Shapeoko mediawiki version is outdated and exploitable :(

Have a suggestion for the website or forum? Post it here.
Post Reply
AnonymousPerson
Posts: 758
Joined: Sun Apr 26, 2015 1:16 pm
Location: 3753 Cruithne

Shapeoko mediawiki version is outdated and exploitable :(

Post by AnonymousPerson » Sat Aug 15, 2015 5:20 pm

Does someone with server access for the Mediawiki server have time to update it?

It's currently running version 1.18.0, which is known to be remotely exploitable. :(
Some of the installed extensions are also really outdated and known to be exploitable too. eg:
Upgrading can be scripted to be near-automatic, if that helps, which really reduces the time and effort needed.

We used to run MediaWiki in a previous Community I was involved with, and upgrading (generally a monthly thing) wasn't a huge PITA.
It's mostly a case of untarring the latest release into the same webroot as the existing one, moving aside the files already there (excepting themes, uploads, and extensions).

If someone needs a hand with this stuff, I'm a decent *nix admin who can assist. ;)
Shapeoko 3 #516

twforeman
Posts: 1347
Joined: Tue Jan 29, 2013 4:51 pm
Location: Minneapolis, MN
Contact:

Re: Shapeoko mediawiki version is outdated and exploitable :

Post by twforeman » Fri Aug 21, 2015 6:31 pm

Thanks for the heads-up. I'll take a look at it soon.
Ender 3 3D Printer
ShapeOko v3 serial #0004 - upgrade thread
All of my ShapeOko related blog posts

twforeman
Posts: 1347
Joined: Tue Jan 29, 2013 4:51 pm
Location: Minneapolis, MN
Contact:

Re: Shapeoko mediawiki version is outdated and exploitable :

Post by twforeman » Tue Jan 19, 2016 2:52 am

Testing subscription. Does this send an email?
Ender 3 3D Printer
ShapeOko v3 serial #0004 - upgrade thread
All of my ShapeOko related blog posts

AnonymousPerson
Posts: 758
Joined: Sun Apr 26, 2015 1:16 pm
Location: 3753 Cruithne

Re: Shapeoko mediawiki version is outdated and exploitable :

Post by AnonymousPerson » Tue Jan 19, 2016 3:06 am

twforeman wrote:Testing subscription. Does this send an email?
Yep, got that one. :)
Shapeoko 3 #516

twforeman
Posts: 1347
Joined: Tue Jan 29, 2013 4:51 pm
Location: Minneapolis, MN
Contact:

Re: Shapeoko mediawiki version is outdated and exploitable :

Post by twforeman » Tue Jan 19, 2016 3:13 am

And I got one for your reply. So I'm not sure why it sometimes works and sometimes doesn't.

The fact that we both got a notification seems to indicate that it is working.

FYI, the PHPBB guys say that this is how it's supposed to work:
are you expecting a new email for every reply to the topic? that is not how it works. you only get one email no matter how many replies were made to the topic since you were there last.

once you visit the topic you will get a new email when there are any new replies to the topic.
Ender 3 3D Printer
ShapeOko v3 serial #0004 - upgrade thread
All of my ShapeOko related blog posts

AnonymousPerson
Posts: 758
Joined: Sun Apr 26, 2015 1:16 pm
Location: 3753 Cruithne

Re: Shapeoko mediawiki version is outdated and exploitable :

Post by AnonymousPerson » Tue Jan 19, 2016 3:15 am

While that makes sense, there are definitely times when completely new topic posts in a subscribed forum aren't emailed out.

And yeah, I don't know why either. Email systems (and printers) are two main areas of *nix which I avoid in depth knowledge of. So far anyway. :D
Shapeoko 3 #516

twforeman
Posts: 1347
Joined: Tue Jan 29, 2013 4:51 pm
Location: Minneapolis, MN
Contact:

Re: Shapeoko mediawiki version is outdated and exploitable :

Post by twforeman » Tue Jan 19, 2016 3:16 am

As for the Wiki upgrade... I'm the sysadmin. The forum and wiki run on my hardware as a donation to the Shapeoko project.

Upgrades come when I can fit them in around my regular schedule and work and Shapeoko usage. :)

I don't mind being reminded that the upgrades are needed, but they may not be very timely.

Both the wiki and the forum are in need of upgrades. I'll try and get on it soon.
Ender 3 3D Printer
ShapeOko v3 serial #0004 - upgrade thread
All of my ShapeOko related blog posts

twforeman
Posts: 1347
Joined: Tue Jan 29, 2013 4:51 pm
Location: Minneapolis, MN
Contact:

Re: Shapeoko mediawiki version is outdated and exploitable :

Post by twforeman » Wed Jan 20, 2016 4:49 pm

I upgraded the wiki to 1.26.2 (the latest) this morning.
Ender 3 3D Printer
ShapeOko v3 serial #0004 - upgrade thread
All of my ShapeOko related blog posts

Post Reply