[00:00:30] hi [00:01:14] I working on extending cite.php. I have this syntax: blah blah what would be the best way to parse the guts of ? simplexml? regex? [00:03:00] + extract( $GLOBALS, EXTR_REFS ); [00:03:02] wtf? [00:03:54] Is that in Configure? [00:04:04] yeah [00:04:29] I thought I killed that stuff. [00:04:34] (ialex's code) [00:04:40] :D [00:04:49] extract is icky [00:05:00] what do we need it fo rthere? [00:05:00] where is it? [00:05:41] http://www.mediawiki.org/wiki/Special:Code/MediaWiki/44195 [00:06:08] 03werdna * r44206 10/trunk/extensions/LinkOpenID/ (. LinkOpenID.i18n.php LinkOpenID.php): Add LinkOpenID extension, by Michael Holzt, because he asked nicely. [00:06:34] hey all! Is it allowed to use wikipedias "On this day..." feature on your own homepage? [00:06:53] no, it's patented [00:07:01] *Charitwo bops river [00:07:10] days, too. you can't use days either. [00:07:43] yksinaisyyteni: really? where can I read more about this? [00:08:01] *Reedy wonders when the new charging scheme is coming in [00:08:19] AaronSchulz: new field on reader_feedback needs to be added? [00:08:19] AaronSchulz: I think the reason it's needed is because we're using a require() on the extension file. [00:08:47] AaronSchulz: and therefore all of the $wgHooks and so on will be set in local, not global scope. [00:08:55] AaronSchulz: and therefore, to counter that, we need to extract them in. [00:09:14] blurf [00:09:54] that's gross [00:09:54] I know. [00:10:31] other problem is that any settings defined by the extension (like $wgCentralAuthAutoNew et al) won't leave local scope. [00:11:09] wow, this no-brand soda water has quotes on the side of it. [00:11:11] another issue is that including them sort of enables every random extension for the ext page view [00:11:15] hmmmm yeah that ain't good [00:11:21] so I see a googleadsense thingy [00:11:23] "Makes me feel refreshed and relaxed, ready for the weekend." -- Bill, loves to entertain. [00:11:25] i think you might just have to have it run those in global scope somehow [00:11:44] suggestions welcome :D [00:12:32] scan the include file, not by including it, but "greping" them to scrap globals [00:12:47] not great, but not as bad as loading everything [00:12:52] *AaronSchulz sighs [00:13:26] ew ew ew ew ew ew ew ew ew ew ew ew ew ew ew ew ew ew [00:13:47] we may as well do $c = file_get_contents( $ext->getFile() ); [00:14:22] $c = preg-replace( '/\$(wg\w+)/i', '$GLOBALS[$1]', $c ); [00:14:25] eval( $c ); [00:14:33] morning all. I wonder if i could seek help for a second? Does anyone here know about changing interface languages where there are mistakes please? [00:14:41] but then extension functions suck too :) [00:15:43] On the dutch wikipedia, there are words when you switch to the english and british english interfaces (in the sidebar) which are still in dutch. How do these get changed please? [00:16:02] thats more #wikimedia-tech [00:16:11] it doesn't matter. [00:16:36] driva2009: Could you link me to a page exhibiting this behaviour? [00:17:27] 04(REOPENED) Add Revision Diff functionality to API - 10https://bugzilla.wikimedia.org/show_bug.cgi?id=13209 +comment (10matthew.britton) [00:17:54] sure. Go to http://nl.wikipedia.org/wiki/Hoofdpagina - switch to the english & british english language interface, and look in the left sidebar. [00:18:32] you will see 2 words, Etalage and Artikelindex - Etalage is Featured articles, and Artikelindex should be pretty self explanatory. [00:18:39] :) [00:19:55] *driva2009 om nom noms on an Oatmeal and Raisin cookie [00:21:53] I hate to say this, but on the dutch interface on en.wikipedia, there is the same problem. There are words still in English :( [00:22:17] probably a local user changed the sidebar and only provided one language [00:22:35] hooking into the parser, will it accept as opposed to the well-formatted syntax of [00:22:41] driva2009: which words? are they local-specific stuff? [00:22:50] no [00:23:08] features articles and article index certainly aren't part of the mediawiki standard ui [00:23:12] so they must be local things [00:23:22] On the NL interface on English, Featured Content and Contact Wikipedia have not been translated. [00:23:23] in the sidebar? they could be localized locally if someone wants to [00:23:28] how? [00:23:38] editing the MediaWiki: pages for them [00:23:52] brion: Would you hate me if I created an Configure/extensionsetup.php, which we require() after efConfigureSetup(), or something? [00:23:58] Can I do this? Or do I need special permissions? [00:24:26] you need to be a local adnomnom [00:24:33] bother [00:24:42] *driva2009 only admins on Tok Pisin :( [00:26:47] :D [00:27:07] werdnum: if you can find a way to trigger it :D [00:27:24] you'd have to put it in the config file. [00:27:28] I can't think of any other way to do it. [00:27:41] I have an account on Betawiki, but I don't know properly how to use it yet. [00:27:56] Otherwise I would localise and submit from there [00:28:26] brb - coffee :) [00:30:30] brion: so I was thinking about OR in mw search [00:30:40] ooh [00:30:47] mysql does it by just having no key characters in front of the query phrases [00:30:57] like MATCH( 'cat meow' ) [00:31:06] currently, MW just adds + if there is nothing there [00:31:15] brion: Aaron told me I should ask you, what exactly is wrong with this: http://www.mediawiki.org/wiki/Special:Code/MediaWiki/44048#code-comments ? [00:31:27] which makes 'meow cat' become '+meow +cat', which is AND notation [00:31:56] brion: I was wondering if there is a nice char to use (obviously no char at all would be confusing) to represent OR as far as the user goes [00:32:31] basically it would just get removed but signal MW not to add the + before the term [00:34:35] - is already taken [00:34:39] + is already taken [00:34:40] maybe ~ [00:35:15] taken [00:35:17] http://dev.mysql.com/doc/refman/5.1/en/fulltext-boolean.html [00:35:33] ><* taken too [00:35:35] | [00:36:38] | would make semantic sense to a programmer [00:36:43] yaa [00:36:43] not nececelery to a user, though. [00:36:53] ? [00:36:58] looks odd, but is rarely used (a good thing) [00:37:11] yksinaisyyteni: was that about the spelling or the comment? [00:37:15] AaronSchulz: yeah we might just want to use OR :) [00:37:16] why i suggested... but if it becomes implemnted, they can be informed [00:37:18] use ? as the character [00:37:23] lol [00:37:27] so "cat meow" -> "+cat +meow" [00:37:27] or that :) [00:37:32] "cat OR meow" -> "cat meow" [00:37:50] i think this is what works right now w/ our lucene backend actually [00:38:13] but lucene's a little funky, and has its own backend parser that's not quite the same as mysql's boolean search parser :) [00:38:17] Perhaps we could change 'cat OR meow' to +(cat meow) [00:38:27] then you could do stuff like foo AND cat OR meow [00:38:27] yeah, that sounds about right [00:38:28] and stuff. [00:39:09] Pinky: sec [00:39:31] yksinaisyyteni: hmm, ? actually seems nice though [00:40:18] brion: kk [00:40:25] Pinky: http://www.mediawiki.org/wiki/Special:Code/MediaWiki/44048#c817 [00:42:51] 03yaron * r44207 10/trunk/extensions/SemanticDrilldown/specials/SD_CreateFilter.php: Added handling for new 'Has input type' property [00:43:41] Can someone help my with this question: Is it allowed to use wikipedias "On this day..." feature on your own homepage? [00:43:52] Mazi: if you can get it sure :) [00:44:05] there's prolly an rss feed somewheres [00:44:17] an RSS feed written in template, no doubt,. [00:44:21] do you have a link? [00:44:27] The sad thing is, that could actually be done :P [00:44:29] http://en.wikipedia.org/wiki/Wikipedia:Syndication#Externally_hosted_RSS_Feeds_of_Wikipedia_pages [00:44:36] has anyone ever integrated this into typo3? [00:45:06] http://helgo.net/simon/wikipedia/sa.xml [00:45:18] do you think this can be integrated easily into a typo3 environment? [00:45:24] it's just RSS [00:45:37] I don't know anything about typo3, but any CMS worth its salt supports rsS syndication [00:45:48] hmm [00:45:55] RSS* [00:46:00] "Change password" section title with "Change password" link seems a little silly [00:46:06] maybe make the section just say "Password"? [00:46:14] AaronSchulz: too many 'e's, not enough 'l's. [00:46:23] heh [00:48:01] 03yaron * r44208 10/trunk/extensions/SemanticDrilldown/includes/SD_Filter.php: Added handling for new 'input type' feature; removed handling for SMW 0.7 [00:48:08] thanks for your help [00:48:50] 03yaron * r44209 10/trunk/extensions/SemanticDrilldown/README: Added section about Ext Javascript library [00:51:08] brion: hmm, the function UsersPager:getGroups() returns the array of groups the user is in, not all available groups, it's basically a copy of the User::loadGroups function [00:51:39] there's a hook to change what User::getEffectiveGroups returns, but SpecialListusers.php uses it's own getGroups function and not getEffectiveGroups [00:52:45] so that hook can be used to add to the groups that get displayed by the user's name [00:53:45] (the hook in r44048) [00:54:38] Pinky: is there some reason the function exists then? sounds like it should just call User::getEffectiveGroups [00:55:07] 03yaron * r44210 10/trunk/extensions/SemanticDrilldown/includes/SD_GlobalFunctions.php: [00:55:08] Added new SD_SP_HAS_INPUT_TYPE property, added support for SMW 1.4, removed all [00:55:08] support for SMW 0.7 [00:57:12] *^demon pokes Brion about bug 16451 again :) [00:57:12] brion: nfi :P [00:57:23] svn blame says it was added by robchurch [00:57:53] but I can't see any reason to use it and not just getEffectiveGroups [01:00:55] brion: yeah, schema change :) [01:01:07] [19:06] AaronSchulz: new field on reader_feedback needs to be added? [01:04:04] whee [01:05:20] brion: hmm [01:05:29] actually getEffectiveGroups isn't good :P [01:05:36] that adds stuff like *, user, etc. [01:06:10] array_diff( getEffectiveGroups, getImplicitGroups ) [01:08:25] *werdnum brb, taking to his keyboard with a screwdriver [01:09:50] werdnum: unifybot please? :D [01:10:31] 03yaron * r44211 10/trunk/extensions/SemanticDrilldown/specials/SD_BrowseData.php: [01:10:31] Added handling for 'free text' and 'date range' input types, including the usage [01:10:31] of the Ext Javascript library for a combobox for the former; [01:17:16] werdnum: yeah that works well enough :D [01:18:40] Are you busy Brion? Got a techie problem which is a bit of a mystery. I'm logged in to wikipedia english, and I'm currently in NL. When I try to edit a page, I'm getting a clear message in dutch telling me I'm not logged in, and I have not logged out. [01:19:08] funky [01:19:14] is it saying your username in the corner? [01:19:15] damn straight :) [01:19:17] No [01:19:19] ok [01:19:35] probably the global cookie expired but your local session is still active [01:19:41] weird stuff like that happens sometimes [01:19:45] When I go to the page I want to edit, it says I'm logged in. Only when I go to edit the page does it say I'm logged out [01:19:55] mm that might be cached [01:19:58] the only thing about using getEffectiveGroups, etc. and maybe this is why rob originally created a new function for it, is at that point in the code you only have the user's id, so you have to make a User::newFromId call [01:20:14] brion: not cached, haven't been to that page before [01:20:23] idk if that takes a significant amount of time or not? [01:20:29] I put it in from the address bar [01:21:46] This is the message I get when I try to edit: [01:21:48] U bent niet aangemeld. Uw IP-adres wordt hierdoor bij elke bewerking opgeslagen en openbaar gemaakt in de bewerkingsgeschiedenis van deze pagina. [01:22:17] driva2009: try Special:Version [01:22:24] ok [01:23:12] It also says I am not logged in [01:25:17] ok probably just cached and expired at a funny time, but...maybe extra funky ;) [01:25:24] log out and log in and it'll probably clear righ tup... [01:25:32] I'm gonna go look at the global cookie I have stored and see if its ok [01:26:41] Now thats a pain in the nipples. [01:26:51] I have a Global cookie stored: [01:27:10] centralauth_LoggedOut [01:27:21] Wed 24 Dec 2008 19:40:09 GMT [01:27:56] yet I swear on all 9 of my lives I didn't log out... [01:28:06] o_O [01:28:24] brion: http://p.defau.lt/?LO_Exi6mbty3ApQqz4a9lQ does that look like an ok patch then? [01:28:26] i assume that's a 30-day logout, so .... november 25? [01:28:31] er 30-day expiration [01:28:48] The expiration is 24 Dec 08, Brion [01:29:06] The cookie content is: 20081124194009 [01:29:08] Pinky: offhand that's prolly ok, assuming nothing's funky :D [01:29:15] heh [01:29:17] k [01:29:30] ok, so logout on 2008-11-24 [01:29:31] So that would be 19:40:09, 24th Nov. 08 [01:29:33] might you have done that? :D [01:29:39] Which has to be wrong [01:29:56] How could I have logged out on the 24th of November. I've been logged in up to today :) [01:30:19] I've not logged out for over a month! [01:32:38] This is good. I also have a cookie called centralauth_User / Content is Iceflow, expires 3rd January 2009 [01:33:01] mysteeeeerious [01:33:05] ok guys i gotta run [01:33:08] catch ya later [01:33:12] bbfn [01:33:38] Best thing I think I will do what Brion said, and try to do a full log in again [01:35:53] Hm. It works - I'll leave it for now and see what happens :) [01:35:56] Night all [01:37:59] hoboy [01:38:37] 03yaron * r44212 10/trunk/extensions/SemanticDrilldown/specials/SD_BrowseData.php: Added setting of global variables [01:39:14] 03pinky * r44213 10/trunk/phase3/ (3 files in 3 dirs): [01:39:14] Update on r44048: [01:39:14] Removing SpecialListusersGetGroups hook completely, and changing the [01:39:14] UsersPager::getGroups function to use User::getEffectiveGroups instead [01:39:15] of directly making a DB query itself. [01:39:17] 03yaron * r44214 10/trunk/extensions/SemanticDrilldown/includes/SD_GlobalFunctions.php: Type checking for SMW 1.3 and earlier [01:40:55] 03yaron * r44215 10/trunk/extensions/SemanticDrilldown/INSTALL: New version: 0.5 [01:43:26] driva2009: i'm having some formatting issues [01:50:16] gah, I managed to lose *one* key. [01:51:37] Nope, found it. [01:58:58] 03demon * r44216 10/trunk/phase3/includes/filerepo/FileRepo.php: Followup to r44204. Hardcoding image because it should (in theory) work always and forever. If you have a wiki acting as repo and you've overridden the canonical name Image: it's your own fault. [02:02:30] ^demon: the default is now file :p [02:06:46] ^demon: also there's an error on Line 265 of FileRepo.php [02:06:50] <^demon> Alexfusco5: But that breaks b/c. With Image:, that means a wiki older than the change to File can act as a repo (ie: commos right now) [02:07:04] Parse error: syntax error, unexpected ';' in /home/yourwiki/htdocs/html/w/includes/filerepo/FileRepo.php on line 265 [02:07:05] <^demon> Image: will always work, File: only works recently. [02:07:21] ^demon: how do I change file back to image again? [02:08:29] anyone thats paying attention, mw is broken [02:09:50] <^demon> Fixed. [02:10:03] 03demon * r44217 10/trunk/phase3/includes/filerepo/FileRepo.php: Cleanup, syntax errors and such. [02:10:46] okay, ^demon how do I rename File back to image? [02:11:32] werdnum: now that tidy works, what do i do? [02:11:41] <^demon> You have to change NS_IMAGE's value in $wgExtraNamespaces. That gets merged into the canonical list. [02:12:01] RingtailedFox: is it activated and everything? [02:12:10] yeah, pretty sure [02:12:15] how do i check if it's activated? [02:12:23] maybe Special:Version [02:12:52] <^demon> Special:Version doesn't mention tidy. [02:12:59] yeah, not mentioned there [02:13:06] <^demon> I wish it would list more enviroment things like that. [02:13:28] i don't understand how wikipedia can use mixed wiki/html markup, but i can't [02:14:20] TimStarling: https://bugzilla.wikimedia.org/show_bug.cgi?id=13223 is a dupe of https://bugzilla.wikimedia.org/show_bug.cgi?id=9342 ? (which may or may not be a dupe of https://bugzilla.wikimedia.org/show_bug.cgi?id=1115 ?) [02:14:28] *Splarka leaves that in the scrollback, since he noticed Tim wasn't here when mentioned yesterday [02:14:59] the mailing list was inconclusive in its assistance... [02:15:11] Splarka: haven't you used bugzilla before...? :/ [02:15:46] werdnum: I don't dupe close bugs by da boss [02:15:55] http://wiki.mobianlegends.com/wiki/Sandbox [02:16:04] you do it *hides behind a table* [02:17:12] 14(DUP) Allow blank lines between list items - 10https://bugzilla.wikimedia.org/show_bug.cgi?id=13223 +comment (10Andrew) [02:17:13] *werdnum rolleyes. [02:17:14] 03(mod) Allow one blank line in list environments - 10https://bugzilla.wikimedia.org/show_bug.cgi?id=9342 +comment (10Andrew) [02:17:39] not a dupe of 1115. [02:17:57] hmm, right, but possibly it is blocked by 9342? [02:18:11] I don't think so. [02:18:19] k [02:18:21] related, but I don't think there are any dependencies either way. [02:18:44] someone should go through and find the most duplicated bugs... and change the summaries to include every possible keyword [02:19:29] allow newline blank line extra linefeed between inside next to items lists ordered unordered li to allow block level elements multiline [02:59:41] splarka: since i have html tidy working, why does it not work on my wiki site? [03:00:14] {{#if:1|}}
foofoo
[03:00:17] what does that do? [03:01:23] just says "foo foo" [03:01:51] disable tidy explicitly, and then try it again? [03:02:02] commenting it out [03:02:35] wikipedia can mix wiki markup and HTML but i can't and that's frustrating me [03:03:01] re-enabling [03:03:12] what was the result with $wgUseTidy = false; [03:03:41] no difference [03:04:09] $wgUseTidy=true; [03:04:09] $wgTidyBin = '/root/opt/tidy/bin/tidy'; [03:04:47] "no difference" did you just view an already-existing page with that content? or action=edit and [save] ? [03:05:20] $wgUseTidy = false; and save a page with {{#if:1|}}
foofoo
still 'foo foo' ? [03:05:45] hit save [03:06:13] now re-enabling HTML TIdy [03:07:12] arr, stop that, keep it disabled, answer the questions [03:07:28] i did [03:07:31] i did exactly as you said [03:07:37] there was NO difference [03:07:51] well, that is when we try the NEXT one [03:08:20] is tidy disabled? [03:09:42] yes [03:10:12] try saving a page with this, and leave tidy off after... [03:10:14]
a
b
c
d
[03:10:34] if you really have tidy disabled, that should totally break your page UI [03:11:41] How do I insert blank spaces in lines? [03:11:59] vertical or horizontal? [03:12:50] xxxxxxxxxx: bla. Then in the second line yyyy: bla. But since yyyy is shorter than xxxxxxx, lines won't align in two symetric collums [03:13:24] you might want
 (core) or  (extension)
[03:13:31] 	or just tables
[03:13:57] 	k
[03:14:34] 	http://p.defau.lt/?M2WE__04FCqzfT_j9TJkTA
[03:14:35] 	bah
[03:14:36] 	quitter
[03:15:13] 	wtf
[03:15:17] 	quit
[03:15:29] 	unilinky: stop spamming me for starting a line with 'quit', heh
[03:15:45] 	quite likely that someone will start a sentence with quit, it isn't impossible anyway
[03:44:19] 	found that wikidot uses CSS to format pages. Ran in trouble, I started a list of bulletpoints, but in the second line I used a table
[03:44:47] 	and the table doesn't have the same left spacing as the bullet points
[03:46:36] 	Started wtih space * space Bla Then the same bullet point should break to a second line, continuing with a table
[03:47:11] <|X|>	Wikidot isn't mediawiki
[03:48:06] 	Is there a better place to host my wiki? 
[03:59:27] 	whatever
[04:01:02] 	wow, how rude of us to not help with non-mediawiki wiki issues
[04:01:13] 	yeah, bad Splarka 
[04:02:59] 	well, spalarka that thing did break my page UI
[04:03:06] 	re-enabling tidy didn't fix it either
[04:04:15] 	odd, then it seems tidy does nothing
[04:04:26] 	as that horrible mix of table tags works fine on wp
[04:04:39] 	dunno!
[04:04:56] 	unless you have a lag between enabling/disabling tidy and it actually doing anything
[04:05:18] 	or if your host intermittently applies tidy at the frontend or something
[04:28:25] 	hi Krimpet
[04:28:31] 	< Krimpet> 'evening. :)
[04:41:22] 	03(NEW) The post-installation screen has too many links to MediaWiki.org - 10https://bugzilla.wikimedia.org/show_bug.cgi?id=16555 15enhancement; normal; MediaWiki: Installation; (Emufarmers)
[05:26:36] 	03(mod) Enable Abuse Filter on English Wikipedia - 10https://bugzilla.wikimedia.org/show_bug.cgi?id=15684  +comment (10achyland)
[06:20:19] 	03(NEW) regression: no column header for category display - 10https://bugzilla.wikimedia.org/show_bug.cgi?id=16556 normal; normal; MediaWiki extensions: Semantic MediaWiki; (info)
[06:44:37] 	03(NEW) date handling regressions in SMW 1.4 - 10https://bugzilla.wikimedia.org/show_bug.cgi?id=16557 major; normal; MediaWiki extensions: Semantic MediaWiki; (info)
[07:59:44] <_wooz>	lo
[08:13:05] 	hey tomaszf 
[08:14:24] 	werdnum: heya
[08:14:47] 	:O you came back.
[08:14:52] 	how's stuff in the office?
[09:24:15] 	hy guys
[09:24:24] 	there is someone here ? 
[09:24:29] 	em
[09:24:33] 	is there...
[09:25:00] 	I need some support from a developer 
[09:25:06] 	or something similar
[09:25:12] 	:)
[09:25:47] 	no one can help me ?
[09:27:22] 	I'm trying to run sca fortify on mediawiki 1.13.2
[09:28:10] 	!ask | scuffio
[09:28:10] --mwbot--	scuffio: Don't say "I have a question", or ask "Is anyone around?" or "Can anyone help?". Just ask the question, and someone will help you if they can. Also, please read < http://workaround.org/moin/GettingHelpOnIrc > for a good explanation of getting help on IRC.
[09:28:31] 	ok
[09:29:13] 	!tell | p858snake
[09:29:13] --mwbot--	p858snake: Tell it like it is, man!
[09:29:14] 	This factoid does not exist.
[09:29:41] 	There is an "open redirect" problem on wikibits.js line 100
[09:30:36] 	where wgBreakFrames come from ? 
[09:31:39] 	wgBreakFrames is defined as a global JS variable in the skin of every page generated by mediawiki (every page that loads wikibits.js anyway)
[09:32:02] 	perfect!
[09:32:25] 	go to any aricle on wikipedia for example, and view the source
[09:32:30] 	^article
[09:33:06] 	on sca fortify i've this message: The file wikibits.js passes unvalidated data to an HTTP redirect function on line 103. Allowing unvalidated input to control the URL used in a redirect can aid phishing attacks.
[09:33:24] 	it can be a securty problem  ?
[09:34:03] 	Manual:Preventing_access emphasizes that mediawiki hasn't been designed to restrict access etc. - but does that mean there is a chance somebody could get access to content when $wgWhitelistRead = array( "Main Page", "Special:Userlogin" ); and $wgGroupPermissions['*']['read'] = false; are being used?
[09:34:34] 	it's a bit silly really
[09:34:46] 	MediaWiki has had access restrictions since like 1.3
[09:34:54] 	we've probably had time to test them by now
[09:35:37] 	the main problem is XSS
[09:35:51] 	just like any web app
[09:36:07] 	hmm
[09:36:29] 	yes,  i've 39 xss issues
[09:36:38] 	but when nobody has write rights to anywhere, there shouldn't be any XSS problems, I think
[09:37:05] 	no, there are XSS vulnerabilities that don't require editing
[09:37:23] 	a registered user just has to click a malicious link and it's all over
[09:37:59] 	it's call stroed xss
[09:38:04] 	stored xss
[09:39:21] 	padde is an answer for my question 
[09:39:24] 	?
[09:39:32] 	my concern mainly focusses on sensitive data that's in that wiki... it shouldn't be possible for anyone to access anything within that wiki except the Main page and the Login page obviously. all the rest is for registered users only...
[09:40:05] 	say if you're a registered user
[09:40:12] 	scuffio: umm no, nothing to do with your question
[09:40:21] 	and I send you an email that says "click here and check out the dancing monkeys"
[09:40:28] *Splarka 	points out breaking frames is probably a security bonus, in the rare case of a browser configured to send XSS between frames, eg "capability.policy.default.XMLHttpRequest.open", "allAccess"
[09:40:43] 	you click on it, you see dancing monkeys, I get your session and steal all your wiki pages
[09:41:16] 	TimStarling: ok, I get it
[09:41:36] 	can banned users without edit permissions submit the POST to clear a page cache?
[09:41:44] 	restricting by IP would provide some protection
[09:41:56] 	against casual attacks
[09:41:57] 	^or
[09:42:13] 	03siebrand * r44218 10/trunk/phase3/languages/messages/ (28 files): Localisation updates for extension messages from Betawiki (2008-12-04 10:28 CET)
[09:42:16] 	but to prevent concerted attacks, the intranet terminals would have to have no access to the internet
[09:42:28] 	Splarka: ok, so it can be sospicius and no exploiable ?
[09:43:10] 	I think a frame-breaking bit of JS isn't exploitable
[09:43:46] *Splarka 	tries to imagine an exploit helped by removal of parent frames
[09:43:57] 	but as you tell before, in the rare case...
[09:44:15] 	TimStarling: IE is forbidden and NoScript extension is enabled on nearly all workstations... that should give some more security in this aspect
[09:44:17] 	hmm, if you generated an iframe inside a mediawiki page that was called by an iframe, top it... no.. you'd still need to execute JS in the mediawiki... hmm
[09:44:23] 	I just can't think of any
[09:44:38] 	padde: yes
[09:44:50] 	unless NoScript is configured to allow javascript on the intranet wiki
[09:45:02] 	which users might be tempted to do
[09:45:18] 	on the belief that the intranet is trusted
[09:46:00] 	mmm
[09:46:26] 	hm... it seems i still don't completely understand XSS.. I thought that NoScript would help in this case, when configured to not allow JavaScript on the attacker's website (the one with the dancing monkeys)
[09:47:15] 	no, the attacker's website just has an invisible iframe that loads the intranet wiki
[09:47:17] 	no JS
[09:47:31] 	03siebrand * r44219 10/trunk/extensions/ (144 files in 114 dirs): Localisation updates for extension messages from Betawiki (2008-12-04 10:28 CET)
[09:47:40] 	the iframe would trigger the XSS attack in the wiki, injecting JS into its output
[09:47:57] 	and that JS would have access to the wiki's session
[09:48:16] 	heh, that recent "There is a new XSS vulnerability, in every browser, it does not require JS, and there is no way to stop it"  *click story*, ahh, flash *has no flash, laughs*
[09:48:45] 	TimStarling: ooh, ok. well then it doesn't help at all, because the users need Javascript to be enabled in the wiki :(
[09:50:22] 	if I were you, I'd use MediaWiki, but make sure to keep up to date with security releases
[09:50:28] 	it's as good as any web app
[09:51:26] 	TimStarling: sure, that's high priority here... subscribed to all the release announcement lists/feeds, upgrade usually on the release day...
[09:51:41] 	whitelist read will protect you against casual attackers
[09:51:49] 	it has lots of paranoid oversight, but that is also a bit of a logical failing of open sourcyness (sometimes people assume it is too secure)
[09:52:02] 	"oh, a hundred people saw this code, it must be good"
[09:52:58] 	Splarka: i thought about just that today... in open source everybody trusts that anybody else actually DID some checking... but sometimes perhaps only the bad guys (tm) did that....
[09:53:18] 	hi all
[09:53:18] 	I don't think anyone in the IT industry protects against concerted attacks
[09:53:46] 	it was nice of Grawp to vandalize a test wiki with a huuuuuuuuge bug using in_array in user rights letting him get any userright at all, rather than wait for the change to go live
[09:53:50] 	background: url(ne.gif) no-repeat top right; 
[09:54:06] 	only by taking the whole system offline, like they do with nuclear plants in states with reasonable governments ;)
[09:54:22] 	right, military and government do, in some cases
[09:54:30] 	(offline as in having a separate network)
[09:54:47] 	I am trying to make use of an image in CSS
[09:54:48] 	like
[09:54:50] 	background: url(ne.gif) no-repeat top right;
[09:55:00] 	i have uploaded the image
[09:55:06] 	but its not appearing
[09:55:14] 	but if a security specialist was given a salary for 6 months plus $20,000 for expenses to hack your system, do you think they'd have any trouble?
[09:55:38] 	JimStar: use the full URL
[09:55:50] 	it is unlikely your upload folder is the same as your stylepath
[09:56:18] 	(unless you FTP'd it (or such) to the stylepath to the same folder as the CSS file in question)
[09:56:21] 	they could pose as the A/C repairman and install a covert camera to capture passwords
[09:56:32] 	TimStarling: probably not. and in any case there would be easier ways to get to the data than through the net from outside... for example by walking into the office, wearing a uniform and carrying a clipboard ;)
[09:57:00] 	because people in uniforms carrying a clipboard are allowed to do about anything, nearly anywhere ;)
[09:57:20] 	or find a gullible employee, call them on the phone, pose as IT support, and ask for their password
[09:57:25] 	padde: that's like walking around a school with a cup of coffee
[09:58:10] 	Splarka: heh, good one ;) but not those paper cups, must be a real cup, should look a bit old already ;)
[09:58:27] 	Splarka: and don't forget the slippers
[09:58:31] 	with a slogan is good, like an einstein or wilde quote
[09:58:33] 	Thanks Splarka
[09:59:27] 	TimStarling: that wouldn't help here... company too small, and all the users who have access to the important systems know all IT guys (there are only three ;) )
[10:00:30] 	kidnap and tourture someone for their password >.>
[10:00:47] 	not that i've done that or anything <.<
[10:02:50] 	[[Category:Wikipedia administrators in GITMO]]
[10:03:00] 	there are endless possibilities with social engineering ;)
[10:03:54] 	or if you're not the social sort, you've probably got an office door lock that can be picked in a few minutes
[10:04:03] 	what's your alarm response time?
[10:04:37] 	TimStarling: heh, there is no alarm ;)
[10:04:50] 	easy then, they've got until morning to bug the place
[10:07:10] 	I worked in a place with a back to base alarm, PIR
[10:07:18] 	i should open a company that offers those security checks.. it would be so much fun ;)
[10:07:24] 	you could defeat it by just unplugging it from the phone line within 30 seconds
[10:07:56] 	heh, just like in the movies. rip it out of the wall - done ;)
[10:08:04] 	TimStarling: but did the phone cable come out of the box or was there a socket inside the box for the systems brain?
[10:08:23] 	are you proponenting (or whatever the verb is for 'being a proponent of') then, an ideology of Security through Abstrusivity?
[10:08:31] 	the phone cable came out of the alarm box and plugged into a wall socket
[10:08:36] 	09:53 < Splarka> it was nice of Grawp to vandalize a test wiki with a huuuuuuuuge bug using in_array in user rights letting him get any userright at all, rather than wait for the change to go live
[10:08:41] 	That bug had been there for years.
[10:08:44] 	"be secure enough so that those that want it won't go through the trouble of getting it"
[10:09:18] 	werd: right, but no one else had an associative array index of zero in their rights assignments?
[10:09:26] 	(or whatever the php terms are)
[10:09:38] 	promoting?
[10:09:49] 	not exactly...
[10:10:05] 	more like, demoting everything else logically
[10:10:24] 	sort of an applied Occam's shaving
[10:10:37] 	ahh, 'advocate' is what I want
[10:11:03] 	  Proponent \Pro*po"nent\, a. [L. proponens, p. pr.]
[10:11:03] 	     Making proposals; proposing.
[10:11:13] 	ugh, I've been writing the ugliest interface known to man.
[10:11:14] 	right, but you aren't really proposing
[10:11:22] 	I've been writing an interface for modifying $wgRateLimits.
[10:11:35] 	It's... slightly ugly :)
[10:11:44] 	hello
[10:11:49] 	yes, security is about deterrence
[10:12:00] 	in that, it is a logical conclusion that security isn't perfect, you don't need to convince anyone
[10:12:23] 	hi domas
[10:12:29] 	mmm, security through semantics
[10:12:49] 	HE SAID SEMANTIC!
[10:12:50] 	GET HIM!
[10:12:54] 	that said, if the deterrence is good enough to make the cost of breaching it more than the benefit, then it's pretty much perfect
[10:12:56] 	doh
[10:13:27] 	ahh, but that assumes you fully calculate the potential benefit of all potential breachers!
[10:13:50] 	one man's pile of old bill stubs is another man's new Camero
[10:14:17] 	like the security on board the MV Sirius Star at the moment
[10:14:28] 	the military can take that ship back any time they want
[10:14:37] 	yeah, that's another problem... most people don't have any idea how much their data could be worth to some other people
[10:14:40] 	as long as they don't mind the cost of a dozen lives and a whole lot of oil in the sea
[10:15:01] 	man them with ninja
[10:15:27] 	not security guards who jump out at the first sign of pirates?
[10:15:27] 	or you mean, the hijackers' security?
[10:15:31] 	yes I did
[10:15:35] 	ahh, k
[10:17:20] 	that's what he was getting at - the cost of breaching the hijackers' security is so high that it's effective.
[10:17:29] 	it's US$100m worth of crude oil.
[10:17:52] 	It'd almost be worth paying the $15m ransom to get the ship back, except that it sets a precedent and doesn't guarantee getting everything back.
[10:18:07] 	it's a bit late for precedents
[10:18:26] 	What do you mean?
[10:18:31] 	they've been doing this for years, and the owners have been consistently paying
[10:18:44] 	they're hijacking ships with equipment paid for with ransom money
[10:18:57] 	Ah.
[10:19:13] 	hey, it's a living
[10:19:25] 	Well, that's another thing - it finances the hijackings themselves.
[10:19:34] 	Just one ransom payment gets them quite a bit of money.
[10:19:58] 	the hijackings stopped for two years while the ICU was in power
[10:20:00] 	I'm sure US$15m will cover their costs.
[10:20:10] *werdnum 	googles ICU
[10:20:16] 	but they were considered "islamist" so an international coalition removed them
[10:20:39] 	it's very much like the cold war, isn't it?
[10:20:43] 	ahh, so it is all Israel's fault
[10:20:45] 	It isn't IBM localisation, intensive care unit, etc.
[10:20:50] 	03(NEW) Template with parameters can't be used in form fields - 10https://bugzilla.wikimedia.org/show_bug.cgi?id=16558 normal; normal; MediaWiki extensions: Semantic Forms; (for_amby)
[10:20:51] 	islamic courts union.
[10:21:47] 	10:20 < TimStarling> it's very much like the cold war, isn't it?
[10:21:55] 	McCarthyism, or something else?
[10:22:45] 	during the cold war, the CIA financed or incited numerous invasions and coups in order to remove left-leaning governments
[10:23:06] 	and russia supported the same governments
[10:23:07] 	Oh, like Bay of Pigs?
[10:23:21] 	even though that didn't really work.
[10:23:24] 	yes
[10:23:31] 	there were plenty that worked just fine
[10:24:16] 	anyway, I mean that it's a proxy war of ideologies
[10:24:48] 	which is very much what the cold war was about
[10:24:50] 	It's a bit different, because the US does ally itself with Sharia countries when it's convenient.
[10:24:57] 	c.f. Pakistan, Saudi Arabia, et al.
[10:25:41] 	you know why those two countries are allies, right?
[10:26:05] 	Saudi Arabia because it's got a quarter of the world's oil.
[10:26:21] 	Pakistan because... it's adjacent to Afghanistan and has/had a receptive government?
[10:26:23] 	because they have (or in pakistan's case had) leaders who came to power by US-supported coups
[10:26:32] 	so, what is the general mood in Aus about recent US political events? "Cool, maybe we'll see some progress with the environment, and less police actions being called wars" "Meh, whatever" "Bad! The US needs an asshole to make the rest of the world keep in line (and us look good)" "What events? We're beind the great E-Barrier Reef!"
[10:26:40] 	really?
[10:26:42] 	I didn't know that?
[10:28:23] 	erm, minus the question mark.
[10:28:45] 	Splarka: I think even in Australia there was considerable excitement about the result.
[10:29:06] 	well, I probably have to check my facts about coups
[10:29:30] 	but did both have a US-supported leadership
[10:29:50] 	to the dismay of anti-american elements within those countries
[10:29:58] 	(or even Canadian politics, things are going nuts up there, Bloc Q formed a coalition with the leftists because the conservatives pissed them off so much)
[10:30:07] 	I know I spent a day that should have been spent studying Chemistry mostly in front of the TV watching results.
[10:30:38] 	Yeah, I've picked up a bit of that Canadian stuff because I have a close politically-inclined friend in Kingston.
[10:30:56] 	The rhetoric is a bit breathtaking.
[10:31:08] 	heh, mine's in Vancouver, so I also get updates on 2010 winter olympics, and The Rheostatics
[10:31:24] 	Harper wants to portray Dion as somebody who is pissed off that he 'lost' the election, and is trying to steal power in something remniscient of a coup.
[10:31:36] 	in the PM's speech yesterday, he slammed the lefties in French (for the Quebecois), and slammed the frogs in english
[10:31:53] 	(or the day before, depending where you are)
[10:31:57] 	Of course, this is a bit silly, because the entire point of a parliamentary system is that the executive serves at the behest of the lower house.
[10:32:11] 	and, of course, he only got 36% of the popular vote.
[10:32:27] 	right, our two party system misses out on fun things like that
[10:33:02] 	Well, a non-preferential system inevitably disadvantages anything other than a two-party system.
[10:33:47] 	although, an interesting comment this week about Obama's appointments... "he's gone past a 'Team of Rivals' and now has, basically, a Coalition Government".. he has members of every Presidental cabinent back to friggen Carter on board
[10:33:51] 	um, disadvantages 'some candidates in' anything other than...
[10:35:02] 	but hopefully it will be harder for the CIA to undermine existing governments, unless they really really want to
[10:35:23] 	(current applicable methods seem to be: invade and execute them, or embargo them until they die of old age)
[10:36:47] 	on index.php line 737 there's a variable $local that is execute dynamically. On fortify is valuted as "code injection". As before, is this a sucurity problem ? 
[10:37:46] 	There isn't a line 737 of index.php
[10:38:18] 	no ? 
[10:38:30] 	which version are you talking about  ? 
[10:38:32] *Splarka 	WPs AU's PPs
[10:38:39] 	scuffio: trunk.
[10:38:49] 	but there have only ever been about 100 lines.
[10:39:50] 	I'm analysing mediawiki ver 1.13.2
[10:40:08] 	03(mod) Fatal Error in Special:AllMessages - 10https://bugzilla.wikimedia.org/show_bug.cgi?id=16497  +comment (10siebrand)
[10:40:11] 	hmm, ALP 43.4%, LPA+NPA 42.1% [LPA 36.6%, NPA 5.5%], but even so, the greens take 8% so you have no majority either?
[10:40:46] 	In the source that I have index.php is composed by 2000 and more lines so also the version that I've got has that line
[10:40:52] 	http://svn.wikimedia.org/viewvc/mediawiki/tags/REL1_13_2/phase3/index.php?view=markup
[10:41:00] 	that ain't 737 lines.
[10:42:04] 	perhaps you're thinking of a different index.php
[10:42:11] 	we are talking about two different files
[10:42:34] 	the index file is in the config folder
[10:42:36] 	there are 2 index.php
[10:42:44] 	ok you understood
[10:42:54] 	we call them index.php and config/index.php
[10:43:03] 	ah, that one.
[10:43:19] 	ok sorry
[10:43:25] 	I'm new with this prj
[10:43:32] 					htmlspecialchars( $local ) .
[10:43:37] 	is that the line you're talking about?
[10:43:43] 	no 
[10:43:48] 	just a moment
[10:43:50] 	oh, eval( $local );
[10:43:54] 	$ok = eval( $local );
[10:44:02] 	line 737
[10:44:07] 	Yes, I can see what you mean
[10:44:17] 	That comes from reading a file on your server, and replacing some variables into it.
[10:44:21] 	fortify says: The file index.php interprets unvalidated user input as source code on line 737. Interpreting user-controlled instructions at run-time can allow attackers to execute malicious code.
[10:44:29] 	No, it doesn't do that.
[10:44:53] 	1. It's the install script. It is not accessible to ordinary users.
[10:45:25] 	2. It does *not* interpret "unvalidated user input". It interprets an internally-generated configuration file.
[10:45:38] 	werdnum: fortify knows *better* :D
[10:45:42] 	a configuration file which is going to be executed anyway
[10:45:52] 	the eval() just does it a bit earlier
[10:45:54] 	Yes, I was about to say :P
[10:46:10] 	so it's not anything special
[10:47:50] 	I understand, so mainly it's not a problem because users cannot access to it, it's just an installation routine isn't it ?
[10:48:03] 	03(mod) number translation for MessagesArz.php - 10http://bugzilla.wikimedia.org/show_bug.cgi?id=16469  +comment (10siebrand)
[10:48:20] 	Right,.
[10:48:35] 	It presents a security risk until you first set it up.
[10:49:37] 	it is bad, nonetheless, whether it's executed via eval() or by writing it out and doing a require()
[10:49:46] 	but it's a necessary evil in most cases
[10:49:57] 	because we have to store the database password
[10:50:13] 	and putting it in a PHP file is the best way to do that while avoiding public disclosure
[10:50:29] 	Yeah, I found that out when writing the files handler for Configure.
[10:50:43] 	webservers are generally pretty good at avoiding source disclosure
[10:50:57] 	We did store settings serialised, but then the config was publicly readable by going to /serialized/conf-now.ser
[10:57:52] 	sigh, I got a reply from Stephen Conroy about internet filtering.
[10:57:56] 	Canned response.
[10:58:21] 	http://wiki.werdn.us/andrew/view/Conroy_Response
[10:58:54] 	hi again!... I want to have a textbox on my wiki page and want to give it an "id"
[10:59:11] 	so that i can access the box in a javascript function
[10:59:27] 	14(WFM) Automatic numbering system does translate - 10https://bugzilla.wikimedia.org/show_bug.cgi?id=16486  +comment (10siebrand)
[10:59:38] 	what do you want it to do? if you need it for JS stuff, create it with JS
[11:00:30] 	well... i want to provide users a search facility... but my wiki is not in English langauge -so i want to use a bit of javascript from Google
[11:00:51] 	this JS will transliterate the English text entered by the user
[11:01:00] 	In the file mediawiki....maintenence/namespace2sql.php fortify tells me that the line 13 is not saftley because "The function mysql_escape_string() cannot be used safely.  It should not be used, In this case the dangerous function you are using is mysql_escape_string() in namespace2sql.php at line 13." why?.
[11:01:14] 	var text = document.createElement('textarea'); text.id = 'some_ID'; someobject.appendChild(text), etc
[11:01:23] 	giudf: that's only unsafe if you use that maintenance script.
[11:02:23] 	maintenance scripts only work from the command line.
[11:02:37] 	and if somebody has shell access to your server, there are a lot more problems than SQL injection.
[11:03:09] 	i want this textbox to appear only on the main page of my wiki
[11:03:27] 	so which JS file should i use to create the box?
[11:03:28] 	if (wgTitle == 'Main Page') { ... }
[11:03:56] 	Can a user have a chance to access to the command line in order to exploit this vulnerability?
[11:04:23] 	If we allowed arbitrary shell command execution, SQL injection would be the last of your problems.
[11:04:35] 	We can't use mysql_escape_real there because we don't have a connection.
[11:04:40] 	That's why we use mysql_escape_string
[11:06:33] 	Ok so it's not a problem also at the line 14 when fortify says the same thing
[11:06:39] 	nope
[11:06:51] 	in general, anything under maintenance/ can be ignored, for the same reason.
[11:07:20] 	werdnum: where exactly do i need to put this > if (wgTitle == 'Main Page') { ... }
[11:07:28] 	i mean in which file?
[11:07:28] 	MediaWiki:Common.js
[11:07:31] 	ok
[11:07:33] 	it's a PAGE on the wiki.
[11:10:51] *werdnum 	grumbles.
[11:10:54] 	Firebug is being useless.
[11:12:37] 	Line 1874 in config/index.php calls shell_exec() with a command built from untrusted data. This call can cause the program to execute malicious commands on behalf of an attacker.
[11:13:14] 	Remember, that's the install script.
[11:13:38] 	so, only the administrator can menage it ? 
[11:13:51] 	yeah, that file will be deleted later anyway
[11:17:49] 	I don't understand the answer at the 1st scuffio question when he was asking about a possible open redirect in the javascript file wikibits.js line 103 how can you be sure that it's safe ?!?
[11:18:23] 	giudf: what are you talking about
[11:18:25] 	hi ialex 
[11:18:37] 	just putting the finishing touches on an interface for $wgRateLimits
[11:18:42] 	it takes forever :(
[11:19:00] 	hello werdnum
[11:19:02] 	hehe :)
[11:19:06] 	ok I'll be more detailed :
[11:19:56] 	forify says "The file wikibits.js passes unvalidated data to an HTTP redirect function on line 103. Allowing unvalidated input to control the URL used in a redirect can aid phishing attacks." 
[11:20:24] 	it isn't "unvalidated"
[11:21:04] 	wgBreakFrames is defined in the first 
[12:13:26] 	03(NEW) Special:Random should pick from ContentNamespaces - 10https://bugzilla.wikimedia.org/show_bug.cgi?id=16560 15enhancement; normal; MediaWiki: Special pages; (lgarczewski)
[12:13:28] 	which page?
[12:13:33] 	main page
[12:16:17] 	brb shower.
[12:16:23] 	ialex: what do I have to do with API?
[12:16:41] 	Spyc::YAMLDump( $arr );
[12:16:55] 	http://www.geekologie.com/2008/11/good_idea_man_submits_drawing.php
[12:18:54] 	any help for me?!
[12:19:46] 	werdnum: I'll do the API
[12:23:56] 	03ialex * r44224 10/trunk/extensions/Configure/Configure.page.php: Avoid fatal errors if $current[$name] is not set
[12:28:48] 	03siebrand * r44225 10/trunk/phase3/languages/messages/MessagesSw.php: Localisation updates from Betawiki. Namespaces and special page aliases
[12:29:11] 	right. That's why it was confusing me. Wikidot emulates wiki syntax with CSS syntax, just found that I can do row/col span there, meh
[12:29:29] 	*Can't
[12:37:26] 	hi can I download mediawiki without donate because in this location I can not pay for society problem 
[12:37:47] 	mrglinux: troll
[12:39:10] 	ekkkk!!!! Wikihost isn't good, default template is bad and they have banners on bottom, top and right side
[12:39:40] 	ialex: <3
[12:39:46] 	plus, captcha to confirm every and each save
[12:39:56] 	ialex: unfortunately, we can't rely on Spyc existing :(
[12:40:05] 	regardless of loggin in or not
[12:42:21] 	werdnum: will be away for some hours
[12:42:24] 	okay
[12:42:26] 	that's cool.
[12:42:29] 	I might have an early night
[12:42:31] 	03(NEW) Make links to nonexisting sections being easy distinguishable - 10https://bugzilla.wikimedia.org/show_bug.cgi?id=16561 15enhancement; normal; MediaWiki: General/Unknown; (derbeth)
[12:42:31] 	before 1am :)
[12:42:33] 	werdnum: will see that when I come back
[12:42:40] 	werdnum: 'night
[12:42:43] 	nn
[12:43:01] 	mrglinux: resay what you said, that sentence is alien language
[12:43:39] 	not_registered: sorry
[12:43:43] 	ok
[12:45:37] 	im limited in Internet because for my country . so I can't payment from internet and I don't have paypal account and ... so I need media wiki and in the part download .. I have to paye at less 1 $ but I don't have payment feature 
[12:46:08] 	03(mod) number translation for MessagesArz.php - 10https://bugzilla.wikimedia.org/show_bug.cgi?id=16469  (10gaghaly)
[12:46:40] 	You should be able to download MediaWiki for free.
[12:46:55] 	If you can't, it's not our fault :)
[12:47:13] 	is mediawiki available as a torrent?
[12:47:33] 	haha-funny
[12:48:04] 	http://wikimediafoundation.org/wiki/Donate/Now/en?utm_source=2008_meter_1c&utm_medium=sitenotice&utm_campaign=fundraiser2008  I got this
[12:48:13] 	03(mod) number translation for MessagesArz.php - 10https://bugzilla.wikimedia.org/show_bug.cgi?id=16469  (10siebrand)
[12:49:17] 	03(NEW) Make links to self-redirects being easy distinguishable - 10https://bugzilla.wikimedia.org/show_bug.cgi?id=16562 15enhancement; normal; MediaWiki: General/Unknown; (derbeth)
[12:49:52] 	03(mod) Make links to nonexisting sections being easy distinguishable - 10https://bugzilla.wikimedia.org/show_bug.cgi?id=16561  (10derbeth)
[12:50:21] 	wikihost sux
[12:50:25] 	 Line 579 of Database.php invokes a SQL query built using unvalidated input.  This call could allow an attacker to modify the statement's meaning or to execute arbitrary SQL commands, I noticed that the parameters are safe, because is passed in function addQuotes, the question is there is a way for an attacker to exploit ?
[12:50:41] 	mrglinux: it is free, http://download.wikimedia.org/mediawiki
[12:50:52] 	03(mod) Make links to nonexisting sections being easy distinguishable - 10https://bugzilla.wikimedia.org/show_bug.cgi?id=16561  +comment (10innocentkiller)
[12:51:24] 	the fundraiser is more for Wikimedia projects in general, of which mediawiki is but one (and a free one)
[12:52:11] 	thanks
[12:52:24] 	http://download.wikimedia.org/mediawiki/1.13/mediawiki-1.13.2.tar.gz
[12:53:19] 	03(NEW) Why not clicking icons in "Login successful" jump to main page of project - 10https://bugzilla.wikimedia.org/show_bug.cgi?id=16563 15enhancement; normal; MediaWiki: User interface; (3tx38k)
[12:54:39] *werdnum 	eats domas 
[12:54:41] 	nom nom nom
[12:55:04] *p858snake 	nom nom nom's on werdnum's brain
[12:55:08] 	ow!
[12:55:10] 	I need that!
[12:55:12] *werdnum 	takes back.
[12:55:18] 	great, somebody hosted a copy of "wikies for dummies" book in google
[12:55:45] *p858snake 	replaces werdnum's brain with senator conroys instead >.>
[12:56:02] 	I don't know if addQuest remove the problem from the grow 
[12:57:09] 	are we assuming that is sure for mediawiki ? 
[13:00:19] 	03(mod) Make links to nonexisting sections being easy distinguishable - 10https://bugzilla.wikimedia.org/show_bug.cgi?id=16561  (10derbeth)
[13:02:11] *^demon 	removes one of werdnum's extra feet and begins munching
[13:03:00] 	eeep
[13:04:43] 	hmmm... I'm sticking with wikidot
[13:19:47] 	03werdna * r44226 10/trunk/extensions/Configure/ (Configure.diff.php Configure.page.php): 
[13:19:47] 	Configure extension diffs:
[13:19:47] 	* Implement specific behaviour for $wgRateLimits.
[13:19:47] 	* Fix up $wgGroupPermissions by sorting, so we don't show false changes.
[13:19:47] 	* Only show 'true' permissions, so we don't show false changes (having false is the same as being unset, so let's treat it as unset)
[13:21:12] 	03(mod) Make links to nonexisting sections being easy distinguishable - 10https://bugzilla.wikimedia.org/show_bug.cgi?id=16561  +comment (10abxabx)
[13:22:03] <^demon>	There needs to be a way to search for "Enhancement requests that aren't necessarily a *bad* idea (so we didn't WONTFIX), but nobody cares enough (except the requestor) to implement it"
[13:22:10] 	03werdna * r44227 10/trunk/extensions/Configure/Configure.php: Bump style
[13:24:20] 	^demon: feature & WONTFIX? :)
[13:27:57] 	03(mod) Make links to nonexisting sections being easy distinguishable - 10https://bugzilla.wikimedia.org/show_bug.cgi?id=16561  (10innocentkiller)
[13:28:30] <^demon>	Am I crazy in thinking that bug is a bad idea and not worth it?
[13:28:36] 	how about a keyword: pet
[13:29:13] <^demon>	I have pet bugs.
[13:29:40] 	03werdna * r44228 10/trunk/extensions/Configure/Configure.js: Don't show [+] for sections with only one subsection, it looks stupid.
[13:30:20] 	werdnum, is there any demo page of configure extension ?
[13:31:50] 	Sasa^Stefanovic: I have it set up on a wiki, if you'd like me to give you the requisite rights.
[13:32:21] 	or you can try look but don't touch mode :P
[13:32:31] 	http://werdn.us/test/view/Special:ViewConfig
[13:32:48] <^demon>	404.
[13:33:13] 	404 - Not Found
[13:33:14] 	:)
[13:33:44] 	sorry, should be http://wiki.werdn.us/test/view/Special:ViewConfig
[13:34:06] 	03werdna * r44229 10/trunk/extensions/Configure/Configure.page.php: Kill debugging code, commented out.
[13:34:09] 	loading :)
[13:36:44] 	nice
[13:37:05] 	but menu is somehow ugly on ff 2 runing on fedora
[13:37:33] 	what's wrong with it specifically?
[13:37:48] 	wait
[13:37:51] <^demon>	note to self: function != fuction
[13:37:58] 	http://i36.tinypic.com/2lcmkqe.jpg
[13:38:05] 	^demon, :)
[13:38:31] <^demon>	My "n" key has been acting up.
[13:38:41] 	werdnum, as you see, text background color, or whatever, is over text above
[13:38:46] 	or menu item above
[13:39:03] 	hint: make skins for configure extensions :PP
[13:39:08] 	-s
[13:39:33] 	hmm, it shouldn't be showing all those settings.
[13:39:52] 	i was thinking about tabs, like on Special:Preferences, but that would be much tabs and subtabs
[13:39:59] 	there would be way too many
[13:40:24] 	03(mod) Make links to nonexisting sections being easy distinguishable - 10https://bugzilla.wikimedia.org/show_bug.cgi?id=16561  (10abxabx)
[13:40:55] 	less padding, more margin, heh
[13:41:39] 	werdnum, http://i34.tinypic.com/2qx2v6d.jpg
[13:41:47] 	another "bug"
[13:42:32] 	ew, something's wrong with Special:ViewConfig
[13:45:22] 	Sasa^Stefanovic> another "bug" 	03werdna * r44230 10/trunk/extensions/Configure/ (Configure.i18n.php Configure.page.php SpecialViewConfig.php): Fix wgRateLimits display in read-only mode.
[13:47:55] 	p858snake, that's why i put "" on bug, because it's not "real" bug
[13:50:35] *Sasa^Stefanovic 	off
[13:59:42] 	how to upload content en masse through CSV?
[14:00:11] 	write yourself a script.
[14:00:33] 	aren't there already scripts which do that?
[14:00:46] 	does mediawiki has upload file ability ?
[14:02:37] 	!upload | mrglinux 
[14:02:37] --mwbot--	mrglinux: File uploads are disabled per default, set $wgEnableUploads=true to enable it. See  for configuration details,  and  for using uploaded images and other files.
[14:04:38] 	I set $wgLogo="images/logo.png"; but I see that first image again
[14:06:04] 	!logo
[14:06:04] --mwbot--	The logo that appears in the top left of each page is determined by $wgLogo in the LocalSettings.php file. To change this you simply change the value of $wgLogo to point to the URL of your own logo. See  for more information. Be sure $wgLogo is set to an absolute path, starting with "/" (or a protocol "http:"/"https:"). If you are using pretty URLs a relative path will behave oddly.
[14:06:12] 	^bit about relative path
[14:07:31] 	ok
[14:11:01] 	how do I link to http://en.wikisource.org/ with interwiki links?
[14:12:08] 	if it is on your own wiki, however you want 
[14:12:08] 	[[s:Main page]]
[14:12:14] 	if it is on an existing wiki, check the interwiki map
[14:12:25] 	^if it is on wikimedya, what str said
[14:12:29] 	yes
[14:12:34] 	s/y/i
[14:14:42] 	Wikisource:en:WHATEVER
[14:15:41] 	"Wikisource:en:The Art of War (Sun)" in my case
[14:15:52] 	just Wikisource doesn't work on that
[14:17:15] 	lch, How about "Wikisource:The art of War (Sun)"?
[14:18:13] 	as I said, it has been moved from Wikisource to en.wikisource
[14:34:25] 	03(mod) Add Revision Diff functionality to API - 10https://bugzilla.wikimedia.org/show_bug.cgi?id=13209  (10roan.kattouw)
[14:39:34] 	03(WONTFIX) In bugzilla, add component 'tests' - 10https://bugzilla.wikimedia.org/show_bug.cgi?id=15967  +comment (10siebrand)
[14:42:43] 	03catrope * r44231 10/trunk/phase3/ (RELEASE-NOTES includes/api/ApiQueryUsers.php): API: Recommit r44182 (Added usprop=canemail to list=users) and rename canemail to emailable
[14:43:00] 	03(FIXED) Determining whether a user has email confirmed and enabled - 10https://bugzilla.wikimedia.org/show_bug.cgi?id=16526  +comment (10roan.kattouw)
[14:46:08] 	03(NEW) Add Support for X-XRDS-Location meta header to LinkOpenID - 10https://bugzilla.wikimedia.org/show_bug.cgi?id=16564 15enhancement; normal; MediaWiki: General/Unknown; (wikimedia-bugreports)
[14:46:17] 	03(FIXED) Add a component for rev_deleted or deletion generally - 10https://bugzilla.wikimedia.org/show_bug.cgi?id=16544  +comment (10siebrand)
[14:49:57] 	03(ASSIGNED) Add Support for X-XRDS-Location meta header to LinkOpenID - 10https://bugzilla.wikimedia.org/show_bug.cgi?id=16564  (10wikimedia-bugreports)
[14:53:34] 	does someone know if relative links are supposed to work with mediawiki+fckeditor (wikia version)?
[14:59:48] 	03(mod) Add Revision Diff functionality to API - 10https://bugzilla.wikimedia.org/show_bug.cgi?id=13209  (10AlexSm)
[15:03:32] 	how to rtl or ltr in edit mode ?
[15:04:55] 	03(mod) Add Revision Diff functionality to API - 10https://bugzilla.wikimedia.org/show_bug.cgi?id=13209  (10roan.kattouw)
[15:05:47] 	mrglinux, rtl, ltr?
[15:06:55] 	bebraw ye installed my mediawiki in fa language and it's rtl but if I want to type english I need rtl but editor is rtl . also I changed lang but editor was rtl 
[15:08:17] 	there are some bidi js gadgets
[15:10:13] 	http://test.wikipedia.org/wiki/MediaWiki:Gadget-BiDiEditing.js
[15:10:16] 	http://test.wikipedia.org/wiki/MediaWiki:Gadget-BiDiEditing2.js
[15:23:12] 	are there other graphical editors, besides fckeditor, available for mediawiki?
[15:30:25] 	how do i use the api to fetch data into a variable by setting a script elements src?
[15:30:50] 	i can't spot it in the api help
[15:32:25] 	heh
[15:32:35] 	apparently nobody thought of it until I started doing it all over the place
[15:32:58] 	format=json&callback=someFunctionName
[15:33:18] 	importScriptURI(wgScriptPath + '/api.php?stuff')
[15:33:36] 	and then:
[15:33:47] 	function someFunctionName(obj) {
[15:33:59] 	and obj has all your data, if you can get it!, mwhahaha, sucker
[15:34:16] 	hippietrail: if you give me an example of data you want I can give you a simple script outline to get it
[15:35:08] 	yes "callback". hard to search for when you can't remember its name (-: thanks i just found it by remembering it must be json-specific!
[15:37:02] 	hippietrail: one spelunkophagia... you lose your certs with callback
[15:37:44] 	you are limited to the 'low' limits, 50 parameters (not 500), 500 results (not 5000), no priv info like your user info, or tokens
[15:37:55] 	sorry its late i don unnerstand everythin
[15:38:07] 	okay
[15:38:13] 	imagine if callback worked while you were logged in
[15:38:35] 	http://en.wikipedia.org/w/api.php?action=query&prop=info&titles=Foo&intoken=edit
[15:38:50] 	imagine if you could visit a random website, and they could load this in a