Commit graph

348 commits

Author SHA1 Message Date
Tim Starling
917f0a5996 Replace all instances of "per default" with "by default"
According to the dictionary, "per" (or more conventionally "as per")
means "according to". Refer OED "per" sense II.3.a. For example:

"No value was passed, so return null, as per default".

In this sentence, we are not specifying the default, we are referring
to the default. This correct usage of "per default" was used nowhere
in MediaWiki core as far as I can see.

Instead we have "per default" being used to mean "by default", that is,
giving the value to use when no explicit value was specified.

In OED, the phrase "by default" is blessed with its own section just
for computing usage:

"P.1.e. Computing. As an option or setting adopted automatically by a
computer program whenever an alternative is not specified by the user
or programmer. Cf. sense I.7a."

There are highly similar pre-computing usages of the same phrase,
whereas the phrase "per default" is not mentioned.

As a matter of style, I think "per default" should not be used even
when it is strictly correct, since the common incorrect usage makes it
ambiguous and misleading.

Change-Id: Ibcccc65ead864d082677b472b34ff32ff41c60ae
2024-04-29 10:47:54 +10:00
Amir Sarabadani
cf77897613 Run pagelinks migration for third parties too
Production is read new almost everywhere, mediawiki core should reflect
that as well.

Bug: T299947
Change-Id: I8f05c4d7026394205bfc54b68dc725392852ae2a
2024-04-27 16:57:37 -04:00
Kosta Harlan
6efd008f33 TempAccounts: Rate limit acquisition of temp account names
Why:

- We don't want to allow unlimited acquisition of temp account names.
  These should be rate limited in similar way to how we limit the
  creation of temp accounts

What:

- Provide a TempAccountNameAcquisitionThrottle, and use it in the
  acquireName() method
- Set a default that is 10 times the limit of
  TempAccountNameCreationThrottle

Depends-On: If660aad1d0f04f366414084aff3f88484a19d416
Bug: T343101
Change-Id: I99d5973498a89ac227847de5837c0a8e895c28fb
2024-04-23 13:33:57 +00:00
jenkins-bot
40f4502e9c Merge "Update wgAutoCreateTempUser config defaults" 2024-04-04 09:34:11 +00:00
Dreamy Jazz
102424bfb3 Update wgAutoCreateTempUser config defaults
Why:
* The default value of wgAutoCreateTempUser has not changed since
  the decision to use a different prefix for temporary accounts
  (T332805).
* The default needs to be updated to reduce the number of overrides
  in operations/mediawiki-config and also to make the development
  experience more consistent with what is happening on WMF
  production.

What:
* Update the wgAutoCreateTempUser default in the following ways:
** Set expireAfterDays as 365
** Set notifyBeforeExpirationDays as 10
** Set genPattern and reservedPattern to '~$1'
** Set matchPattern to null, which will mean that the genPattern
   is used as the value.
* Update RealTempUserConfig::getPlaceholderName to add the year to
  the placeholder name so that if the match pattern includes the
  first digit of the year, then the placeholder name still is
  considered a valid temporary account username.
* Replace modifications of the wgAutoCreateTempUser config in
  integration tests with a use of the TempUserTestTrait to make
  the code cleaner and make it easier to find tests that relies on
  the values in wgAutoCreateTempUser.
* Update multiple tests to handle the new defaults for the config.

Bug: T359335
Change-Id: Ifa5a0123cd915bdb7c87e473c51fb93321622f12
2024-04-03 16:25:47 +00:00
Steph Toyofuku
1e26f420dc Add new conditional default conditions for user options: anon and named
Adds two new conditional user option default conditions CUDCOND_ANON and
CUDCOND_NAMED, for the purpose of allowing the specification of a
separate default user option for logged-out users.  We're taking two
different approaches to the targeting of logged-out users (anon vs
named) because of the temporary users project - anon will not include
temporary users while named will allow us to target only fully created
user accounts.  This will be ultimately be used for the rollout of the
reading accessibility settings menu

Bug: T360098
Change-Id: I316d231330159770f05234dd2f5fdb7d07531002
2024-04-02 14:46:53 -07:00
Timo Tijhof
4110f91b22 MainConfigSchema: Consistently mark unstable flags as @unstable
Follows-up 5c78508628, which added ShowLogoutConfirmation (T357484).

Also mark these with appropiate since tags:

* DjvuUseBoxedCommand, T352515.

* UseContentMediaStyles, 8b5f95a963 (1.38.0), T51097.
* UseLegacyMediaStyles, f99dc83677 (1.41.0), T318433.

* EnablePartialActionBlocks, c67f181dd4 (1.37.0) T280531, T280532.

* EnableEditRecovery, 404f3a205d, T341844.

* UseCodexSpecialBlock, 22dc49a5c5, T358153.

Bug: T357484
Change-Id: Ib71902ea46789819069d2351953e308fef3b4c90
2024-03-29 18:07:41 -07:00
jenkins-bot
0ec86c1fb0 Merge "Switch Special:Upload to use async upload-by-url" 2024-03-28 15:22:13 +00:00
Giuseppe Lavagetto
cfa7ed13b1 Switch Special:Upload to use async upload-by-url
With this change, when async uploads are enabled, upload-by-url
will spawn a job and a form with a button to check the status of the
process is shown to the user.

In the process, add processing of warnings in the remote jobs spawned by
the API or the Special page. This is done by adding checks to
UploadJobTrait::verifyUpload. In order to manage warnings serialized in
the job status, a method to unserialize the result of
UploadBase::makeWarningsSerializable.

Things that we might want to fix:
* The form's UI is abysmal, we should probably use Codex
* While it's not a huge deal, I'd like to figure out why I need to
purge the page cache if I want the file to show up. And more
interestingly, why this doesn't happen when uploading via the API

Bug: T295007
Bug: T118887
Change-Id: I49181d93901f064815808380285fc4abae755341
2024-03-28 11:01:46 +01:00
Bartosz Dziewoński
dd992c1a7d Remove $wgHTMLFormAllowTableFormat and its uses
Described as "Evil hack for mobile :(", this config variable had been
overridden in the MobileFrontend extension for some time, but this has
been removed last year in Icb1711a0cef828dda0d99b8a7c7963bc409816c9.

Since it was introduced, most HTMLForms using the 'table' format have
been reworked to use 'ooui' (or 'codex', these days), so the hack is
no longer needed.

We recently removed $wgUseMediaWikiUIEverywhere for similar reasons
in aa7eeeeef9 / be135c0fc0.

Change-Id: Id507c0dc5a1c1cfb9737073bae97b14badc30a54
2024-03-26 22:49:55 +01:00
Giuseppe Lavagetto
c2373af679 Add job for upload from UploadFromUrl
This is the first step to make upload from url work asynchronously

Bug: T295007
Change-Id: I1fb30352849b543c0fb1f27028a34d49dff17797
2024-03-23 11:23:07 +01:00
Derick Alangi
d372626b97
objectcache: Introduce ObjectCacheFactory MW service
ObjectCache is already doing a lot of factory pattern logic like
creating instances of the various BagOStuff, this should really be
the responsibility of the factory servicet.

This patch introduces a proper factory (ObjectCacheFactory) to handle
the responsibility of creating various instances of BagOStuff. Since
`newFromParams()` is a static function that gets passed in configuration
of $wgObjectCaches, that can stay that way (to keep supporting how we do
this in prod today).

Technical Breaking Change: `ObjectCache::makeLocalServerCache()` now has
a parameter and requires it but there are no callers of this method outside
MW core hence it is safe to change (and this patch update all callers) to
work correctly. Cache prefix is gotten from global state because sometimes
at this stage, the services container is not available.

Bug: T358346
Change-Id: I3179a387486377c6a575d173f39f82870c49c321
2024-03-19 12:38:39 +03:00
hmonroy
5c78508628 Add temporary feature flag for logout confirmation
Add a temporary feature flag that is going to be covering the work
around implementing a logout confirmation.

Bug: T357484
Change-Id: I3ee8f52976cb956e24f32115c02903c5c4f358c3
2024-03-15 19:05:47 -07:00
jenkins-bot
5d8b59b3ea Merge "ResourceLoader: Add module property skipStructureTest" 2024-03-13 22:09:01 +00:00
daniel
a9ba533bd7 Config: Mark MainPageIsDomainRoot official
The MainPageIsDomainRoot setting has been supported since 1.34, time to
remove the "experimental" marker.

Note that this setting was never marked as experimental in the documentation: <https://www.mediawiki.org/wiki/Manual:$wgMainPageIsDomainRoot>. It seems likely that it is in use on many third party wikis already.

Change-Id: I02d2b2d4569f505d5dcc59ae60bc9f64deee064c
2024-03-13 15:23:37 +00:00
Tim Starling
c45ca5c0e3 ResourceLoader: Add module property skipStructureTest
Allow extensions with very special modules that can't be called in a
testing environment to skip ResourcesTest::testRespond().

Needed by If1186797fd047d4f for ext.wikisource.OCR.

Change-Id: Id02915d9633c2d8209d2ff2e60f6748095ec10fe
2024-03-11 17:01:16 +00:00
jenkins-bot
3eaeedc5c2 Merge "Add TranslationAliasesDirs to specify special page aliases in JSON" 2024-03-06 16:51:34 +00:00
Kosta Harlan
08fef95627
TempUserCreator: Use separate rate limit for temp account creations
Why:

- The pathway to creating a regular account is different from that of a
  temporary account. It makes sense to rate limiting creation of these
  two types of accounts at different rates.

What:

- Add a TempAccountCreationThrottle config with a restrictive default
  that matches the existing production configuration of
  AccountCreationThrottle (6 creations per day)
- Update resetAuthenticationThrottle.php to support resetting the temp
  account creation throttle
- For now, not adding an equivalent hook for account creation throttle's
  ExemptFromAccountCreationThrottle

Bug: T357777
Change-Id: Ibf36ac96f717107bace6f0a3326f79ed129a1dfe
2024-03-06 14:41:15 +01:00
Abijeet
8ddc4ee2ef Add TranslationAliasesDirs to specify special page aliases in JSON
The TranslationAliasesDirs configuration allows defining translatable
aliases in JSON files. The value should be a name or names of folders
that contains files that have localized aliases. Each language should
have a separate file.

Currently, it supports defining special page aliases but in the
future can be extended to support magic words and namespace aliases.

The patch adds a script: ConvertExtensionsMessagesToTranslationAlias
that can be used to convert existing ExtensionMessagesFiles to the new
format.

Bug: T89947
Change-Id: Ief16a48a8dc8742854f67301791aa2a0b0531116
2024-03-06 18:13:28 +05:30
jenkins-bot
c3b32c0af5 Merge "config: Fix indenting of comment for EditPageFrameOptions" 2024-02-29 19:39:10 +00:00
Reedy
ce1f4d5c55 config: Fix various typos
Change-Id: I0d29beb873d1867a642b787c0e40d2487d1e1691
2024-02-29 18:59:00 +00:00
Reedy
3f1ea15679 config: Fix indenting of comment for EditPageFrameOptions
Change-Id: I1ecdfe47f75195ad8429830e4b5d038aa3452109
2024-02-29 18:42:18 +00:00
hmonroy
22dc49a5c5 Add feature flag for Codex Special:Block UI
Introduce a temporary feature flag that will be used to display
Special:Block UI in Codex.

Bug: T358153
Change-Id: I74bc90af986ac2f429a952a19b6edf4fb02c5618
2024-02-21 13:52:29 -08:00
Tim Starling
380d398f1d Remove $wgUseSameSiteLegacyCookies
After the deployment of the updated mediawiki.cookie module, the
configuration variable can be safely removed.

Bug: T344791
Change-Id: Idf3b3ef521ef2ac368c3f575f99bf4c6da7baa82
2024-02-14 11:26:30 +11:00
jenkins-bot
86965e099d Merge "Drop deprecated config $wgOpenSearchTemplate" 2024-02-13 17:22:42 +00:00
Amir Sarabadani
ef7497d8cd Drop deprecated config $wgOpenSearchTemplate
Not to be confused with $wgOpenSearchTemplates (plural)

Soft-deprecated since 1.25 and hard-deprecated since at least
I9776d11d4e2d184 (1.39).

Not set in production.

Change-Id: I6a95b9e0e2b74bb44d51c375a62886761ec9ea88
2024-02-12 19:54:00 +01:00
Brian Wolff
ea84b992ef Change $wgSVGMetadataCutoff default to 5 MiB (previously 512KiB).
This is used to (among other things) detect lang tags in multilingual
SVGs. Users have complained that lang tags are often missed in large
SVG files.

The cut-off is used for two things during upload:
* Run some (simple) regexes to detect <?xml header
* Use XMLReader (with entity substitution enabled!) to look for specific tags.

The first check doesn't make sense to use a configurable cut off. Change
it to look at the first 4096 bytes only. The <?xml header is required to be
the first thing in the file other than BOM, so this should be more than
sufficient. XML parsers give a fatal error if there is whitespace before
the <?xml declaration.

It seems unlikely to be problematic to use XMLReader on up to 5MB of the file,
since that is a "pull" XML parser, and won't load the entire file at once.
The code that cuts off the SVG at the 5MB mark likely uses more memory
than parsing the file does. In fact, we separately use XMLReader to do
security checks with no such cut-off, so potentially it could even make sense
to remove the cut-off entirely, since clearly parsing the full file is not
causing problems.

Bug: T270889
Change-Id: I7350918647d92c40934a7c86e906b6bfb8a40ada
2024-02-09 19:20:34 -08:00
jenkins-bot
b235bbab53 Merge "Always log a message when disableLocalTransform is hit" 2024-02-09 11:27:31 +00:00
Tim Starling
7c81d82d76
Stop using $wgUseSameSiteLegacyCookies
* Deprecate the wgUseSameSiteLegacyCookies configuration variable and
  imply false (the previous default).
* Deprecate WebRequest::getCrossSiteCookie(), which was introduced to
  support this feature.
* Ignore the sameSiteLegacy option if it is passed to
  WebResponse::setCookie() or mediawiki.cookie.set(). The configuration
  variable can't be removed until the after the JS change is deployed.

Bug: T344791
Change-Id: I30392ebc02809bc6b6ee2070d3e468e48d5d1fae
2024-02-06 16:25:38 -08:00
jenkins-bot
0e593c7a28 Merge "Migrate bot passwords to virtual domains" 2024-02-07 00:11:25 +00:00
Dreamy Jazz
79dd6be086 Remove mention of removal in 1.38 for wgEnablePartialActionBlocks
Why:
* The wgEnablePartialActionBlocks config is marked as unstable,
  but also as to be removed before 1.38.
* This is no longer the case as this config is present in 1.42 and
  as such this should be removed and instead still indicate this
  is unstable without listing a release version for this config.

What:
* Reword the @unstable tag for the wgEnablePartialActionBlocks
  to no longer reference a specific release version.

Bug: T280531
Change-Id: I317cd07c42aa59c6a45bf7403fdc79a363880bb5
2024-02-06 13:41:49 +00:00
jenkins-bot
d9ae1a9609 Merge "grants: Fix risk rating of 'privateinfo'" 2024-02-05 14:29:37 +00:00
Bartosz Dziewoński
be135c0fc0 Remove $wgUseMediaWikiUIEverywhere
MediaWiki UI has never really made it out of beta before being
deprecated. Legacy code using plain HTML forms doesn't need it;
new code can be written using Codex.

Bug: T182050
Change-Id: Ib9966bc6a4a94f771cb99a5aa52fb6a1dc826ca5
2024-02-05 09:05:14 -05:00
Gergő Tisza
b73cce53f7 grants: Fix risk rating of 'privateinfo'
Per T290790#9447932, not actually risky.

Bug: T290790
Change-Id: I99e3f8d7e6cf210954325f2d066cc1475af9bd3a
2024-02-05 13:41:18 +00:00
Amir Sarabadani
be5593b10d Migrate bot passwords to virtual domains
Bug: T351559
Change-Id: I645f1e4a4517b9177286e834236b0c047bef928c
2024-02-01 17:35:29 +01:00
Amir Sarabadani
2d66025fdf Drop deprecated configs $wgMinimalPasswordLength and $wgMaximalPasswordLength
Soft-deprecated since 1.26 and hard-deprecated since at least
I9776d11d4e2d184 (1.39).

Not set in production.

Change-Id: I55e4569c5a40f77a719bc7ab1924eaa706e0da53
2024-02-01 16:29:05 +01:00
jenkins-bot
e4ab75aad5 Merge "rdbms: clarify allowed characters in DBname/DBschema/DBprefix" 2024-01-31 00:25:42 +00:00
Amir Sarabadani
4c68983623 Drop deprecated config $wgAllowImageTag
Soft-deprecated since 1.35 and hard-deprecated since at least
I9776d11d4e2d184 (1.39).

Not set in production.

Change-Id: I68b68ffcdff22daafad34c186d1cc609dcecbf32
2024-01-30 11:42:54 +00:00
Reedy
e2f9bea62b Fix casing of Mediawiki to MediaWiki
Change-Id: I0f266a034a99255b27fd96d82335d6e710a61f20
2024-01-29 17:15:04 +00:00
Amir Sarabadani
c1043ec8ff Drop deprecated config SquidPurgeUseHostHeader
Soft-deprecated since 1.33 and hard-deprecated since at least
I9776d11d4e2d184 (1.39). It's already noop in the code.

Not set in production.

Change-Id: I5895bc4dae9620d53c37188662e21bf01ae7bd85
2024-01-26 16:47:11 +01:00
Amir Sarabadani
ba1563a0ba Drop deprecated config ContentHandlerTextFallback
Soft-deprecated since 1.37 and hard-deprecated since at least
I9776d11d4e2d184 (1.39)

Not set in production.

Change-Id: I0b25e89d1652dfa697ab1176a1e2b6ca3163bdab
2024-01-26 12:45:18 +01:00
jenkins-bot
939fa4e5e5 Merge "Drop deprecated config $wgLogoHD" 2024-01-24 22:40:47 +00:00
Amir Sarabadani
167fbd0a20 Drop deprecated config $wgLogoHD
It has been deprecated since 1.35, hard deprecated since at least I9776d11d4e2d184

No grep result in wmf-config

Change-Id: I2c67bab3e3212f25a0cbce7301f5e32a082f76da
2024-01-24 19:46:04 +01:00
TheresNoTime
2466abb518 EditRecovery: Add user preference
Add a user preference to allow the user to enable or disable
EditRecovery.
Set the default as disabled.

Bug: T350653
Change-Id: Ibbb59eb84f1dd0b40f9576e048f2ac76044f9014
2024-01-23 13:28:31 +00:00
Gergő Tisza
9de0e23b48 Support dependency injection in log formatters
Use ObjectFactory specifications instead of class names in
$wgLogActionHandlers, like in most other places. Class name
support is retained for B/C.

Also remove old LogPage code that assumed $wgLogActionsHandlers
is an array of callables. This is how $wgLogActionsHandlers was
defined in b6d72cfeb2, but then
4ac56c2466 redefined it to an
array of classnames (and I6846ce0 adjusted the documentation),
and the old functionality has been broken since.

Make LogFormatter::__construct() public so subclasses can be
created in the service wiring.

Technically this is a breaking change since there is no
guarantee existing formatter classes are publicly creatable,
but there is no way to issue a deprecation warning about that,
and it isn't really covered by the stable interface policy.
All non-public constructors found by codesearch are fixed in
companion patches.

Bug: T54220
Change-Id: I72427a4b3f4be1c3c1eb3522a8b58fe9445a3397
Depends-On: Ie691e8d59141f696619dce8f756645c45a3e943a
Depends-On: I41562247d51f4f9fe8dafed37ba2ad81c881d99d
2024-01-20 16:36:56 +01:00
Aaron Schulz
448bdf06b1 rdbms: clarify allowed characters in DBname/DBschema/DBprefix
Change-Id: I8e010b27cc436d845687843c2a20dbd89ebe2197
2024-01-18 15:56:35 +00:00
jenkins-bot
e462a9275d Merge "Support multiple matchPatterns in temp user autocreate config" 2024-01-17 17:25:04 +00:00
jenkins-bot
55c5c9ee6f Merge "user preferences: Add some information about types to the phpdoc" 2024-01-17 14:44:10 +00:00
Dreamy Jazz
7f588780a0 Support multiple matchPatterns in temp user autocreate config
Why:
* There is a need to update the generation and match pattern on
  WMF wikis to a new format that includes the year and starts with
  `~`. As such, the 'matchPattern' key needs to be updated.
* Removing the old 'matchPattern' from the wgAutoCreateTempUser
  config currently leaves existing temporary accounts as no longer
  recongnised as temporary accounts.
* Instead, the 'matchPattern' needs to be able to take an array of
  string patterns so that old patterns can still be used for matching.

What:
* Update the MainConfigSchama to indicate that 'matchPattern' in the
  wgAutoCreateTempUser config can be an array of strings.
* Add TempUserConfig::getMatchPatterns and deprecate TempUserConfig::
  getMatchPattern. This is needed because ::getMatchPattern was typed
  to only ever return one Pattern, which is no longer the case with this
  config change.
* Update the RealTempUserConfig to support multiple patterns defined in
  the 'matchPattern' key. The RealTempUserConfig::getMatchPattern method
  returns the pattern or first pattern if multiple are defined to allow
  time for existing usages of this deprecated method to be updated.
* Update the RealTempUserConfig to rely on other methods instead of checking
  object property values where possible (e.g. use ::isEnabled instead of
  checking $this->enabled) to allow easier unit testing.
* Update UserSelectQueryBuilder and ChangesListSpecialPage to use TempUserConfig
  ::getMatchPatterns instead of ::getMatchPattern.
* Update mediawiki.util/util.js to be able to parse the 'matchPattern' value
  when it is an array of strings.
* Update maintenance/userOptions.php to use ::getMatchPatterns instead of
  ::getMatchPattern.
* Add and update unit and integration tests for the new code, as well as
  expanding coverage over existing code that was indirectly affected.

Bug: T354619
Change-Id: I3763daefe4dc7c76370bd934fb20452591c9c762
2024-01-17 11:24:26 +00:00
Gergő Tisza
183372c995 authz: Group grants by riskiness
Bug: T290790
Change-Id: Ib7a195c167f82e686c4ede45388957f9988bf75d
2024-01-16 23:55:48 +01:00