Current configuration on the wiki
Find a file
Gergő Tisza b1adf3c728 SECURITY: Allow extensions to supress the reauth flag on login
CVE-2025-6926

This is a workaround for extensions with some sort of "autologin"
implemented via the login page to indicate that the login flow
didn't involve the user actually logging in, it merely copied
some central login state, and so isn't appropriate for the
reauthentication flag.

This isn't the best way to provide an interface to extensions
(if we keep it, a more explicit interface, such as a
SessionPropertiesAuthenticationRequest object that's part of
the initial request set and can be modified by providers,
and can also be used for the "remember me" flag, would be
nicer), and maybe the whole approach of letting extensions
suppress the reauthentication flag is not the best way of
handling the problem in the first place, but it's simple
which is important for a security patch.

Bug: T389010
Change-Id: Ifce73837b25b0caad2d3d3cba000cceb0184c29d
2025-06-30 19:58:42 +01:00
.phan structure tests: allow PHP 8.1 syntax and autoload enums 2025-06-18 10:55:15 +01:00
cache In .htaccess deny files, use "Satisfy All" 2025-04-04 13:17:15 +00:00
docs [REST Sandbox] Remove SwaggerUI from MediaWiki Releases 2025-06-30 16:05:49 +01:00
extensions Update git submodules 2025-06-30 14:30:45 +00:00
images
includes SECURITY: Allow extensions to supress the reauth flag on login 2025-06-30 19:58:42 +01:00
languages [REST Sandbox] Remove SwaggerUI from MediaWiki Releases 2025-06-30 16:05:49 +01:00
maintenance composer.json: Updated nikic/php-parser from ^4.10.2 to ^5.3.1 2025-06-18 10:54:38 +01:00
mw-config installer: Fix class name in example override 2025-01-25 15:07:10 +00:00
resources SECURITY: apisandbox: Fix reflected XSS when invalid 'format' is provided 2025-06-30 19:58:40 +01:00
skins Update git submodules 2025-06-24 06:32:01 +00:00
tests specials: SpecialTalkPage: Use config from request context 2025-06-28 15:11:13 +00:00
vendor@b96399785b Update git submodules 2025-06-16 09:42:09 +00:00
.dockerignore
.editorconfig Fix .editorconfig for tests/parser/ directory 2024-02-27 17:35:16 +01:00
.eslintignore REST: validate JSON in tests 2024-09-20 15:42:32 +00:00
.eslintrc.json
.fresnel.yml Add explanatory comment for .fresnel.yml 2022-02-01 20:32:20 -05:00
.git-blame-ignore-revs Add .git-blame-ignore-revs 2024-06-02 23:03:04 +02:00
.gitattributes .gitattributes: Ship docker-compose.yml to the tarball 2022-11-30 09:37:13 -05:00
.gitignore Branch commit for REL1_43 2024-10-22 12:47:33 -04:00
.gitmessage git: Introduce .gitmessage 2023-05-21 14:20:31 +03:00
.gitmodules Branch commit for REL1_43 2024-10-22 12:47:33 -04:00
.gitreview
.mailmap build: De-duplicate two recent CREDITS additions via mailmap 2024-09-11 10:02:02 -07:00
.phpcs.xml build: Use inline ignore for MediaWiki.Usage.DeprecatedGlobalVariables 2024-09-26 18:15:32 +00:00
.stylelintrc.json Login page: Use Codex CSS components 2023-07-06 17:20:17 -07:00
.svgo.config.js
.vsls.json
api.php Namespace includes/context 2024-02-08 11:07:01 -05:00
autoload.php [REST Sandbox] Remove SwaggerUI from MediaWiki Releases 2025-06-30 16:05:49 +01:00
CODE_OF_CONDUCT.md
composer.json composer.json: Updated nikic/php-parser from ^5.3.1 to ^5.5.0 2025-06-18 10:30:59 +00:00
composer.local.json-sample
COPYING Replace HTTP by HTTPS in docs 2017-10-15 11:11:16 +02:00
CREDITS build: De-duplicate two recent CREDITS additions via mailmap 2024-09-11 10:02:02 -07:00
DEVELOPERS.md Codex: Allow a local development version to be used 2024-08-22 17:20:24 -07:00
docker-compose.yml dev(docker): Bump mediawiki-web container to dev/bookworm-apache2:1.0.1 2025-01-07 17:02:36 +00:00
FAQ
Gruntfile.js Merge "codex: Provide i18n function and messages" 2024-07-03 07:06:47 +00:00
HISTORY HISTORY: Add point releases 2024-10-01 02:21:50 +01:00
img_auth.php filerepo: extract AuthenticatedFileEntryPoint from img_auth.php 2024-05-16 13:22:00 +02:00
index.php Namespace includes/context 2024-02-08 11:07:01 -05:00
INSTALL INSTALL: Document requirement for bcmath/gmp on 32-bit systems 2025-04-18 15:57:48 +00:00
jsdoc.json Update jsdoc-wmf-theme from 1.0.1 to 1.1.0 2024-06-27 19:29:24 +00:00
load.php ResourceLoader: Follow-up creation of ResourceLoaderEntryPoint 2024-02-22 22:30:39 +00:00
opensearch_desc.php Replace direct use of $wgRestPath with wfScript() 2024-07-01 22:01:32 +00:00
package-lock.json build: Updating npm dependencies 2025-01-06 08:38:45 -05:00
package.json Merge "Update Codex from v1.13.1 to v1.14.0" 2024-10-16 17:26:41 +00:00
phpunit.xml.dist phpunit: Determine what extensions to load in unit tests via config 2023-09-25 23:03:48 +00:00
README.md docs: Link to "Local development quickstart" in README 2024-01-22 13:58:11 +00:00
RELEASE-NOTES-1.43 RELEASE-NOTES-1.43: Update 2025-06-24 21:12:11 +00:00
rest.php Use namespaced classes (1) 2024-06-16 20:18:23 +02:00
SECURITY
thumb.php Use namespaced classes (1) 2024-06-16 20:18:23 +02:00
thumb_handler.php Use namespaced classes (1) 2024-06-16 20:18:23 +02:00
UPGRADE UPGRADE: Update mailing list archive link 2024-04-14 21:36:52 +03:00

MediaWiki

MediaWiki is a free and open-source wiki software package written in PHP. It serves as the platform for Wikipedia and the other Wikimedia projects, used by hundreds of millions of people each month. MediaWiki is localised in over 350 languages and its reliability and robust feature set have earned it a large and vibrant community of third-party users and developers.

MediaWiki is:

  • feature-rich and extensible, both on-wiki and with hundreds of extensions;
  • scalable and suitable for both small and large sites;
  • simple to install, working on most hardware/software combinations; and
  • available in your language.

For system requirements, installation, and upgrade details, see the files RELEASE-NOTES, INSTALL, and UPGRADE.

MediaWiki is the result of global collaboration and cooperation. The CREDITS file lists technical contributors to the project. The COPYING file explains MediaWiki's copyright and license (GNU General Public License, version 2 or later). Many thanks to the Wikimedia community for testing and suggestions.