Merge "Upgrade wikimedia/remex-html to 2.0.1"

diff --git a/.gitignore b/.gitignore
index 248931e..35c8fc6 100644 (file)
--- a/.gitignore
+++ b/.gitignore
@@ -20,6 +20,8 @@ project.index
 ## Sublime
 sublime-*
 sftp-config.json
+## Visual Studio Code
+*.vscode
 
 # MediaWiki install & usage
 /cache

diff --git a/includes/actions/RawAction.php b/includes/actions/RawAction.php
index b5a6d3a..77a8b14 100644 (file)
--- a/includes/actions/RawAction.php
+++ b/includes/actions/RawAction.php
@@ -129,6 +129,30 @@ class RawAction extends FormlessAction {
                        }
                }
 
+               // Don't allow loading non-protected pages as javascript.
+               // In future we may further restrict this to only CONTENT_MODEL_JAVASCRIPT
+               // in NS_MEDIAWIKI or NS_USER, as well as including other config types,
+               // but for now be more permissive. Allowing protected pages outside of
+               // NS_USER and NS_MEDIAWIKI in particular should be considered a temporary
+               // allowance.
+               if (
+                       $contentType === 'text/javascript' &&
+                       !$title->isUserJsConfigPage() &&
+                       !$title->inNamespace( NS_MEDIAWIKI ) &&
+                       !in_array( 'sysop', $title->getRestrictions( 'edit' ) ) &&
+                       !in_array( 'editprotected', $title->getRestrictions( 'edit' ) )
+               ) {
+
+                       $log = LoggerFactory::getInstance( "security" );
+                       $log->info( "Blocked loading unprotected JS {title} for {user}",
+                               [
+                                       'user' => $this->getUser()->getName(),
+                                       'title' => $title->getPrefixedDBKey(),
+                               ]
+                       );
+                       throw new HttpError( 403, wfMessage( 'unprotected-js' ) );
+               }
+
                $response->header( 'Content-type: ' . $contentType . '; charset=UTF-8' );
 
                $text = $this->getRawText();

diff --git a/includes/installer/i18n/en.json b/includes/installer/i18n/en.json
index 893df5a..5a63d32 100644 (file)
--- a/includes/installer/i18n/en.json
+++ b/includes/installer/i18n/en.json
@@ -304,7 +304,7 @@
        "config-help": "help",
        "config-help-tooltip": "click to expand",
        "config-nofile": "File \"$1\" could not be found. Has it been deleted?",
-       "config-extension-link": "Did you know that your wiki supports [https://www.mediawiki.org/wiki/Special:MyLanguage/Manual:Extensions extensions]?\n\nYou can browse [https://www.mediawiki.org/wiki/Special:MyLanguage/Category:Extensions_by_category extensions by category] or the [https://www.mediawiki.org/wiki/Extension_Matrix Extension Matrix] to see the full list of extensions.",
+       "config-extension-link": "Did you know that your wiki supports [https://www.mediawiki.org/wiki/Special:MyLanguage/Manual:Extensions extensions]?\n\nYou can browse [https://www.mediawiki.org/wiki/Special:MyLanguage/Category:Extensions_by_category extensions by category].",
        "config-skins-screenshots": "$1 (screenshots: $2)",
        "config-skins-screenshot": "$1 ($2)",
        "config-extensions-requires": "$1 (requires $2)",

diff --git a/languages/i18n/en.json b/languages/i18n/en.json
index 5283a5b..e35af5a 100644 (file)
--- a/languages/i18n/en.json
+++ b/languages/i18n/en.json
@@ -4519,5 +4519,6 @@
        "passwordpolicies-policy-passwordcannotmatchblacklist": "Password cannot match specifically blacklisted passwords",
        "passwordpolicies-policy-maximalpasswordlength": "Password must be less than $1 {{PLURAL:$1|character|characters}} long",
        "passwordpolicies-policy-passwordcannotbepopular": "Password cannot be {{PLURAL:$1|the popular password|in the list of $1 popular passwords}}",
-       "easydeflate-invaliddeflate": "Content provided is not properly deflated"
+       "easydeflate-invaliddeflate": "Content provided is not properly deflated",
+       "unprotected-js": "For security reasons JavaScript cannot be loaded from unprotected pages. Please only create javascript in the MediaWiki: namespace or as a User subpage"
 }

diff --git a/languages/i18n/qqq.json b/languages/i18n/qqq.json
index a17cfca..cbee32b 100644 (file)
--- a/languages/i18n/qqq.json
+++ b/languages/i18n/qqq.json
@@ -4721,5 +4721,6 @@
        "passwordpolicies-policy-passwordcannotmatchblacklist": "Password policy that enforces that passwords are not on a list of blacklisted passwords (often previously used during MediaWiki automated testing)",
        "passwordpolicies-policy-maximalpasswordlength": "Password policy that enforces a maximum number of characters a password must be. $1 - maximum number of characters that a password can be",
        "passwordpolicies-policy-passwordcannotbepopular": "Password policy that enforces that a password is not in a list of $1 number of \"popular\" passwords. $1 - number of popular passwords the password will be checked against",
-       "easydeflate-invaliddeflate": "Error message if the content passed to easydeflate was not deflated (compressed) properly"
+       "easydeflate-invaliddeflate": "Error message if the content passed to easydeflate was not deflated (compressed) properly",
+       "unprotected-js": "Error message shown when trying to load javascript via action=raw that is not protected"
 }

diff --git a/maintenance/resetUserEmail.php b/maintenance/resetUserEmail.php
index d6b4b79..771d19b 100644 (file)
--- a/maintenance/resetUserEmail.php
+++ b/maintenance/resetUserEmail.php
@@ -65,6 +65,7 @@ class ResetUserEmail extends Maintenance {
                        // Kick whomever is currently controlling the account off
                        $user->setPassword( PasswordFactory::generateRandomPasswordString( 128 ) );
                }
+               $this->output( "Done!\n" );
        }
 }