Page MenuHomeMiraheze
Create Task
Maniphest T4105

A word cloud extension request
Closed, ResolvedPublic
Actions

Description

We would like to have this extension in our wiki, or a similar one that does the job: https://www.mediawiki.org/wiki/Extension:WikiCategoryTagCloud

Thanks!

Wiki URLhttps://cyberlaw.miraheze.org/wiki/Main_Page

Event Timeline

Uncleistvan1BBB created this task.Feb 13 2019, 11:09
Herald added subscribers: revi, Southparkfan, CnocBride and 4 others. · View Herald TranscriptFeb 13 2019, 11:09
Reception123 edited projects, added Extension-Review, Extensions; removed Configuration.Feb 13 2019, 11:39
Reception123 added subscribers: John, labster, Samwilson.

Will need to be security reviewed.

Reception123 added a comment.Feb 13 2019, 12:09

Note from @Samwilson:

"There looks to be an SQL injection bug here:

https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/extensions/WikiCategoryTagCloud/+/master/WikiCategoryTagCloud.class.php#116"

Void added a comment.Feb 13 2019, 14:37

Isn't that resolved by using htmlspecialchars on line 164, as that is what defines $minCountInput?

Samwilson added a comment.Feb 14 2019, 06:46

@Void no you could still do things like this:

<tagcloud>
min_count = foo
</tagcloud>

to get a database error (or worse, probably).

I've made a patch for this if anyone wants to review it: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/WikiCategoryTagCloud/+/490511

Samwilson added a comment.Feb 14 2019, 06:47

(Thanks to Reception123 for relaying my message earlier; I was locked out of Phabricator here.)

Paladox claimed this task.May 9 2019, 22:23
Paladox removed a project: Extension-Review.
Paladox moved this task from Backlog to Reviewed, Approved on the Extensions board.
Paladox closed this task as Resolved.May 9 2019, 22:37

You can now enable the extension your self through Special:ManageWikiExtensions!