headers
Keir | 1 Dec 2007 14:31
Picon

Login errors

Hi, I was wondering if there was any way to change the login error message
when a user tries to log in with a correct username but incorrect password
to be the same as the error given when they try to log in with an incorrect
password?  I dont want a potential attacker to be able to know if a username
is valid or not.

Cheers

Keir
Permalink | Reply | 6 comments |
headers
Emufarmers Sangly | 1 Dec 2007 15:56
Picon

Re: Login errors

On Dec 1, 2007 8:31 AM, Keir <keirlawson@...> wrote:

> Hi, I was wondering if there was any way to change the login error message
> when a user tries to log in with a correct username but incorrect password
> to be the same as the error given when they try to log in with an
> incorrect
> password?  I dont want a potential attacker to be able to know if a
> username
> is valid or not.

As a matter of general security practice I would agree with you and suggest
that this be changed in the core MediaWiki code, but remember that MediaWiki
comes with a publicly-viewable user list, plus user pages that will reveal
whether or not a user exists.  Unless you've got your wiki on complete
lockdown, changing the failed login message would only give you a false
sense of security and annoy your users.

At any rate, take a look at MediaWiki:Nosuchuser, MediaWiki:Nosuchusershort,
MediaWiki:Wrongpassword, and MediaWiki:Wrongpasswordempty.

--

-- 
Arr, ye emus, http://emufarmers.com
Permalink | Reply | 5 comments |
headers
Boris Steipe | 1 Dec 2007 17:49
Picon
Picon
Favicon

Re: Login errors

You also need to change MediaWiki:Nouserspecified

However: I myself think this is a really bad idea. I remember more  
than once failing login on one of the several Wikis I have an account  
for, unsuccessfully cycling through my usual passwords until I  
finally *read* the error message and noticed I had used the wrong  
username. You will probably impact legitimate users more than  
dissuading attackers. Security through obscurity is not a sound plan.  
If you need additional security against cracking attacks, use a CAPTCHA.

YMMV,
Boris

On 1-Dec-07, at 9:56 AM, Emufarmers Sangly wrote:

> On Dec 1, 2007 8:31 AM, Keir <keirlawson@...> wrote:
>
>> Hi, I was wondering if there was any way to change the login error  
>> message
>> when a user tries to log in with a correct username but incorrect  
>> password
>> to be the same as the error given when they try to log in with an
>> incorrect
>> password?  I dont want a potential attacker to be able to know if a
>> username
>> is valid or not.
>
> As a matter of general security practice I would agree with you and  
> suggest
> that this be changed in the core MediaWiki code, but remember that
(Continue reading)

Permalink | Reply | 0 comments |
headers
Platonides | 1 Dec 2007 20:01
Picon

Re: Revision control of images via subversion?

Daniel Barrett wrote:
> Wait a minute... I appear to be mistaken.
> 
> Old images are indeed saved automatically... in /images/archive.  I
> never noticed this before. Has this been the case for a long time?  I
> don't remember it in Mediawiki 1.9.
> 
> DanB

It has been.
What has been done more recently is the support for deleted images 
storage (they were deleted forever) so now they can be undeleted. But 
it's disabled by default.
Permalink | Reply | 0 comments |
headers
Herta Van den Eynde | 1 Dec 2007 22:09
Picon

Re: table templates behaving differently in IE?

On 30/11/2007, Michael Daly <michael_daly@...> wrote:
> Herta Van den Eynde wrote:
>
> > Non-breaking spaces do the trick.  Thanks for the workaround.
>
> That's not really a work-around.  That's what IE expects to display
> tables properly going back at least 8 years.
>
> Mike

If my interpretation of Jim Hu's question ("[Mediawiki-l] IE7
extension textarea problem - just me? css?" dd. 30-Nov) is correct,
he's probably suffering the same problem.

If that is expected behaviour for IE, and given that the &nbs; does
not screw up the display of the other browsers, would it make sense
for MediaWiki to make non-breaking spaces the  default?  Or is he
right in that we can/should fix this ourselves via the css?

Kind regards,

Herta
Permalink | Reply | 2 comments |
headers
Steve VanSlyck | 1 Dec 2007 22:13
Favicon

Re: Login errors

Also check out /index.php/Special:Allmessages

Emufarmers Sangly wrote:
> On Dec 1, 2007 8:31 AM, Keir <keirlawson@...> wrote:
>
>   
>> Hi, I was wondering if there was any way to change the login error message
>> when a user tries to log in with a correct username but incorrect password
>> to be the same as the error given when they try to log in with an
>> incorrect
>> password?  I dont want a potential attacker to be able to know if a
>> username
>> is valid or not.
>>     
>
> As a matter of general security practice I would agree with you and suggest
> that this be changed in the core MediaWiki code, but remember that MediaWiki
> comes with a publicly-viewable user list, plus user pages that will reveal
> whether or not a user exists.  Unless you've got your wiki on complete
> lockdown, changing the failed login message would only give you a false
> sense of security and annoy your users.
>
> At any rate, take a look at MediaWiki:Nosuchuser, MediaWiki:Nosuchusershort,
> MediaWiki:Wrongpassword, and MediaWiki:Wrongpasswordempty.
>
>
>
Permalink | Reply | 3 comments |
headers
Josh Joy | 1 Dec 2007 22:43
Picon

SMTP configuration localhost

Hi,

I have recently installed mediawiki, postfix with sasl and tls, and php pear
I configured my postfix server as a relay smtp, and tested it by 
invoking sendmail directly and was able to receive an email.
I then ran a test using php with a php page doing a submit and sending 
an email, this also worked.
For configuring mediawiki, for some reason I'm receiving errors. Here is 
the configuration I used in LocalSettings.php
## Begin Custom Configuration
$wgSMTP = array (
 "host" => 'localhost',
 "IDHost" => 'localhost',
 "port" => "25",
 "auth" => false
);

$wgEmailAuthentication = true;
$wgEnableEmail = true;
#$wgEnableUserEmail = true;

# Logging
$wgDebugLogFile = "/tmp/wiki.log";

The error message I receive when I create a new user on mediaiwiki and 
it tries to send a confirmation email is

    Login error:

Error sending mail: 1
(Continue reading)

Permalink | Reply | 0 comments |
headers
Thomas Dalton | 1 Dec 2007 23:53
Picon

Re: table templates behaving differently in IE?

> If my interpretation of Jim Hu's question ("[Mediawiki-l] IE7
> extension textarea problem - just me? css?" dd. 30-Nov) is correct,
> he's probably suffering the same problem.
>
> If that is expected behaviour for IE, and given that the &nbs; does
> not screw up the display of the other browsers, would it make sense
> for MediaWiki to make non-breaking spaces the  default?  Or is he
> right in that we can/should fix this ourselves via the css?

The default what? The default for a parameter if none is specified is
a literal {{{1}}} or similar (which will display in any browser, but
isn't really desirable). The default of a space was entered into the
wikitext manually, just as the default of a non-breaking space was.
Permalink | Reply | 0 comments |
headers
tunnel | 2 Dec 2007 17:25
Picon

script error "wgbreakframes is not defined"


I keep getting this js error, and can't figure out where to fix it.  The var
seems to be defined in skin.php, but is not getting to the page source. I
read somewhere this is a bug, but what should my workaround be? The JS
should ignore an undefined variable, but doesn't. 
As a workaround, i am defining the far in the top of wikibits.js, but then I
get another 
undefined error for another var "wgContentLanguage."

What am I missing here? How do I remove these errors without just resetting
the VARs  = 0, and thus, overriding things that might be set by
localsettings.php, and thus be important?
--

-- 
View this message in context: http://www.nabble.com/script-error-%22wgbreakframes-is-not-defined%22-tf4932202.html#a14116974
Sent from the WikiMedia General mailing list archive at Nabble.com.
Permalink | Reply | 0 comments |
headers
Nelson A Li | 3 Dec 2007 02:10
Favicon

Is it SMW?

Hello,

Anybody has an idea about this error?  Is it my code or SMW error?

Fatal error: Call to undefined function mb_strpos() in
/var/www/wiki/testwiki/extensions/SemanticMediaWiki/includes/SMW_InlineQueries.php
 on line 628

Thank you for any quick help.

Nelson

Computer Sciences Corporation
Registered Office: 2100 East Grand Avenue, El Segundo California 90245, USA
Registered in USA No: C-489-59

----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

This is a PRIVATE message. If you are not the intended recipient, please
delete without copying and kindly advise us by e-mail of the mistake in
delivery.
NOTE: Regardless of content, this e-mail shall not operate to bind CSC to
any order or other contract unless pursuant to explicit written agreement
or government initiative expressly permitting the use of e-mail for such
purpose.
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Permalink | Reply | 2 comments |

Gmane