Your message dated Mon, 03 Mar 2008 13:17:03 +0000
with message-id <[EMAIL PROTECTED]>
and subject line Bug#462609: fixed in mediawiki 1:1.11.2-1
has caused the Debian Bug report #462609,
regarding mediawiki: README.Debian contains not full information for secured
installation
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [EMAIL PROTECTED]
immediately.)
--
462609: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=462609
Debian Bug Tracking System
Contact [EMAIL PROTECTED] with problems
--- Begin Message ---
Package: mediawiki
Version: 1:1.11.0-3
Severity: minor
README.Debian says:
"Then just copy the generated config to the real system location"
(LocalSettings.php)
But generated configuration file has diabolic permissions 0666, and this
config contains
security information like wiki database password.
Mediawiki installation script says:
"You should change file permissions for LocalSettings.php as required to
prevent other users on the server
reading passwords and altering configuration data.",
I think this message should be putted in README.Debian too.
-- System Information:
Debian Release: lenny/sid
APT prefers testing
APT policy: (500, 'testing'), (497, 'unstable'), (495, 'stable'),
(493, 'experimental')
Architecture: amd64 (x86_64)
Kernel: Linux 2.6.22-3-amd64 (SMP w/1 CPU core)
Locale: LANG=ru_RU.UTF-8, LC_CTYPE=ru_RU.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash
Versions of packages mediawiki depends on:
ii apache2 2.2.6-3 Next generation, scalable,
extenda
ii apache2-mpm-prefork [httpd] 2.2.6-3 Traditional model for Apache
HTTPD
ii debconf [debconf-2.0] 1.5.18 Debian configuration management
sy
ii mime-support 3.39-1 MIME files 'mime.types'
& 'mailcap
ii php5 5.2.4-2 server-side, HTML-embedded
scripti
ii php5-mysql 5.2.4-2+b1 MySQL module for php5
Versions of packages mediawiki recommends:
ii mysql-server 5.0.45-5 MySQL database server (meta
packag
ii mysql-server-5.0 [mysql-serve 5.0.45-5 MySQL database server binaries
ii php5-cli 5.2.4-2+b1 command-line interpreter for the
p
-- debconf-show failed
--- End Message ---
--- Begin Message ---
Source: mediawiki
Source-Version: 1:1.11.2-1
We believe that the bug you reported is fixed in the latest version of
mediawiki, which is due to be installed in the Debian FTP archive:
mediawiki-math_1.11.2-1_amd64.deb
to pool/main/m/mediawiki/mediawiki-math_1.11.2-1_amd64.deb
mediawiki_1.11.2-1.diff.gz
to pool/main/m/mediawiki/mediawiki_1.11.2-1.diff.gz
mediawiki_1.11.2-1.dsc
to pool/main/m/mediawiki/mediawiki_1.11.2-1.dsc
mediawiki_1.11.2-1_all.deb
to pool/main/m/mediawiki/mediawiki_1.11.2-1_all.deb
mediawiki_1.11.2.orig.tar.gz
to pool/main/m/mediawiki/mediawiki_1.11.2.orig.tar.gz
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [EMAIL PROTECTED],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Romain Beauxis <[EMAIL PROTECTED]> (supplier of updated mediawiki package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [EMAIL PROTECTED])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.7
Date: Mon, 03 Mar 2008 13:16:27 +0100
Source: mediawiki
Binary: mediawiki mediawiki-math
Architecture: source all amd64
Version: 1:1.11.2-1
Distribution: unstable
Urgency: high
Maintainer: Mediawiki Maintenance Team <[EMAIL PROTECTED]>
Changed-By: Romain Beauxis <[EMAIL PROTECTED]>
Description:
mediawiki - website engine for collaborative work
mediawiki-math - math rendering plugin for MediaWiki
Closes: 462609
Changes:
mediawiki (1:1.11.2-1) unstable; urgency=high
.
* New upstream release
* Security fix:
"Possible cross-site information leaks using the callback
parameter for JSON-formatted results in the API are prevented by
dropping user credentials."
* Added informations on LocalSettings.php in README.Debian
Closes: #462609
Files:
18a622e30367e5981f52897ee0d44b03 832 web optional mediawiki_1.11.2-1.dsc
12e81f27a37b15b9d1ed110d6f48b35f 4880707 web optional
mediawiki_1.11.2.orig.tar.gz
fe1d95318742dfebb0b46a710d589fe8 29919 web optional mediawiki_1.11.2-1.diff.gz
18c1262908e6651ec28de97d7cdbaf52 4904354 web optional
mediawiki_1.11.2-1_all.deb
aa113401f72a8f4a11ae8eb8c56a35a3 154600 web optional
mediawiki-math_1.11.2-1_amd64.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
iD8DBQFHy/cPnuQ3Rt5ZmAARAgeSAJ9s+2IautPTeo6Qpa16YclbeAlFTwCfcsBp
QZbEnjJ2xZvsHL6gBXzE3sQ=
=TK4a
-----END PGP SIGNATURE-----
--- End Message ---
