'MediaWiki\\ShellDisabledError' => __DIR__ . '/includes/exception/ShellDisabledError.php',
'MediaWiki\\Shell\\Command' => __DIR__ . '/includes/shell/Command.php',
'MediaWiki\\Shell\\CommandFactory' => __DIR__ . '/includes/shell/CommandFactory.php',
+ 'MediaWiki\\Shell\\FirejailCommand' => __DIR__ . '/includes/shell/FirejailCommand.php',
'MediaWiki\\Shell\\Result' => __DIR__ . '/includes/shell/Result.php',
'MediaWiki\\Shell\\Shell' => __DIR__ . '/includes/shell/Shell.php',
'MediaWiki\\Site\\MediaWikiPageNameNormalizer' => __DIR__ . '/includes/site/MediaWikiPageNameNormalizer.php',
* It should be appended in the query string of static CSS and JS includes,
* to ensure that client-side caches do not keep obsolete copies of global
* styles.
+ *
+ * @deprecated since 1.31
*/
$wgStyleVersion = '303';
'hidepatrolled' => 0,
'hidecategorization' => 1,
'imagesize' => 2,
- 'math' => 1,
'minordefault' => 0,
'newpageshidepatrolled' => 0,
'nickname' => '',
*/
$wgShellLocale = 'C.UTF-8';
+/**
+ * Method to use to restrict shell commands
+ *
+ * Supported options:
+ * - 'autodetect': Autodetect if any restriction methods are available
+ * - 'firejail': Use firejail <https://firejail.wordpress.com/>
+ * - false: Don't use any restrictions
+ *
+ * @note If using firejail with MediaWiki running in a home directory different
+ * from the webserver user, firejail 0.9.44+ is required.
+ *
+ * @since 1.31
+ * @var string|bool
+ */
+$wgShellRestrictionMethod = false;
+
/** @} */ # End shell }
/************************************************************************//**
];
$result = Shell::command( $cmd )
->environment( [ 'GIT_DIR' => $this->basedir ] )
+ ->restrict( Shell::RESTRICT_DEFAULT | Shell::NO_NETWORK )
+ ->whitelistPaths( [ $this->basedir ] )
->execute();
if ( $result->getExitCode() === 0 ) {
'filesize' => $config->get( 'MaxShellFileSize' ),
];
$cgroup = $config->get( 'ShellCgroup' );
+ $restrictionMethod = $config->get( 'ShellRestrictionMethod' );
- $factory = new CommandFactory( $limits, $cgroup );
+ $factory = new CommandFactory( $limits, $cgroup, $restrictionMethod );
$factory->setLogger( LoggerFactory::getInstance( 'exec' ) );
$factory->logStderr();
return null;
}
+ $cache = ObjectCache::getMainWANInstance();
$optionsHash = md5( serialize( $opts->getAllValues() ) ) . $wgRenderHashAppend;
- $timekey = wfMemcKey(
+ $timekey = $cache->makeKey(
$this->type, $this->format, $wgLang->getCode(), $optionsHash, 'timestamp' );
- $key = wfMemcKey( $this->type, $this->format, $wgLang->getCode(), $optionsHash );
+ $key = $cache->makeKey( $this->type, $this->format, $wgLang->getCode(), $optionsHash );
FeedUtils::checkPurge( $timekey, $key );
application/x-tcl [EXECUTABLE]
application/x-perl [EXECUTABLE]
application/x-python [EXECUTABLE]
+application/wasm [EXECUTABLE]
application/pdf application/acrobat [OFFICE]
application/msword [OFFICE]
chemical/x-mdl-rgfile rg
application/x-amf amf
application/sla stl
+application/wasm wasm
return $minTTL; // no last-modified time provided
}
- $age = time() - $mtime;
+ $age = $this->getCurrentTime() - $mtime;
return (int)min( $maxTTL, max( $minTTL, $factor * $age ) );
}
/** @var string|false */
private $cgroup = false;
+ /**
+ * bitfield with restrictions
+ *
+ * @var int
+ */
+ protected $restrictions = 0;
+
/**
* Constructor. Don't call directly, instead use Shell::command()
*
return $this;
}
+ /**
+ * Set additional restrictions for this request
+ *
+ * @since 1.31
+ * @param int $restrictions
+ * @return $this
+ */
+ public function restrict( $restrictions ) {
+ $this->restrictions |= $restrictions;
+
+ return $this;
+ }
+
+ /**
+ * Bitfield helper on whether a specific restriction is enabled
+ *
+ * @param int $restriction
+ *
+ * @return bool
+ */
+ protected function hasRestriction( $restriction ) {
+ return ( $this->restrictions & $restriction ) === $restriction;
+ }
+
+ /**
+ * If called, only the files/directories that are
+ * whitelisted will be available to the shell command.
+ *
+ * limit.sh will always be whitelisted
+ *
+ * @param string[] $paths
+ *
+ * @return $this
+ */
+ public function whitelistPaths( array $paths ) {
+ // Default implementation is a no-op
+ return $this;
+ }
+
/**
* String together all the options and build the final command
* to execute
namespace MediaWiki\Shell;
+use ExecutableFinder;
use Psr\Log\LoggerAwareTrait;
use Psr\Log\NullLogger;
/** @var bool */
private $doLogStderr = false;
+ /**
+ * @var string|bool
+ */
+ private $restrictionMethod;
+
+ /**
+ * @var string|bool
+ */
+ private $firejail;
+
/**
* Constructor
*
* @param array $limits See {@see Command::limits()}
* @param string|bool $cgroup See {@see Command::cgroup()}
+ * @param string|bool $restrictionMethod
*/
- public function __construct( array $limits, $cgroup ) {
+ public function __construct( array $limits, $cgroup, $restrictionMethod ) {
$this->limits = $limits;
$this->cgroup = $cgroup;
+ if ( $restrictionMethod === 'autodetect' ) {
+ // On Linux systems check for firejail
+ if ( PHP_OS === 'Linux' && $this->findFirejail() !== false ) {
+ $this->restrictionMethod = 'firejail';
+ } else {
+ $this->restrictionMethod = false;
+ }
+ } else {
+ $this->restrictionMethod = $restrictionMethod;
+ }
$this->setLogger( new NullLogger() );
}
+ private function findFirejail() {
+ if ( $this->firejail === null ) {
+ $this->firejail = ExecutableFinder::findInDefaultPaths( 'firejail' );
+ }
+
+ return $this->firejail;
+ }
+
/**
* When enabled, text sent to stderr will be logged with a level of 'error'.
*
* @return Command
*/
public function create() {
- $command = new Command();
+ if ( $this->restrictionMethod === 'firejail' ) {
+ $command = new FirejailCommand( $this->findFirejail() );
+ } else {
+ $command = new Command();
+ }
$command->setLogger( $this->logger );
return $command
--- /dev/null
+<?php
+/**
+ * Copyright (C) 2017 Kunal Mehta <legoktm@member.fsf.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+namespace MediaWiki\Shell;
+
+use RuntimeException;
+
+/**
+ * Restricts execution of shell commands using firejail
+ *
+ * @see https://firejail.wordpress.com/
+ * @since 1.31
+ */
+class FirejailCommand extends Command {
+
+ /**
+ * @var string Path to firejail
+ */
+ private $firejail;
+
+ /**
+ * @var string[]
+ */
+ private $whitelistedPaths = [];
+
+ /**
+ * @param string $firejail Path to firejail
+ */
+ public function __construct( $firejail ) {
+ parent::__construct();
+ $this->firejail = $firejail;
+ }
+
+ /**
+ * @inheritDoc
+ */
+ public function whitelistPaths( array $paths ) {
+ $this->whitelistedPaths = array_merge( $this->whitelistedPaths, $paths );
+ return $this;
+ }
+
+ /**
+ * @inheritDoc
+ */
+ protected function buildFinalCommand() {
+ // If there are no restrictions, don't use firejail
+ if ( $this->restrictions === 0 ) {
+ return parent::buildFinalCommand();
+ }
+
+ if ( $this->firejail === false ) {
+ throw new RuntimeException( 'firejail is enabled, but cannot be found' );
+ }
+ // quiet has to come first to prevent firejail from adding
+ // any output.
+ $cmd = [ $this->firejail, '--quiet' ];
+ // Use a profile that allows people to add local overrides
+ // if their system is setup in an incompatible manner. Also it
+ // prevents any default profiles from running.
+ // FIXME: Doesn't actually override command-line switches?
+ $cmd[] = '--profile=' . __DIR__ . '/firejail.profile';
+
+ // By default firejail hides all other user directories, so if
+ // MediaWiki is inside a home directory (/home) but not the
+ // current user's home directory, pass --allusers to whitelist
+ // the home directories again.
+ static $useAllUsers = null;
+ if ( $useAllUsers === null ) {
+ global $IP;
+ // In case people are doing funny things with symlinks
+ // or relative paths, resolve them all.
+ $realIP = realpath( $IP );
+ $currentUser = posix_getpwuid( posix_geteuid() );
+ $useAllUsers = ( strpos( $realIP, '/home/' ) === 0 )
+ && ( strpos( $realIP, $currentUser['dir'] ) !== 0 );
+ if ( $useAllUsers ) {
+ $this->logger->warning( 'firejail: MediaWiki is located ' .
+ 'in a home directory that does not belong to the ' .
+ 'current user, so allowing access to all home ' .
+ 'directories (--allusers)' );
+ }
+ }
+
+ if ( $useAllUsers ) {
+ $cmd[] = '--allusers';
+ }
+
+ if ( $this->whitelistedPaths ) {
+ // Always whitelist limit.sh
+ $cmd[] = '--whitelist=' . __DIR__ . '/limit.sh';
+ foreach ( $this->whitelistedPaths as $whitelistedPath ) {
+ $cmd[] = "--whitelist={$whitelistedPath}";
+ }
+ }
+
+ if ( $this->hasRestriction( Shell::NO_ROOT ) ) {
+ $cmd[] = '--noroot';
+ }
+
+ $seccomp = [];
+
+ if ( $this->hasRestriction( Shell::SECCOMP ) ) {
+ $seccomp[] = '@default';
+ }
+
+ if ( $this->hasRestriction( Shell::NO_EXECVE ) ) {
+ $seccomp[] = 'execve';
+ }
+
+ if ( $seccomp ) {
+ $cmd[] = '--seccomp=' . implode( ',', $seccomp );
+ }
+
+ if ( $this->hasRestriction( Shell::PRIVATE_DEV ) ) {
+ $cmd[] = '--private-dev';
+ }
+
+ if ( $this->hasRestriction( Shell::NO_NETWORK ) ) {
+ $cmd[] = '--net=none';
+ }
+
+ list( $fullCommand, $useLogPipe ) = parent::buildFinalCommand();
+
+ $builtCmd = implode( ' ', $cmd );
+
+ return [ "$builtCmd -- $fullCommand", $useLogPipe ];
+ }
+
+}
*/
class Shell {
+ /**
+ * Apply a default set of restrictions for improved
+ * security out of the box.
+ *
+ * Equal to NO_ROOT | SECCOMP | PRIVATE_DEV
+ *
+ * @note This value will change over time to provide increased security
+ * by default, and is not guaranteed to be backwards-compatible.
+ * @since 1.31
+ */
+ const RESTRICT_DEFAULT = 7;
+
+ /**
+ * Disallow any root access. Any setuid binaries
+ * will be run without elevated access.
+ *
+ * @since 1.31
+ */
+ const NO_ROOT = 1;
+
+ /**
+ * Use seccomp to block dangerous syscalls
+ * @see <https://en.wikipedia.org/wiki/seccomp>
+ *
+ * @since 1.31
+ */
+ const SECCOMP = 2;
+
+ /**
+ * Create a private /dev
+ *
+ * @since 1.31
+ */
+ const PRIVATE_DEV = 4;
+
+ /**
+ * Restrict the request to have no
+ * network access
+ *
+ * @since 1.31
+ */
+ const NO_NETWORK = 8;
+
+ /**
+ * Deny execve syscall with seccomp
+ * @see <https://en.wikipedia.org/wiki/exec_(system_call)>
+ *
+ * @since 1.31
+ */
+ const NO_EXECVE = 16;
+
/**
* Returns a new instance of Command class
*
--- /dev/null
+# Firejail profile used by MediaWiki when shelling out
+# See <https://firejail.wordpress.com/features-3/man-firejail-profile/> for
+# syntax documentation
+# Persistent local customizations
+include /etc/firejail/mediawiki.local
+# Persistent global definitions
+include /etc/firejail/globals.local
* @author Petr Kadlec <mormegil@centrum.cz>
*/
class SpecialListGroupRights extends SpecialPage {
- function __construct() {
+ public function __construct() {
parent::__construct( 'Listgrouprights' );
}
? 'all'
: $group;
- $msg = $this->msg( 'group-' . $groupname );
- $groupnameLocalized = !$msg->isBlank() ? $msg->text() : $groupname;
+ $groupnameLocalized = UserGroupMembership::getGroupName( $groupname );
- $msg = $this->msg( 'grouppage-' . $groupname )->inContentLanguage();
- $grouppageLocalized = !$msg->isBlank() ?
- $msg->text() :
- MWNamespace::getCanonicalName( NS_PROJECT ) . ':' . $groupname;
- $grouppageLocalizedTitle = Title::newFromText( $grouppageLocalized );
+ $grouppageLocalizedTitle = UserGroupMembership::getGroupPage( $groupname )
+ ?: Title::newFromText( MWNamespace::getCanonicalName( NS_PROJECT ) . ':' . $groupname );
if ( $group == '*' || !$grouppageLocalizedTitle ) {
// Do not make a link for the generic * group or group with invalid group page
* @param array $remove Array of groups this group is allowed to remove or true
* @param array $addSelf Array of groups this group is allowed to add to self or true
* @param array $removeSelf Array of group this group is allowed to remove from self or true
- * @return string List of all granted permissions, separated by comma separator
+ * @return string HTML list of all granted permissions
*/
private function formatPermissions( $permissions, $revoke, $add, $remove, $addSelf, $removeSelf ) {
$r = [];
"uploadstash-file-not-found-no-remote-thumb": "Памылка атрыманьня мініятуры: $1\nURL = $2",
"uploadstash-file-not-found-missing-content-type": "Адсутнічае загаловак тыпу зьместу.",
"uploadstash-file-not-found-not-exists": "Не атрымалася знайсьці шлях, ці не зьяўляецца простым файлам.",
+ "uploadstash-file-too-large": "Немагчыма апрацаваць файл памерам большым за $1 байтаў.",
"invalid-chunk-offset": "Няслушнае зрушэньне фрагмэнту",
"img-auth-accessdenied": "Доступ забаронены",
"img-auth-nopathinfo": "Адсутнічае PATH_INFO.\nВаш сэрвэр не ўстаноўлены на пропуск гэтай інфармацыі.\nМагчма, ён працуе праз CGI і не падтрымлівае img_auth.\nГлядзіце https://www.mediawiki.org/wiki/Special:MyLanguage/Manual:Image_Authorization.",
"recentchangesdays-max": "(maximum $1 jour{{PLURAL:$1||s}})",
"recentchangescount": "Nombre de modifications à afficher par défaut :",
"prefs-help-recentchangescount": "Ceci inclut les modifications récentes, les pages d'historiques et les journaux.",
+ "prefs-help-tokenmanagement": "Vous pouvez voir et réinitialiser la clé secrète de votre compte qui peut accéder au flux Web de votre liste de suivi. Toute personne connaissant la clé pourra lire votre liste de suivi, alors ne la partagez pas.",
"savedprefs": "Les préférences ont été sauvegardées.",
"savedrights": "Les droits utilisateur de {{GENDER:$1|$1}} ont été enregistrés.",
"timezonelegend": "Fuseau horaire :",
"nosuchusershort": "Non existe ningún usuario chamado \"$1\".\nVerifique o nome que inseriu.",
"nouserspecified": "Cómpre especificar un nome de usuario.",
"login-userblocked": "Este usuario está bloqueado. Acceso non autorizado.",
- "wrongpassword": "O contrasinal escrito é incorrecto.\nPor favor, insira outro.",
+ "wrongpassword": "O nome de usuario ou o contrasinal escrito son incorrectos.\nPor favor, probe de novo.",
"wrongpasswordempty": "O campo do contrasinal estaba en branco.\nPor favor, inténteo de novo.",
"passwordtooshort": "Os contrasinais deben conter, como mínimo, {{PLURAL:$1|1 carácter|$1 caracteres}}.",
"passwordtoolong": "Os contrasinais non poden ser máis longo de {{PLURAL:$1|1 carácter|$1 caracteres}}.",
"diff-multi-sameuser": "(Non se {{PLURAL:$1|mostra unha revisión|mostran $1 revisións}} do historial {{PLURAL:$1|feita|feitas}} polo mesmo usuario.)",
"diff-multi-otherusers": "(Non se {{PLURAL:$1|mostra unha revisión|mostran $1 revisións}} do historial {{PLURAL:$1|feita|feitas}} por {{PLURAL:$2|outro usuario|$2 usuarios}}.)",
"diff-multi-manyusers": "(Non se {{PLURAL:$1|mostra unha revisión|mostran $1 revisións}} do historial {{PLURAL:$1|feita|feitas}} por máis {{PLURAL:$2|dun usuario|de $2 usuarios}}.)",
+ "diff-paragraph-moved-tonew": "Moveuse o parágrafo. Prema para saltar para á nova localización.",
+ "diff-paragraph-moved-toold": "Moveuse o parágrafo. Prema para saltar para á localización anterior.",
"difference-missing-revision": "Non se {{PLURAL:$2|atopou revisión ningunha|atoparon $2 revisións}} desta diferenza ($1).\n\nA miúdo, isto está provocado por seguir unha ligazón de diferenzas obsoleta cara a unha páxina que foi borrada.\nO [{{fullurl:{{#Special:Log}}/delete|page={{FULLPAGENAMEE}}}} rexistro de borrados] contén máis detalles.",
"searchresults": "Resultados da procura",
"searchresults-title": "Resultados da procura de \"$1\"",
"prefs-watchlist-edits": "Número máximo de edicións que mostrar na lista de vixilancia:",
"prefs-watchlist-edits-max": "Número máximo: 1000",
"prefs-watchlist-token": "Pase para a lista de vixilancia:",
+ "prefs-watchlist-managetokens": "Xestionar identificadores",
"prefs-misc": "Preferencias varias",
"prefs-resetpass": "Cambiar o contrasinal",
"prefs-changeemail": "Cambiar ou eliminar o enderezo de correo electrónico",
"recentchangesdays-max": "Máximo: $1 {{PLURAL:$1|día|días}}",
"recentchangescount": "Número de edicións a mostrar por defecto:",
"prefs-help-recentchangescount": "Isto inclúe os cambios recentes, os historiais e mais os rexistros.",
- "prefs-help-watchlist-token2": "Esta é a clave secreta da fonte de novas web para a súa lista de vixilancia.\nCalquera persoa que a saiba poderá ler a súa lista de vixilancia; non comparta esta clave.\n[[Special:ResetTokens|Prema aquí se necesita restablecela]].",
"savedprefs": "Gardáronse as súas preferencias.",
"savedrights": "Gardáronse os grupos de {{GENDER:$1|usuario|usuaria}} de $1.",
"timezonelegend": "Fuso horario:",
"rcfilters-savedqueries-apply-and-setdefault-label": "Crear filtro por defecto",
"rcfilters-savedqueries-cancel-label": "Cancelar",
"rcfilters-savedqueries-add-new-title": "Gardar a configuración do filtro actual",
- "rcfilters-savedqueries-already-saved": "Estes filtro xa están gardados",
+ "rcfilters-savedqueries-already-saved": "Estes filtros xa están gardados. Cambie a súa configuración para crear un filtro gardado novo.",
"rcfilters-restore-default-filters": "Restaurar os filtros por defecto",
"rcfilters-clear-all-filters": "Borrar todos os filtros",
"rcfilters-show-new-changes": "Mostrar os cambios máis recentes",
"rcfilters-show-new-changes": "Vidi najnovije izmjene",
"rcfilters-search-placeholder": "Filtriraj nedavne promjene (pretražite ili počnite unositi)",
"rcfilters-invalid-filter": "Filter nije valjan",
- "rcfilters-empty-filter": "Nema aktivnih filtra. Prikazani su svi doprinosi.",
+ "rcfilters-empty-filter": "Nema aktivnih filtara. Prikazani su svi doprinosi.",
"rcfilters-filterlist-title": "Filtri",
"rcfilters-filterlist-whatsthis": "Kako ovo radi?",
"rcfilters-filterlist-feedbacklink": "Recite nam Vaše mišljenje o ovim (novim) oruđima za filtriranje",
"recentchangesdays-max": "Mássimo: $1 {{PLURAL:$1|die|dies}}",
"recentchangescount": "Númaro d'eidiçones a apersentar por omisson:",
"prefs-help-recentchangescount": "Anclui mudanças recentes, stórico de páiginas i registros.",
- "prefs-help-watchlist-token2": "Esta ye la chabe secreta pa l ''feed'' RSS de la sue lhista de páiginas begiadas.\nQualquiera pessona que coinça la chabe será capaç de lher la sue lhista de páiginas begiadas, por esso nun la dibulgue.\n[[Special:ResetTokens|Clique eiqui pa redefenir eilha]].",
"timezonelegend": "Fuso hourário:",
"localtime": "Hora lhocal:",
"timezoneuseoffset": "Outro (specificar defréncia)",
"youhavenewmessagesfromusers": "{{PLURAL:$4|Você tem}} $1 de {{PLURAL:$3|outro usuário|$3 usuários}} ($2).",
"youhavenewmessagesmanyusers": "Você tem $1 de muitos usuários ($2).",
"newmessageslinkplural": "{{PLURAL:$1|uma mensagem nova|999=mensagens novas}}",
- "newmessagesdifflinkplural": "último {{PLURAL:$1|mudança|999=mudanças}}",
+ "newmessagesdifflinkplural": "{{PLURAL:$1|última mudança|999=últimas mudanças}}",
"youhavenewmessagesmulti": "Você tem novas mensagens em $1",
"editsection": "editar",
"editold": "editar",
"november-date": "ᱱᱚᱵᱷᱮᱢᱵᱚᱨ $1",
"december-date": "ᱰᱤᱥᱮᱢᱵᱚᱨ $1",
"pagecategories": "{{PLURAL:$1|Bivag|Bivagko}}",
- "category_header": "Sakam korenaḱ rokom sokom \"$1\"",
+ "category_header": "ᱛᱷᱚᱠ ᱨᱮᱱ ᱥᱟᱦᱴᱟᱞᱩ \"$1\"",
"subcategories": "Huḍiń rokom sokomko",
"category-media-header": "\"$1\" babot reaḱ rokom sokomte emen meḍiya rẽtko",
"category-empty": "\"Noa rokom sokom sakamre do nit jahan sakam se miḍiya rẽt do bạnuḱa.\"",
"createaccount": "Ṭhai benaome",
"userlogin-resetpassword-link": "Amaḱ uku nambarem hiṛiń akada?",
"userlogin-helplink2": "Bolon khạtir go̠ṛo̠",
+ "createacct-emailrequired": "ᱤᱢᱮᱞ ᱵᱩᱴᱟᱹ",
"createacct-emailoptional": "Email ṭhikana (iccha lekate)",
"createacct-email-ph": "Amaḱ e-mail ṭhikana emme",
+ "createacct-another-email-ph": "ᱤᱢᱮᱞ ᱵᱩᱴᱟᱹ ᱟᱫᱮᱨᱢᱮ",
"createaccountmail": "E-mail hotete",
"createacct-submit": "Amaḱ account tearme",
+ "createacct-another-submit": "ᱠᱷᱟᱛᱟ ᱛᱮᱭᱟᱨᱢᱮ",
+ "createacct-continue-submit": "ᱠᱷᱟᱛᱟ ᱛᱮᱭᱟᱨ ᱛᱚᱝᱜᱮᱢᱮ",
+ "createacct-another-continue-submit": "ᱠᱷᱟᱛᱟ ᱛᱮᱭᱟᱨ ᱛᱚᱝᱜᱮᱢᱮ",
"createacct-benefit-heading": "{{SITENAME}} am lekan hoṛ hotete tear akan.",
"createacct-benefit-body1": "{{PLURAL:$1|joṛao|joṛaoko}}",
"createacct-benefit-body2": "{{PLURAL:$1|ᱥᱟᱦᱴᱟ|ᱥᱟᱦᱴᱟᱠᱳ}}",
"badretype": "Am do okaṭaḱ oku nambarkom em keda ona do baṅ milạolena.",
"userexists": "Laṛcaṛicaḱ ńutum em hoyena ona do beohar hoyakana.\nDayakatet́ eṭagaḱ ńutum bachaome.",
"loginerror": "Bhitri bolok do vulgea",
+ "createacct-error": "ᱠᱷᱟᱛᱟ ᱛᱮᱭᱟᱨ ᱦᱩᱲᱟᱹᱜ",
"createaccounterror": "Ekaunṭ do baṅ tear lena: $1",
"nocookiesnew": "Beoharićaḱ ekaunṭ tear hoe akana, menkhan am do nit hạbićte ekaunṭre bam boloakana. {{SITENAME}} re kuki beohar kate beoharićaḱ ekaunṭre boloa.\nAmaḱ sendrare kukiko bondo hoeakana. Dayakate kukiko kạmi hoe ocoemẽ ar amaḱ nãwã beohar ńutum ar uku nambar beohar hotete noa ekaunṭre boloḱmẽ.",
"nocookieslogin": "{{SITENAME}} re kuki hotete beoharićaḱ bhitri boloḱ do hoyoḱa. Amaḱ sendrare kuki bondo menaḱa. Kuki cạlu kate arhõ kurumuṭuimẽ.",
"retypenew": "Doṛhate oku namber olme",
"resetpass_submit": "Oku namber joṛao ar bhitri bolok",
"changepassword-success": "Amaḱ oku namber do napayte bodolena!\nNitoḱ do am bhitritem boloḱkana...",
+ "botpasswords-createnew": "ᱱᱟᱶᱟ ᱵᱚᱴ ᱫᱟᱱᱟᱝ ᱥᱟᱵᱟᱫᱽ ᱛᱮᱭᱟᱨᱢᱮ",
+ "botpasswords-label-appid": "ᱵᱚᱴ ᱧᱩᱛᱩᱢ:",
"botpasswords-label-create": "ᱛᱮᱭᱟᱨ",
+ "botpasswords-label-update": "ᱟᱹᱨᱩ ᱯᱷᱮᱨᱟᱣ",
"botpasswords-label-delete": "ᱜᱮᱫ ᱜᱤᱰᱤ",
"resetpass_forbidden": "Oku namber do baṅ bodoloklena",
"resetpass-no-info": "Noa sakam sojhete laṛcaṛ lạgit́te am do bhitri boloḱ hoyoḱtama.",
"searchresults-title": "\"$1\" ᱨᱮᱱᱟᱜ ᱥᱮᱸᱫᱽᱨᱟ ᱯᱷᱚᱞ",
"prevn": "Laha reaḱ {{PLURAL:$1|$1}}",
"nextn": "Táyom teaḱ {{PLURAL:$1|$1}}",
+ "prev-page": "ᱯᱟᱪᱮ ᱥᱟᱦᱴᱟ",
+ "next-page": "ᱫᱟᱨᱟᱭ ᱥᱟᱦᱴᱟ",
"prevn-title": "Laha renaḱ sakam $1 {{PLURAL:$1|result|results}}",
"nextn-title": "Tayom $1 {{PLURAL:$1|result|results}}",
"shown-title": "ᱥᱟᱦᱴᱟ $1 {{PLURAL:$1|ᱚᱨᱡᱚ|ᱚᱨᱡᱚᱠᱳ}} ᱩᱰᱩᱜᱽᱢᱮ",
"search-interwiki-caption": "Hopon porjekṭko",
"search-interwiki-default": "$1 folko:",
"search-interwiki-more": "(Arhõ)",
+ "search-interwiki-more-results": "ᱵᱟᱹᱲᱛᱤ ᱚᱨᱡᱚᱠᱚ",
+ "search-relatedarticle": "ᱥᱟᱹᱜᱟᱹᱭᱟᱱ",
"searchrelated": "songenko",
"searchall": "Sanamaḱ",
"search-showingresults": "{{PLURAL:$4|ᱚᱨᱡᱚ <strong>$1</strong> ᱨᱮᱱᱟᱜ <strong>$3</strong>|ᱚᱨᱡᱚᱠᱚ <strong>$1 - $2</strong> ᱨᱮᱱᱟᱜ <strong>$3</strong>}}",
"search-nonefound": "Kupuli leka roṛruạṛ bạnuḱa",
+ "powersearch-ns": "ᱨᱟᱠᱷᱟ ᱧᱩᱛᱩᱢ ᱨᱮ ᱥᱮᱸᱫᱽᱨᱟ",
"powersearch-togglelabel": "Sendra",
"powersearch-toggleall": "Sanamaḱ",
"powersearch-togglenone": "Okaṭaḱ hõ baṅ",
"preferences": "Pạsindko",
"mypreferences": "Pạsindko",
+ "prefs-edits": "ᱥᱟᱯᱲᱟᱣᱟᱜ ᱮᱞ:",
"prefs-skin": "Harta",
"skin-preview": "Ńel, Unuduḱ",
"datedefault": "Pạsind banuḱa",
"username": "Beoharićaḱ ńutum:",
"yourrealname": "Sạri ńutum",
"yourlanguage": "ᱯᱟᱹᱨᱥᱤ:",
+ "yournick": "ᱱᱟᱶᱟ ᱥᱩᱦᱤ:",
"gender-male": "Baba hoṛ",
"gender-female": "Gogo hoṛ, Kuṛi, Kuṛi gidrạ",
"email": "E-mail",
"prefs-help-email": "E-mail ṭhikana do bạṛtitege, menkhan uku namber nãwãte benao jạruṛa, am do amaḱ uku nomborem hiṛiń keda.",
"prefs-help-email-others": "Am são e-mail hotete jogajog dohoy lạgitte mitṭen joṛao se amaḱ katha roṛaḱ sakam bachao jońme.\nAmaḱ e-mail ṭhikạna do bań cabaḱa tinre onko do ko beohara",
+ "prefs-signature": "ᱥᱩᱦᱤ",
+ "prefs-editor": "ᱥᱟᱯᱲᱮᱛ",
+ "prefs-preview": "ᱧᱮᱞ ᱵᱤᱰᱟᱹᱣ",
"userrights": "Beoharićaḱ laṛcaṛ ektiạrko",
"userrights-lookup-user": "Beoharkoaḱ gãotako laṛcaṛ",
"userrights-user-editname": "Beoharićaḱ ńutum emmẽ",
"editusergroup": "Beoharićaḱ gãotako toṅgeymẽ",
"userrights-editusergroup": "Beoharićaḱ gãotako toṅgeymẽ",
"saveusergroups": "Beoharićaḱ gãotako rukhiyaymẽ",
+ "userrights-reason": "ᱚᱡᱮ:",
"group-bot": "ᱵᱚᱴᱠᱚ",
"group-sysop": "ᱟᱰᱢᱤᱱᱤᱥᱴᱨᱮᱴᱚᱨ",
"grouppage-bot": "{{ns:project}}:ᱵᱚᱴᱠᱚ",
"tooltip-n-help": "ᱥᱮᱸᱫᱽᱨᱟ ᱧᱟᱢ ᱨᱮᱭᱟᱜ ᱡᱟᱜᱟ",
"tooltip-t-whatlinkshere": "ᱥᱟᱱᱟᱢ ᱩᱤᱠᱤ ᱥᱟᱦᱴᱟ ᱨᱮᱱᱟᱜ ᱛᱟᱹᱞᱠᱟᱹ ᱟᱨ ᱡᱚᱱᱚᱲ ᱫᱚ ᱱᱚᱸᱰᱮ",
"tooltip-t-recentchangeslinked": "ᱱᱚᱭᱟ ᱥᱟᱦᱴᱟ ᱨᱮ ᱨᱚᱠᱟ ᱵᱚᱫᱚᱞ ᱟᱠᱟᱱ ᱥᱟᱦᱴᱟ ᱨᱮᱱᱟᱜ ᱡᱚᱱᱚᱲ",
- "tooltip-feed-atom": "Noa sakam lạgit́ atom phiḍ",
+ "tooltip-feed-atom": "ᱱᱚᱣᱟ ᱥᱟᱦᱴᱟ ᱞᱟᱹᱜᱤᱛ Atom feed",
"tooltip-t-contributions": "ᱮᱱᱮᱢ ᱨᱮᱱᱟᱜ ᱛᱟᱹᱞᱠᱟᱹ {{GENDER:$1|ᱱᱩᱭ ᱵᱮᱵᱷᱟᱨᱤᱭᱟᱹ}}",
"tooltip-t-emailuser": "ᱢᱤᱫ ᱤᱢᱮᱞ ᱠᱩᱞᱟᱭᱢᱮ {{GENDER:$1|ᱱᱩᱭ ᱵᱮᱵᱷᱟᱨᱤᱭᱟᱹ}}",
"tooltip-t-upload": "ᱨᱮᱫ ᱠᱚ ᱞᱟᱫᱮᱢᱮ",
"tooltip-ca-nstab-mediawiki": "ᱥᱤᱥᱴᱚᱢ ᱢᱮᱥᱮᱡᱽ ᱧᱮᱞ",
"tooltip-ca-nstab-template": "Forom uduḱme",
"tooltip-ca-nstab-help": "ᱜᱚᱸᱲᱚ ᱥᱟᱦᱴᱟ ᱧᱮᱞᱢᱮ",
- "tooltip-ca-nstab-category": "Rokom sokom sakamko udukme",
+ "tooltip-ca-nstab-category": "ᱛᱷᱚᱠ ᱥᱟᱦᱴᱟ ᱧᱮᱞᱢᱮ",
"tooltip-minoredit": "Noa do huḍiń joṛao lekate lekhay me",
"tooltip-save": "Bodolaḱko rukhiyayme",
"tooltip-preview": "Amaḱ bodolaḱ uduḱme, noa beoharme ạuri rukhiyayre",
"tooltip-diff": "Uduḱme okaṭaḱ onolem bodolakada",
"tooltip-compareselectedversions": "ᱱᱚᱣᱟ ᱥᱟᱦᱴᱟ ᱨᱮᱱᱟᱜ ᱵᱟᱨᱭᱟ ᱧᱮᱞᱟᱹᱨᱩ ᱵᱷᱮᱜᱮᱫ ᱧᱮᱞ ᱢᱮ",
- "tooltip-watch": "Amaḱ ńeloḱ sakamre noa do dohoyme",
+ "tooltip-watch": "ᱱᱚᱭᱟ ᱥᱟᱦᱴᱟ ᱫᱚ ᱟᱢᱟᱜ ᱧᱮᱞᱚᱜ ᱛᱟᱹᱞᱠᱟᱹᱨᱮ ᱡᱚᱲᱟᱣᱢᱮ",
"tooltip-rollback": "ᱫᱚᱲᱦᱟᱛᱮ ᱢᱤᱫ ᱫᱷᱟᱣ ᱞᱤᱱ ᱛᱮ contributor ᱟᱜ ᱢᱩᱪᱟᱹᱫ ᱥᱟᱯᱲᱟᱣ \"ᱜᱷᱩᱨᱞᱟᱹ ᱟᱹᱪᱩᱨ\" ᱢᱮ",
"tooltip-undo": "Noa joṛao kạmire ulṭao \"bạgiyaḱme\" ar ńeloḱ lekate noa joṛao jhicme. Noa do am guḍ karon joṛaoe ektiyariye emama.",
"tooltip-preferences-save": "Pạsindko rukhiyaymẽ",
'7' => '٧', # ٧
'8' => '٨', # ٨
'9' => '٩', # ٩
- '.' => '٫', # ٫ wrong table ?
+];
+
+$separatorTransformTable = [
+ '.' => '٫', # ٫
',' => '٬', # ٬
];
'7' => '7',
'8' => '8',
'9' => '9',
+];
+
+$separatorTransformTable = [
'.' => '.',
',' => ',',
];
'7' => '٧', # ٧
'8' => '٨', # ٨
'9' => '٩', # ٩
- '.' => '٫', # ٫ wrong table ?
+];
+
+$separatorTransformTable = [
+ '.' => '٫', # ٫
',' => '٬', # ٬
];
'8' => '۸', # ۸
'9' => '۹', # ۹
'%' => '٪', # ٪
- '.' => '٫', # ٫ wrong table?
+];
+
+$separatorTransformTable = [
+ '.' => '٫', # ٫
',' => '٬', # ٬
];
'7' => '٧', # ٧
'8' => '٨', # ٨
'9' => '٩', # ٩
- '.' => '٫', # ٫ wrong table ?
+];
+
+$separatorTransformTable = [
+ '.' => '٫', # ٫
',' => '٬', # ٬
];
'7' => '七',
'8' => '八',
'9' => '九',
+];
+
+$separatorTransformTable = [
'.' => '點',
',' => '',
];
}
},
featureFlags: {
- liveUpdate: mw.config.get( 'StructuredChangeFiltersLiveUpdatePollingRate' ) &&
- ( mw.user.options.get( 'rcenhancedfilters' ) || new mw.Uri().query.liveupdate )
+ liveUpdate: mw.config.get( 'StructuredChangeFiltersLiveUpdatePollingRate' )
}
};
}( mediaWiki ) );
border-radius: 100%;
transform-origin: 50% 50%;
opacity: 0;
- animation: ripple 1.2s ease-out infinite;
+ animation: ripple 2.3s ease-out infinite;
animation-delay: 1s;
}
}
.transform( scale( 1.5 ) );
opacity: 0.8;
}
+ 80%,
100% {
opacity: 0;
.transform( scale( 4 ) );
.client-js #preferences > .oo-ui-panelLayout > .oo-ui-fieldsetLayout > .oo-ui-fieldsetLayout-header {
margin-bottom: 1em;
}
+
+/* Make the "Basic information" section more compact */
+/* OOUI's `align: 'left'` for FieldLayouts sucks, so we do our own */
+#mw-htmlform-info > .oo-ui-fieldLayout-align-top > .oo-ui-fieldLayout-body > .oo-ui-fieldLayout-header {
+ width: 20%;
+ display: inline-block;
+ vertical-align: middle;
+ padding: 0;
+}
+
+#mw-htmlform-info > .oo-ui-fieldLayout-align-top > .oo-ui-fieldLayout-body > .oo-ui-fieldLayout-field {
+ width: 80%;
+ display: inline-block;
+ vertical-align: middle;
+}
<?php
+use MediaWiki\Shell\Command;
use MediaWiki\Shell\CommandFactory;
+use MediaWiki\Shell\FirejailCommand;
use Psr\Log\NullLogger;
use Wikimedia\TestingAccessWrapper;
'walltime' => 40,
];
- $factory = new CommandFactory( $limits, $cgroup );
+ $factory = new CommandFactory( $limits, $cgroup, false );
$factory->setLogger( $logger );
$factory->logStderr();
$command = $factory->create();
+ $this->assertInstanceOf( Command::class, $command );
$wrapper = TestingAccessWrapper::newFromObject( $command );
$this->assertSame( $logger, $wrapper->logger );
$this->assertSame( $limits, $wrapper->limits );
$this->assertTrue( $wrapper->doLogStderr );
}
+
+ /**
+ * @covers MediaWiki\Shell\CommandFactory::create
+ */
+ public function testFirejailCreate() {
+ $factory = new CommandFactory( [], false, 'firejail' );
+ $factory->setLogger( new NullLogger() );
+ $this->assertInstanceOf( FirejailCommand::class, $factory->create() );
+ }
}
--- /dev/null
+<?php
+
+/**
+ * Copyright (C) 2017 Kunal Mehta <legoktm@member.fsf.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+use MediaWiki\Shell\FirejailCommand;
+use MediaWiki\Shell\Shell;
+use Wikimedia\TestingAccessWrapper;
+
+class FirejailCommandTest extends PHPUnit_Framework_TestCase {
+ public function provideBuildFinalCommand() {
+ global $IP;
+ // @codingStandardsIgnoreStart
+ $env = "'MW_INCLUDE_STDERR=;MW_CPU_LIMIT=180; MW_CGROUP='\'''\''; MW_MEM_LIMIT=307200; MW_FILE_SIZE_LIMIT=102400; MW_WALL_CLOCK_LIMIT=180; MW_USE_LOG_PIPE=yes'";
+ // @codingStandardsIgnoreEnd
+ $limit = "$IP/includes/shell/limit.sh";
+ $profile = "--profile=$IP/includes/shell/firejail.profile";
+ $default = '--noroot --seccomp=@default --private-dev';
+ return [
+ [
+ 'No restrictions',
+ 'ls', 0, "/bin/bash '$limit' ''\''ls'\''' $env"
+ ],
+ [
+ 'default restriction',
+ 'ls', Shell::RESTRICT_DEFAULT,
+ "firejail --quiet $profile $default -- /bin/bash '$limit' ''\''ls'\''' $env"
+ ],
+ [
+ 'no network',
+ 'ls', Shell::NO_NETWORK,
+ "firejail --quiet $profile --net=none -- /bin/bash '$limit' ''\''ls'\''' $env"
+ ],
+ [
+ 'default restriction & no network',
+ 'ls', Shell::RESTRICT_DEFAULT | Shell::NO_NETWORK,
+ "firejail --quiet $profile $default --net=none -- /bin/bash '$limit' ''\''ls'\''' $env"
+ ],
+ [
+ 'seccomp',
+ 'ls', Shell::SECCOMP,
+ "firejail --quiet $profile --seccomp=@default -- /bin/bash '$limit' ''\''ls'\''' $env"
+ ],
+ [
+ 'seccomp & no execve',
+ 'ls', Shell::SECCOMP | Shell::NO_EXECVE,
+ "firejail --quiet $profile --seccomp=@default,execve -- /bin/bash '$limit' ''\''ls'\''' $env"
+ ],
+ ];
+ }
+
+ /**
+ * @covers \MediaWiki\Shell\FirejailCommand::buildFinalCommand()
+ * @dataProvider provideBuildFinalCommand
+ */
+ public function testBuildFinalCommand( $desc, $params, $flags, $expected ) {
+ $command = new FirejailCommand( 'firejail' );
+ $command
+ ->params( $params )
+ ->restrict( $flags );
+ $wrapper = TestingAccessWrapper::newFromObject( $command );
+ $output = $wrapper->buildFinalCommand();
+ $this->assertEquals( $expected, $output[0], $desc );
+ }
+
+}