20 months agoPrepare 1.31.4 1.31.4
Reedy [Sat, 21 Sep 2019 21:33:26 +0000 (22:33 +0100)]
Prepare 1.31.4

Change-Id: I21a8dbeed30df0e8d3a1063e8d10eaa5e9c9ad77

20 months agoSQLite: Make patch-add-3d.sql a no-op
Brad Jorsch [Wed, 21 Nov 2018 16:13:52 +0000 (11:13 -0500)]
SQLite: Make patch-add-3d.sql a no-op

On a fresh install, update.php will apply patch-add-3d.sql even though
it doesn't need to. But this partially wipes out the new schema from
tables.sql, and the omnibus comment and actor table patched don't detect
this, leading to image, oldimage, and filearchive missing the new

Since SQLite doesn't actually care about the values in the ENUM type
(it's just an alias for TEXT), let's just make patch-add-3d.sql do

Change-Id: I335cb8d9626f535a66b0fe18e051640b22848ef7

20 months agoSplit down patch-actor-table.sql
Reedy [Sat, 28 Sep 2019 14:48:19 +0000 (15:48 +0100)]
Split down patch-actor-table.sql

Bug: T227662
Change-Id: I024ff1d6f4c2726242138ba7e7f19480d9d2b948

20 months agoSQLite: Split actor and comment filearchive updates to a separate file
Brad Jorsch [Wed, 28 Nov 2018 18:53:17 +0000 (13:53 -0500)]
SQLite: Split actor and comment filearchive updates to a separate file

On a fresh install, update.php will apply patch-editsummary-length.sql
even though it doesn't need to. But this partially wipes out the new schema from
tables.sql, and the omnibus comment and actor table patches don't detect
this, leading to filearchive missing the new fields.

Unlike the case with patch-add-3d.sql in I335cb8d9, here the patch does
make a change (if only a tiny one): fa_deleted_reason changes from TEXT
to BLOB.

Change-Id: I08047ff1207d471660365c0eb3faabc0b47746bb

20 months agoSplit down patch-comment-table.sql
Reedy [Thu, 15 Aug 2019 13:36:53 +0000 (14:36 +0100)]
Split down patch-comment-table.sql

Bug: T227662
Change-Id: I7617616df57f7468d06e9b52426b6851bfef0e7d

20 months agoUpdate RELEASE-NOTES
Reedy [Sat, 21 Sep 2019 21:15:41 +0000 (22:15 +0100)]

Change-Id: Iba71a248ecbdc188c131609a5b65e004547c771e

20 months agodispatchUser() should use a 302 http status code
sbassett [Tue, 27 Aug 2019 20:55:39 +0000 (15:55 -0500)]
dispatchUser() should use a 302 http status code

dispatchUser() in SpecialRedirect.php should use a 302 http
status code instead of a 301 to avoid certain caching issues.

Bug: T231386
Change-Id: Idb0cb21cc81d73bb9f77fc211af9cfd8b4f71e7d
(cherry picked from commit 02f35caa16fa574bb36a1d22eea62c3b250de235)

20 months agoCache redirects from Special:Redirect
Brian Wolff [Fri, 1 Feb 2019 01:54:08 +0000 (01:54 +0000)]
Cache redirects from Special:Redirect

People sometimes link these from high traffic places, so it is
important to cache in varnish.

File's with height can change so only cache that for 10 seconds.

Also change from 302 to 301.

Change-Id: I87a60c812cd1aa78a36359090c0cb8390be7183f
(cherry picked from commit f661f3373eb500949b7e421b0df5a955d2904809)

20 months agoGive more specific error messages on Special:Redirect
Umherirrender [Sat, 18 Aug 2018 02:37:59 +0000 (04:37 +0200)]
Give more specific error messages on Special:Redirect

Added some basic tests

Bug: T202183
Change-Id: Ib0dd50ff5575a2b2093a57afce79e9f8623fa24d
(cherry picked from commit 114e6547dea1a2508fe24889d65221af0163622a)

20 months agoImprove documentation for the MinimumPasswordLengthToLogin policy
Thalia [Tue, 17 Sep 2019 19:16:05 +0000 (20:16 +0100)]
Improve documentation for the MinimumPasswordLengthToLogin policy

Bug: T233119
Change-Id: I2d0fa6f7116b407cbf62ad93da73d0800c9d14f9

21 months agoUpdate RELEASE-NOTES-1.31
Reedy [Thu, 12 Sep 2019 11:22:20 +0000 (12:22 +0100)]

Change-Id: Idcec102a3bd9e3a6c83755fd429a687d5dce1066

21 months agoFix XMP parser errors due to trailing nullchar
Derk-Jan Hartman [Wed, 11 Sep 2019 22:12:22 +0000 (00:12 +0200)]
Fix XMP parser errors due to trailing nullchar

JPEG files can have trailing \0 chars at the end of the XMP value. Use
trim() to remove these from the string value.

Bug: T118799
Change-Id: Id4ab223ef432e5d2c0dd3b4e332320db02422700
(cherry picked from commit 9ce26a564d066a33ba7ae2a6502e3d57e7e4d48b)

21 months agoMerge "SECURITY: Add permission check for suppressed account" into REL1_31
Jforrester [Wed, 21 Aug 2019 16:57:32 +0000 (16:57 +0000)]
Merge "SECURITY: Add permission check for suppressed account" into REL1_31

21 months agoAdd helper for HTTPFileStreamer header syntax
Gergő Tisza [Sat, 20 Apr 2019 00:12:59 +0000 (17:12 -0700)]
Add helper for HTTPFileStreamer header syntax

Adds a helper function for transforming an intuitive header array
to the peculiar syntax expected by HTTPFileStreamer and the related
FileRepo/FileBackend streaming methods.

Change-Id: Idac9281b0f1b3c93f4ec1d1c3f336db110e5d260
(cherry picked from commit 65648f5523c9d1b772106e16e2adf57870892bc7)

21 months agoSECURITY: Add permission check for suppressed account
rxy [Tue, 13 Aug 2019 09:30:38 +0000 (18:30 +0900)]
SECURITY: Add permission check for suppressed account

Bug: T230402
Change-Id: I6a13859be81e5c746bdf0993eb5416fecdac2306
(cherry picked from commit 4356572546b2b4e8eefda9bf10943ba1b12526b9)

22 months agoAdd ImgAuthModifyHeaders hook to img_auth.php to modify headers
James Montalvo [Fri, 15 Mar 2019 04:03:29 +0000 (23:03 -0500)]
Add ImgAuthModifyHeaders hook to img_auth.php to modify headers

Change-Id: I3c6fd7b0c39d7fd52c484494233241093d152f88

22 months agoUpdate LanguageTrTest::testDottedAndDotlessI for PHP 7.3
Santhosh Thottingal [Tue, 23 Jul 2019 06:50:52 +0000 (12:20 +0530)]
Update LanguageTrTest::testDottedAndDotlessI for PHP 7.3

PHP 7.3+ uses Unicode CaseFolding.txt for case mappings. For Turkic
languages(tr,az) the dotted i is given as a special case and we need
to implement it specifically for tr and az.

Updated the documentation and refactored the lcfirst and ucfirst methods
to use arrays containing the above mentioned special cases.

Bug: T207100
Change-Id: I317f2ca66b0adeaa79bc0f9e3dea5edfcd5e4693
(cherry picked from commit 27b424066453d59eeceda48a43d51e4915da960d)

23 months agoAdd 1.31.4 section to RELEASE-NOTES
Reedy [Mon, 1 Jul 2019 23:40:46 +0000 (00:40 +0100)]
Add 1.31.4 section to RELEASE-NOTES

Change-Id: I20f691740d2e79914816b0a297027933f074280b

23 months agoPrepare 1.31.3 1.31.3
Reedy [Mon, 1 Jul 2019 23:40:03 +0000 (00:40 +0100)]
Prepare 1.31.3

Bug: T227046
Change-Id: I0758709c11c68bb46573198903c88ba390c8ec8d

23 months agoAdd missing RELEASE-NOTES entries
Reedy [Sun, 30 Jun 2019 22:44:23 +0000 (23:44 +0100)]
Add missing RELEASE-NOTES entries

Change-Id: I55f69c01045be8752b396e3acc506e531aa9cc81

23 months agoFix SQLite patch-(page|template)links-fix-pk.sql column order
Reedy [Sun, 30 Jun 2019 16:47:53 +0000 (17:47 +0100)]
Fix SQLite patch-(page|template)links-fix-pk.sql column order

Bug: T202211
Change-Id: Ife673b88c23acdc1bfc04630715d18243471035f

23 months agoMake sure database update succeeds from older database versions too.
Purdea Andrei [Sun, 13 Jan 2019 04:14:56 +0000 (06:14 +0200)]
Make sure database update succeeds from older database versions too.

Fixes the following error message when updating from an older database.
Renaming index il_from into PRIMARY to table imagelinks ...[7dbf1dd298ecf39128707744] [no req]   Wikimedia\Rdbms\DBQueryError from line 1149 of /home/zok/mediawiki-1.30.1/includes/libs/rdbms/database/Database.php: A database query error has occurred. Did you forget to run your application's database schema updater after upgrading?
Query: INSERT INTO imagelinks_tmp
 SELECT * FROM imagelinks

Function: Wikimedia\Rdbms\Database::sourceFile( /home/zok/mediawiki-1.30.1/maintenance/sqlite/archives/patch-imagelinks-fix-pk.sql )
Error: 19 UNIQUE constraint failed: imagelinks_tmp.il_from, imagelinks_tmp.il_to

the "imagelinks" table used to have two fields: il_from and il_to.
At one point during the development of mediawiki a new field has been
added called il_from_namespace. This new filed is the second column
if the database is created from scratch, however if the database is
updated from an older version then the il_from_namespace column becomes
the 3rd column.

That means that some of the older databases will have the columns in the
following order:
(1) il_from, il_from_namespace, il_to
while some older ones, which have been updated will have the following
(2) il_from, il_to, il_from_namespace

This shouldn't matter much, except the file modified in this commit
copies records from one table to another using the INSERT INTO ... SELECT
command without explicitly listing the column names.
The newly created table has the (1) order, but the source table
might sometimes have the (2) order.

Explicitly listing the column names solves all the issues.

Change-Id: I222b171495d14ae45339c4679e263f0ab610e826
(cherry picked from commit 68c298ed05ef7b5be8099ff272e6dea20d00e42b)

23 months agoRemove jetbrains/phpstorm-stubs from composer dev dependancies
Reedy [Sun, 30 Jun 2019 17:18:24 +0000 (18:18 +0100)]
Remove jetbrains/phpstorm-stubs from composer dev dependancies

Bug: T226766
Change-Id: I8f985996dcc780a8307c4d1ef9a1d6e2b9f1a1d0

23 months agoinstaller: Detect APC for MainCacheType in CLI installer
Timo Tijhof [Thu, 13 Jun 2019 14:06:43 +0000 (15:06 +0100)]
installer: Detect APC for MainCacheType in CLI installer

The web installer did this already, but with the CLI installer,
the generated LocalSettings.php always contained the following

 $wgMainCacheType = CACHE_NONE;

Combined with the fact that in WMF CI, the generated local settings
is applied *after* the inclusion of Quibble settings and
DevelopmentSettings, meant that it was not possible to enable
object caching.

For now, make it match the behaviour of the web installer and thus
output $wgMainCacheType = CACHE_ACCELL if we detect a supported
implementation in the PHP runtime.

For later we should probably:

* Make this an option to install.php,
* or, change Quibble to append its overrides, instead of
  prepending. So that DevelopmentSettings actually after the
  generated LocalSettings.

Bug: T225496
Change-Id: I3f43cd054ce71d0f1b2395302e8ef9ee2f6b01c2
(cherry picked from commit 7e0fb4fff6a247802c2209df48cf9fab8bfb8563)

23 months agoDisable rate limiting in Development Settings
Leszek Manicki [Mon, 17 Jun 2019 09:11:39 +0000 (11:11 +0200)]
Disable rate limiting in Development Settings

Bug: T225796
Change-Id: I2475a04066d4aaefeba372bd223ef68548a8cf18

2 years agoInstaller: Update link to PHP intl away from old PECL package
Karsten Hoffmeyer [Tue, 11 Jun 2019 19:24:16 +0000 (21:24 +0200)]
Installer: Update link to PHP intl away from old PECL package

PHP 5.5 was the last version supported by PECL intl package. Now the
PHP intl extension is used instead.

Bug: T225558
Change-Id: I68cb7a549c899e69da9a8cfea5a69b9acb41e8ae
(cherry picked from commit 7f0f6af2902cb7cf1406df5b8ee8cd12a5a88f1f)

2 years ago1.31.3 RELEASE-NOTES section
Reedy [Tue, 28 May 2019 23:43:59 +0000 (00:43 +0100)]
1.31.3 RELEASE-NOTES section

Change-Id: I8bc00c2274018f5d7051b34cdd162c001c58061c

2 years agoPrepare 1.31.2 1.31.2
Reedy [Tue, 28 May 2019 23:39:18 +0000 (00:39 +0100)]
Prepare 1.31.2

Change-Id: I0e6ef5f4a51adbe20631265a693c86f2114859d4

2 years agoAdd RELEASE-NOTES for security patches
Reedy [Tue, 28 May 2019 23:38:44 +0000 (00:38 +0100)]
Add RELEASE-NOTES for security patches

Change-Id: I9032e202505fb77a7d4abea6662ef4f8fa49e0dd

2 years agoSECURITY: resources: Patch jQuery 3.2.1 for CVE-2019-11358
James D. Forrester [Thu, 25 Apr 2019 21:12:52 +0000 (16:12 -0500)]
SECURITY: resources: Patch jQuery 3.2.1 for CVE-2019-11358

Patch taken from https://github.com/DanielRuf/snyk-js-jquery-174006?files=1.

Bug: T221739
Change-Id: I99c2be81c74a8f1d35c421f0ee43c75efb30a7d0

2 years agoSECURITY: Add permission check for user is permitted to view the log type
rxy [Sun, 28 Apr 2019 20:14:18 +0000 (05:14 +0900)]
SECURITY: Add permission check for user is permitted to view the log type

Bug: T222038
Change-Id: I92ec2adfd9c514b3be1c07b7d22b9f9722d24a82

2 years agoSECURITY: Add permission check for user is permitted to view the log type
rxy [Sun, 28 Apr 2019 20:04:01 +0000 (05:04 +0900)]
SECURITY: Add permission check for user is permitted to view the log type

Bug: T222036
Change-Id: I7584ee8db23a8834bbab21e355cab9857a293f72

2 years agoSECURITY: Fix cache mode for (un)patrolled recent changes query
Lucas Werkmeister [Mon, 17 Dec 2018 13:02:39 +0000 (14:02 +0100)]
SECURITY: Fix cache mode for (un)patrolled recent changes query

Restricting the list of recent changes to patrolled, not patrolled,
autopatrolled, not autopatrolled, or unpatrolled recent changes requires
special permissions (as does displaying that status in the properties of
returned entries), but we only set the cache mode to private in the
first two cases.

Bug: T212118
Change-Id: I4c3fe6e47f80ebf97fa37875c704328d08772d26

2 years agoSECURITY: API: Respect $wgBlockCIDRLimit in action=block
Kunal Mehta [Fri, 13 Jul 2018 15:07:51 +0000 (08:07 -0700)]
SECURITY: API: Respect $wgBlockCIDRLimit in action=block

$wgBlockCIDRLimit states how large rangeblocks are allowed to be for IPv4
and IPv6. The API now calls SpecialBlock::validateTarget() to perform
that validation step.

As a minor thing, SpecialBlock::checkUnblockSelf() is now called twice by
the API, but that can probably be cleaned up at another time.

Tests included.

Bug: T199540
Change-Id: Ic7d60240d9ebd9580c0eb3b41e4befceab69bd81

2 years agoSECURITY: rate-limit and prevent blocked users from changing email
Brian Wolff [Wed, 21 Nov 2018 16:15:28 +0000 (16:15 +0000)]
SECURITY: rate-limit and prevent blocked users from changing email

This is to counter spam where people use Special:ChangeEmail to
spam people with the confirmation email and using the username
to promote their thing

Bug: T209794
Change-Id: I8b2bd0f60c66f44c91dc78e3512a73e4237df2f3

2 years agoSECURITY: blacklist CSS var()
Max Semenik [Wed, 7 Nov 2018 02:38:22 +0000 (18:38 -0800)]
SECURITY: blacklist CSS var()

Bug: T208881
Change-Id: I9a4ced2bc47eb5f96cf35e693bf5261c48acb126

2 years agoSECURITY: Fix reauth in Special:ChangeEmail
Brian Wolff [Fri, 15 Jun 2018 08:19:49 +0000 (08:19 +0000)]
SECURITY: Fix reauth in Special:ChangeEmail

Previously you could bypass reauthentication by directly
POSTing to Special:ChangeEmail.

Bug: T197279
Change-Id: I674557351e0e91a8105c12ddf6cd30283aac9f7a

2 years agoselenium: wdio-mocha-framework now v0.6.4
James D. Forrester [Tue, 7 May 2019 19:43:54 +0000 (12:43 -0700)]
selenium: wdio-mocha-framework now v0.6.4

Bug: T213268
Bug: T222406
Change-Id: I5935fc5d5bc23978e50275d3c99ac870b3b82f49

2 years agoAdd getLoginSecurityLevel() support to FormSpecialPage
Brad Jorsch [Wed, 9 May 2018 18:53:32 +0000 (14:53 -0400)]
Add getLoginSecurityLevel() support to FormSpecialPage

The base SpecialPage will handle reauthentication automatically if you
just implement getLoginSecurityLevel() to return an appropriate string.

But it doesn't work with FormSpecialPage, and if you try calling
checkLoginSecurityLevel() manually it'll lose any post data if the
reauth happens when the form is posted.

So this patch has SpecialPage::checkLoginSecurityLevel() preserve post
data across reauth (using logic similar to that in AuthManagerSpecialPage),
and has FormSpecialPage call checkLoginSecurityLevel() in the same
way the base SpecialPage does.

It also fixes the SpecialPage logic to not call
checkLoginSecurityLevel() when the special page doesn't implement
getLoginSecurityLevel(), as was the originally-intended behavior.
Apparently almost nothing actually gets to SpecialPage::execute() or
this would probably have been noticed already.

Change-Id: Ic89dc1b6583aaecd2efe3f5109896148a188c271
(cherry picked from commit bfc4e41636aca33b943f8522024bd9f8eeac1977)

2 years agoAdd/update RELEASE-NOTES to match commits
Reedy [Tue, 28 May 2019 22:27:12 +0000 (23:27 +0100)]
Add/update RELEASE-NOTES to match commits

Change-Id: Ib260482dcbab92610b978744c98bc3a94940dcab

2 years agoMake config-outdated-sqlite parameter numbers consistent with config-*-old
Reedy [Sun, 26 May 2019 19:14:03 +0000 (20:14 +0100)]
Make config-outdated-sqlite parameter numbers consistent with config-*-old

Bug: T224374
Change-Id: Iebfb8299234cc9c66db0ecc4abd0c0a32af63602

2 years agoresourceloader: Use AND instead of OR for upsert conds in saveFileDependencies()
Reedy [Thu, 23 May 2019 23:16:42 +0000 (00:16 +0100)]
resourceloader: Use AND instead of OR for upsert conds in saveFileDependencies()

Follows-up e7b57d881a, which changed it from replace() to upsert()
but lost one of the wrapping arrays in doing so.

Previously updated many more rows than expected on Postgresql, when it
should only be updating individual rows, not all rows that match either

SQL query before:
 WHERE ((md_module = 'jquery.makeCollapsible.styles') OR (md_skin = 'vector|en-gb'))

SQL query after:
 WHERE ((md_module = 'jquery.makeCollapsible.styles' AND md_skin = 'vector|en-gb'))

Not a problem on MySQL as upsert() is implemented differently there.

Bug: T222385
Change-Id: If8a458bf4543b297b3a06f31e09c0e77666bf7e6

2 years agoMerge "Update cssjanus/cssjanus from 1.2.0 to 1.3.0" into REL1_31
jenkins-bot [Sat, 11 May 2019 02:44:53 +0000 (02:44 +0000)]
Merge "Update cssjanus/cssjanus from 1.2.0 to 1.3.0" into REL1_31

2 years agoUpdate git submodules
Reedy [Sat, 11 May 2019 02:10:14 +0000 (03:10 +0100)]
Update git submodules

* Update vendor from branch 'REL1_31'
  to 1521f359a06aed626e860285769ed78a7152cdec
  - Update cssjanus/cssjanus from 1.2.0 to 1.3.0


    Change-Id: Id8aba2d9e99671a9c45e02b271dbf290a11228d7

2 years agoUpdate cssjanus/cssjanus from 1.2.0 to 1.3.0
Reedy [Sat, 11 May 2019 02:18:13 +0000 (03:18 +0100)]
Update cssjanus/cssjanus from 1.2.0 to 1.3.0


Change-Id: I352f79f6f34279e669057aee7c2f1570800c8a11
Depends-On: Id8aba2d9e99671a9c45e02b271dbf290a11228d7

2 years agoApiLogout: Follow up Icb674095
Brad Jorsch [Thu, 25 Apr 2019 13:49:01 +0000 (09:49 -0400)]
ApiLogout: Follow up Icb674095

This implements getWebUITokenSalt(), as mentioned in T25227#2008199 and
implemented in F3328897. Somehow it didn't make it into Icb674095.

This also fixes some issues in the unit test:
* Properly link the user to the request's Session so User::doLogout()
  won't log a warning. This also gives use to the otherwise-unneeded
  implementation of setUp(), and lets us get rid of the broken call to
  User::newFromId() that was passing an IP address rather than a user ID.
* Privatize some internal methods.
* Use setExpectedApiException() instead of manually catching and
  hard-coding the English exception message.
* Also assert that the bad token error didn't result in a logout.

Bug: T25227
Change-Id: I2aecfba821cca3c367c5e7e8d188a88197fb82d2

2 years agoNew helper ApiTestCase::setExpectedApiException()
Aryeh Gregor [Tue, 31 Jul 2018 13:19:10 +0000 (16:19 +0300)]
New helper ApiTestCase::setExpectedApiException()

This allows setting the expected exception message by the message key,
not text, so it remains correct if the message is updated.  This
function could be defined to work with other exception types too, but it
seems useful to have shortcuts for common types like ApiUsageException
or MWException.

Change-Id: Ic86278e9e1e91eea0c045d2b93342f018e1d8e66

2 years ago[SECURITY] [API BREAKING CHANGE] Require logout token.
sbassett [Tue, 16 Apr 2019 22:09:43 +0000 (17:09 -0500)]
[SECURITY] [API BREAKING CHANGE] Require logout token.

Special:Userlogout now requires a token

Api action=logout requires a csrf token and the request to be POSTed

Patch author: bawolff

Bug: T25227
Change-Id: Icb674095956bb3f6c847c9553c53e404402ea774

2 years agoAdd support for new Japanese era name "Reiwa"
rxy [Mon, 1 Apr 2019 07:04:40 +0000 (16:04 +0900)]
Add support for new Japanese era name "Reiwa"

Bug: T219728
Change-Id: I28c26291c38e7e6c167011472236fb81a8adf032

2 years agoUrlencode fragments when redirecting after editing
Max Semenik [Mon, 18 Mar 2019 05:42:42 +0000 (22:42 -0700)]
Urlencode fragments when redirecting after editing

This is a quick fix for the main symptom of the Chrome bug that results in
users being redirected to Special:BadTitle after section editing. We'll
need to discuss a more permanent solution.

Bug: T216029
Change-Id: I4b2d42ebc74031df86bc52310da71819da11c1ae

2 years agoRearrange code in User::getBlockedStatus to avoid isAllowed calls
Gergő Tisza [Thu, 21 Mar 2019 16:00:49 +0000 (09:00 -0700)]
Rearrange code in User::getBlockedStatus to avoid isAllowed calls

User::isAllowed() triggers session loading, which results in a loop
if it is called during session loading. Session providers need to
check block status when $wgBlockDisablesLogin is enabled, so try to
avoid isAllowed calls in that situation.

Bug: T218608
Change-Id: Iab24923c613d6aeed4b574f587fc4cee8f33077c

2 years agoReplace $wgUser with RequestContext::getUser in User::getBlockedStatus
Gergő Tisza [Mon, 18 Mar 2019 21:50:48 +0000 (14:50 -0700)]
Replace $wgUser with RequestContext::getUser in User::getBlockedStatus

$wgUser is not guaranteed to exist until MediaWiki has been fully
initialized; block status needs to be checked early on for
authentication-related permission checks.

Bug: T218608
Change-Id: I16315c071855024bc0412d5360c95f843420d9a9

2 years agoUpdate git submodules
Brad Jorsch [Mon, 2 Jul 2018 17:52:49 +0000 (13:52 -0400)]
Update git submodules

* Update extensions/Renameuser from branch 'REL1_31'
  to 21f254948a422f367b397cc842dce85f521f83ff
  - Fix incorrect usage in RenameUserJob

    Too many rewrites of that code while I was writing it.

    Also, no idea why that was passing false to in_array()'s $strict

    Bug: T198285
    Change-Id: Ib4ab555f53f5ffa95ef7c974c3a53f33a34d2ad5
    (cherry picked from commit 130b99c4613058dfda0a9532c9794f516933b8b6)

2 years agouser_group, the nonexistent table that keeps on giving
Jack Phoenix [Wed, 6 Mar 2019 09:07:26 +0000 (11:07 +0200)]
user_group, the nonexistent table that keeps on giving

Follow-up to 27c61fb1e94da9114314468fd00bcf129ec064b6.

Bug: T199474
Change-Id: Ie8e054f5898209c51538669149e966bee7754f1e

2 years agoFix a rather fatal typo in rebuildrecentchanges.php
Jack Phoenix [Tue, 5 Mar 2019 23:13:59 +0000 (01:13 +0200)]
Fix a rather fatal typo in rebuildrecentchanges.php

The JOIN condition was being ignored because there is no table called "user_group" in MediaWiki core.
Thus if and when using $wgSharedDB, the query would end up listing *all* registered users from the shared user table.
And even without $wgSharedDB, running rebuildrecentchanges.php would result in everyone's edits being marked as bot edits (recentchanges.rc_bot = 1) and thus hidden from the Special:RecentChanges page.

Thanks to Lcawte for reporting this bug.

Follow-up to 27c61fb1e94da9114314468fd00bcf129ec064b6

Change-Id: I18d658b67c50f2200341f732783c2e7524dd27f1

2 years agoBackport WikiMap/JobQueueGroup logic to handle hyphenated DB names
Aaron Schulz [Wed, 20 Feb 2019 00:26:10 +0000 (16:26 -0800)]
Backport WikiMap/JobQueueGroup logic to handle hyphenated DB names

Although the documentation in DefaultSettings.php states that such
cases should be avoided, some common cases and code paths can be
made to work easily enough.

Partially cherry-picked from dcd0a3d5351945dbca3594, and 5196ac32c6.

Bug: T204423
Change-Id: Ia3c5855b18b98d9fc5bc02fe68358cfa52ccbce1

2 years agoRELEASE-NOTES for last two commits
Reedy [Tue, 26 Feb 2019 14:48:05 +0000 (14:48 +0000)]
RELEASE-NOTES for last two commits

Change-Id: I119b88499bdd59f58295473523b1a0974c0c1476

2 years agoDatabasePostgres: Ignore "IGNORE" option to update()
Brad Jorsch [Wed, 20 Feb 2019 15:22:26 +0000 (10:22 -0500)]
DatabasePostgres: Ignore "IGNORE" option to update()

PostgreSQL doesn't support anything like this. For now, avoid generating
invalid SQL by just ignoring the option. If we come up with a use case
someday, that can guide implementation of a workalike.

Bug: T215169
Change-Id: I1409c80b39834d1977c82c489226255a8cc93fd0
(cherry picked from commit 814605a979633fc37bcfa8319ddbfe627a66a308)

2 years agoReturn the page_id in list=langbacklinks as an int
Reedy [Mon, 25 Feb 2019 00:18:47 +0000 (00:18 +0000)]
Return the page_id in list=langbacklinks as an int

Bug: T216968
Change-Id: I5b16779be7b24b1e46d4787a82a8daa3611f67b1

2 years agoReturn the page_id in list=iwbacklinks as an int rather than string
setian [Sun, 24 Feb 2019 21:43:33 +0000 (16:43 -0500)]
Return the page_id in list=iwbacklinks as an int rather than string

Bug: T216968
Change-Id: I6645c5f1c6e76be3187c24053ed430e99c03bff4

2 years agoBackfill release notes for Iaf531795
Gergő Tisza [Tue, 20 Nov 2018 20:38:32 +0000 (20:38 +0000)]
Backfill release notes for Iaf531795

Change-Id: Ida5491d2376fc28e75c8887feb213e301991e115

2 years agoUpdate required PHP version to 7.0.13
James D. Forrester [Thu, 14 Feb 2019 19:29:48 +0000 (11:29 -0800)]
Update required PHP version to 7.0.13

Bug: T209423
Change-Id: I66e563adb062bc132a1092d78bfd06e2210f382e

2 years agoFix flaky MessageBlobStoreTest assertion failures
Aaron Schulz [Tue, 12 Jun 2018 01:32:19 +0000 (18:32 -0700)]
Fix flaky MessageBlobStoreTest assertion failures

Bug: T176097
Change-Id: I0f1e9a6a73bb5b2bc54ee400c5710055e992c3f1
(cherry picked from commit 46a43d8187a1aa1a7702bbfec2a3c5e20df4435a)

2 years agoobjectcache: add setMockTime() method to BagOStuff/WANObjectCache
Aaron Schulz [Thu, 31 May 2018 06:14:09 +0000 (23:14 -0700)]
objectcache: add setMockTime() method to BagOStuff/WANObjectCache

Change-Id: I3e5760814fb7dbe628eb0d979d690c3275fc3c15

2 years agoUpdate git submodules
Peter Boehm [Thu, 24 Jan 2019 12:44:53 +0000 (13:44 +0100)]
Update git submodules

* Update extensions/CategoryTree from branch 'REL1_31'
  to a1717183d7a263ad2a109a1891ac430f1e604c02
  - Change 'title' attributes to links to use full page name

    This changes the title attribute on the link generated in the
    CategoryTree. The only effect is additional information about the
    link target that may be truncated by 'hideprefix' or CSS overflow,
    will now still be accessible in another way.

    Change-Id: I4f07fa88f0a528634e9bf3c504e84fb4bf55e3bf
    (cherry picked from commit 1dfe6ca618afd5b85631417c10772591de02043a)

2 years agoUpdate git submodules
Fomafix [Wed, 18 Apr 2018 06:23:38 +0000 (08:23 +0200)]
Update git submodules

* Update extensions/CategoryTree from branch 'REL1_31'
  to fec55f2994c3e8021d0329e45aed510a0062c168
  - Simplify by using Xml::element

    Xml::element already makes the HTML encoding.

    Change-Id: Idee5e6871c5a7b5e6763ebe85275598b9b217224
    (cherry picked from commit 6684f62bbaa17068c50a0ed89319a515d86bea1c)

2 years agoUpdate git submodules
Brian Wolff [Thu, 5 Jul 2018 00:34:08 +0000 (00:34 +0000)]
Update git submodules

* Update extensions/CategoryTree from branch 'REL1_31'
  to 27e63545302d93d98dabd15ca9844c40227ff41f
  - Fix some raw html messages

    Try also to ensure that the bullet messages are treated the
    same in both JS and PHP. It should be noted that the mk and scn
    translations are currently broken on the JS side.

    Bug: T195010
    Change-Id: Id87d26db8d90e293701ae11f6434026a8ae88822
    (cherry picked from commit f36af623179350b42e69d98816203273b6e8ac3b)

2 years agoMerge "Fix $magicWords for the Sanskrit language" into REL1_31
jenkins-bot [Sat, 9 Feb 2019 20:32:40 +0000 (20:32 +0000)]
Merge "Fix $magicWords for the Sanskrit language" into REL1_31

2 years agoFollow-up I41cc21708: Add to RELEASE-NOTES as it's now a pre-release patch
James D. Forrester [Fri, 8 Feb 2019 19:53:58 +0000 (11:53 -0800)]
Follow-up I41cc21708: Add to RELEASE-NOTES as it's now a pre-release patch

Bug: T215632
Change-Id: Id8a25f38bbb28d04c725bc0941a0ceb94aa151fd

2 years agoRemoves Google web search from exception page
Juan Osorio [Fri, 9 Nov 2018 22:45:55 +0000 (14:45 -0800)]
Removes Google web search from exception page

When a wiki is down, it is not necessarily useful to be able to
search the web. Additionally, there is general consensus that
the hard-coded Google search form should be removed.

Bug: T208871
Change-Id: I5bcae848de1144d4fc1116c475b2e2ab1ccc3f7d

2 years agoMWExceptionRenderer: Fix db error outage page
Strainu [Thu, 24 May 2018 20:23:26 +0000 (23:23 +0300)]
MWExceptionRenderer: Fix db error outage page

Set content encoding and add some content to the header tag.

Bug: T195525
Change-Id: Ieabfe18280359459e9462204371d3fe8d62a4177
(cherry picked from commit 94b58b2c268541cf09612f5f9fa99c7c3edb2af4)

2 years agoAvoid session double-start in Setup.php
Brad Jorsch [Sat, 12 Jan 2019 19:16:52 +0000 (14:16 -0500)]
Avoid session double-start in Setup.php

In PHP before 7.3, the double start doesn't really matter: session_id()
changes the ID even if it was already started, and the warning from
session_start() can just be ignored. Which is what we did.

In PHP 7.3, now session_id() also warns and no longer changes the ID. To
preserve the previous behavior, we'll need to explicitly close the old
session and open the new one.

Bug: T213489
Change-Id: I02a5be1c3adb326927c156fdd00663bccee37477

2 years agordbms: reduce LoadBalancer replication log spam
Aaron Schulz [Mon, 10 Dec 2018 20:29:43 +0000 (15:29 -0500)]
rdbms: reduce LoadBalancer replication log spam

LoadMonitor already has similar and less-frequent logging since
it only happens on cache rebuilds.

Bug: T204531
Change-Id: I270a65ab1d3f471bd49c8f54d85151c91827a518
(cherry picked from commit 38b54d71ece279f978246fefa21142f34cb6e07f)

2 years agoFix $magicWords for the Sanskrit language
Jayprakash12345 [Sat, 30 Jun 2018 13:20:44 +0000 (18:50 +0530)]
Fix $magicWords for the Sanskrit language

Bug: T102320
Change-Id: I4ef78dc7a41916a9af6aa259de455e3948662913
(cherry picked from commit eb741da7a18c7f52dc2e2b55c4f34e69362b5c7f)

2 years agoUser: Bypass repeatable-read when creating an actor_id
Brad Jorsch [Thu, 29 Nov 2018 14:03:20 +0000 (09:03 -0500)]
User: Bypass repeatable-read when creating an actor_id

When MySQL is using repeatable-read transaction isolation (which is the
default), the following sequence of events can occur:

1. Request A: Begin a transaction.
2. Request A: Try to select the actor ID for a user. Find no rows.
3. Request B: Insert an actor ID for that user.
4. Request A: Try to insert an actor ID for the user. Fails because one
5. Request A: Try to select the actor ID that must exist. Fail because of
   the snapshot created at step 2.

In MySQL we can avoid this issue at step #5 by using a locking select
(FOR UPDATE or LOCK IN SHARE MODE), so let's do that.

Bug: T210621
Change-Id: I6c1d255fdd14c6f49d2ea9790e7bd7d101e98ee4
(cherry picked from commit 37f48fdb25a78ba7623c57b50cdfd842292d3ccb)

2 years agoAdd join conditions to ActiveUsersPager
Brad Jorsch [Fri, 21 Sep 2018 18:32:34 +0000 (14:32 -0400)]
Add join conditions to ActiveUsersPager

We're (very slowly and somewhat unofficially) moving towards using join
conditions everywhere, and here they're needed to avoid errors once the
actor migration reaches the READ_NEW stage.

Bug: T204767
Change-Id: I8bfe861fac7874f8938bed9bfac3b7ec6f478238
(cherry picked from commit 15441cabe60d84e17ffb25824aeb095d92bc375a)

2 years agoUpdate git submodules
Alexia E. Smith [Thu, 15 Nov 2018 16:09:15 +0000 (10:09 -0600)]
Update git submodules

* Update extensions/ParserFunctions from branch 'REL1_31'
  to a28ad04eeefa05a16264e67537ba118bd67576d4
  - Fix E_WARNING with {{#pos:}} if the offset is larger than the string

    The mb_strpos() function throws E_WARNING if the offset is longer
    than the length of the string.

    Bug: T209600
    Change-Id: Ib4296ba136eaf5c8461681e9d5f108118b2494f4
    (cherry picked from commit cf1480cb9629514dd4400b1b83283ae6c83ff163)

2 years agoMerge "i18n: Clarify the default sidebar 'Help' link is about MediaWiki itself" into...
jenkins-bot [Wed, 19 Dec 2018 12:30:23 +0000 (12:30 +0000)]
Merge "i18n: Clarify the default sidebar 'Help' link is about MediaWiki itself" into REL1_31

2 years agoFix copy-paste error
Amir Sarabadani [Tue, 18 Dec 2018 17:55:13 +0000 (18:55 +0100)]
Fix copy-paste error

It's actually adding the column on the wrong table

Change-Id: I2fd8ea50f3eb4b5da04fce2ea0348a2dc6329965

2 years agoi18n: Clarify the default sidebar 'Help' link is about MediaWiki itself
Andre Klapper [Thu, 29 Nov 2018 10:09:34 +0000 (11:09 +0100)]
i18n: Clarify the default sidebar 'Help' link is about MediaWiki itself

Enough users of third-party MediaWiki installations seem to think it is a
link to a help forum for the topic of that installation, and not for

Bug: T209335
Change-Id: I6614b7a5c06de3ffca7ddbb10ea75450e7c6f183
(cherry picked from commit ac0a3f17cf46b7733fcc1d0cef65febb1d04b7b6)

2 years agoMerge "Upgrade wikimedia/ip-set to 1.3.0" into REL1_31
jenkins-bot [Tue, 18 Dec 2018 05:45:47 +0000 (05:45 +0000)]
Merge "Upgrade wikimedia/ip-set to 1.3.0" into REL1_31

2 years agoMerge "Use our fork of less.php" into REL1_31
jenkins-bot [Tue, 18 Dec 2018 05:45:41 +0000 (05:45 +0000)]
Merge "Use our fork of less.php" into REL1_31

2 years agoUpdate git submodules
Kunal Mehta [Tue, 18 Dec 2018 04:13:14 +0000 (20:13 -0800)]
Update git submodules

* Update vendor from branch 'REL1_31'
  to 5c8dde3a1611b701e28678b36a878c4e3cecfeb7
  - Upgrade wikimedia/ip-set to 1.3.0

    Change-Id: Ib749ec9aae5aeb3fad8232ecbea749530e0408a2

2 years agoUpdate git submodules
Kunal Mehta [Tue, 18 Dec 2018 04:09:56 +0000 (20:09 -0800)]
Update git submodules

* Update vendor from branch 'REL1_31'
  to a48c47a029213b44e032b8dcdd4795876cfc93a8
  - Switch to our less.php fork

    Bug: T206975
    Change-Id: I01e0b3328c8e1c4a69c37a471e436acd8911f1fa

2 years agoUpgrade wikimedia/ip-set to 1.3.0
Kunal Mehta [Tue, 18 Dec 2018 04:14:25 +0000 (20:14 -0800)]
Upgrade wikimedia/ip-set to 1.3.0

Bug: T209756
Depends-On: Ib749ec9aae5aeb3fad8232ecbea749530e0408a2
Change-Id: I7f5625924baea822f2679115278a3d7a02a72d57

2 years agoUse our fork of less.php
Kunal Mehta [Tue, 18 Dec 2018 04:12:14 +0000 (20:12 -0800)]
Use our fork of less.php

Supports PHP 7.3, among other things

Bug: T206975
Depends-On: I01e0b3328c8e1c4a69c37a471e436acd8911f1fa
Change-Id: I8edcd9316cbff40aee3d52c7295f5974ee2f44b0

2 years agoImageListPager: Actor migration for buildQueryConds()
Brad Jorsch [Tue, 4 Dec 2018 16:08:08 +0000 (11:08 -0500)]
ImageListPager: Actor migration for buildQueryConds()

This method got missed in I8d825eb0.

Bug: T211061
Change-Id: Ice7446e54a42cbf48eae2a2092862a722650086c
(cherry picked from commit 86b081aa4100bfde2c4903c16fd593f485954326)

2 years agoSave value from CLI installers `--lang` argument
rvogel [Mon, 3 Dec 2018 10:48:08 +0000 (11:48 +0100)]
Save value from CLI installers `--lang` argument

This way the value of `--lang` is available to `LocalSettingsGenerator`.

Bug: T210998
Change-Id: I8b6bd83603687e4d23fc7e0642c3b8f27157b62d
(cherry picked from commit 996ac9f61e34db8b5d50ca9574a021e422cf9030)

2 years agoRELEASE-NOTES-1.31: Add in other cherry-picks since 1.31.1 was cut
James D. Forrester [Fri, 30 Nov 2018 23:16:20 +0000 (15:16 -0800)]
RELEASE-NOTES-1.31: Add in other cherry-picks since 1.31.1 was cut

Gone through `git log --topo-order --no-merges --reverse 1.31.1..`
from 1f664ea4 to 7a6393fc (HEAD as of writing); re-worded a couple,
grouped the PHP version work together, and skipped a couple which
were just follow-up tweaks or test fixes to ones already in the list.

Change-Id: Ic04998209348abf73eefb1cad404700da91457ed

2 years agoLogFormatter: Fail softer when trying to link an invalid titles
Bartosz Dziewoński [Wed, 1 Aug 2018 01:13:18 +0000 (03:13 +0200)]
LogFormatter: Fail softer when trying to link an invalid titles

Old log entries contain titles that used to be valid, but now are not.

Bug: T185049
Change-Id: Ia66d901aedf1b385574b3910b29f020b3fd4bd97
(cherry picked from commit 26bb9d9b23eb2075eefca2097ca393a9d4aa3264)

2 years agoSQL syntax error in MS-SQL file
Seb35 [Tue, 20 Nov 2018 14:25:09 +0000 (15:25 +0100)]
SQL syntax error in MS-SQL file

Bug: T209870
Change-Id: I91e4f8472832c4bb17eb1d185db1bcbde57a9287
(cherry picked from commit e1100d2d53baa71d20cc282b6dc0a950b080aaad)

2 years agoUse $revQuery['joins'] in query in populateSearchIndex
Paladox [Mon, 19 Nov 2018 21:29:44 +0000 (21:29 +0000)]
Use $revQuery['joins'] in query in populateSearchIndex

Bug: T209885
Change-Id: Iaf53179535030064788eb107c4ebdd398ed306e4

2 years agoUpdate git submodules
RazeSoldier [Sat, 10 Nov 2018 07:32:34 +0000 (15:32 +0800)]
Update git submodules

* Update extensions/LocalisationUpdate from branch 'REL1_31'
  to 8ac18feceb9bf298a65c4e27d29cd458e4bc061a
  - Use "break" instead of "continue" inside a switch

    "continue" statements in a switch are equivalent to "break". In PHP 7.3, will generate a warning.

    Bug: T206976
    Change-Id: I7e28a59918edbbcc741a64c6c0ed2a55bd650384
    (cherry picked from commit fa93fda37e308a83e3211f53c8f828b5c3482c07)

2 years agoUpdate git submodules
Derk-Jan Hartman [Wed, 14 Nov 2018 20:01:22 +0000 (21:01 +0100)]
Update git submodules

* Update extensions/WikiEditor from branch 'REL1_31'
  to dca935d7de870eb5352788c0537c172b574f1475
  - Modules: Protect against loading modules twice

    Bug: T189029
    Change-Id: Ie0dff9c1dfa8e3a0927f2915a9a237dff739289a
    (cherry picked from commit 0161e37e6e67ac6eb76fbc0bea4f299e17fcdda2)

2 years agoAdd test for completionSearch with wgCapitalLinkOverrides
David Causse [Tue, 6 Nov 2018 13:35:03 +0000 (14:35 +0100)]
Add test for completionSearch with wgCapitalLinkOverrides

Bug: T208255
Change-Id: Id2299a013b2dc9b5391d400d7c7c4dc37185f714

2 years agoCompletion search should not change the search query
David Causse [Tue, 6 Nov 2018 14:52:08 +0000 (15:52 +0100)]
Completion search should not change the search query

when extracting the namespace

Bug: T208255
Change-Id: I98206bda9a32e12acc7e515c3396fa823c3cd4f3

2 years agoUpdate git submodules
Niklas Laxström [Wed, 24 Oct 2018 08:33:04 +0000 (10:33 +0200)]
Update git submodules

* Update extensions/LocalisationUpdate from branch 'REL1_31'
  to bdf7b30dbada29938bd92ee6b9370a45d0ecac61
  - Handle exceptions from GitHubFetcher

    If a l10n directory is not found, log a message but continue.

    This commit introduces some output to normal update.php run, which
    can be disabled with the --quiet switch.

    Bug: T176390
    Change-Id: Ic1001303aef859d325e307edd4348364cab9ed7d
    (cherry picked from commit db84ba6ed2b4e255c844171db545fa451da08e1f)

2 years agocomposer.json, require ext-fileinfo
addshore [Mon, 24 Sep 2018 08:25:53 +0000 (09:25 +0100)]
composer.json, require ext-fileinfo

PHPVersionCheck requires fileinfo be installed for mime_content_type

Change-Id: Iea7d2c7842c770e77c05265d4f4b08b17f9ab71f
(cherry picked from commit 139bf5bc7b66c83bd5a27d4fc6806ddaebe3f188)

2 years agoDon't throw E_NOTICEs about undefined properties
Jack Phoenix [Fri, 13 Jul 2018 03:33:10 +0000 (06:33 +0300)]
Don't throw E_NOTICEs about undefined properties

Bug: T199494
Change-Id: Id24b9ece76ca0bedcaac29f1a6f5567af78658c1
(cherry picked from commit 83164669a140717797953f07baaf0b3239689017)

2 years agoMerge "Update wikimedia/base-convert to 2.0.0" into REL1_31
jenkins-bot [Mon, 22 Oct 2018 22:03:54 +0000 (22:03 +0000)]
Merge "Update wikimedia/base-convert to 2.0.0" into REL1_31