Commit graph

16761 commits

Author SHA1 Message Date
sbassett 61d9bb77b5 SECURITY: ve.ui.MWMediaDialog: Escape plaintext image metadata fields
CVE-2021-44855

Bug: T293589
Change-Id: I691b4065e67c53c4276599c8d16c31ab5591db3a
2021-12-15 12:35:48 +00:00
Translation updater bot 5f4d43c0c6 Localisation updates from https://translatewiki.net.
Change-Id: Ifac82a5b1aa65fc074f4578f8b4bb645020e02e0
2021-12-13 06:57:55 +01:00
libraryupgrader cd6568ca4f build: Updating npm dependencies
* path-parse: 1.0.6 → 1.0.7
  * https://npmjs.com/advisories/1773 (CVE-2021-23343)
* jszip: 3.4.0 → 3.7.1
  * https://npmjs.com/advisories/1774 (CVE-2021-23413)

Change-Id: I18d6786d89d946c231792bc3a2e2da27cce9c780
2021-09-04 12:11:47 +00:00
Alexander Vorwerk 0137e71f6a Update VE core submodule to origin/REL1_35
New changes:
9894e0b91 build: Updating path-parse to 1.0.7
048cffda4 build: Updating npm dependencies

Change-Id: I7ac9c0e92719b8b46ab6ae46e3128b93e2ec87eb
2021-08-13 23:08:22 +02:00
Arlo Breault cc3466a035 Remove skinning modules when showing preview
Bug: T185284
Change-Id: Ifec8809cd75cb76c79936a69351be0c7779de39e
(cherry picked from commit 2fd09aaba3)
2021-07-28 20:52:18 +00:00
libraryupgrader 480357b6ba build: Updating npm dependencies
* postcss: 7.0.32 → 7.0.36
  * https://npmjs.com/advisories/1693 (CVE-2021-23368)
* @stylelint/postcss-markdown: 0.36.1 → 0.36.2
  * https://npmjs.com/advisories/1700 (CVE-2020-7753)
* browserslist: 4.12.0 → 4.16.6
  * https://npmjs.com/advisories/1747 (CVE-2021-23364)
* glob-parent: 5.1.1 → 5.1.2
  * https://npmjs.com/advisories/1751 (CVE-2020-28469)
* trim-newlines: 1.0.0 → 3.0.1
  * https://npmjs.com/advisories/1753 (CVE-2021-33623)

Change-Id: I901bfd03844fe663eb106821f2cd91d6b6d3850a
2021-07-21 19:28:15 +00:00
Bartosz Dziewoński b73df7e472 Update VE core submodule to origin/REL1_35
New changes:
05215269a build: Updating npm dependencies
5695586df build: Updating npm dependencies

Bug: T285602
Change-Id: Ib5f397d1c9f2b93aa4396a1d8ee4f384e9380305
2021-06-28 13:48:41 +00:00
libraryupgrader 11eeeba20c build: Updating npm dependencies
* grunt: 1.1.0 → 1.4.0
* lodash: 4.17.19 → 4.17.21
  * https://npmjs.com/advisories/1673 (CVE-2021-23337)
* hosted-git-info: 2.8.8 → 2.8.9
  * https://npmjs.com/advisories/1677 (CVE-2021-23362)

Additional changes:
* Dropped .php5 and .inc files from .phpcs.xml (T200956).

Change-Id: I458a1bd01b56db36e69d2c0ac96b177268a4a29f
2021-05-07 21:04:02 +00:00
Kunal Mehta c16410ff6f Require MediaWiki >= 1.35.2
This patch release is needed for usage of the Promise-Non-Write-API-Action
header, added in 4465cbe542.

Bug: T279039
Change-Id: I9a899b03c38fb3de755211bfe8ea3177832d8647
2021-04-15 21:19:06 -07:00
Bartosz Dziewoński 07ed2531f2 SECURITY: Act like users don't exist if hidden from viewer (VE edit notices)
Applying the changes from the MediaWiki core patch for T120883
(Ife272a0eb1f3322bc8eb30ca803bd21801acba3e) to our duplicated
code implementing the same functionality.

Bug: T270453
Change-Id: I1b2de322aa0c69eb6d3b3ffadaed3fbaa3a58bca
2021-04-08 20:36:49 +01:00
Bartosz Dziewoński dc85118f06 Update VE core submodule to origin/REL1_35
New changes:
96c02e75c build: Updating ini to 1.3.8
059cb9445 build: Updating socket.io to 2.4.1
504e7d258 build: Updating y18n to 4.0.1

Change-Id: I2cc57f403ff74dcbc3e0431acd5da53f3d7d2214
2021-03-30 17:04:23 +02:00
Ed Sanders f089b743ca Gallery: Handle invalid titles
Items which are invalid titles will still get discarded if
the gallery is edited, but this is better than crashing.

Bug: T260584
Change-Id: I5dc20c233fd9ab41bdf48531829bddca2c5b25df
(cherry picked from commit 42c7096dbf)
2021-03-18 16:50:59 +00:00
Bartosz Dziewoński 6086cc378b Fix $wgVisualEditorUseSingleEditTab compat with PostgreSQL
Bug: T270953
Change-Id: I30bd329e8c19d7b2e7ae905cead6b21b8584db5d
(cherry picked from commit 932d009cd7)
2021-02-25 21:43:36 +00:00
C. Scott Ananian 4465cbe542 Rename magic header to be consistent with WMF CDN infrastructure
This name is consistent with T91820.

Bug: T91820
Bug: T259685
Depends-On: I0c4ec63bb26641b237c92dbd3bc5367811ca0675
Followup-to: 3561167493
Change-Id: I4c4c5f83ad56a198d08095d629a6ba86ce9dc1a4
(cherry picked from commit fce9192e82)
2021-02-05 21:11:51 +00:00
C. Scott Ananian 1ddd2930bb Fix sqlite compatibility by opting out of obligatory write lock
Bug: T259685
Depends-On: If37dc890a24a45c3a914e310b5b5bf625965e9e6
Change-Id: Ib203145f4c9ddfdc6701a916cbbbe17dae85efb9
(cherry picked from commit 3561167493)
2021-02-05 21:09:48 +00:00
libraryupgrader be34a2da1e build: Updating npm dependencies
* bl: 1.2.2 → 1.2.3
  * https://npmjs.com/advisories/1555
* ini: 1.3.5 → 1.3.8
  * https://npmjs.com/advisories/1589

Additional changes:
* Added the "composer phan" command to conveniently run phan.
* Removed globals `OO`, `require`, included via `wikimedia/mediawiki` profile (T262222).
* Removing manual extensions for eslint.

Change-Id: I1afb9adfd5ea00ce3d5c9bbc934c81ffb5e7e080
2020-12-31 11:36:41 +00:00
jenkins-bot 10ac245273 Merge "Start using edit api results for watchlist UI updates" into REL1_35 2020-09-11 03:46:16 +00:00
Sam Wilson c043653efe Ignore non-checkbox fields for page saving dialog
The 'checkbox' part of the edit form is now allowed to contain
non-checkbox form widgets, but these are not yet supported
by VisualEditor. Until they are, this skips them entirely
in order that no broken form field be shown.

Bug: T259546
Change-Id: If62c11b174df235be611b9d32eb28e4759ba5f66
(cherry picked from commit 82bfa015ec)
2020-09-11 03:26:22 +00:00
Dayllan Maza cecb076605 Start using edit api results for watchlist UI updates
This patch starts using watchlist related values from ApiEditPage
results instead of updating the "watch link" based on whether the
checkbox was selected or not at the time of saving the article.

This change does not depend on T261030 and can be merged without it
but T261030 needs to be fixed or temporarily watched items will not
display the right tooltip when hovering the "watch link" or star icon.

Bug: T260434
Change-Id: I2c844223620d7d28f36a0cd8ae3dee4b0c8ae5bf
(cherry picked from commit 4fc73112ee)
2020-09-11 03:24:39 +00:00
C. Scott Ananian cc95db5afd Ensure Parsoid doesn't throw when <ref> is used w/o Cite installed
Parsoid always enables `<ref>` processing, but our Cite extension
implementation tries to fetch $wgCiteResponsiveReferences, which won't
be set if the Cite extension is not installed.

Change-Id: Idde8af07e5bf40983b2ec878ebf70aabb522a800
(cherry picked from commit 0ca4ae6908b626d34f8445d9048342378d0e3c23)
(cherry picked from commit 29d3e25b4a)
2020-08-21 16:39:04 +00:00
Kunal Mehta 342ccbf4b3 Support private wikis in Parsoid zero configuration mode
Set the 'forwardCookies' flag if the wiki is private (not everyone is
allowed 'read' access).

Bug: T260201
Change-Id: I0b958e8b75c04e4a27f50f91276be221a5b1404d
(cherry picked from commit 45a02ee03e)
2020-08-12 10:12:55 +00:00
Ed Sanders 8e48a1844b Follow-up I0a1a889: Show user uploads in gallery dialog
Gallery dialog should behave the same as media dialog.

Bug: T62398
Change-Id: I601df9370b82868ba981e415fe24bd4f29399cdb
(cherry picked from commit 69d8a195e5)
2020-07-30 20:35:55 +00:00
Bartosz Dziewoński d43266f061 Update VE core submodule to master (0cab1cfbb)
New changes:
94448b786 Adds tabindex to document node

Bug: T255314
Change-Id: I76f150dedaec73ec28b6037f1630bbe6325eaf61
2020-07-13 23:29:15 +02:00
jenkins-bot ca8c828787 Merge "Update VE core submodule to master (1a42033ce)" 2020-07-13 21:07:03 +00:00
jenkins-bot b097557733 Merge "Fix: focus order and screen reader issue in help popup dialog" 2020-07-13 19:58:59 +00:00
jenkins-bot c17c7047ef Merge "Fix: provide proper focus order to Category popup" 2020-07-13 19:58:56 +00:00
Akinwale Alagbe 92f2fb1522 Fix: focus order and screen reader issue in help popup dialog
Bug: T257175
Change-Id: Ib1e72caf06de827d5867e2badfd16408d32e9593
2020-07-13 21:32:43 +02:00
Akinwale Alagbe 2f7765d1e8 Fix: provide proper focus order to Category popup
Bug: T257173
Change-Id: I99e9332adb83bf1197da827583b9f22f68b2f395
2020-07-13 21:30:38 +02:00
C. Scott Ananian 4b04f413fa Zero-configuration VisualEditor + PHP for MediaWiki LTS
This copies the Parsoid extension code into includes/VEParsoid
to allow a "one extension, zero-configuration" install of
VisualEditor for MW's LTS release. The Parsoid code has been
re-namespaced (`VEParsoid` instead of `MWParsoid`) to avoid
autoloader conflicts if you actually install Parsoid as an
extension (as we do in Wikimedia production). Similarly, we
arrange that the ServiceWiring and RestRoutes configurations
are skipped unless running in zeroconf mode, to avoid
conflicts with the Parsoid extension.

This import matches Parsoid commit b30f223.

Bug: T248343
Change-Id: Ic63ce40f59c4be8f4fdc5f9ac17798353fc86866
2020-07-13 18:39:08 +00:00
jenkins-bot 939437632a Merge "MWMediaDialog: Show user uploads when no query provided" 2020-07-13 13:31:44 +00:00
James D. Forrester ec244f4e62 Update VE core submodule to master (1a42033ce)
New changes:
72ee5f358 Update OOUI to v0.39.3
eb9f726d5 Localisation updates from https://translatewiki.net.
1a42033ce build: Updating lodash to 4.17.19

Change-Id: Iff81328d669ba0b2795795c3b537c4bcff25fc86
2020-07-13 10:38:16 +01:00
C. Scott Ananian 5e83b1da2c Enable VisualEditor by default
This provides a "zero configuration" installation option for VisualEditor
for the MW 1.35 LTS release.

Depends on a change to mediawiki-config to reset the default in production
to disabled, so that we don't change user experience on the projects.

Bug: T248343
Depends-On: Ic32a4dc4436c8304e9fde4e1ec18401a8403b167
Change-Id: I5e422bc3eaf8a59a098e13802f511c2519583c0a
2020-07-13 08:56:30 +00:00
Ed Sanders 7d722c5f9a MWMediaDialog: Show user uploads when no query provided
Bug: T62398
Depends-On: Iff4b9fab47764e5b775f6757de1163a245f58ed5
Change-Id: I0a1a88933efa9003a75373c61f194f56bb083219
2020-07-13 08:39:40 +00:00
libraryupgrader 8d83473fe1 build: Updating lodash to 4.17.19
* https://npmjs.com/advisories/1523
* CVE-2019-10744

Change-Id: I04c3216bd76c2493e1d0be418e23320712174fe7
2020-07-11 09:26:35 +00:00
Translation updater bot cd8ab9925a Localisation updates from https://translatewiki.net.
Change-Id: I4c047fa33902346e8b94dae86501d655c6a6c868
2020-07-10 08:26:35 +02:00
Translation updater bot b22b02bd71 Localisation updates from https://translatewiki.net.
Change-Id: Ife17b98686017d224625cd7afa33a6c71125937c
2020-07-09 08:25:51 +02:00
Bartosz Dziewoński 39b6eb1256 Update VE core submodule to master (806716154)
New changes:
3375a5e83 GeneratedContentNode: Don't try to render if model is detached
c85a59d71 Clear surface.activeNode when table cell is torn down
71b9a08fe CompletionWidget: Use getCoveringRange
530d34e49 Fixes table edit buttons (<>) missing name and role

Local changes:
* Add localisation messages for table edit buttons

Bug: T256500
Bug: T256969
Bug: T257267
Change-Id: Ia75180e0b782b0dbe11e94689f8cee32418b4ae8
2020-07-08 21:03:34 +00:00
jenkins-bot 6ccaee2828 Merge "MWSignatureNode: Use template's rendering hash object" 2020-07-08 20:47:20 +00:00
jenkins-bot f197832398 Merge "MWSignatureNode: Don't inherit from TransclusionNode" 2020-07-08 20:44:16 +00:00
Ed Sanders 5a017602c6 MWSignatureNode: Use template's rendering hash object
Bug: T256969
Change-Id: Ie573c677d1bf7f4e0306bcfcb0052e2b64025e89
2020-07-08 22:18:35 +02:00
Ed Sanders a8753df147 MWSignatureNode: Don't inherit from TransclusionNode
We don't share much functionality, and we have to do a bunch
of hacks to disable functionality we don't want.

Change-Id: I9861123d8f1cbab1923f1aa5be713c2dadaed53d
2020-07-08 22:18:35 +02:00
jenkins-bot 51b8ff5a72 Merge "Remove warning shown when editing a translatable page source" 2020-07-08 20:18:19 +00:00
jenkins-bot f817ea3a0f Merge "Update VE core submodule to master (b1cc9bcff)" 2020-07-08 19:51:52 +00:00
jenkins-bot 0e67319854 Merge "ArticleTargetSaver: Use request action to fetch data from response" 2020-07-08 19:51:01 +00:00
jenkins-bot c7dedaa353 Merge "ve.ui.MWSignatureContextItem: Keep the $body element, just empty" 2020-07-08 18:34:34 +00:00
James D. Forrester 6c39b8db8f Update VE core submodule to master (b1cc9bcff)
New changes:
d2e6d8ec5 Localisation updates from https://translatewiki.net.
f3656e4b5 Localisation updates from https://translatewiki.net.
a9aaedd16 Localisation updates from https://translatewiki.net.
b1cc9bcff Fix typo: vender->vendor

Change-Id: I881ae462a46f50449fc9e4be7bc0e9eb50588632
2020-07-08 19:24:35 +01:00
jenkins-bot 657d46eace Merge "getPreferredEditor() shouldn't return VisualEditor if it's disabled by the user" 2020-07-08 11:13:16 +00:00
Translation updater bot 04827ba357 Localisation updates from https://translatewiki.net.
Change-Id: I8d15bb25b641fa171e32083611f2d0e830be0343
2020-07-08 09:11:20 +02:00
Bartosz Dziewoński b819b8a657 getPreferredEditor() shouldn't return VisualEditor if it's disabled by the user
Bug: T257234
Change-Id: I68002cc7bf6935bad705497df6531e3611bd2ca6
2020-07-07 21:58:12 +02:00
Bartosz Dziewoński 4ea0cf0cab MobileArticleTarget: Double-check that section is not 'undefined'
It's supposed to be a string or null. The parent class sets
`this.section = null` for us by default.

Bug: T257355
Change-Id: I375a3f6724235f22888bb7f0cb77a7081153768e
2020-07-07 20:50:59 +02:00