Page MenuHomePhorge
Feed All Stories

May 1 2025

aklapper committed rPde2b53638299: Aphlict: Bump NodeJS package ws from 7.5.0 to 7.5.10.
May 1 2025, 10:38
aklapper added a comment to D25967: Aphlict: Bump NodeJS package ws from 7.5.0 to 7.5.10.

@aklapper want to land this?

May 1 2025, 10:38
avivey created Blog Post: DoS attack against Aphlict.
May 1 2025, 08:04 · Aphlict
avivey triaged T16037: Bump ws npm package for Aphlict as High priority.

Possible ways to reduce risk for future issues:

  • add a Setup Check that runs npm audit
  • remove node, use php-based websocket implementation
May 1 2025, 07:49 · Security, Aphlict
avivey added a comment to D25967: Aphlict: Bump NodeJS package ws from 7.5.0 to 7.5.10.

@aklapper want to land this?
I figure users need to just run npm audit fix to be safe, and then fix the mess it did on the git diff.

May 1 2025, 07:20
avivey edited projects for Security Announcements, added: Security; removed phorge.it install.
May 1 2025, 07:16 · Security

Apr 30 2025

aklapper added a comment to D25676: DifferentialRevisionQuery: avoid nonsense query comparing r.authorPHID with project PHIDs.

Ah...I may take another look (jmeador: Feel of course also very free to commandeer this back to you)

Apr 30 2025, 16:42 · Differential
valerio.bozzolan added inline comments to D25676: DifferentialRevisionQuery: avoid nonsense query comparing r.authorPHID with project PHIDs.
Apr 30 2025, 16:35 · Differential
aklapper retitled D25676: DifferentialRevisionQuery: avoid nonsense query comparing r.authorPHID with project PHIDs from Fix responsible authors in DifferentialRevisionQuery to Make responsible authors in DifferentialRevisionQuery only include users.
Apr 30 2025, 16:32 · Differential
aklapper added a comment to D25676: DifferentialRevisionQuery: avoid nonsense query comparing r.authorPHID with project PHIDs.

Ah sorry for maybe stepping on toes, and welcome back! :)

Apr 30 2025, 16:31 · Differential
jmeador accepted D25676: DifferentialRevisionQuery: avoid nonsense query comparing r.authorPHID with project PHIDs.
Apr 30 2025, 16:21 · Differential
aklapper updated the diff for D25676: DifferentialRevisionQuery: avoid nonsense query comparing r.authorPHID with project PHIDs.

Seems @jmeador is AWOL thus updating per last comment

Apr 30 2025, 16:01 · Differential
aklapper commandeered D25676: DifferentialRevisionQuery: avoid nonsense query comparing r.authorPHID with project PHIDs.

seems @jmeador is AWOL thus boldly commandeering

Apr 30 2025, 15:59 · Differential
aklapper renamed T16044: Diviner: All Method and File query results have invalid 404 URIs from Diviner: All Method query results have invalid 404 URIs to Diviner: All Method and File query results have invalid 404 URIs.
Apr 30 2025, 15:31
aklapper added a comment to T16044: Diviner: All Method and File query results have invalid 404 URIs.

Digging a bit further, rP600a3e3b7c2de5d93644e0410cd354ea6752949d implies that methods and files should not be indexed at all and not show up in the results. See also T16045#21931.

Apr 30 2025, 15:30
aklapper added a comment to T16045: All @{method:...} links in Diviner docs result in a "Documentation Not Found" error.

A quick fix would be removing the single line $query->withIsDocumentable(true); in https://we.phorge.it/source/phorge/browse/master/src/applications/diviner/controller/DivinerFindController.php;85f51c54303fe50ebc09ee0b652033a8a9f29ab1$45
as that'll allow results for Methods.

Apr 30 2025, 14:58
aklapper edited the content of Next Up.
Apr 30 2025, 14:39
aklapper renamed T16044: Diviner: All Method and File query results have invalid 404 URIs from Diviner: All Method query results have invalid URIs to Diviner: All Method query results have invalid 404 URIs.
Apr 30 2025, 14:33
aklapper created T16045: All @{method:...} links in Diviner docs result in a "Documentation Not Found" error.
Apr 30 2025, 14:33
valerio.bozzolan awarded T16044: Diviner: All Method and File query results have invalid 404 URIs a Yellow Medal token.
Apr 30 2025, 14:28
aklapper added a revision to T16044: Diviner: All Method and File query results have invalid 404 URIs: D25812: Fix method search result URIs in Diviner.
Apr 30 2025, 14:27
aklapper updated the summary of D25812: Fix method search result URIs in Diviner.
Apr 30 2025, 14:27 · Diviner
aklapper created T16044: Diviner: All Method and File query results have invalid 404 URIs.
Apr 30 2025, 14:27
aklapper updated the diff for D25967: Aphlict: Bump NodeJS package ws from 7.5.0 to 7.5.10.

also manually bump version in package.json; then running npm install results in another bump in package-lock.json

Apr 30 2025, 10:50
aklapper added a comment to D25967: Aphlict: Bump NodeJS package ws from 7.5.0 to 7.5.10.

Both are good questions. I only put here the diff which npm created. First question: Very likely Yes.
(Note that I have no knowledge in this area and don't even know why both package-lock.json and package.json are needed.)

Apr 30 2025, 10:49
avivey added a comment to D25967: Aphlict: Bump NodeJS package ws from 7.5.0 to 7.5.10.
  1. Can we specify the .10 in packages.json itself?
  2. Do installs need upgrade instructions to complete the upgrade?
Apr 30 2025, 09:01
valerio.bozzolan moved T16043: Create Unit Tests to cover Project Destroy from Backlog to Code Sprint Candidate on the User-valerio.bozzolan board.
Apr 30 2025, 08:53 · Wikimedia Hackathon 2025, User-valerio.bozzolan, Feature Requests, Projects
valerio.bozzolan added a project to T16043: Create Unit Tests to cover Project Destroy: User-valerio.bozzolan.
Apr 30 2025, 08:53 · Wikimedia Hackathon 2025, User-valerio.bozzolan, Feature Requests, Projects
valerio.bozzolan created T16043: Create Unit Tests to cover Project Destroy.
Apr 30 2025, 08:52 · Wikimedia Hackathon 2025, User-valerio.bozzolan, Feature Requests, Projects
avivey added a comment to T15671: Allow to import Picture from Gravatar.

As a general rule, I prefer the have the abstractions as much as possible, to allow extensions to do things.
In this case, an abstraction would also make this feature easier to enable/disable, which I think is desired.

Apr 30 2025, 08:50 · User-valerio.bozzolan, People
aklapper closed D25979: Fix invalid return values for void.
Apr 30 2025, 06:50
aklapper committed rPc51002398d63: Fix invalid return values for void.
Apr 30 2025, 06:50
aklapper closed T15959: Modified files not counted in total when attaching files as Resolved by committing rP44c7bfb42ddf: Include number of modified files in total of attached files.
Apr 30 2025, 06:46 · Good Starter Task, Bug Reports, Files
aklapper closed D25892: Include number of modified files in total of attached files.
Apr 30 2025, 06:46
aklapper committed rP44c7bfb42ddf: Include number of modified files in total of attached files.
Apr 30 2025, 06:46
aklapper closed D25981: PHPDoc: Correct syntax of variadic function params.
Apr 30 2025, 06:45
aklapper committed rARC80906355979a: PHPDoc: Correct syntax of variadic function params.
Apr 30 2025, 06:45
aklapper closed D25980: PHPDoc: Correct syntax of variadic function params.
Apr 30 2025, 06:44
aklapper committed rP3f49ac5b484c: PHPDoc: Correct syntax of variadic function params.
Apr 30 2025, 06:44
aklapper committed rPff6a998f2320: Strip surrounding whitespace from project and task titles.
Apr 30 2025, 06:36
aklapper closed D25835: Strip surrounding whitespace from project and task titles.
Apr 30 2025, 06:36 · Projects, Maniphest
connorgurney added a comment to T15671: Allow to import Picture from Gravatar.

Chris has asked me to pick this up as he'd like to see this implemented.

Apr 30 2025, 00:32 · User-valerio.bozzolan, People

Apr 29 2025

valerio.bozzolan accepted D25980: PHPDoc: Correct syntax of variadic function params.

yesyes

Apr 29 2025, 21:29
valerio.bozzolan accepted D25972: Remove non-existing min-device-pixel-ratio CSS syntax.

If the CSS rule should not change anything, why does it change something?

Apr 29 2025, 21:28
valerio.bozzolan accepted D25892: Include number of modified files in total of attached files.

Yuuum. As I mentioned downstream ( https://phabricator.wikimedia.org/T380361#10778444 ) I think probably, fortunately, nobody noticed this in a real world, since it's complicated to cause this condition using the API, and probably impossible from the web interface, but this still seems somehow a reasonable workflow and not dead code and the change makes sense. Thaaaanks

Apr 29 2025, 21:22
valerio.bozzolan accepted D25979: Fix invalid return values for void.

lgtm

Apr 29 2025, 21:12
valerio.bozzolan added a project to T16037: Bump ws npm package for Aphlict: Security.
Apr 29 2025, 21:11 · Security, Aphlict
aklapper edited the content of Next Up.
Apr 29 2025, 20:11
aklapper updated the diff for D25979: Fix invalid return values for void.

Remove "return;" lines

Apr 29 2025, 20:04
aklapper closed D25982: Remove doc references to LiskDAO::loadRelatives().
Apr 29 2025, 20:00
aklapper committed rP1d27fde0186b: Remove doc references to LiskDAO::loadRelatives().
Apr 29 2025, 19:59
valerio.bozzolan accepted D25982: Remove doc references to LiskDAO::loadRelatives().

sgtm

Apr 29 2025, 19:43
mainframe98 accepted D25982: Remove doc references to LiskDAO::loadRelatives().
Apr 29 2025, 19:23
aklapper requested review of D25982: Remove doc references to LiskDAO::loadRelatives().
Apr 29 2025, 18:32
valerio.bozzolan requested changes to D25966: Add a Copy-to-Clipboard Button to code blocks.

Kindly flagging as "little fixes needed on unit tests"

Apr 29 2025, 14:42
valerio.bozzolan added inline comments to D25979: Fix invalid return values for void.
Apr 29 2025, 14:38
valerio.bozzolan accepted D25835: Strip surrounding whitespace from project and task titles.

lgtm

Apr 29 2025, 14:33 · Projects, Maniphest
aklapper updated the diff for D25835: Strip surrounding whitespace from project and task titles.

gotta set it

Apr 29 2025, 13:13 · Projects, Maniphest
aklapper updated the diff for D25835: Strip surrounding whitespace from project and task titles.

like this I guess

Apr 29 2025, 13:01 · Projects, Maniphest
valerio.bozzolan accepted D25981: PHPDoc: Correct syntax of variadic function params.

yesyes

Apr 29 2025, 11:53
aklapper retitled D25980: PHPDoc: Correct syntax of variadic function params from PHPDoc: Correct syntax of variadic functions' params
Apr 29 2025, 11:29
aklapper retitled D25981: PHPDoc: Correct syntax of variadic function params from PHPDoc: Correct syntax of variadic functions' params
Apr 29 2025, 11:29
aklapper requested review of D25981: PHPDoc: Correct syntax of variadic function params.
Apr 29 2025, 11:28
aklapper requested review of D25980: PHPDoc: Correct syntax of variadic function params.
Apr 29 2025, 11:27
aklapper requested review of D25979: Fix invalid return values for void.
Apr 29 2025, 11:21
chris18890 assigned T15671: Allow to import Picture from Gravatar to connorgurney.
Apr 29 2025, 02:39 · User-valerio.bozzolan, People
chris18890 awarded T15671: Allow to import Picture from Gravatar a Like token.
Apr 29 2025, 02:38 · User-valerio.bozzolan, People
connorgurney added a member for Trusted Contributors: chris18890.
Apr 29 2025, 01:57

Apr 28 2025

aklapper updated the diff for D25972: Remove non-existing min-device-pixel-ratio CSS syntax.

git rebase master

Apr 28 2025, 20:58
aklapper updated the summary of D25978: Fix wrong argument count in numerous calls' signatures.
Apr 28 2025, 20:57
aklapper closed D25973: Correct invalid min-height CSS value.
Apr 28 2025, 20:54
aklapper committed rPdc32286e4c52: Correct invalid min-height CSS value.
Apr 28 2025, 20:54
aklapper edited the content of Next Up.
Apr 28 2025, 20:54
aklapper closed D25917: Make an IE CSS hack pass W3C CSS validator.
Apr 28 2025, 20:52
aklapper committed rPbda8034982a2: Make an IE CSS hack pass W3C CSS validator.
Apr 28 2025, 20:52
aklapper updated the diff for D25917: Make an IE CSS hack pass W3C CSS validator.

git rebase master

Apr 28 2025, 20:51
aklapper closed D25977: PHPDoc: Correct some param types.
Apr 28 2025, 20:50
aklapper committed rPa52702118e59: PHPDoc: Correct some param types.
Apr 28 2025, 20:50
valerio.bozzolan requested changes to D25812: Fix method search result URIs in Diviner.

I've added 2 unuseful tips but this seems not ready for production. Flag as "solution seems affected by N+1 query problem". Maybe useful to open a cute task and do more triage.

Apr 28 2025, 10:30 · Diviner
valerio.bozzolan accepted D25973: Correct invalid min-height CSS value.

sgtm

Apr 28 2025, 10:09
valerio.bozzolan updated the test plan for D25973: Correct invalid min-height CSS value.
Apr 28 2025, 10:08
valerio.bozzolan accepted D25917: Make an IE CSS hack pass W3C CSS validator.

I've tested in my console:

Apr 28 2025, 08:13
valerio.bozzolan accepted D25967: Aphlict: Bump NodeJS package ws from 7.5.0 to 7.5.10.

notmyfault

Apr 28 2025, 08:03
valerio.bozzolan updated the summary of D25967: Aphlict: Bump NodeJS package ws from 7.5.0 to 7.5.10.
Apr 28 2025, 08:02
valerio.bozzolan added a comment to T16037: Bump ws npm package for Aphlict.

Relevant report:

Apr 28 2025, 08:01 · Security, Aphlict
valerio.bozzolan updated the summary of D25967: Aphlict: Bump NodeJS package ws from 7.5.0 to 7.5.10.
Apr 28 2025, 07:59
valerio.bozzolan requested changes to D25864: Paste previous milestone's description text when creating a new milestone.

Super nice prototype but flagging as "more digging probably needed for production"

Apr 28 2025, 07:13
valerio.bozzolan accepted D25977: PHPDoc: Correct some param types.

yesyes

Apr 28 2025, 06:57
aklapper committed rP3cf47d2cb6b1: Remove an unneeded condition in PHUITimelineEventView.php.
Apr 28 2025, 06:31
aklapper closed D25976: Remove an unneeded condition in PHUITimelineEventView.php.
Apr 28 2025, 06:31
valerio.bozzolan accepted D25976: Remove an unneeded condition in PHUITimelineEventView.php.

lgtm

Apr 28 2025, 05:42

Apr 27 2025

aklapper updated the diff for D25976: Remove an unneeded condition in PHUITimelineEventView.php.

oh true that! sigh I should look around a bit more

Apr 27 2025, 23:33
valerio.bozzolan accepted D25976: Remove an unneeded condition in PHUITimelineEventView.php.
Apr 27 2025, 19:10
aklapper added a comment to T16035: Update embedded copy of Font Awesome 4.7.0.

FYI I pasted the list of the 341 different FA icons used by Phorge as of 2025-04-24 (excluding the list of all icons in PHUIIconView::getIcons()) in P50

Apr 27 2025, 17:16
aklapper created P50 FontAwesome icons used on 2025-04-24, excluding the list of all items in PHUIIconView::getIcons().
Apr 27 2025, 17:15
aklapper closed T15891: Ineffective instanceof check in PhabricatorMySQLSetupCheck:shouldUseMySQLSearchEngine() as Resolved by committing rP35e233345cd6: Fix check in PhabricatorMySQLSetupCheck:shouldUseMySQLSearchEngine().
Apr 27 2025, 17:11
aklapper closed D25975: Fix check in PhabricatorMySQLSetupCheck:shouldUseMySQLSearchEngine().
Apr 27 2025, 17:11
aklapper committed rP35e233345cd6: Fix check in PhabricatorMySQLSetupCheck:shouldUseMySQLSearchEngine().
Apr 27 2025, 17:11
aklapper requested review of D25978: Fix wrong argument count in numerous calls' signatures.
Apr 27 2025, 16:17
aklapper added a comment to D25900: Remove the onboard "mailKey" from Paste.

Argh, PEBKAC, right. Thanks!

[acko@fedora phorge (master *$|u=)]$ ./bin/storage upgrade
Target                          Error
phabricator_paste.paste.mailKey Surplus
Apr 27 2025, 15:46