On Mon, Apr 27, 2009 at 10:29:25PM +0200, H. Langos wrote: > > the next step would be to update the mediwiki software to 1.11.1 if you have > $wgEnableAPI = true, that is. (i know it is only a XSS that hits internet > explorer users .. but hey, they are people, too ;-)
I will update to 1.14.0. This is the current version, and it is also used by wiki.kernel.org (there is a secret plan to eventually move the wiki there). And all the shiny new anti-spam extensions don't seem to work with 1.11 anymore... > if i remember right, the linuxtv wiki only allows editing to registered > users. therefore you could simply temporarily disable new user registration > and enable editing again for registered users. I will do the update first. > then i'd suggest installing the reCAPTCHA extention. not only will it > prevent bots from registering, you also help to digitize old books. > > http://recaptcha.net/plugins/mediawiki/ Looked at that and noticed they don't provide any statement regarding confidentiality / data protection. Who knows if they aren't creating a huge database of who did what in Wikis and Blogs around the net... Besides that, this wouldn't have stopped the present attack since the bot used does a manual login assisted by a human user. To thwart that I'd have to enable the captcha for every page save... Johannes -- To unsubscribe from this list: send the line "unsubscribe linux-media" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
