This partially would fix bug 8857 for wikinews

Bryan.TongMinh wrote:

It looks like this extension has some problems where one could do some sql injections:

			$category = ucfirst(preg_replace($removeCatPrefixes, '', trim($wgRequest->getVal('cat' . $i))));
			if ($category != null && $category != '') {
				$inCategoriesStr .= "'" . str_replace("'", "\\'", str_replace(' ', '_', $category)) . "',";

What if $wgRequest->getVal('cat', $i) is something containing \' ? The extension should use proper database functions like tableName() and addQuotes() anyway.

I also thing the sysadmins are not gonna like the unoptimized queries this extension uses.

codemonk wrote:

There is new version 1.5, accomodated especially for Wikinews installation. That issue is fixed there among others.

wikinewsie.anonymous101 wrote:

The suggestion for the options is:

var $channelTitle = 'Latest Wikinews Headlines';
var $channelDescription = 'Wikinews, the free news site you can write';
var $channelSiteLink = 'http://en.wikinews.org/wiki/';
var $channelLanguage = 'en';
var $channelCopyright = 'Copyright © Wikinews contributors. Released under the creative commons attribution 2.5 license. See http://creativecommons.org/licenses/by/2.5/ for more information';
var $channelLogoImage = 'http://upload.wikimedia.org/wikipedia/commons/thumb/8/8a/Wikinews-logo.png/88px-Wikinews-logo.png';
var $channelUpdateInterval = '30';
var $channelNewsItems = '15';
var $channelEditorName = 'Wikinews';
var $channelEditorAddress = 'wikinews-l@lists.wikimedia.org';
var $channelWebMasterName = 'Wikinews';
var $channelWebMasterAddress = 'wikinews-l@lists.wikimedia.org';
var $newsWikiCategory = 'Published';
var $newsWikiArticlePrefix = ;
var $convertWikiMarkup = true;
var $authorizedEditors = array(); // everyone

codemonk wrote:

In version 1.5 most of these settings are already built-in, only categories are left to be set outside in LocalSettings.php file:

$wgNewsChannelCategory = 'Published';
$wgNewsChannelExcludeCategory = 'Disputed';

Sent some review notes to author...

codemonk wrote:

Version 1.6 released. As Brion Vibber suggested, all configuration settings are now specified explicitly. So the following options need to be set in LocalSettings.php file:

$wgNewsChannelTitle = 'Latest Wikinews Headlines';
$wgNewsChannelDescription = 'Wikinews, the free news site you can write.';
$wgNewsChannelCopyright = 'Copyright © Wikinews contributors. Released under the
creative commons attribution 2.5 license. See
http://creativecommons.org/licenses/by/2.5/ for more information.';
$wgNewsChannelLogoImage =
'http://upload.wikimedia.org/wikipedia/commons/thumb/8/8a/Wikinews-logo.png/88px-Wikinews-logo.png';
$wgNewsChannelUpdateInterval = '30';
$wgNewsChannelDefaultItems = 10;
$wgNewsChannelMaxItems = 30;
$wgNewsChannelCategory = 'Published';
$wgNewsChannelExcludeCategory = 'Disputed';

Keywords: -/-shell, +need-review

Also: extension needs to end up in the MediaWiki Subversion repo before it could ever be installed.

I have made some updates in r39151. Default settings are not fault free.

On Special:NewsChannel:

• Notice: Undefined variable: msgComment in phase3\extensions\NewsChannel\NewsChannel_body.php on line 384

Requesting the standard feed (nothing set) I get a file download containing the below notices:

• Strict Standards: Non-static method FeedItem::xmlEncode() should not be called statically, assuming $this from incompatible context in phase3\extensions\NewsChannel\NewsChannel_body.php on line 258
• Strict Standards: Non-static method FeedItem::xmlEncode() should not be called statically, assuming $this from incompatible context in phase3\extensions\NewsChannel\NewsChannel_body.php on line 259
• Strict Standards: Non-static method FeedItem::xmlEncode() should not be called statically, assuming $this from incompatible context in phase3\extensions\NewsChannel\NewsChannel_body.php on line 260
• Strict Standards: Non-static method FeedItem::xmlEncode() should not be called statically, assuming $this from incompatible context in phase3\extensions\NewsChannel\NewsChannel_body.php on line 261
• Strict Standards: Non-static method FeedItem::xmlEncode() should not be called statically, assuming $this from incompatible context in phase3\extensions\NewsChannel\NewsChannel_body.php on line 262
• Strict Standards: Non-static method FeedItem::xmlEncode() should not be called statically, assuming $this from incompatible context in phase3\extensions\NewsChannel\NewsChannel_body.php on line 264
• Strict Standards: Non-static method FeedItem::xmlEncode() should not be called statically, assuming $this from incompatible context in phase3\extensions\NewsChannel\NewsChannel_body.php on line 265
• Strict Standards: Non-static method FeedItem::xmlEncode() should not be called statically, assuming $this from incompatible context in phase3\extensions\NewsChannel\NewsChannel_body.php on line 266
• Strict Standards: Non-static method FeedItem::xmlEncode() should not be called statically, assuming $this from incompatible context in phase3\extensions\NewsChannel\NewsChannel_body.php on line 271
• Strict Standards: Non-static method FeedItem::xmlEncode() should not be called statically, assuming $this from incompatible context in phase3\extensions\NewsChannel\NewsChannel_body.php on line 272

The above should probably be fixed as soon as possible.

codemonk wrote:

Please, remove that line 384 "$wgOut->addWikiText( $msgComment );" from \extensions\NewsChannel\NewsChannel_body.php in SVN. That line must not be there.

I reported the problem with FeedItem::xmlEncode() function in bug 15128, and it was fixed on-the-fly in r39198, so the compiler probably won't yell any more.

brian.mcneil wrote:

I believe this would be solved with https://bugzilla.wikimedia.org/show_bug.cgi?id=20818

wikinewsie.anonymous101: Is this still requested?

Note google news sitemap provides the requested functionality. I think this can be closed.

(In reply to comment #13)

Note google news sitemap provides the requested functionality. I think this
can
be closed.

Resolving WORKSFORME then.