Jump to content

Extension talk:WikiForum

About this board

Please report WikiForum bugs on Phabricator rather than on this page.

--> Archived old talk

Will the security issues be addressed?

3
SungHerSong (talkcontribs)

I really like this extension and would like to re-add it to my project to re-create our original wiki's forums (Wetpaint/Wikifoundry hosted) which in many ways acted as our original talk pages.

Is anybody planning to resolve the security issues? Or should I start considering other options?

Jack Phoenix (talkcontribs)

I posted a patch for testing on the currently non-public Phabricator ticket about a couple weeks ago. Nobody's commented on it so far, so if no-one comments on it and points out obvious issues (not that I saw any, but it's been a while since I actually worked on it), I'll probably just commit it and +2 it myself by the end of the year or so.

That said, the issues aren't really that big. An actual security engineer told me once that CSRF issues aren't much of a big deal with modern browsers anymore and the "XSS" possibility is basically "some messages accept raw HTML (but they probably shouldn't)" ā€” problematic if and when you don't trust the people with the wikiforum-admin user right, but if you do trust the users with that right, then it's unlikely to be an issue. Really, it's like with the editinterface user right in general: be careful about who you hand it out to and you'll be fine.

Pspviwki (talkcontribs)

I would really like to install a forum but any security issue is a show-stopper. As a developer you can do your own penetration testing on your installation using zaproxy https://www.zaproxy.org/

Response from Phabricator may take a few years, they have limited capacity.

Reply to "Will the security issues be addressed?"

cannot create a topic

3
107.77.205.159 (talkcontribs)

Install went smoothly, and set-up went well, until I tried to actuall post a topic:


[Yl3RvajgvwANJiXOLIwiDAAA5gQ] /index.php?title=Special:WikiForum&wfaction=addthread&forum=3 InvalidArgumentException: WikiPage constructed on a Title that cannot exist as a page: Special:WikiForum

Backtrace:

from directory/includes/page/WikiPage.php(175)

#0 directory/includes/page/Article.php(143): WikiPage->__construct(Title)

#1 directory/includes/page/Article.php(129): Article->newPage(Title)

#2 directory/extensions/WikiForum/includes/WikiForumGui.php(239): Article->__construct(Title)

#3 directory/extensions/WikiForum/includes/WFThread.php(969): WikiForumGui::showWriteForm(boolean, array, string, string, string, string, User)

#4 directory/extensions/WikiForum/includes/WFForum.php(703): WFThread::showGeneralEditor(string, string, string, array, User)

#5 directory/extensions/WikiForum/includes/specials/SpecialWikiForum.php(158): WFForum->showNewThreadForm(string, string)

#6 directory/includes/specialpage/SpecialPage.php(647): SpecialWikiForum->execute(NULL)

#7 directory/includes/specialpage/SpecialPageFactory.php(1366): SpecialPage->run(NULL)

#8 directory/includes/MediaWiki.php(314): MediaWiki\SpecialPage\SpecialPageFactory->executePath(string, RequestContext)

#9 directory/includes/MediaWiki.php(930): MediaWiki->performRequest()

#10directory//includes/MediaWiki.php(564): MediaWiki->main()

#11 directory/index.php(53): MediaWiki->run()

#12 directory/index.php(46): wfIndexMain()

#13 {main}

Jack Phoenix (talkcontribs)

Can you provide more information about your setup, e.g. MediaWiki version? The exception message ("WikiPage constructed on a Title that cannot exist as a page") seems to not even exist in MediaWiki 1.35, the current LTS release, which is what WikiForum has been currently tested with and somewhat guaranteed to work (as per social tools/MediaWiki compatibility, which basically applies to all other extensions and skins I also maintain). I tested out both topic creation and replying to an existing topic on my local 1.35 install and both worked just fine.

It's unfortunate, though hardly surprising, that things break with newer versions of MediaWiki, especially as the powers that be intentionally make breaking changes to the underlying APIs. I cannot promise anything else than to take a look, but the guaranteed fix is to use a compatible (LTS) version of MediaWiki core, i.e. the 1.35 series currently.

107.77.205.155 (talkcontribs)

Thank you Jack. This is from my "version" special page:

Product Version MediaWiki 1.37.1 PHP 8.0.17 (litespeed) MySQL 5.7.23-23 ICU 69.1 Pygments 2.10.0 Entry point URLs Entry point URL Article path /index.php/$1 Script path / index.php /index.php api.php /api.php rest.php /rest.php

Reply to "cannot create a topic"

Mediawiki time does not match extension time

1
62.176.23.211 (talkcontribs)

Mediawiki shows the correct time (timezone)

WIKIFORUM shows time in sections, topics, messages - UTC time

what could be the mistake?


Windows Server 2012

MW 1.33.1

PHP 7.3.9


Reply to "Mediawiki time does not match extension time"
There are no older topics