MWCryptHKDF was added ten years ago (in af66c04d39), and as far as
I can tell, it was never used anywhere. It seems unlikely that CryptHKDF
will be used in the future, at least in its current form, for several
reasons:
* PHP 7.1.2+ has hash_hkdf(), so HKDF() would not be needed.
* At the time MWCryptHKDF was created, access to a CSPRNG was dependent
on server configuration: operating system, enabled PHP extensions,
open_basedir, etc. The "clock drift" RNG used as a last resort was not
considered to be secure or fast enough for generating large amounts of
output.[1] random_bytes(), added in PHP 7, changed the situation.
* Depleting the input pool of Linux's RNG is no longer a concern; there
is no more blocking output pool for /dev/random.[2][3] In 2022, this
change and others, including some that improved performance,[4] were
backported to stable kernels as old as 4.9.[5]
* $wgAuthenticationTokenVersion obviated the primary use case of
quickly resetting the user_token field for all users, assuming all
the existing tokens are unique.
* CryptHKDF seems to perform much slower than random_bytes(), at least
on Linux, making it pointless to use given that the other reasons for
its existence no longer apply.
[1]: https://bots.wmflabs.org/logs/%23mediawiki-core/20161004.txt
[2]: https://lwn.net/Articles/808575/
[3]: https://lore.kernel.org/all/cover.1577088521.git.luto@kernel.org/
[4]: https://www.zx2c4.com/projects/linux-rng-5.17-5.18/
[5]: https://lore.kernel.org/all/Yo3pmh9hiUFtQz77@zx2c4.com/T/
Change-Id: I29136fad826341d21728671aa30285d5551f1162
Hard deprecated since MW 1.37, cannot be found in Codesearch, even with "Everything" selected.
Bug: T362636
Change-Id: Ie2e09d55a464f72e2fe9a01113629aafc38f2ce9
- Make si_page primary key
- Allow si_title to be larger
- Switch from utf8 to utf8mb4
- Remove default of empty string for titles
Sqlite is not migrated, as it has it's own overrides
Postgres is migrated, but is not in actual use
This is mostly from I273e3a7715abf97d2889904642c7c375e76de4f6
Bug: T249976
Bug: T231827
Change-Id: I12adff3e6ca6a9986ff207bef16272195c3a6a48
(cherry picked from commit a2ba7ee14d6b38a5e89bcc63c3bd0ca8b5107702)
Follow up to I4c249acb1fcd0848428c99b8d3badebbc38b5dac
to note that previously soft deprecated methods now emit
warnings.
Bug: T377521
Change-Id: Ia02cad71d2274cecc7ad39ca9e2e94c149360213
Methods were deprecated in 1.39 and the majority of skins are now
updated. This change means that skins can no longer override the rendering
of the HEAD element meaning extensions can rely on ResourceLoader support,
and hooks that modify the HEAD element indirectly
The new Skin::outputPageFinal method is adding to honor the existing
outputPage method that is stable to override but to prevent extending skin classes
from generating HTML which does not include HTML generated by hooks e.g.
ResourceLoader internals. This new method is for
internal usage by OutputPage only for this reason.
This keeps all HTML generation inside
the Skin class (e.g. preserves the status quo) until we can work out better
boundaries between Skin and OutputPage.
Bug: T306942
Change-Id: Ib023ef3335bb72306a01230b6cd1169dc7652588
(cherry picked from commit c7656257159a3d85422f4558f5add6df1564f3c3)
In a future release this will return an array, not a reference to the
internal array, to maintain abstraction and allow for representation
changes internal to ParserOutput.
This patch just add deprecation notices to the class and to the
release notes.
Change-Id: Ie3a3f98402c5a5a3a92326d7736c0df874829a6b
Should be merged only when appropriate for
migrating from "kr" to "knc" on translatewiki.
See bug T356144.
The autonym is from Ethnologue.
The namespace translations are by User:MohammedBama123
(Mohammed Mustapha Bulama), shared at:
https://incubator.wikimedia.org/w/index.php?title=Talk:Wp/knc/Main_Page&oldid=6416513#Namespaces
Bug: T356144
Change-Id: Ifa1a692619d3b12e279cc74482b6327262fcb20f
* Skin::makeSearchInput has been deprecated @since 1.35
and was replaced with a final method on SkinTemplate
* Skin::makeSearchButton has been deprecated @since 1.39
- and was replaced with a final method on SkinTemplate
* SkinTemplate::buildContentNavigationUrls deprecated @since 1.38
and has no consumers.
* Merges the @internal makeSearchButtonInternal method into
makeSearchButton per deprecation note
Bug: T377521
Change-Id: I59c75d5636fc7958cc6ee4444f9c32d79fefa15d
Fix two problems that made it difficult to convert between Message
and MessageValue, or to write code that could accept both of them,
as exemplified by the StatusValue class:
* Implement a common interface
* Use the same internal format for message parameters
While these changes should be compatible with most of existing code,
where the authors were courteous enough to simply call methods such
as Message::numParam() and not look inside the values they return,
it is potentially a breaking change for anything that depended on
the formatted params being arrays or accessed their keys.
Example patches: https://gerrit.wikimedia.org/r/q/topic:message-param
Notable changes:
* Message and MessageValue now both implement MessageSpecifier
(only Message implemented it before).
* Message::numParam() and other static methods for encoding params
now return MessageParam objects, instead of special arrays.
Use these MessageParam objects internally in Message.
* Narrow down the return type of MessageSpecifier::getParams() (it
was just `array`, allowing any type in the array). Narrow down the
types for Message::params() and MessageValue::params() to match.
* Deprecate MediaWiki\Message\Converter. As a replacement add
MessageValue::newFromSpecifier(), which is analogous to
Message::newFromSpecifier(), but without weird legacy edge cases.
* Make StatusValue::getMessages() return MessageValues. Remove code
that converted between Message and MessageValue, no longer needed.
* Update many type declarations and comments to use MessageSpecifier
instead of MessageValue, as well as a couple of tests that depended
on implementation details.
Bug: T358779
Change-Id: I625a48a6ecd3fad5c2ed76b23343a0fef91e1b83
HtmlInputTransformHelper::setMetrics() and
HtmlToContentTransform::setMetrics() take a StatsFactory now; deprecate
passing a StatsdDataFactoryInterface.
Depends-On: I0d8eb6cacd761fa4959419b10d59046e61c714ff
Change-Id: I2374731f6d37a191fc4a865d2665f2ca18182db1
This deprecates a number of methods which returned arrays by reference and
exposed internal representation details of the ParserOutput. It also
regularizes the return values to return consistent LinkTarget values,
working around the wide variety of different internal storage formats
used for links.
In the future, once these methods which expose the internal representation
are removed, we can simplify our internal storage as well. But for the
moment we add the new getter without changing the internal representation.
Note that by returning TitleValue objects this new interface also provides
a means to fix the issue identified in T204792 where interwiki and namespace
prefixes were getting confused. A TitleValue properly distinguishes between
these -- although the callers will still have to be careful to use it as
a TitleValue and not attempt to reparse it.
These methods also correctly handle fragments, which are present for the
language link type but stripped for the other linkt types.
Bug: T204792
Change-Id: I48a2077b9645124f83082afd953d6bf7a861270b
Use OutputPage::setIndexPolicy() so that we document the change in
behavior for OutputPage::setRobotPolicy() and emit deprecation
warnings as needed.
Bug: T377586
Change-Id: Ieab6a66b7ba868acf4da2d785a44a0307c0dacc1
As a first step in a plan to reduce redundancy in OutputPage, replace
the $mIndexPolicy property of OutputPage with the corresponding
getter/setter methods in a ParserOutput held for the purpose of
storing metadata.
Bug: T301020
Change-Id: I6073f4033be936b669532ecf8104a8e5ff498e24
