Merge "Bump release notes for RemexHtml upgrade"

diff --git a/composer.json b/composer.json
index 2e13f90..d7a25e3 100644 (file)
--- a/composer.json
+++ b/composer.json
@@ -44,7 +44,7 @@
                "wikimedia/php-session-serializer": "1.0.6",
                "wikimedia/purtle": "1.0.7",
                "wikimedia/relpath": "2.1.1",
-               "wikimedia/remex-html": "2.0.0",
+               "wikimedia/remex-html": "2.0.1",
                "wikimedia/running-stat": "1.2.1",
                "wikimedia/scoped-callback": "2.0.0",
                "wikimedia/utfnormal": "2.0.0",

diff --git a/includes/DefaultSettings.php b/includes/DefaultSettings.php
index 1e15524..fa95633 100644 (file)
--- a/includes/DefaultSettings.php
+++ b/includes/DefaultSettings.php
@@ -2898,11 +2898,6 @@ $wgSquidPurgeUseHostHeader = true;
  * @endcode
  *
  * @since 1.22
- *
- * $wgHTCPRouting replaces $wgHTCPMulticastRouting that was introduced in 1.20.
- * For back compatibility purposes, whenever its array is empty
- * $wgHTCPMutlicastRouting will be used as a fallback if it not null.
- *
  * @see $wgHTCPMulticastTTL
  */
 $wgHTCPRouting = [];

diff --git a/includes/actions/RawAction.php b/includes/actions/RawAction.php
index b5a6d3a..77a8b14 100644 (file)
--- a/includes/actions/RawAction.php
+++ b/includes/actions/RawAction.php
@@ -129,6 +129,30 @@ class RawAction extends FormlessAction {
                        }
                }
 
+               // Don't allow loading non-protected pages as javascript.
+               // In future we may further restrict this to only CONTENT_MODEL_JAVASCRIPT
+               // in NS_MEDIAWIKI or NS_USER, as well as including other config types,
+               // but for now be more permissive. Allowing protected pages outside of
+               // NS_USER and NS_MEDIAWIKI in particular should be considered a temporary
+               // allowance.
+               if (
+                       $contentType === 'text/javascript' &&
+                       !$title->isUserJsConfigPage() &&
+                       !$title->inNamespace( NS_MEDIAWIKI ) &&
+                       !in_array( 'sysop', $title->getRestrictions( 'edit' ) ) &&
+                       !in_array( 'editprotected', $title->getRestrictions( 'edit' ) )
+               ) {
+
+                       $log = LoggerFactory::getInstance( "security" );
+                       $log->info( "Blocked loading unprotected JS {title} for {user}",
+                               [
+                                       'user' => $this->getUser()->getName(),
+                                       'title' => $title->getPrefixedDBKey(),
+                               ]
+                       );
+                       throw new HttpError( 403, wfMessage( 'unprotected-js' ) );
+               }
+
                $response->header( 'Content-type: ' . $contentType . '; charset=UTF-8' );
 
                $text = $this->getRawText();

diff --git a/languages/i18n/en.json b/languages/i18n/en.json
index 5283a5b..e35af5a 100644 (file)
--- a/languages/i18n/en.json
+++ b/languages/i18n/en.json
@@ -4519,5 +4519,6 @@
        "passwordpolicies-policy-passwordcannotmatchblacklist": "Password cannot match specifically blacklisted passwords",
        "passwordpolicies-policy-maximalpasswordlength": "Password must be less than $1 {{PLURAL:$1|character|characters}} long",
        "passwordpolicies-policy-passwordcannotbepopular": "Password cannot be {{PLURAL:$1|the popular password|in the list of $1 popular passwords}}",
-       "easydeflate-invaliddeflate": "Content provided is not properly deflated"
+       "easydeflate-invaliddeflate": "Content provided is not properly deflated",
+       "unprotected-js": "For security reasons JavaScript cannot be loaded from unprotected pages. Please only create javascript in the MediaWiki: namespace or as a User subpage"
 }

diff --git a/languages/i18n/qqq.json b/languages/i18n/qqq.json
index a17cfca..cbee32b 100644 (file)
--- a/languages/i18n/qqq.json
+++ b/languages/i18n/qqq.json
@@ -4721,5 +4721,6 @@
        "passwordpolicies-policy-passwordcannotmatchblacklist": "Password policy that enforces that passwords are not on a list of blacklisted passwords (often previously used during MediaWiki automated testing)",
        "passwordpolicies-policy-maximalpasswordlength": "Password policy that enforces a maximum number of characters a password must be. $1 - maximum number of characters that a password can be",
        "passwordpolicies-policy-passwordcannotbepopular": "Password policy that enforces that a password is not in a list of $1 number of \"popular\" passwords. $1 - number of popular passwords the password will be checked against",
-       "easydeflate-invaliddeflate": "Error message if the content passed to easydeflate was not deflated (compressed) properly"
+       "easydeflate-invaliddeflate": "Error message if the content passed to easydeflate was not deflated (compressed) properly",
+       "unprotected-js": "Error message shown when trying to load javascript via action=raw that is not protected"
 }

diff --git a/maintenance/resetUserEmail.php b/maintenance/resetUserEmail.php
index d6b4b79..771d19b 100644 (file)
--- a/maintenance/resetUserEmail.php
+++ b/maintenance/resetUserEmail.php
@@ -65,6 +65,7 @@ class ResetUserEmail extends Maintenance {
                        // Kick whomever is currently controlling the account off
                        $user->setPassword( PasswordFactory::generateRandomPasswordString( 128 ) );
                }
+               $this->output( "Done!\n" );
        }
 }