SocialProfile, Social-Tools, ci-test-error

Oct 4 2025

ashley claimed T406412: The Refreshed-this-wiki-wordmark message is ignored, if $wgLogos['wordmark'] is set.

Please try out the aforementioned patch to see if it fixes this issue for you.

Oct 4 2025, 4:22 PM · Patch-For-Review, Refreshed
ashley moved T302636: "Add row" button missing in VisualEditor from Backlog to Bugs on the Refreshed board.
Oct 4 2025, 4:21 PM · Refreshed
ashley moved T406412: The Refreshed-this-wiki-wordmark message is ignored, if $wgLogos['wordmark'] is set from Backlog to Bugs on the Refreshed board.
Oct 4 2025, 4:20 PM · Patch-For-Review, Refreshed

Sep 30 2025

ashley added a comment to T405988: SystemGifts not awarding despite meeting threshold.

Nevermind, I just realized that running UserStats:updateUserStats.php fixes it.

Sep 30 2025, 8:24 PM · Social-Tools, affects-Miraheze, SocialProfile

Sep 27 2025

ashley closed T403131: Provide a way to retrieve a page’s rating in MediaWiki API as Resolved.
Sep 27 2025, 8:45 AM · affects-Miraheze, ArticleRatings

Sep 21 2025

ashley closed T25791: SelectCategory removes Category assignments within <pre>- and <nowiki> -tags as Resolved.
Sep 21 2025, 7:46 AM · MediaWiki-extensions-SelectCategory
ashley closed T10359: add option to not strip categories from input as Resolved.
Sep 21 2025, 7:46 AM · MediaWiki-extensions-SelectCategory

Sep 8 2025

ashley added a comment to T403924: CVE-2025-62654: Stored XSS through system messages in QuizGame.

LGTM with the same caveats/question as in T403923#11158964.

The module already depends on jQueryMsg since 505a46a71594b8302677ff650aa0fa3473604b7a.

Ah, awesome; I didn't check, as you can tell. ;-)

Sep 8 2025, 6:08 PM · Social-Tools, SecTeam-Processed, Vuln-XSS, QuizGame, affects-Miraheze, Security, Security-Team
ashley added a comment to T403923: CVE-2025-62653: Stored XSS through system messages in PollNY.

In theory you do need to, but in this case, there is already an indirect dependency on jQueryMsg through mediawiki.api. Though of course, it would be safer to still add an explicit dependency on jQueryMsg.

Updated patch with jQueryMsg as a dependency:

Awesome, feel free to push this to gerrit whenever you're ready! 🎉

Sep 8 2025, 5:25 PM · Social-Tools, SecTeam-Processed, PollNY, Vuln-XSS, affects-Miraheze, Security, Security-Team
ashley removed a project from T155949: Trying to mark the state of a feedback can return a database error and disable the ability to mark the state: Social-Tools.
Sep 8 2025, 5:12 PM · Brickimedia, ArticleFeedbackv5
ashley closed T155264: Decrease heavy (800) font weight in SocialProfile modules to 700 as Resolved.

Closing per T155264#10833050.

Sep 8 2025, 5:12 PM · RoadToWiki, Patch-Needs-Improvement, good first task, CSS, Design, SocialProfile, Social-Tools
ashley moved T401998: ImageRating: Mixing of GROUP columns (MIN(),MAX(),COUNT(),...) with no GROUP columns is illegal if there is no GROUP BY clause from Backlog to ImageRating on the Social-Tools board.
Sep 8 2025, 5:09 PM · Social-Tools, ImageRating
ashley moved T403923: CVE-2025-62653: Stored XSS through system messages in PollNY from Backlog to PollNY on the Social-Tools board.
Sep 8 2025, 5:09 PM · Social-Tools, SecTeam-Processed, PollNY, Vuln-XSS, affects-Miraheze, Security, Security-Team
ashley moved T403924: CVE-2025-62654: Stored XSS through system messages in QuizGame from Backlog to QuizGame on the Social-Tools board.
Sep 8 2025, 5:09 PM · Social-Tools, SecTeam-Processed, Vuln-XSS, QuizGame, affects-Miraheze, Security, Security-Team
ashley added a project to T403924: CVE-2025-62654: Stored XSS through system messages in QuizGame: Social-Tools.

LGTM with the same caveats/question as in T403923#11158964.

Sep 8 2025, 5:09 PM · Social-Tools, SecTeam-Processed, Vuln-XSS, QuizGame, affects-Miraheze, Security, Security-Team
ashley added a project to T403923: CVE-2025-62653: Stored XSS through system messages in PollNY: Social-Tools.

Patch LGTM (not tested though, but I trust you), though I wonder...do the formats like .escaped(), .parse() etc. work just like that, i.e. don't you need to declare a dependency on mediawiki.jqueryMsg? (I think at one point you needed to, but that was literally years ago and core probably has changed a fair bit since that.)

Sep 8 2025, 5:08 PM · Social-Tools, SecTeam-Processed, PollNY, Vuln-XSS, affects-Miraheze, Security, Security-Team

Aug 28 2025

ashley added a comment to T403131: Provide a way to retrieve a page’s rating in MediaWiki API.

^It's something. It helped a bit that I had the most of it already written for a different extension (VoteNY), I just had to adapt said uncommitted code a bit for ARE. :-)

Aug 28 2025, 8:26 PM · affects-Miraheze, ArticleRatings

Aug 27 2025

ashley added a comment to T403120: Pages sometimes appear multiple times in Special:MassRatings.

Would be very interesting to see what's going on in the ratings DB table...one thing is that unlike e.g. the core page table, the ratings table lacks a UNIQUE INDEX which'd enforce that only one key-value pair with the same data can exist.

Aug 27 2025, 9:03 PM · affects-Miraheze, ArticleRatings
ashley triaged T403116: Unclear or ineffective category field in MediaWiki:Are-ratings configuration as Low priority.

First off, full disclaimer: I didn't check all of the 2014-era commits. That being said, I feel pretty confident in saying it's a feature that may have once been planned for ARE, but was never written, and the codebase has no special handling whatsoever for a value called category.
The Rating class only cares about codename, name, img and link -- that's all.

Aug 27 2025, 8:54 PM · Documentation, ArticleRatings

Aug 21 2025

ashley updated subscribers of T57734: Word count for field "Biography" ignores non-latin.

This is because internally ConfirmAccount uses PHP's str_word_count (line 141 of /includes/business/AccountRequestSubmission.php as of the master version of the extension), which is known to be buggy for UTF-8 characters.

Aug 21 2025, 9:12 PM · I18n, MediaWiki-extensions-ConfirmAccount
ashley closed T347128: Remove use of UserLoginForm and UserCreateForm hooks from ConfirmAccount as Resolved.

Done by @Fomafix in 357fd5545e4df29995827a571cad26352e56c131.

Aug 21 2025, 8:51 PM · MediaWiki-extensions-ConfirmAccount
ashley closed T401505: Integrate ConfirmAccountSpam gadget into extension as Resolved.
Aug 21 2025, 8:49 PM · MediaWiki-extensions-ConfirmAccount
ashley closed T394717: ConfirmAccount exception due to Title class as Resolved.
Aug 21 2025, 8:48 PM · MediaWiki-extensions-ConfirmAccount
ashley closed T402580: Fix "Creation of dynamic property ConfirmAccountsPager::$xxx is deprecated" issue as Invalid.

As far as I can see, @MarkAHershberger fixed this already back in January in 6efc92baa2ee2ab5a25451c3db101a5e6e781ae5 while working on T379300.

Aug 21 2025, 8:47 PM · MediaWiki-extensions-ConfirmAccount
ashley closed T379300: Add hook to ConfirmAccount to filter out requests as Resolved.

Patch got merged back in January, so I think this is now fixed.

Aug 21 2025, 8:46 PM · MediaWiki-extensions-ConfirmAccount

Aug 18 2025

ashley merged T402238: Setting a birthday without specifying a year causes an incorrect year to be displayed into T391053: Wrong birthday displayed when "Show year of birth" unchecked.
Aug 18 2025, 11:22 PM · affects-Miraheze, Social-Tools, SocialProfile
ashley merged task T402238: Setting a birthday without specifying a year causes an incorrect year to be displayed into T391053: Wrong birthday displayed when "Show year of birth" unchecked.
Aug 18 2025, 11:22 PM · Social-Tools, affects-Miraheze, SocialProfile

Aug 15 2025

ashley added a comment to T402002: CVE-2025-62664: Stored XSS through a system message in ImageRating.

Patch:

LGTM, nice catch! 👍

Would you be able to +2 it if I uploaded it to gerrit shortly?

Aug 15 2025, 11:35 AM · Social-Tools, SecTeam-Processed, Vuln-XSS, ImageRating, affects-Miraheze, Security, Security-Team
ashley added a comment to T401998: ImageRating: Mixing of GROUP columns (MIN(),MAX(),COUNT(),...) with no GROUP columns is illegal if there is no GROUP BY clause.

So this is some strict SQL mode thing; WMF CI enforces stricter SQL stuff than what many installations in practise do, and the same appears to be true of my dev environment, and it goes without saying that Aaron, Dave & co. weren't very strict at all about these sorta things way back in the early-to-mid 2000s...

Aug 15 2025, 11:34 AM · Social-Tools, ImageRating
ashley added a comment to T402002: CVE-2025-62664: Stored XSS through a system message in ImageRating.

Patch:

Aug 15 2025, 11:30 AM · Social-Tools, SecTeam-Processed, Vuln-XSS, ImageRating, affects-Miraheze, Security, Security-Team

Aug 11 2025

ashley closed T61995: {{PAGENAME}} shown in comment when uploading a new file and selecting a category as Invalid.

Not reproducible on current master on MW 1.43 at least when using Chosen (which is nowadays the default, instead of the treeview-based previous thing). With Chosen, if I choose categories "Foo Bar" and "Baz", they are shown in the summary with the localized category name as their prefix, but that's it - no reference to {{PAGENAME}} anywhere, and even the PHP source has only one reference to it in a regex.

Aug 11 2025, 3:41 PM · MediaWiki-extensions-SelectCategory
ashley closed T133138: "jQuery is not defined" in SelectCategory since 1.26 as Resolved.
Aug 11 2025, 1:29 PM · MediaWiki-extensions-SelectCategory
ashley assigned T133138: "jQuery is not defined" in SelectCategory since 1.26 to tosfos.

Being bold and assuming this was fixed back in 2016/2017 by @tosfos' 363d0e09353a79c81c22a09800255a4722af0aea, thus closing this task.
Feel free to reopen if it's still happening on current master with a currently supported version of MediaWiki core. (Note that as of 64834d8a5145c610fd3867807705765bfbf37677 the Chosen-based selector instead of the treeview-based one is used by default.)

Aug 11 2025, 1:29 PM · MediaWiki-extensions-SelectCategory

Aug 4 2025

ashley closed T24716: SelectCategory collides with CategoryOnUpload on upload as Resolved.

The CategoryOnUpload extension got archived in very early 2019. As of today, SelectCategory's support for Special:Upload should be decent. Please make sure you're running MediaWiki 1.43 (or newer) and update your copy of SelectCategory to git master to pick up the latest changes. Please feel free to report back with any and all issues you may still encounter. Thanks!

Aug 4 2025, 12:19 PM · MediaWiki-extensions-SelectCategory
ashley closed T104054: SelectCategory - prevents editing pages as Declined.

Closing this as unactionable, since:

  • this ticket hasn't seen any action in over a decade
  • the wiki mentioned is gone
  • I wasn't able to reproduce this locally last year when I worked on cleaning up and improving SelectCategory
Aug 4 2025, 12:17 PM · MediaWiki-extensions-SelectCategory
ashley closed T193479: Category tree doesn't expand - failed to open stream: No such file or directory in LocalSettings.php as Invalid.

This sounds like a file permissions related local issue.

Aug 4 2025, 12:14 PM · MediaWiki-extensions-SelectCategory
ashley closed T167220: PHP Notice when uploading a file: "Undefined property: SpecialUpload::$mUploadDescription" as Resolved.

Fixed in this patch.

Aug 4 2025, 12:08 PM · MediaWiki-extensions-SelectCategory
ashley removed a project from T204325: Convert SelectCategory to use extension registration: Patch-Needs-Improvement.
Aug 4 2025, 11:57 AM · MediaWiki-extensions-SelectCategory
ashley closed T204325: Convert SelectCategory to use extension registration, a subtask of T98668: Convert all extensions and skins on gerrit to use extension registration, as Resolved.
Aug 4 2025, 11:57 AM · Google-Code-in-2019, Google-Code-in-2018, MediaWiki-extensions-General, Goal, MediaWiki-Configuration
ashley closed T204325: Convert SelectCategory to use extension registration as Resolved.

Now done.

Aug 4 2025, 11:57 AM · MediaWiki-extensions-SelectCategory

Jul 14 2025

ashley added a comment to T399368: ProtectSite extension doesn't respect users in required groups when disallow certain actions.

So I was able to partially confirm this on latest master of ProtectSite w/ MW 1.43.0. I'm able to edit pages just fine but the account creation part indeed fails and throws an error message, despite that regular users should be able to create accounts.
The bug is most likely in ProtectSite#setup, likely related to these two lines:

			$wgGroupPermissions['*']['createaccount'] = ( $wgGroupPermissions['*']['createaccount'] ?? false ) && !( $prot['createaccount'] >= 1 );
			$wgGroupPermissions['user']['createaccount'] = ( $wgGroupPermissions['user']['createaccount'] ?? false ) && !( $prot['createaccount'] == 2 );

since changing the latter conditional to $wgGroupPermissions['user']['createaccount'] = !( $prot['createaccount'] == 2 ); does seemingly fix this issue, but I think it also reintroduces T273687.

Jul 14 2025, 2:56 AM · MediaWiki-extensions-ProtectSite

Jul 11 2025

ashley created T399252: CheckUser's UserInfoCard Service test causing CI failures in SocialProfile and other repos related to/depending on SocialProfile due to the TitleIsAlwaysKnown hook handler (simulation).
Jul 11 2025, 2:11 AM · OKR-Work, MW-1.45-notes (1.45.0-wmf.12; 2025-07-29), Trust and Safety Product Sprint (Sprint Cannoli (July 7 - July 25)), Social-Tools, Trust and Safety Product Team, Refreshed, SocialProfile, ci-test-error, CheckUser-UserInfoCard

Jul 8 2025

ashley added a comment to T399024: Use of string return from LookupUser::getDescription().

Already fixed on master in e52ad4b712ed392901df75dca348b54b0807c57b in late March 2025.

Jul 8 2025, 9:17 PM · LookupUser
ashley added a comment to T398876: Should we keep Special:Captcha around?.

What kind of a(n) (no-JS-friendly) alternative do you propose?

Jul 8 2025, 6:55 AM · ConfirmEdit (CAPTCHA extension)

Jul 6 2025

ashley added a comment to T398758: [[MediaWiki:Timedmedia-in-job-queue]] is untranslatable due to concatenation.

I suppose this is yet another instance of T69959.

Jul 6 2025, 10:11 AM · TimedMediaHandler, I18n

Jul 4 2025

ashley closed T376527: Extend the StaffEdit extension to add other tags as Resolved.

Thanks @Seb35 for your work on this! 👍 🎉

Jul 4 2025, 11:35 PM · MediaWiki-extensions-StaffEdits

Jun 17 2025

ashley moved T396956: Text above headings not selectable when using Skin:Refreshed from Backlog to Bugs on the Refreshed board.
Jun 17 2025, 8:59 AM · affects-Miraheze, Refreshed

Jun 16 2025

ashley updated subscribers of T396956: Text above headings not selectable when using Skin:Refreshed.

I suspect that what you really want is to set https://developer.mozilla.org/en-US/docs/Web/CSS/scroll-padding-top on the html node in CSS (equal to the height of the sticky header), and remove that JS code entirely.

Jun 16 2025, 1:28 PM · affects-Miraheze, Refreshed

Jun 7 2025

ashley added a comment to T395949: CVE-2025-53489: Improperly sanitized style parameter in GoogleDocs4MW.

It's really more about finding maintainers than about the actual usage of an extension or skin. The current Developers/Maintainers page is pretty laughably out-of-date and flawed in other ways.

Indeed, but at least it's translated into various non-English languages. ;-)

Jun 7 2025, 1:03 AM · Vuln-Infoleak, SecTeam-Processed, affects-Miraheze, MediaWiki-extensions-GoogleDocs4MW, Security

Jun 5 2025

ashley added a comment to T395949: CVE-2025-53489: Improperly sanitized style parameter in GoogleDocs4MW.

@SomeRandomDeveloper: Very nice find and detailed write-up and functional patch, thanks for all this! 😍 Patch is fine to land as-is, but mandatory nitpicks:

  • might be worthwhile to bump the extension's version number in extension.json
  • likewise, I'd suggest making the minimum required MW version 1.43 as (per mw:Version lifecycle) it's the current LTS version and the namespaced Html class is available there; otherwise I'd suggest 1.39, which is the legacy LTS version, but the namespaced Html class is not available there; either way, 1.40.x series reached their EOL about a year ago
  • if going with the 1.43 suggestion, might add a use MediaWiki\Parser\Sanitizer; statement to the top of the file as well as the Sanitizer class is namespaced in MW 1.43(+)
  • I'd suggest decreasing indentation on patch lines 71-76 by one
Jun 5 2025, 1:41 AM · Vuln-Infoleak, SecTeam-Processed, affects-Miraheze, MediaWiki-extensions-GoogleDocs4MW, Security

May 29 2025

ashley created T395570: PageInCat extension: E_NOTICEs: "Undefined property: Parser::$PageInCat_cache" and "Indirect modification of overloaded property Parser::$PageInCat_cache has no effect".
May 29 2025, 2:29 PM · Brickimedia, ShoutWiki, MediaWiki-extensions-Other

May 22 2025

ashley added a comment to T394564: Migrate some uses of EchoGetDefaultNotifiedUsers hook to locators.

There are a few more extensions maintained in Gerrit, I'll submit patches for them as well

Thank you for this, and thank you for setting a good example to other people and teams on how these kind of changes should be handled! ❤

May 22 2025, 5:57 PM · MW-1.45-notes (1.45.0-wmf.3; 2025-05-27), Technical-Debt, MediaWiki-Platform-Team, Notifications (Echo), Growth-Team, MediaWiki-Core-Notifications

May 18 2025

ashley added a comment to T394590: CVE-2025-53486: Reflected XSS in WikiCategoryTagCloud.

Thanks for the quick response and for merging my patch! Would it be possible (or necessary?) to backport this patch to other branches as well? Especially REL1_39, REL1_42, REL1_43 and REL1_44, since those versions of MediaWiki are still supported

May 18 2025, 9:54 PM · WikiCategoryTagCloud, Vuln-XSS, affects-Miraheze, Security, Security-Team
ashley closed T394590: CVE-2025-53486: Reflected XSS in WikiCategoryTagCloud as Resolved.

Thank you for the detailed write-up, and, naturally, for the patch as well! ❤ I've applied it against gerrit master and merged the patch (rEWCTbee952ba5da2: [SECURITY] Prevent reflected XSS via the linkstyle attribute by using the Html…).

May 18 2025, 4:45 PM · WikiCategoryTagCloud, Vuln-XSS, affects-Miraheze, Security, Security-Team

Apr 26 2025

ashley added a comment to T278033: Upgrade testing-Wikimini from MediaWiki 1.28.0 to 1.39.

I no longer have a 1.39 box to test with, but this might be resolvable with this VE patch (which was backported to REL1_39 as well). If memory serves me correctly, I did have VE working under 1.39 just fine; it definitely works under MW 1.43.0 with no related changes to the skin. (For 1.43, there are two tiny PHP-level changes needed to get rid of some deprecation notices and whatnot, and a whole bunch of LESS changes related to the .background-image mixin to unbreak the skin for 1.43.0; again, as you're targeting 1.39, it should just work.)

Apr 26 2025, 2:57 AM · Wikimini.org, WMCH-Infrastructure

Apr 20 2025

ashley added a comment to T159062: Merge UnusedRedirects extension functionality into MediaWiki core.

There are already too many editors out there who believe redirects are "bad"; adding this functionality to core would only validate that view by providing them with a maintenance report which existence implicitly claims that certain redirects are categorically bad (similar maintenance reports indicate problems that need to be fixed, providing an obvious parallel argument).

Apr 20 2025, 12:24 AM · MediaWiki-Special-pages, Technical-Debt, Brickimedia, UnusedRedirects

Apr 19 2025

ashley closed T272226: Special:TopRatings doesn't sort results as Resolved.

Hopefully it's a bit better now. :)

Apr 19 2025, 5:11 PM · Social-Tools, VoteNY
ashley triaged T152363: Replace SiteMetrics' usage of the Google Chart API as High priority.

Raising priority now that the Google Charts API is gone for good and that part of Special:SiteMetrics is broken (yet it still pings Google's servers, of course, until this ticket is resolved...).

Apr 19 2025, 4:33 PM · Technical-Debt, Social-Tools, SiteMetrics
ashley moved T152363: Replace SiteMetrics' usage of the Google Chart API from Feedback to Bugs on the SiteMetrics board.
Apr 19 2025, 4:32 PM · Technical-Debt, Social-Tools, SiteMetrics
ashley merged T392336: Special:SiteMetrics is broken, as Google has finally phased out their Charts API; come up with a functional FOSS replacement into T152363: Replace SiteMetrics' usage of the Google Chart API.
Apr 19 2025, 4:31 PM · Technical-Debt, Social-Tools, SiteMetrics
ashley merged task T392336: Special:SiteMetrics is broken, as Google has finally phased out their Charts API; come up with a functional FOSS replacement into T152363: Replace SiteMetrics' usage of the Google Chart API.
Apr 19 2025, 4:31 PM · Social-Tools, SiteMetrics
ashley moved T392336: Special:SiteMetrics is broken, as Google has finally phased out their Charts API; come up with a functional FOSS replacement from Backlog to Bugs on the SiteMetrics board.
Apr 19 2025, 4:31 PM · Social-Tools, SiteMetrics
ashley triaged T392336: Special:SiteMetrics is broken, as Google has finally phased out their Charts API; come up with a functional FOSS replacement as High priority.
Apr 19 2025, 4:31 PM · Social-Tools, SiteMetrics
ashley created T392336: Special:SiteMetrics is broken, as Google has finally phased out their Charts API; come up with a functional FOSS replacement.
Apr 19 2025, 4:30 PM · Social-Tools, SiteMetrics

Apr 14 2025

ashley closed T391901: Get rid of Flash support code as Resolved.
Apr 14 2025, 10:42 PM · QuizGame, PollNY, PictureGame, SocialProfile, Social-Tools
ashley created T391901: Get rid of Flash support code.
Apr 14 2025, 9:46 PM · QuizGame, PollNY, PictureGame, SocialProfile, Social-Tools

Apr 12 2025

ashley edited Description on Social-Tools.
Apr 12 2025, 7:26 PM

Apr 11 2025

ashley closed T391541: HAWelcome rendering PAGENAME as bad title as Resolved.
Apr 11 2025, 8:03 PM · HAWelcome, affects-Miraheze

Apr 10 2025

ashley claimed T391541: HAWelcome rendering PAGENAME as bad title .
Apr 10 2025, 2:25 PM · HAWelcome, affects-Miraheze

Apr 9 2025

ashley changed the subtype of T391053: Wrong birthday displayed when "Show year of birth" unchecked from "Task" to "Bug Report".
Apr 9 2025, 9:49 PM · affects-Miraheze, Social-Tools, SocialProfile

Apr 5 2025

ashley closed T325830: User subpages throw an error in 1.39 when Social Profile is active as Invalid.

No activity in almost two years now and I was never able to reproduce this issue, so unfortunately closing this. Please feel free to reopen if the problem persists under the current LTS release (which is 1.43 as of now) and you have more details on the issue. Thanks!

Apr 5 2025, 5:52 PM · Social-Tools, SocialProfile
ashley moved T373263: Drop unused fields from the user_profile table from Backlog to Feedback on the SocialProfile board.
Apr 5 2025, 5:48 PM · Social-Tools, Technical-Debt, SocialProfile
ashley moved T391053: Wrong birthday displayed when "Show year of birth" unchecked from Backlog to Bugs on the SocialProfile board.
Apr 5 2025, 5:48 PM · affects-Miraheze, Social-Tools, SocialProfile
ashley moved T391053: Wrong birthday displayed when "Show year of birth" unchecked from Backlog to SocialProfile on the Social-Tools board.
Apr 5 2025, 5:47 PM · affects-Miraheze, Social-Tools, SocialProfile
ashley triaged T391053: Wrong birthday displayed when "Show year of birth" unchecked as Medium priority.

Confirmed. This is my fault, I introduced this bug in b9c7ebe0556434b848d02101e9b8cec9288d8208 while fixing T363693.

Apr 5 2025, 5:47 PM · affects-Miraheze, Social-Tools, SocialProfile