Re: [Mediawiki-l] MediaWiki security release 1.16.4

2011-04-14 Thread Tim Starling
On 15/04/11 13:44, jida...@jidanni.org wrote: > Do mention if MW 1.17 or 1.18 sysops need to worry about any of this. Yes, the same issue existed in 1.17 and trunk before the release date. -- Tim Starling ___ MediaWiki-l mailing list MediaWiki-l@lists

Re: [Mediawiki-l] MediaWiki security release 1.16.4

2011-04-14 Thread jidanni
Do mention if MW 1.17 or 1.18 sysops need to worry about any of this. ___ MediaWiki-l mailing list MediaWiki-l@lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/mediawiki-l

Re: [Mediawiki-l] MediaWiki security release 1.16.4

2011-04-14 Thread Tim Starling
On 14/04/11 18:20, Kilian wrote: > Hi Tim, > > On 04/14/2011 09:47 AM, Tim Starling wrote: >> Also, if you used >> the Apache configuration I suggested in the previous release >> announcement, you should update it to: >> >> RewriteEngine On >> RewriteCond %{QUERY_STRING} \.[a-z0-9]{1,4}(

Re: [Mediawiki-l] How do I add a Link of a external website into the footer?

2011-04-14 Thread uv22e Alcott
hello, thank you so much for your help! I am using the MonoBook skin. If someone would be so nice and post an example, this would really bring me forward ;) Wish you all a nice weekend uv On Tue, Apr 12, 2011 at 5:46 PM, Daniel Friesen wrote: > On 11-04-12 07:31 AM, OQ wrote: > > On Tue, Ap

[Mediawiki-l] MediaWiki Sites won"t load...???

2011-04-14 Thread Karin Remeikis
Hi, have aquestion and hope that someone out there can help me. Am using MediaWiki for http://spaceweek.de Tried to keep the site open for everyone interested, however, to much spam, so I gave only the admin (myself) all the permissions to edit. Nonetheless, since couple weeks, after I log in, th

Re: [Mediawiki-l] [Wikitech-l] Dropping IE6 support (was: MediaWiki security release 1.16.4)

2011-04-14 Thread Trevor Parscal
*For reading*, we aim to support any browser with 0.1%[1] use or more. This has both culled things out, like IE 5.5, and surfaced things like NetFront (Sony Playstation Browser). *For security*, if it's possible to protect the site or our users, and we have money in the bank, we should be doin

Re: [Mediawiki-l] where can I get mw_tools? backup w/o shell

2011-04-14 Thread nakohdo
wiki-9 wrote: > > The Special:Export sounds complicated to me if I want to backup all > pages since I have to give all the pagenames. Do I not see the global > solution? > Hi Holger, Try using http://www.mediawiki.org/wiki/Extension:MaintenanceShell You should then be able to dump your whole

Re: [Mediawiki-l] Page closure warning when previewing changes

2011-04-14 Thread Platonides
Neil Bird wrote: > >Having now been bitten a few times by this (and. OK, it's really just > down to me being a numpty) I was wondering if there was an extension or > built-in option to pop-up a JavaScript warning if the user tries to close an > edit page that has a “changes preview” section

Re: [Mediawiki-l] Dropping IE6 support (was: MediaWiki security release 1.16.4)

2011-04-14 Thread Chad
On Thu, Apr 14, 2011 at 11:32 AM, wrote: > In a message dated 4/14/2011 2:11:49 AM Pacific Daylight Time, > s.mazel...@xs4all.nl writes: > > >> I would suggest to set a percentage of worldwide usage as reported by >> some >> "trusted" statistics reported, or possibly a percentage of Wikimedia >>

Re: [Mediawiki-l] Any help on sophisticated MySQL-Statemanet

2011-04-14 Thread Stefan Werthmann
Hey daniel, you'r not working blind. It's exactly what I needed (results compared with the ugly code) :-)! Never really realized that $wg is reserved. I'm doing this for a function called: wfAjaxSexyHistoryUpdate() :-). Could you prepare a last translation? $qString = "SELECT cl_to,count(*) as

Re: [Mediawiki-l] Dropping IE6 support (was: MediaWiki security release 1.16.4)

2011-04-14 Thread WJhonson
In a message dated 4/14/2011 2:11:49 AM Pacific Daylight Time, s.mazel...@xs4all.nl writes: > I would suggest to set a percentage of worldwide usage as reported by > some > "trusted" statistics reported, or possibly a percentage of Wikimedia > pageviews. 3% or 4%? > That's high. I would like

Re: [Mediawiki-l] Any help on sophisticated MySQL-Statemanet

2011-04-14 Thread Daniel Friesen
I'm still working a little blind, I don't have enough detailed information and context on what exactly you're trying to do to give the best suggestion. I don't know if this is exactly what is wanted since I don't have data to test it on. And I'm not sure atm if a JOIN, LEFT JOIN, or RIGHT JOIN is b

Re: [Mediawiki-l] Any help on sophisticated MySQL-Statemanet

2011-04-14 Thread Stefan Werthmann
Hey! Wow! yes it's very blaming. Your code looks mutch more better! The $e was just for convenience. Actually I need something like this as end result: for($i=1;$i0"; $wgRes = $db->query($qString); while($row = $db->fetchObject($wgRes)): $categories[$i]

Re: [Mediawiki-l] spam, spam, spam, and spam

2011-04-14 Thread Daniel Friesen
On 11-04-14 04:28 AM, Anne Wilson wrote: > On Wednesday 13 April 2011 22:29:35 Daniel Friesen wrote: >> On 11-04-13 10:42 AM, Anne Wilson wrote: >>> On Wednesday 13 April 2011 18:01:30 Kilian wrote: On 04/13/2011 06:57 PM, Hiram Clawson wrote: > The spam is getting really tiresome. I turn

Re: [Mediawiki-l] Any help on sophisticated MySQL-Statemanet

2011-04-14 Thread Daniel Friesen
This will only get a series of cl_to's. I'm not sure what that $e is for, or what the /dev/null style fetchObject call is for, and I'm not sure what data output you're expecting. So I'll need more information if you want other information in the rows, a count, or a grouping of things together.

Re: [Mediawiki-l] spam, spam, spam, and spam

2011-04-14 Thread OQ
On Thu, Apr 14, 2011 at 7:08 AM, Schneelocke wrote: > On Thu, Apr 14, 2011 at 13:28, Anne Wilson wrote: >>> ^_^ That would be our autoconfirmed feature... and guess what, spambots >>> that know how to register, wait for the autoconfirmed time to elapse, >>> and then come back, already exist. Ther

[Mediawiki-l] Any help on sophisticated MySQL-Statemanet

2011-04-14 Thread Stefan Werthmann
Hi all! Could someone translate this to a single sophisticated mysql-statement (perhaps with a count() on the categories-result)? The code below retrieves category links from pages (articles) containing specific files. At the beginning I only have page ids from the filepages. for($i=1;$iquery($q

Re: [Mediawiki-l] spam, spam, spam, and spam

2011-04-14 Thread Schneelocke
On Thu, Apr 14, 2011 at 13:28, Anne Wilson wrote: >> ^_^ That would be our autoconfirmed feature... and guess what, spambots >> that know how to register, wait for the autoconfirmed time to elapse, >> and then come back, already exist. There are also ones that know how to >> confirm their own e-ma

Re: [Mediawiki-l] spam, spam, spam, and spam

2011-04-14 Thread Kilian
On 04/14/2011 01:28 PM, Anne Wilson wrote: > How do the spambots know what delay is set? They probably try periodically. -Kilian ___ MediaWiki-l mailing list MediaWiki-l@lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/mediawiki-l

Re: [Mediawiki-l] spam, spam, spam, and spam

2011-04-14 Thread Anne Wilson
On Wednesday 13 April 2011 22:29:35 Daniel Friesen wrote: > On 11-04-13 10:42 AM, Anne Wilson wrote: > > On Wednesday 13 April 2011 18:01:30 Kilian wrote: > >> On 04/13/2011 06:57 PM, Hiram Clawson wrote: > >>> The spam is getting really tiresome. I turned on ConfirmAccount and > >>> the spammers

Re: [Mediawiki-l] Dropping IE6 support (was: MediaWiki security release 1.16.4)

2011-04-14 Thread Siebrand Mazeland
On 14-04-11 10:02 Daniel Kinzler wrote: >Wow, seriously? IE6 should be taken out the back and shot... You're in luck. These days, even Microsoft agrees with you: http://www.ie6countdown.com/ So when will we be able to drop IE6 support in MediaWiki completely? What metrics/thresholds can we us

Re: [Mediawiki-l] MediaWiki security release 1.16.4

2011-04-14 Thread Kilian
Hi Tim, On 04/14/2011 09:47 AM, Tim Starling wrote: > Also, if you used > the Apache configuration I suggested in the previous release > announcement, you should update it to: > > RewriteEngine On > RewriteCond %{QUERY_STRING} \.[a-z0-9]{1,4}(#|\?|$) [nocase] > RewriteRule . - [forb

[Mediawiki-l] Page closure warning when previewing changes

2011-04-14 Thread Neil Bird
Having now been bitten a few times by this (and. OK, it's really just down to me being a numpty) I was wondering if there was an extension or built-in option to pop-up a JavaScript warning if the user tries to close an edit page that has a “changes preview” section (i.e., the current changes

Re: [Mediawiki-l] MediaWiki security release 1.16.3

2011-04-14 Thread Tim Starling
On 14/04/11 17:29, Gordon Joly wrote: > I see that this snippet is to be found in ".htaccess" file inside > ./images/ (this appears to be new file 1.16.3) > > Could the ".htaccess" be placed at top level (that is one above ./images/)? If you do that, then certain URLs that give harmless HTML res

Re: [Mediawiki-l] [Wikitech-l] MediaWiki security release 1.16.4

2011-04-14 Thread Daniel Kinzler
On 14.04.2011 09:47, Tim Starling wrote: > We missed the fact that there can be more than one question mark in a > URL. In certain circumstances, IE 6 will use a file extension > immediately before a question mark character, regardless of how many > question marks precede it. For example, with the

[Mediawiki-l] MediaWiki security release 1.16.4

2011-04-14 Thread Tim Starling
Our patch for the Internet Explorer 6 XSS issue (bug 28235) released two days ago in 1.16.3 was insufficient to fix that bug. The original reporter, Masato Kinugawa, pointed out the flaw on bug 28507. So we are doing another release, which contains a second attempt at fixing the issue. Apologies t

Re: [Mediawiki-l] MediaWiki security release 1.16.3

2011-04-14 Thread Brian J Mingus
On Thu, Apr 14, 2011 at 1:29 AM, Gordon Joly wrote: > On 12/04/2011 04:23, Tim Starling wrote: > > > > To fix this issue, configure your web server to deny requests with > > URLs that have a path part ending in a dot followed by a dangerous > > file extension. For example, in Apache with mod_rewr

Re: [Mediawiki-l] MediaWiki security release 1.16.3

2011-04-14 Thread Gordon Joly
On 12/04/2011 04:23, Tim Starling wrote: > > To fix this issue, configure your web server to deny requests with > URLs that have a path part ending in a dot followed by a dangerous > file extension. For example, in Apache with mod_rewrite: > > RewriteEngine On > RewriteCond %{QUERY_STRING