[00:06:44] 03yaron * r29907 10/trunk/extensions/SemanticForms/specials/ (SF_AddData.php SF_EditData.php): Form page title is now settable from a new, fourth, return value of formHTML() [00:14:42] 03yaron * r29909 10/trunk/extensions/SemanticForms/includes/SF_FormClasses.inc: Output of 'CreateForm' page is now in wiki-text instead of HTML [00:15:02] 03yaron * r29910 10/trunk/extensions/SemanticForms/ (INSTALL includes/SF_GlobalFunctions.php): New version - 0.9 [00:25:42] Yay, I'm getting French e-mail company spam to my Wikibugs address. [00:30:56] *Skizzerz gives out a reCAPTCHA for his email address [00:31:37] granted, only to view the address, not to send stuff to it -- reCAPTCHA doesn't have that yet :( [00:32:45] The clever thing is that I can change my Bugzilla address to Simetrical+wikibugs2@gmail.com and then have a filter mark all messages to +wikibugs as spam. [00:33:02] Except I'd inevitably forget that I changed the address. [00:33:08] :P [00:33:31] si.me.tric.al@gmail.com tricks are fun too [00:48:45] Can add inline styles to a ==Heading== ? [00:49:06] you can use

[00:50:29] it seems I am getting a "Can't write config file, aborting" error when I have allowed everyone to write in the config folder [00:50:37] so you mean

Heading

? [00:52:04] Simetrical: then all your bug mail will show up as spam [00:52:41] flyingparchment, no, first I'll change my Bugzilla e-mail address to Simetrical+wikibugs2@gmail.com. And rotate as the spammers catch up. [00:52:51] (By filtering +wikibugs I obviously meant filtering Simetrical+wikibugs@gmail.com.) [00:52:57] Skizzerz: requiring any form of verification for people who mail you is a bad idea, because people will just not do it [00:53:02] That's the theory, anyway. In practice spam isn't such an issue that I care. [00:53:30] flyingparchment: no, it's a thing to SEE what my email is, once they know it (or if they get it elsewhere) there are no restriction [00:53:43] Skizzerz: yes, you then said 'not to send stuff to it yet' [00:54:07] I've wondered before if there are e-mail spammers who just hack routers and have a little program that checks for SMTP packets and records involved e-mail addresses. [00:54:38] If so, they'll always get your address sooner or later, if you use it (unless all e-mail to and from is encrypted). [00:55:07] SMTPS is used by major e-mail providers like Gmail, but I don't think it's usually used by random sites, is it? [00:55:10] there was a blogging a few years ago about some experiments... [00:55:36] some guy created dozens of hotmail email addies, and other random providers, and never gave them out and never used them [00:55:44] and some of them started getting spam after a few weeks [00:56:22] Simetrical: hm, when i send STARTTLS to gmail, it claims unrecognised command [01:05:04] Hmm, true, the MX server I picked doesn't report STARTTLS support and doesn't recognize the command. [01:05:07] Oh well, then. [01:09:03] 03(mod) It should be possible to enter expiry dates for edit and move protection separately - 10http://bugzilla.wikimedia.org/show_bug.cgi?id=12650 +comment (10lunasantin) [01:13:33] *amidaniel sighs at bug 12650 [01:15:36] protect from edits: 'sysop', reduce to 'autoconfirmed' after [ ] days, reduce to 'user' after [ ] days, reduce to '*' after [ ] days [01:15:48] protect from moves: 'sysop', reduce to 'autoconfirmed' after [ ] days, reduce to 'user' after [ ] days [01:15:50] *Splarka giggles [01:17:06] Advanced: [+] PHP code to decide what the protection level should be at time $t: [ ] [01:17:44] *amidaniel sends Splarka back to Uncyclopedia [01:18:55] [ ] comma delimited list of epoch ranges when this page should be editable by user group 'founder' [01:18:58] [ ] comma delimited list of epoch ranges when this page should be editable by user group 'bureaucrat' [01:19:02] [ ] comma delimited list of epoch ranges when this page should be editable by user group 'sysop' ... etc [01:20:05] 1200619102-120063000,120065000-120069000 [01:20:28] Sim: you can't make it *too* hard [01:22:09] I tried configuring my test wiki to allow for protection for levels higher than sysop and things other than edit/move, it didn't like that [01:22:19] I rather prefer a system where the protection specifies a number of edits that a user must have to edit it. Then the number of edits required to edit the page decays at a rate specified by the protecting admin. Could be a linear decay, but more sensible as a logarithmic decay. [01:22:25] Then of course the same thing for moves as well. [01:23:07] Things like being autoconfirmed or a sysop can then count in as a multiplier of the number of edits that the user has. So a sysop with 5000 edits would be treated as a regular user with 25000 edits. [01:23:11] Sound good? [01:23:14] edit=bureaucrat, protect=bureaucrat was quite ugly [01:23:17] *amidaniel goes to open a bug [01:23:39] ami: the protection level should also be configurable by the number of hits for that article title on the main pages of news organizations in a week [01:23:52] "Protect [[Anna Nicole Smith]] for 5 mentions per week or more" [01:24:00] Splarka: But of course! I just wanted to provide a general overview. [01:24:11] and delete-protection was pretty horrible [01:24:28] amidaniel, that sounds crazy. :D [01:24:34] Seriously, this is what bots are for. [01:24:45] MrZ-man: if things are edit-protected at a higher level than sysop, then IIRC sysop cannot delete or unprotect [01:24:51] There's no point in trying to write such flexible interfaces. [01:24:56] MrZ-man: you saw the new user right 'bigdelete' ? [01:25:02] yes [01:25:02] Of course enwiki doesn't usually allow admin bots, but it's not our problem if they're morons. [01:25:12] Hehe [01:25:14] Agreed :) [01:25:24] Simetrical: they may not be allowed, doesn't mean they aren't run [01:25:31] That too. [01:25:35] to delete a delete=bureaucrat protected page I had to use Special:Nuke, regular deletion didn't work [01:25:38] most admins with bots just have the bot login to their admin account [01:25:44] yep [01:25:47] Well, I personally didn't really see the need for expiries on protection myself .. stretching much further than that is just asanine [01:25:57] Majorly: There is actually one approved by the BAG and RFA :) [01:26:00] MrZ-man, how did you get such a page? [01:26:03] lol @ giving bureaucrats the right [01:26:04] (if they need to delete, edit protected, protect, whatever) [01:26:05] at least on my local 1.12 install, when I edit protect to steward, then logout and log back in on a bureaucrat account, that account cannot unprotect or delete the page [01:26:09] amidaniel: yes I know [01:26:27] Having a higher protection level than 'protect' is semi-ridiculous. [01:26:39] Well, except that I guess someone changed it so you can't protect/unprotect a page you can't edit. [01:26:41] Simetrical: messing with LocalSettings on my wiki [01:26:42] So I suppose it works. [01:26:45] Simetrical: no, it's entirely ridiculous :) [01:26:48] Yeah, I dunno .. I sort of liked semiprotection [01:26:54] And it has been used quite well [01:26:58] Yes, certainly. [01:26:59] hello ... anyone here familiar with the wikimedia data dumps? [01:27:00] Sort of antiwiki, but whatever :) [01:27:09] Better than full protection. *shrug* [01:27:10] considering anybody that can protect can protect the page above their level [01:27:18] zenkat, mainly brion-away, who appears to be away. [01:27:27] Skizzerz, yes, you're right, it's still entirely ridiculous. [01:27:30] I was able to create a page that could not be edited, unprotected, or deleted through normal means :P [01:27:36] ahhh, thanks. I'll try back later. [01:27:41] Am I remembering right that people can't unprotect pages that they can't edit? [01:27:49] that is true [01:27:50] Simetrical: yes [01:27:53] MrZ-man, even if you were a bureaucrat? [01:28:03] people who want pages that auto revert themselves next instead of using bots [01:28:06] I tried lots of things [01:28:09] and yet, blocked sysops can unblock themselves... [01:28:15] err will want [01:28:22] darkcode: they already want that :) [01:28:25] darkcode: flagged_revs [01:28:26] even specifically assigning protect rights only to bureacrats [01:28:39] coming soon to a wikimedia near you [01:28:49] Well, protection levels are semi-hardcoded to sysop/bot/*. [01:28:51] Splarka: that's to prevent a rogue sysop from blocking every other sysop to seize control of a wiki [01:28:52] *Splarka glares at AaronSchulz to get cracking [01:29:03] Not in theory, but in practice, we don't bother thinking about other levels half the time. [01:30:13] there's probably a reason that $wgRestrictionTypes says "You probably shouldn't change this" in DefaultSettings ... [01:30:47] *Skizzerz was thinking of making a patch that prevented them from protecting higher than they are, but it'd not only get lost in the next upgrade, but it might block viewing the protection levels as well [01:30:48] *amidaniel wonders why we even have that as a global rather than a constant or class member [01:31:17] amidaniel, there's some support for other restriction types. [01:31:21] Has anyone ever installed MediaWiki on a sourceforge account before? [01:31:23] Just people are lazy, so it's not complete support. [01:31:28] *Splarka wonders why more projects don't have autoconfirmed require a minimum edit count [01:31:30] Ah, okay :) [01:31:36] GhostlyDeath, I haven't, at least. [01:31:56] Splarka: I believe it was suggested on en.wiki, but it got shot down [01:32:01] flagged revisions keeps a static version of a page in which another version has to be explicitly asked for to override it, from what I understand. reverting would be like "after [ ] minutes/hours/days/weeks/months/years/etc revert to revision [ ]" [01:32:06] "omg no consensus" [01:32:37] *MrZ-man files a bug report, waits for ArbCom sanction [01:32:39] dark: I mean, a self reverting page feature would be superceeded by flagged revs [01:33:21] which I think is a good idea for main namespaces on major projects, especially those prominent in the media like en.wp [01:33:21] self-reverting = bad [01:33:39] anyone can get the latest version, but the default action=view would be the latest 'good' version [01:33:50] darkcode: Huh? Not a feature of flaggedrevs I'm aware of [01:34:34] contrary to things like flagged forums, that require a sysop to approve all new posts, this would be flagging in the wiki style, open ^_^ [01:34:41] Splarka I'm thinking of uses for bots right now like a Sandbox that is cleared one a day for instance [01:34:58] och, seems clunky for a big project [01:35:02] unless it was just for sandboxen [01:35:14] http://en.wikipedia.org/wiki/Wikipedia:Autoconfirmed_Proposal [01:35:18] in which case it is already done some places [01:35:59] Splarka: are there enough sysops on en.wp to keep every good revision flagged? :) [01:36:19] skiz: the rights are separate from sysop 'editor' and 'reviewer' [01:36:46] oh, don't get en.wiki on flagged revisions... [01:36:49] yeah, but I'm assuming they aren't going to just make anyone able to do it, only trusted people [01:36:55] I'm sure there'll be votes for for sysop-assignable groups for one or both, followed by bugzilla, consensus fights, and arbcoms [01:36:58] s/enwiki/enwiki started [01:37:18] Splarka: sounds about right [01:37:33] as I understand it, 'editor's would have all edits flagged automatically, and all 'reviewers' would be able to flag as good, or something [01:38:06] autoconfirmed = reviewer, rollback&sysop = editor? [01:38:07] http://en.wikipedia.org/wiki/Wikipedia_talk:Flagged_revisions/Sighted_versions [01:38:22] I'd say, making a group 'editor' with both would be good enough for a project, and make it sysop assignable [01:38:30] but of course, some will argue [01:38:40] IIRC, reviewer > editor [01:38:52] right, a reviewer can review other people's [01:38:59] they aren't really comparable [01:39:03] apples and oranges [01:39:39] wouldn't be hard to allow reviewers to selectively enable/disable the 'editor' right to themselves, with a recent userrights patch allowing a separate 'self' group [01:39:40] seems like reviewer==new page patroller [01:40:02] anyway, this could all change a dozen times over before Aaron gets it ready ^_^ [01:40:22] reviewer can mark pages as high quality, editor can mark as stable/non-crap [01:40:27] he'd made a MakeReviewer/Editor extension, and now that's been deprecated by userrights refactoring [01:41:30] since new page patrolling is a lot like reviewing a page [01:41:53] Splarka: Did he finally remove all of that? [01:41:56] patrolling might be a thing of the past [01:42:14] amid: I don't think any have been removed, because the UR UI is so, hmm, what did brion say.. "ugly" [01:42:32] Ugg ... [01:42:36] I think UR should be a series of tubes [01:42:39] er, checkboxes [01:42:50] *amidaniel tried to remove Aaron's makereviewer jazz and replace it with userrights 6 months ago [01:43:06] Ooh, I like the tubes idea :) [01:43:15] a checkbox list of all assignable groups (not emailconfirmed/autoconfirmed/user, but all the rest) [01:43:15] checked="checked" for those that are assigned [01:43:15] disabled="disabled" for those you can't change [01:43:34] simple! [01:43:52] and maybe a warning [01:44:06] "Warning, you cannot undo this" if you can add but not remove, or remove but not add [01:44:08] how about a select menu that allows multiple selection? [01:44:19] ...great idea.... [01:44:24] Wow, was I dead on or what? Click for information from Amazon, right-click for menu. [01:44:27] Woops [01:44:34] http://svn.wikimedia.org/viewvc/mediawiki?view=rev&revision=23832 [01:44:42] 6 months, 1 week ago :) [01:44:55] nice [01:45:11] but a bit premature [01:45:19] Meh, it was working fine then [01:45:20] but then again, so was whoever enabled it on wikimedia [01:45:36] At least for FlaggedRevs' purposes, it worked fine [01:45:51] Splarka: Were there further problems with userrights after it was enabled on enwiki? [01:45:59] *Splarka again lords over the fact that he WP:BEANSed the bug that would have allowed anyone with the least bit of access to UserRights to hack the form allowing them to make themselves founder/steward/checkuser [01:46:10] O.O [01:46:13] yes, the one I just said, although only bureaucrats had accesson all projects [01:46:17] except test.wp [01:46:18] *amidaniel stabs Splarka [01:46:21] ow! [01:46:27] How could there not be a check in there? OMG [01:46:32] there was [01:46:36] but only in form generation, not on submission [01:46:37] hehe [01:46:39] *amidaniel stabs Simetrical because that was all his doing [01:47:00] so you could hack the form to add and set yourself [01:47:13] was no prob when only the highest level of user had access to userrights [01:47:23] I blamed werdna, he blamed rotem [01:47:40] in fact [01:47:51] some test wikis on the internets still have this vulnerability [01:47:57] 02:24, 28 December 2007 Splarka (Talk | contribs) changed group membership for User:Brion from (none) to steward ‎ (this better not work) [01:48:01] Did anyone .. uhh ... make use of the bug before it was fixed? [01:48:10] amidaniel, hey, I didn't do all of it! Werdna did some too. [01:48:11] on enwiki, that is [01:48:11] just me, that I know of, on wikimedia and wikia [01:48:20] 02:29, 28 December 2007 Splarka (Talk | contribs) changed group membership for User:Splarka from editor, reviewer, sysop to editor, reviewer, sysop, bot, bureaucrat, checkuser, steward, povwatch, boardvote, import, developer, oversight ‎ (testing bug scope) [01:48:22] and coupled with the bug before it: where *everyone* had access to UserRights, even IP addresses [01:48:24] Simetrical: I choose to blame you. [01:48:30] *Simetrical goes to look whose fault it was [01:48:30] some wikis out there might be very vulnerable [01:48:44] Simetrical: Oh, don't you come to me with your empirical, concrete evidence. [01:48:45] If they're running trunk. [01:48:47] running certain revisions of Userrights (wikimedia never did) [01:48:47] We know it was all you. [01:48:52] In which case they deserve whatever they get. [01:49:16] MrZ-man: brion set me bureaucrat, but really, any 'user' could have done that on test.wp [01:49:22] *Splarka also used the bug to unset himself bureaucrat, heh [01:50:42] Splarka, what commit fixed the bug you reported? [01:51:10] um [01:51:13] *Splarka looks [01:51:18] http://svn.wikimedia.org/viewvc/mediawiki/trunk/phase3/includes/SpecialUserrights.php?r1=29276&r2=29323 [01:51:29] and http://svn.wikimedia.org/viewvc/mediawiki/trunk/phase3/includes/SpecialUserrights.php?r1=29323&r2=29526 [01:51:52] er, no... [01:51:55] hmm [01:52:05] hmm, my rights log on test.wp seems to be borked - http://test.wikipedia.org/w/index.php?title=Special%3ALog&type=rights&user=Mr.Z-man&page= [01:52:24] Simetrical: http://svn.wikimedia.org/viewvc/mediawiki/trunk/phase3/includes/SpecialUserrights.php?r1=28897&r2=28915 [01:52:30] and then: http://svn.wikimedia.org/viewvc/mediawiki/trunk/phase3/includes/SpecialUserrights.php?r1=28915&r2=28916 [01:53:04] the second one was because: you could still create a log entry that appeared to change it, but it didn't [01:53:18] *Simetrical has the gloomy feeling that may have been his fault [01:53:20] *Simetrical looks [01:54:20] well, the bug existed as far back as 1.5 that I know of [01:54:31] you could user UserRights to set nonexistant groups [01:54:40] The second bug isn't such a big deal. [01:54:41] or, more usefully, remove deprecated groups [01:54:42] It's just kind of weird. [01:55:14] like for example, if a 'boardvote' group was removed from LocalSettings, and people had it, you could hack in