[08:01:44] hi [08:02:17] i am trying to link and external image to my mediawiki page [08:02:38] the .jpg files work fine..but .png does not seem to work [08:03:21] is there any settings that i need to change to allow .png file from external site to be displayed on my site? [08:06:03] asciii: https://www.mediawiki.org/wiki/Manual:$wgAllowExternalImages [08:07:46] p958snake: i used https://www.mediawiki.org/wiki/Manual:$wgAllowExternalImagesFrom [08:08:10] i can display the jpg files from external..but not the png [08:09:35] asciii: i'm not sure how well that feature is tested, or it could be the following https://www.mediawiki.org/wiki/Manual:$wgAllowExternalImages#Thumbnails_of_external_images [08:10:49] hrm.. [11:17:09] about ldapauthentication (the old stand alone plugin) it seems to want a special user; https://www.mediawiki.org/wiki/Extension:LDAP_Authentication/Requirements#Overview states in the 2nd to last bullet point "If you would like to use LDAP as a backend for MediaWiki (creating users, changing passwords, etc), you must provide a user who has write permissions to specific user attributes (please [11:17:15] only give this user the minimum amount of access that is required) [11:18:34] in the case of using ldap as the single authentication source but only requiring read-only access to the ldap database (it should not be changed and be able to be updated using mediawiki) do i still need such a special user? [11:20:27] i sadly got distracted yesterday with other tasks and research on simplesamlphp and from the looks there is no easy way to make it work with http only in testing and https in prod w/o some changes to the source code provided (i rather not do that automatically and be then the blame for password leaks) [13:46:34] want to install MW. I have MariaDB and SQLite. Which one is easier (beginner question, I'm new to MW, sorry) [13:50:21] Mooniac: MariaDB is standard, so most people use that. Only about 5% use SQLite. [13:50:31] thx. [14:01:46] Mooniac: SQLite is way easier [14:02:54] it seems I don't need a username and password if I pick SQLite [14:06:09] it is just a file [14:06:15] yes [14:06:29] I think I'll go with this. I just need it for proof-of-concept at this point. [14:06:42] if it is a concept, it should work totally fine [14:06:52] If it's approved I can do a MariaDB version in the AWS [14:07:02] but for production use it might not be so good on a popular wiki [14:08:04] understand [14:09:01] this step fails: chgrp apache data. Do I have to create a group "data" now? [14:17:21] so what do I have to do with the permissions for the data dir now? I always get "Change its permissions so that the webserver can write to it, and try again.". The pemissions are already 777 [14:26:17] it's an SELinux problem! [14:26:27] SELinux refuses setrlimit [14:42:41] ouch, finally got it. The installation instructions are not good, they don't say anything about SELinix [14:42:58] you have to expand the rights of httpd to make that installation work. But I have it now [14:52:47] Mooniac: could you please update the instructions on the wiki? [14:53:53] I don't feel competent enough yet. I'm a total beginner with MW. I have to say, it was impressive, the manual installation was a jiffy, except for that. It's really a 2minute affair, just follow the instructions as you go through the steps in the browser. [14:54:30] Given that my experience with MW is one hour, I don't think I should make any changes to the installation instructions yet [14:54:43] sujre, but your update would make it even jiffier [14:54:57] I'll think about it. [14:55:00] if you update, I'll review and modify [14:55:11] ok, send me the link of the page [14:55:42] oh, I thought you wer looking at the wiki for instructions [14:55:49] I did [14:56:11] Honestly, I'd rather write a paragraph with thoughts and how to solve things, and send you as a pastebin. [14:56:17] I'll do it later this weekend [14:56:32] which page? There should be an edit button right there [14:56:35] Sounds good. tyvm [14:56:49] It depends on which user you run httpd as, the permissions, and the top suggestion in SELinux doesn't work, you have to take the second suggestion. [14:57:05] # semanage fcontext -a -t httpd_sys_rw_content_t 'data' [14:57:05] # restorecon -v 'data' [14:57:08] doesn't work [14:57:16] setsebool -P httpd_unified 1 [14:57:17] works [14:57:58] but then the wizard takes only a minute [14:58:17] you know more about selinux than I do. Could you explain the difference between those? [14:58:43] I will in my pastebin text to you. Kinda busy now [14:58:52] k [14:59:16] but, I'm impresse [14:59:40] one more q for the pastebin: what os are you using? What wizard? [15:00:13] (Sometimes I have to deal with selinux and it is a pain becaujse I'm not used to it.) [15:01:08] Fedora 26 (I'm one version behind, current is already 27). webserver is httpd. With "wizard" I mean the "follow the instructions in the browser". You go to the folder, that seems to start index.php, and it walks you through everything [15:07:21] I'm not used to selinux either, it is intimidating [15:07:39] well, that doesn't mean you guys could ignore it :) [15:08:10] well I have had to deal with it, but it has never been very pleasant so far :) [15:13:01] hexmode[m]: you recall the old way using ldapauthentication? :) [15:13:50] i read up in a post on a google discussion board (not sure what it's called right now) that simplesamlphp requires actual patching to NOT use https forwards [15:13:54] not really, but if you have q I may be able to help. [15:14:14] it is a small question about one minor instruction detail mentioned [15:14:45] let me simply copy my old messages from a couple hours ago for that purpose [15:14:54] about ldapauthentication (the old stand alone plugin) it seems to want a special user; https://www.mediawiki.org/wiki/Extension:LDAP_Authentication/Requirements#Overview states in the 2nd to last bullet point "If you would like to use LDAP as a backend for MediaWiki (creating users, changing passwords, etc), you must provide a user who has write permissions to specific user attributes (please [15:15:00] only give this user the minimum amount of access that is required) [15:15:58] i am not interested in changing the ldap details -- i just need it as a source for authentication (and then authorization as well) [15:16:35] the users are not supposed to modify their passwords or the likes from within mediawiki -- my university supplies their own password changer for that [15:17:46] so you should be able to tell it to just authenticate... shouldn't need that user, right? [15:19:12] i was not sure what was meant with "backend" :) [15:19:55] at the very least some internal user needs to be created for each ldap-user (if i understoof the approach correctly) and this is all done transparently [15:20:39] and there i wasn't certain if that autocreation of user was related to the "backend" responsibilities [15:20:53] right. MW will create a user in its db for each ldap user that authenticates [15:22:52] it does that without the special user in question i take [15:22:57] Guessing here, but this is what I've seen: when it is refering to "backend" that is when you want MW to manage LDAP, not just consume what is already in LDAP [15:23:05] yes [15:23:32] ah, then i am not completely off -- sometimes a second brain helps to clear up any completely wrong assumptions [15:23:44] thanks a lot for your help over the past 2 days [15:23:51] np [15:24:36] i ever find some time and have the necessary skills then i will contribute back :) [15:24:52] +1 [16:34:54] To sabinemelnicki and justinl about GDPR. If a company was a private wiki storing information related to the company built by edits from employees, does GDPR require them to do anything when an individual leaves? [16:35:21] Also, how do I tag people in Riot on the mobile client? [16:40:06] bryandamon[m]: I think you just did. [16:40:11] try tagging me [16:44:43] Interesting hexmode perhaps it just doesn't show up on my view? [16:45:09] I was pinged in IRC and on riot. [16:45:22] bryandamon[m]: ping? [16:46:32] Sometimes I see other people's tags and theirs show up with the tagged persons name in a black box. Yours doesn't right now though, but it's in red (for me). [16:47:15] You need to put an @ at the beginning of the name to tag in riot. [16:47:58] @cicalese:matrix.org: and @hexmode:matrix.org are you tagged? [16:48:36] hexmode: tagging myself in riot and my irc nick [16:48:52] (sorry to #mw regulars, we are just facinated with the new tech.) [16:49:44] This is without the @ symbol bryandamon and this is with @bryandamon:matrix.org [16:50:59] note that there is some confusion on the bridge about matching users. Putting @ in riot doesn't translate to the [m] nick in irc [16:51:02] Doesn't look right from my end. It's predicting my name with a pop up in both cases and I select the pop up to autocomplete. [16:54:26] Tagging cicalese [16:57:42] That tagged me in riot but not in irc. [16:58:18] (where my nick is different, so that makes sense) [16:58:48] but still, it should translate.... [18:26:37] >To sabinemelnicki and justinl about GDPR. If a company was a private wiki storing information related to the company built by edits from employees, does GDPR require them to do anything when an individual leaves? [18:26:37] Bryan, I'd say, it depends. ;) It depends on the legal basis for the (duration of) data storage. It depends on what's stored in the wiki (personal data?), what legal base is justifying the storage of that data, if the person is asking for deletion at all. That's more questions than an answer. [18:52:38] bryandamon: ^^ [19:02:50] Thanks sabinemelnicki, I was just curious about edits attributed to the employee by name and "remembering" that the employee work there in a department, etc. If that is unacceptable, it seems a bit of a slippery slope. What about engineering drawings signed by the individual? [19:03:38] sabinemelnicki: ^^ [19:04:43] * hexmode[m] grumbles about tagging people.... but keeps his mouth shut b/c he wants people to use this to communicate. [19:05:56] bryandamon: It seems to me that your case ("engineering drawings...") predates the whole "right to be forgotten" and that the right isn't meant to address that case. [19:06:24] but I'm just a dumb american, so I'm not sure about any of it. [19:19:44] hexmode[m]: https://pastebin.com/2VeUESCk [19:20:25] \o/ [19:20:37] tyvm [19:23:29] * FoxT confirms that SELinux is also an issue for MariaDB, e.g. on RHEL. [19:24:24] Mooniac: do you you happen to have a phabricator account? [19:24:49] never heard of it. I guess that means I don't have an account :) [19:24:56] np [19:26:06] mooniac: my recollection is that for SELinux on CentOS and RHEL, I needed both the semanage and the setsebool commands. It may be that the semanage was not enough but was still required for it to work. [19:28:10] https://phabricator.wikimedia.org/T191148 [19:28:44] Mooniac: ^^ that is (part of) your report on phabricator. I'll try to update install instructions on wiki later [19:30:27] CindyCicaleseWMF: I'm realizing that my logic was a tad wrong. The first two steps didn't solve the problem (alone). I thought "didn't work ". But, if all steps are required, then I'd see the success only after the last step, shadowing the fact that the first steps were indeed necessary. But they were not sufficient. My bad. [19:30:50] hexmode[m]: please change it, all three steps are required. Perhaps do the relabel last [19:35:39] CindyCicaleseWMF, Mooniac : please check the updated description on phabricator: https://phabricator.wikimedia.org/T191148 [19:36:01] looks good to me [19:37:43] cicalese: you didn't have to use "restorecon"? [19:38:23] I reguarly use it after all SELinux work, it cannot hurt. At worst, it does nothing [19:39:18] should it be last, then? [19:40:29] I think so [19:41:37] although not necessary here. semanage does something to the dir, now you need to restore the condition. setsetbool, however, sets a boolean variable of the overall system, that doesn't need a condition restore. You do a condition restore of a dir [19:43:41] it was two separate suggestions from the SELinux troubleshooting browser. The first two were suggestion 1, with 93% likelihood. The second suggestion was the setsebool, with 7% likelihood. I tried the first one first, and when that didn't work, I tried the second, and that completed the list of three items :) [19:44:30] is there a link you can give me to read up on the troubleshooting browser? [19:44:50] I confess, I'm a Debian man. We're not so hot on selinux. [19:45:17] but, you know $CLIENTs have RH... [19:45:44] sealert. [19:45:54] I can make a pastebin of the output of the message [19:47:10] https://pastebin.com/NgJYpEQk [19:49:09] "If you want to allow httpd to unified" what does that mean? [19:52:14] httpd can be configured to not differentiate file controls based on context, i.e. all files labeled as httpd context can be read/write/exe- cute. Setting this boolean to false allows you to setup the security policy such that one httpd service can not interfere with another. [19:52:54] httpd_unified (HTTPD Service)Unify HTTPD handling of all content files. [19:53:37] it's also in the man page for selinux. [19:53:48] setting this to one sounds kinda dangerous to me. [19:54:30] That sounds like its saying whether or not one virtual host can access files from other vittual hosts (?) [19:56:24] I think when I end the POC and go for the "real" version with MariaDB, I'll write a dedicated policy module. I don't let to set global SELinux variables that affect the whole session. I don't feel safe with httpd_unified set to 1 permanently. [19:57:57] let --> like [19:59:05] Have you seen https://www.mediawiki.org/wiki/SELinux (may be really old and out of date) [20:00:01] OH, interesting, I just noticed that you only need it enabled for the installer. Once the MW system is ready, you can turn it off: [20:00:02] # setsebool -P httpd_unified 0 [20:00:45] so itseems when you install something in an httpd dir through a browser, you need it on for the install, and then you can (and I think, should) turn it off again [20:01:14] It would be interesting to know what the installer is actually doing that requires that [20:01:14] * hexmode[m] updates the phab task [20:01:58] because i dont think installer creates any files and is supposed to work even without write access (needs read access presumably) [20:02:06] so I think the instruction should say that you should turn it on before you go through the installer, and afterwards turn it off again. That may actually make the first two steps redundant [20:02:12] Mooniac: could you verify that editing stillworks [20:02:21] will do [20:02:22] moment [20:03:37] ah, very good catch. After I turn it off, I can't log in anymore [20:06:02] this is for a sqlite-backed install. I wonder if mysql would do the same. [20:06:19] still, might be an interesting way to set up a "secure" read-only wiki. [20:07:01] you could do that with a custom policy module for SELinux [20:07:10] That might make sense. Default place to put sqlite directory is outside normal web area [20:07:13] you can write the craziest configurations for SELinux [20:07:39] so it might be triggering on writes to sqlite file as its in a weird place [20:10:52] right, it triggers when httpd wants to write to the dir with the name "data" [20:16:25] if you give it the full path instead of 'data' does that restrict it to just that directory? [20:17:32] will have to try later, can't do it now, sorry [21:00:24] Hello, I'm trying to run VisualEditor on my MediaWiki 1.30.0 installation. Howevever, for some reason when I click the "Edit" button. It just refreshes the page and changes the url to /wiki/index.php?title=Main_Page&veaction=edit however, it does not show the editor when clicked. Here is my LocalSettings.php: https://hastebin.com/ucovovogeh.xml Here is the access.log: https://hastebin.com/yuperazocu.pl, no errors [21:02:54] Anyone have any idea? Can PM link to demonstrate if needed [21:03:37] Robb_: sec [21:03:44] Robb_: can you pm me link? [21:03:47] 5 'url' => 'http://127.0.0.1:8192', for parsoid doesn't look right. [21:09:20] Zethrus: could you pm me the link? [21:09:40] eddiegp: I was using localhost as well to test prior. [21:12:52] Zethrus: you checked out ve via git, right? [21:13:41] Yes [21:13:51] As well as MediaWiki [21:13:58] 1.30 branch [21:14:10] use `git submodule init && git submodule update` in your ve directory [21:14:53] Done [21:14:57] looking at requests, you are missing lib/ve [21:17:16] Also, I had a look at the talk page on the extension earlier and it seems people we're having issues with it? https://www.mediawiki.org/w/index.php?title=Topic:Ua42lnptxq4056ki&topic_showPostId=ua6fqdtyua794gtu#flow-post-ua6fqdtyua794gtu [21:17:28] now I'm getting the follwing from the js console: "(curl error: 7) Couldn't connect to server" [21:17:35] is parsoid running? [21:18:09] Yes [21:18:19] wow thanks hexmode, I wasn't aware of git submodule. Is it possible to fetch all the submodules at once and stick them to the same branch? [21:18:47] Would it be a problem with my parsoid being version 8? I downgraded earlier because I kept receiving http error 406 [21:19:39] Zethrus: don't know. Could you re-upgrade? [21:20:23] harmaahylje: Maybe this: https://stackoverflow.com/questions/3796927/how-to-git-clone-including-submodules [21:21:13] Done [21:22:27] At least it is displaying errors now instead of leaving them in the console. [21:23:00] See the man page for git-submodule [21:23:27] Curious, how are you viewing the errors from mediawiki? [21:23:42] I've only used the software a few times in the past. [21:24:11] Which version of submodule you get is commited to the main repo [21:24:30] but you have to run git submodule update [21:27:13] Zethrus: access the console: http://wickedlysmart.com/hfjsconsole/ (your browser should be there somewhere) [21:28:40] Zethrus: you maybe the port parsoid is listening on doesn't match the port mw is trying to contact [21:28:43] Oh duh, I thought you meant something else, like mediawiki had it's own built in error logging page or something [21:29:12] it has a debug log, but that wasn't what I was using ;) [21:29:37] Is there a way to specify the parsoid port? [21:29:54] serverPort? [21:29:54] you mean for parsoid or mw? [21:30:01] parsoid [21:30:19] I want to force it to listen on something, that way I know where to point mw to. [21:31:03] look in config.yaml [21:31:22] Yeah, I just set that, restarted parsoid. No luck. [21:31:54] Both LocalSettings.php and config.yaml have mirrored settings. [21:32:26] ok, but the error is different now [21:32:46] could you paste your config.yaml? [21:34:03] hexmode: thanks a lot! I'll have a look at that :) [21:35:46] Sent a PM [21:40:06] Zethrus: you need to update your VE installation [21:42:59] I have the latest VE from git? [21:43:18] That isn't what your Special:Version says. [21:43:41] git clone https://gerrit.wikimedia.org/r/p/mediawiki/extensions/VisualEditor.git --branch REL1_30 [21:43:45] That's what I used [21:44:05] use "master" instead of REL1_30 [21:44:30] I'm guessing that will fail, but hoping it won't [21:45:04] if it fails, we'll need to try upgrading like https://www.mediawiki.org/wiki/Parsoid/Releases#0.9.0_(released_Mar_23,_2018) [21:45:11] Now it really broke [21:45:14] lol [21:45:32] sec [21:49:00] Yeah, it's not liking the new version [21:49:20] I can disable the extension and the wiki loads, but if I enable it shows blank. [21:49:21] so, https://www.mediawiki.org/wiki/Parsoid/Releases#0.9.0_(released_Mar_23,_2018) says "newer than Dec 12" [21:49:39] lets find a version of VE from that date [21:49:50] * hexmode goes to look at the log [21:52:57] Zethrus: try `git checkout d2d6d2352 && git submodule update` in the ve dir [21:53:32] Done [21:53:48] feh [21:54:29] you checked out MW from git, too, right? [21:54:50] Not master, just 1.30 branch as I stated earlier [21:55:37] "git checkout REL1_31" in MW and VE.... CindyCicaleseWMF is getting 1.31 ready for release. [21:55:51] * hexmode hopes she tagged the repositories [21:56:22] error: pathspec 'REL1_31' did not match any file(s) known to git. [21:56:48] argh... switch to master on both then [21:57:09] it should be close to what 1.31 will eventually be [21:57:37] there [21:58:09] what is your php error log saying? [21:58:58] It loads now [21:59:04] But, no editor still [21:59:32] I got one [21:59:37] shift reload? [22:00:24] Works for you>? [22:00:26] check history on main page [22:00:53] yep, works now. [22:01:01] Sweet, I'll clear my browser [22:01:13] Thank you so much for solving this mess! [22:01:22] np [22:01:56] Also, quick question, I was thinking of using the Tweeki theme. Would I have any incompatibilities with VE? [22:02:09] Or, does theming typically not affect it [22:02:35] I have no idea. I'm sure it can, but it should be easy enough to try [22:02:49] if it doesn't work, takei it out ;)