Page MenuHomeDevCentral
Create Task
Maniphest T1367

Review and deploy extensions for Wolfplex wiki
Closed, ResolvedPublic
Actions

Description

I'm a little puzzled by the list of extensions used by the Wolfplex wiki.

It seems SMW was installed, probably to edit events in form mode.

grep from LocalSettings.php
require_once("$IP/extensions/SyntaxHighlight_GeSHi/SyntaxHighlight_GeSHi.php");
require_once($IP.'/extensions/Poem/Poem.php');
require_once("$IP/extensions/Cite/Cite.php");
require_once( "$IP/extensions/ParserFunctions/ParserFunctions.php" );
require_once( "$IP/extensions/Gadgets/Gadgets.php" );
require_once($IP . '/extensions/RawMsg.php');
require_once("{$IP}/extensions/CategoryTree/CategoryTree.php");
require_once( "$IP/extensions/ContactPage/ContactPage.php" );
require_once( "$IP/extensions/Vector/Vector.php" );
//require_once( "$IP/extensions/semantic-bundle/SemanticBundleSettings.php" );
//require_once( "$IP/extensions/semantic-bundle/SemanticBundle.php" );

Vector is not needed anymore, as it's full merged in core.

We also have this full list in the extensions directory:

AdminLinks                      DataTransfer                    RawMsg.php                      SemanticMaps
Akismet                         ExtensionFunctions.php          README                          SemanticMediaWiki
ApprovedRevs                    ExternalData                    ReplaceText                     SemanticResultFormats
ArrayExtension                  Gadgets                         semantic-bundle                 SemanticTasks
AzharAuthPlugin.php             HeaderTabs                      SyntaxHighlight_GeSHi
CategoryTree                    Maps                            SemanticCompoundQueries         Validator
Cite                            PageObjectModel                 SemanticDrilldown               Vector
ConfirmEdit                     ParserFunctions                 SemanticForms                   Widgets
ContactPage                     Poem                            SemanticInternalObjects

We should track the use for those extensions, and enable only the ones needed.

Furthermore, if it's only to provide forms, SMW is a no.

Revisions and Commits

rSAASMW SaaS MediaWiki
D1474rSAASMWc9fc6c7bb9ec Enable WolfplexMessages on www.wolfplex.org
D1505rSAASMW35f94c64c5d4 Enable Gadgets extension everywhere
D1509rSAASMWc928dd388feb Enable CategoryTree extension everywhere
D1495rSAASMWba09c6e89e0e Enable Poem extension everywhere
rOPS Nasqueron Operations
D1459rOPS947aba25ba7c Deploy ParserFunctions MediaWiki extension
D1494rOPS040a1dcede59 Deploy common MediaWiki extensions

Related Objects
Search...

Event Timeline

dereckson created this task.Mar 24 2018, 02:25
dereckson added a subscriber: ledesillusionniste.

@ledesillusionniste any souvenir about one of those wiki extensions and why/where it's needed?

dereckson added a revision: D1494: Deploy common MediaWiki extensions.Mar 24 2018, 02:28
dereckson updated the task description. (Show Details)Mar 24 2018, 02:32
dereckson updated the task description. (Show Details)
dereckson updated the task description. (Show Details)
dereckson added a commit: rOPS040a1dcede59: Deploy common MediaWiki extensions.Mar 24 2018, 02:40
dereckson added a commit: rSAASMWba09c6e89e0e: Enable Poem extension everywhere.Mar 24 2018, 02:45
dereckson added a revision: D1495: Enable Poem extension everywhere.
dereckson added a comment.Mar 26 2018, 02:01

The ParserFunctions extension is configured on Wolfplex to allow legacy string replace, pos, etc. operations but SQL queries to try to find them used in the actual content shows we don't have use that.

SELECT DISTINCT rev_page FROM mw_revision WHERE rev_text_id IN (
    SELECT old_id FROM mw_text WHERE old_text LIKE '%#replace%'
);
dereckson added a revision: D1509: Enable CategoryTree extension everywhere.Mar 26 2018, 02:06
dereckson added a commit: rSAASMWc928dd388feb: Enable CategoryTree extension everywhere.Mar 26 2018, 02:06
dereckson added a comment.Mar 26 2018, 02:08

Currently loaded extensions:

  • SyntaxHighlight_GeSHi
  • Poem
  • Cite
  • ParserFunctions
  • Gadgets (tested with HotCat, updated to use ResourceLoader)
  • ContactPage (configured)
  • CategoryTree

Not needed anymore:

  • Vector (merged into core)

The last remaining case is RawMsg, something I'm not glad to see used:
this extension allows to embed arbitrary HTMKL content, like a bunch of JavaScript code without any special rights to edit interface, so anyvody can write malicious content on the wiki.

dereckson closed subtask T1370: Hunt RawMsg role on Wolfplex wiki as Resolved.Mar 26 2018, 02:25
dereckson added a project: Mediawiki SaaS.Mar 26 2018, 16:22
dereckson set the cover image to Restricted File.Mar 26 2018, 16:29
dereckson closed this task as Resolved.Mar 26 2018, 16:33
dereckson claimed this task.
dereckson added commits: rOPS947aba25ba7c: Deploy ParserFunctions MediaWiki extension, rSAASMW35f94c64c5d4: Enable Gadgets extension everywhere, rSAASMWc9fc6c7bb9ec: Enable WolfplexMessages on www.wolfplex.org.
Nasqueron DevCentral · If it had been much bigger the moon would have had a core of ice. · Powered by Phabricator