Version in base suite: 1.31.6-1~deb10u1 Base version: mediawiki_1.31.6-1~deb10u1 Target version: mediawiki_1.31.7-1~deb10u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/m/mediawiki/mediawiki_1.31.6-1~deb10u1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/m/mediawiki/mediawiki_1.31.7-1~deb10u1.dsc RELEASE-NOTES-1.31 | 16 + debian/changelog | 9 + extensions/OATHAuth/includes/special/SpecialOATHDisable.php | 8 extensions/OATHAuth/includes/special/SpecialOATHEnable.php | 8 includes/DefaultSettings.php | 3 includes/Defines.php | 9 + includes/MediaWikiVersionFetcher.php | 8 includes/PHPVersionCheck.php | 2 includes/libs/rdbms/database/DatabaseDomain.php | 53 ++++++ includes/libs/rdbms/loadbalancer/LoadBalancer.php | 8 includes/user/UserGroupMembership.php | 26 ++- maintenance/checkComposerLockUpToDate.php | 4 maintenance/recountCategories.php | 2 maintenance/view.php | 4 resources/src/jquery/jquery.makeCollapsible.js | 1 tests/phpunit/includes/MediaWikiVersionFetcherTest.php | 2 tests/phpunit/includes/libs/rdbms/database/DatabaseDomainTest.php | 83 ++++++++++ tests/selenium/specs/page.js | 15 + tests/selenium/specs/user.js | 10 - 19 files changed, 240 insertions(+), 31 deletions(-) diff -Nru mediawiki-1.31.6/RELEASE-NOTES-1.31 mediawiki-1.31.7/RELEASE-NOTES-1.31 --- mediawiki-1.31.6/RELEASE-NOTES-1.31 2019-12-19 13:40:52.000000000 +0000 +++ mediawiki-1.31.7/RELEASE-NOTES-1.31 2020-03-26 17:18:20.000000000 +0000 @@ -1,3 +1,19 @@ +== MediaWiki 1.31.7 == + +This is a security and maintenance release of the MediaWiki 1.31 branch. + +=== Changes since MediaWiki 1.31.6 === +* (T193565, T234022) Re-add DB domain sanity checks to LoadBalancer. +* Use proper SemVer comparison in CheckComposerLockUpToDate. +* (T212738) Add the MW_VERSION constant, global $wgVersion is soft deprecated. +* Update comment about PHP versions supported by The PHP Group. +* (T247215) Fix output of RecountCategories::doWork(). +* Add check for page existence to view.php maintenance script. +* (T247580) Disable some broken Selenium tests. +* (T236509) SECURITY: Fix HTML escaping in UserGroupMembership::getLink(). +* (T246602) SECURITY: jquery.makeCollapsible allows applying event handler to any + CSS selector. + == MediaWiki 1.31.6 == This is a security and maintenance release of the MediaWiki 1.31 branch. diff -Nru mediawiki-1.31.6/debian/changelog mediawiki-1.31.7/debian/changelog --- mediawiki-1.31.6/debian/changelog 2019-12-19 21:03:58.000000000 +0000 +++ mediawiki-1.31.7/debian/changelog 2020-03-26 21:59:51.000000000 +0000 @@ -1,3 +1,12 @@ +mediawiki (1:1.31.7-1~deb10u1) buster-security; urgency=medium + + * New upstream version 1.31.7, fixing CVE-2020-10960. + CVE-2020-10960 does not affect this version of MediaWiki. + * A hardening fix was included for the OATHAuth extension to + limit access of user-controlled JavaScript. + + -- Kunal Mehta Thu, 26 Mar 2020 14:59:51 -0700 + mediawiki (1:1.31.6-1~deb10u1) buster-security; urgency=medium * New upstream version 1.31.6 (security release), fixing diff -Nru mediawiki-1.31.6/extensions/OATHAuth/includes/special/SpecialOATHDisable.php mediawiki-1.31.7/extensions/OATHAuth/includes/special/SpecialOATHDisable.php --- mediawiki-1.31.6/extensions/OATHAuth/includes/special/SpecialOATHDisable.php 2019-12-19 13:40:54.000000000 +0000 +++ mediawiki-1.31.7/extensions/OATHAuth/includes/special/SpecialOATHDisable.php 2020-03-26 17:18:26.000000000 +0000 @@ -83,6 +83,14 @@ } /** + * @param string $par + */ + public function execute( $par ) { + $this->getOutput()->disallowUserJs(); + parent::execute( $par ); + } + + /** * @return array[] */ protected function getFormFields() { diff -Nru mediawiki-1.31.6/extensions/OATHAuth/includes/special/SpecialOATHEnable.php mediawiki-1.31.7/extensions/OATHAuth/includes/special/SpecialOATHEnable.php --- mediawiki-1.31.6/extensions/OATHAuth/includes/special/SpecialOATHEnable.php 2019-12-19 13:40:54.000000000 +0000 +++ mediawiki-1.31.7/extensions/OATHAuth/includes/special/SpecialOATHEnable.php 2020-03-26 17:18:26.000000000 +0000 @@ -86,6 +86,14 @@ } /** + * @param string $par + */ + public function execute( $par ) { + $this->getOutput()->disallowUserJs(); + parent::execute( $par ); + } + + /** * @return array[] */ protected function getFormFields() { diff -Nru mediawiki-1.31.6/includes/DefaultSettings.php mediawiki-1.31.7/includes/DefaultSettings.php --- mediawiki-1.31.6/includes/DefaultSettings.php 2019-12-19 13:38:12.000000000 +0000 +++ mediawiki-1.31.7/includes/DefaultSettings.php 2020-03-26 17:18:20.000000000 +0000 @@ -70,8 +70,9 @@ /** * MediaWiki version number * @since 1.2 + * @deprecated since 1.35; use the MW_VERSION constant instead */ -$wgVersion = '1.31.6'; +$wgVersion = MW_VERSION; /** * Name of the site. It must be changed in LocalSettings.php diff -Nru mediawiki-1.31.6/includes/Defines.php mediawiki-1.31.7/includes/Defines.php --- mediawiki-1.31.6/includes/Defines.php 2019-12-19 13:38:12.000000000 +0000 +++ mediawiki-1.31.7/includes/Defines.php 2020-03-26 17:18:20.000000000 +0000 @@ -30,6 +30,15 @@ * @defgroup Constants MediaWiki constants */ +/** + * The running version of MediaWiki. + * + * This replaces the the $wgVersion global found in earlier versions. + * + * @since 1.31.7 + */ +define( 'MW_VERSION', '1.31.7' ); + # Obsolete aliases /** * @deprecated since 1.28 diff -Nru mediawiki-1.31.6/includes/MediaWikiVersionFetcher.php mediawiki-1.31.7/includes/MediaWikiVersionFetcher.php --- mediawiki-1.31.6/includes/MediaWikiVersionFetcher.php 2019-11-04 18:09:13.000000000 +0000 +++ mediawiki-1.31.7/includes/MediaWikiVersionFetcher.php 2020-03-26 16:54:25.000000000 +0000 @@ -9,19 +9,19 @@ class MediaWikiVersionFetcher { /** - * Returns the MediaWiki version, in the format used by MediaWiki's wgVersion global. + * Get the MediaWiki version, extracted from the PHP source file where it is defined. * * @return string * @throws RuntimeException */ public function fetchVersion() { - $defaultSettings = file_get_contents( __DIR__ . '/DefaultSettings.php' ); + $code = file_get_contents( __DIR__ . '/Defines.php' ); $matches = []; - preg_match( "/wgVersion = '([0-9a-zA-Z\.\-]+)';/", $defaultSettings, $matches ); + preg_match( "/define\( 'MW_VERSION', '([0-9a-zA-Z\.\-]+)'/", $code, $matches ); if ( count( $matches ) !== 2 ) { - throw new RuntimeException( 'Could not extract the MediaWiki version from DefaultSettings.php' ); + throw new RuntimeException( 'Could not extract the MediaWiki version from Defines.php' ); } return $matches[1]; diff -Nru mediawiki-1.31.6/includes/PHPVersionCheck.php mediawiki-1.31.7/includes/PHPVersionCheck.php --- mediawiki-1.31.6/includes/PHPVersionCheck.php 2019-12-19 13:38:12.000000000 +0000 +++ mediawiki-1.31.7/includes/PHPVersionCheck.php 2020-03-26 17:18:20.000000000 +0000 @@ -93,7 +93,7 @@ 'implementation' => 'PHP', 'version' => PHP_VERSION, 'vendor' => 'the PHP Group', - 'upstreamSupported' => '5.6.0', + 'upstreamSupported' => '7.2.0', 'minSupported' => '7.0.13', 'upgradeURL' => 'https://secure.php.net/downloads.php', ); diff -Nru mediawiki-1.31.6/includes/libs/rdbms/database/DatabaseDomain.php mediawiki-1.31.7/includes/libs/rdbms/database/DatabaseDomain.php --- mediawiki-1.31.6/includes/libs/rdbms/database/DatabaseDomain.php 2019-12-19 13:38:12.000000000 +0000 +++ mediawiki-1.31.7/includes/libs/rdbms/database/DatabaseDomain.php 2020-03-26 17:18:21.000000000 +0000 @@ -84,6 +84,10 @@ $database = null; } + if ( $schema === '' ) { + $schema = null; + } + return new self( $database, $schema, $prefix ); } @@ -96,10 +100,10 @@ /** * @param DatabaseDomain|string $other - * @return bool + * @return bool Whether the domain instances are the same by value */ public function equals( $other ) { - if ( $other instanceof DatabaseDomain ) { + if ( $other instanceof self ) { return ( $this->database === $other->database && $this->schema === $other->schema && @@ -111,6 +115,44 @@ } /** + * Check whether the domain $other meets the specifications of this domain + * + * If this instance has a null database specifier, then $other can have any database + * specified, including the null, and likewise if the schema specifier is null. This + * is not transitive like equals() since a domain that explicitly wants a certain + * database or schema cannot be satisfied by one of another (nor null). If the prefix + * is empty and the DB and schema are both null, then the entire domain is considered + * unspecified, and any prefix of $other is considered compatible. + * + * @param DatabaseDomain|string $other + * @return bool + * @since 1.32 + */ + public function isCompatible( $other ) { + if ( $this->isUnspecified() ) { + return true; // even the prefix doesn't matter + } + + $other = ( $other instanceof self ) ? $other : self::newFromId( $other ); + + return ( + ( $this->database === $other->database || $this->database === null ) && + ( $this->schema === $other->schema || $this->schema === null ) && + $this->prefix === $other->prefix + ); + } + + /** + * @return bool + * @since 1.32 + */ + public function isUnspecified() { + return ( + $this->database === null && $this->schema === null && $this->prefix === '' + ); + } + + /** * @return string|null Database name */ public function getDatabase() { @@ -150,7 +192,12 @@ if ( $this->schema !== null ) { $parts[] = $this->schema; } - if ( $this->prefix != '' ) { + if ( $this->prefix != '' || $this->schema !== null ) { + // If there is a schema, then we need the prefix to disambiguate. + // For engines like Postgres that use schemas, this awkwardness is hopefully + // avoided since it is easy to have one DB per server (to avoid having many users) + // and use schema/prefix to have wiki farms. For example, a domain schemes could be + // wiki--, e.g. "wiki-fitness-es"/"wiki-sports-fr"/"wiki-news-en". $parts[] = $this->prefix; } diff -Nru mediawiki-1.31.6/includes/libs/rdbms/loadbalancer/LoadBalancer.php mediawiki-1.31.7/includes/libs/rdbms/loadbalancer/LoadBalancer.php --- mediawiki-1.31.6/includes/libs/rdbms/loadbalancer/LoadBalancer.php 2019-12-19 13:38:12.000000000 +0000 +++ mediawiki-1.31.7/includes/libs/rdbms/loadbalancer/LoadBalancer.php 2020-03-26 17:18:21.000000000 +0000 @@ -28,6 +28,7 @@ use EmptyBagOStuff; use WANObjectCache; use ArrayUtils; +use UnexpectedValueException; use InvalidArgumentException; use RuntimeException; use Exception; @@ -998,8 +999,13 @@ } } - // Increment reference count if ( $conn instanceof IDatabase ) { + // Final sanity check to make sure the right domain is selected + if ( !$domainInstance->isCompatible( $conn->getDomainID() ) ) { + throw new UnexpectedValueException( + "Got connection to '{$conn->getDomainID()}', but expected '$domain'." ); + } + // Increment reference count $refCount = $conn->getLBInfo( 'foreignPoolRefCount' ); $conn->setLBInfo( 'foreignPoolRefCount', $refCount + 1 ); } diff -Nru mediawiki-1.31.6/includes/user/UserGroupMembership.php mediawiki-1.31.7/includes/user/UserGroupMembership.php --- mediawiki-1.31.6/includes/user/UserGroupMembership.php 2019-12-19 13:38:12.000000000 +0000 +++ mediawiki-1.31.7/includes/user/UserGroupMembership.php 2020-03-26 17:18:21.000000000 +0000 @@ -396,15 +396,19 @@ // link to the group description page, if it exists $linkTitle = self::getGroupPage( $group ); - if ( $linkTitle ) { - if ( $format === 'wiki' ) { + if ( $format === 'wiki' ) { + if ( $linkTitle ) { $linkPage = $linkTitle->getFullText(); $groupLink = "[[$linkPage|$groupName]]"; } else { - $groupLink = Linker::link( $linkTitle, htmlspecialchars( $groupName ) ); + $groupLink = $groupName; } } else { - $groupLink = htmlspecialchars( $groupName ); + if ( $linkTitle ) { + $groupLink = Linker::link( $linkTitle, htmlspecialchars( $groupName ) ); + } else { + $groupLink = htmlspecialchars( $groupName ); + } } if ( $expiry ) { @@ -414,14 +418,18 @@ $expiryDT = $uiLanguage->userTimeAndDate( $expiry, $uiUser ); $expiryD = $uiLanguage->userDate( $expiry, $uiUser ); $expiryT = $uiLanguage->userTime( $expiry, $uiUser ); - if ( $format === 'html' ) { + + if ( $format === 'wiki' ) { + return $context->msg( 'group-membership-link-with-expiry' ) + ->params( $groupLink, $expiryDT, $expiryD, $expiryT )->text(); + } else { $groupLink = Message::rawParam( $groupLink ); + return $context->msg( 'group-membership-link-with-expiry' ) + ->params( $groupLink, $expiryDT, $expiryD, $expiryT )->escaped(); } - return $context->msg( 'group-membership-link-with-expiry' ) - ->params( $groupLink, $expiryDT, $expiryD, $expiryT )->text(); - } else { - return $groupLink; } + + return $groupLink; } /** diff -Nru mediawiki-1.31.6/maintenance/checkComposerLockUpToDate.php mediawiki-1.31.7/maintenance/checkComposerLockUpToDate.php --- mediawiki-1.31.6/maintenance/checkComposerLockUpToDate.php 2019-11-04 18:09:16.000000000 +0000 +++ mediawiki-1.31.7/maintenance/checkComposerLockUpToDate.php 2020-03-02 01:05:32.000000000 +0000 @@ -2,6 +2,8 @@ require_once __DIR__ . '/Maintenance.php'; +use Composer\Semver\Semver; + /** * Checks whether your composer-installed dependencies are up to date * @@ -38,7 +40,7 @@ $installed = $lock->getInstalledDependencies(); foreach ( $json->getRequiredDependencies() as $name => $version ) { if ( isset( $installed[$name] ) ) { - if ( $installed[$name]['version'] !== $version ) { + if ( !SemVer::satisfies( $installed[$name]['version'], $version ) ) { $this->output( "$name: {$installed[$name]['version']} installed, $version required.\n" ); diff -Nru mediawiki-1.31.6/maintenance/recountCategories.php mediawiki-1.31.7/maintenance/recountCategories.php --- mediawiki-1.31.6/maintenance/recountCategories.php 2019-12-19 13:36:54.000000000 +0000 +++ mediawiki-1.31.7/maintenance/recountCategories.php 2020-03-26 17:15:36.000000000 +0000 @@ -98,7 +98,7 @@ protected function doWork() { $this->output( "Finding up to {$this->getBatchSize()} drifted rows " . - "starting at cat_id {$this->getBatchSize()}...\n" ); + "greater than cat_id {$this->minimumId}...\n" ); $countingConds = [ 'cl_to = cat_title' ]; if ( $this->mode === 'subcats' ) { diff -Nru mediawiki-1.31.6/maintenance/view.php mediawiki-1.31.7/maintenance/view.php --- mediawiki-1.31.6/maintenance/view.php 2019-12-19 13:37:35.000000000 +0000 +++ mediawiki-1.31.7/maintenance/view.php 2020-03-26 17:18:23.000000000 +0000 @@ -39,6 +39,10 @@ $title = Title::newFromText( $this->getArg() ); if ( !$title ) { $this->fatalError( "Invalid title" ); + } elseif ( $title->isSpecialPage() ) { + $this->fatalError( "Special Pages not supported" ); + } elseif ( !$title->exists() ) { + $this->fatalError( "Page does not exist" ); } $page = WikiPage::factory( $title ); diff -Nru mediawiki-1.31.6/resources/src/jquery/jquery.makeCollapsible.js mediawiki-1.31.7/resources/src/jquery/jquery.makeCollapsible.js --- mediawiki-1.31.6/resources/src/jquery/jquery.makeCollapsible.js 2019-12-19 13:38:14.000000000 +0000 +++ mediawiki-1.31.7/resources/src/jquery/jquery.makeCollapsible.js 2020-03-26 17:18:24.000000000 +0000 @@ -279,6 +279,7 @@ } else { collapsibleId = $collapsible.attr( 'id' ) || ''; if ( collapsibleId.indexOf( 'mw-customcollapsible-' ) === 0 ) { + collapsibleId = $.escapeSelector( collapsibleId ); $customTogglers = $( '.' + collapsibleId.replace( 'mw-customcollapsible', 'mw-customtoggle' ) ) .addClass( 'mw-customtoggle' ); } diff -Nru mediawiki-1.31.6/tests/phpunit/includes/MediaWikiVersionFetcherTest.php mediawiki-1.31.7/tests/phpunit/includes/MediaWikiVersionFetcherTest.php --- mediawiki-1.31.6/tests/phpunit/includes/MediaWikiVersionFetcherTest.php 2019-12-19 13:38:15.000000000 +0000 +++ mediawiki-1.31.7/tests/phpunit/includes/MediaWikiVersionFetcherTest.php 2020-03-26 17:18:24.000000000 +0000 @@ -16,7 +16,7 @@ public function testReturnsResult() { $versionFetcher = new MediaWikiVersionFetcher(); - $this->assertInternalType( 'string', $versionFetcher->fetchVersion() ); + $this->assertSame( MW_VERSION, $versionFetcher->fetchVersion() ); } } diff -Nru mediawiki-1.31.6/tests/phpunit/includes/libs/rdbms/database/DatabaseDomainTest.php mediawiki-1.31.7/tests/phpunit/includes/libs/rdbms/database/DatabaseDomainTest.php --- mediawiki-1.31.6/tests/phpunit/includes/libs/rdbms/database/DatabaseDomainTest.php 2019-12-19 13:38:15.000000000 +0000 +++ mediawiki-1.31.7/tests/phpunit/includes/libs/rdbms/database/DatabaseDomainTest.php 2020-03-26 17:18:24.000000000 +0000 @@ -130,4 +130,87 @@ $this->assertSame( null, $domain->getSchema() ); $this->assertSame( '', $domain->getTablePrefix() ); } + + public static function provideIsCompatible() { + return [ + 'Basic' => + [ 'foo', 'foo', null, '', true ], + 'db+prefix' => + [ 'foo-bar', 'foo', null, 'bar', true ], + 'db+schema+prefix' => + [ 'foo-bar-baz', 'foo', 'bar', 'baz', true ], + 'db+dontcare_schema+prefix' => + [ 'foo-bar-baz', 'foo', null, 'baz', false ], + '?h -> -' => + [ 'foo?hbar-baz-baa', 'foo-bar', 'baz', 'baa', true ], + '?? -> ?' => + [ 'foo??bar-baz-baa', 'foo?bar', 'baz', 'baa', true ], + 'Nothing' => + [ '', null, null, '', true ], + 'dontcaredb+dontcaredbschema+prefix' => + [ 'mywiki-mediawiki-prefix', null, null, 'prefix', false ], + 'dontcaredb+schema+prefix' => + [ 'mywiki-schema-prefix', null, 'schema', 'prefix', false ], + 'db+dontcareschema+prefix' => + [ 'mywiki-schema-prefix', 'mywiki', null, 'prefix', false ], + 'postgres-db-jobqueue' => + [ 'postgres-mediawiki-', 'postgres', null, '', false ] + ]; + } + + /** + * @dataProvider provideIsCompatible + * @covers Wikimedia\Rdbms\DatabaseDomain::isCompatible + */ + public function testIsCompatible( $id, $db, $schema, $prefix, $transitive ) { + $compareIdObj = DatabaseDomain::newFromId( $id ); + $this->assertInstanceOf( DatabaseDomain::class, $compareIdObj ); + + $fromId = new DatabaseDomain( $db, $schema, $prefix ); + + $this->assertTrue( $fromId->isCompatible( $id ), 'constructed equals string' ); + $this->assertTrue( $fromId->isCompatible( $compareIdObj ), 'fromId equals string' ); + + $this->assertEquals( $transitive, $compareIdObj->isCompatible( $fromId ), + 'test transitivity of nulls components' ); + } + + public static function provideIsCompatible2() { + return [ + 'db+schema+prefix' => + [ 'mywiki-schema-prefix', 'thatwiki', 'schema', 'prefix' ], + 'dontcaredb+dontcaredbschema+prefix' => + [ 'thatwiki-mediawiki-otherprefix', null, null, 'prefix' ], + 'dontcaredb+schema+prefix' => + [ 'mywiki-otherschema-prefix', null, 'schema', 'prefix' ], + 'db+dontcareschema+prefix' => + [ 'notmywiki-schema-prefix', 'mywiki', null, 'prefix' ], + ]; + } + + /** + * @dataProvider provideIsCompatible2 + * @covers Wikimedia\Rdbms\DatabaseDomain::isCompatible + */ + public function testIsCompatible2( $id, $db, $schema, $prefix ) { + $compareIdObj = DatabaseDomain::newFromId( $id ); + $this->assertInstanceOf( DatabaseDomain::class, $compareIdObj ); + + $fromId = new DatabaseDomain( $db, $schema, $prefix ); + + $this->assertFalse( $fromId->isCompatible( $id ), 'constructed equals string' ); + $this->assertFalse( $fromId->isCompatible( $compareIdObj ), 'fromId equals string' ); + } + + /** + * @covers Wikimedia\Rdbms\DatabaseDomain::isUnspecified + */ + public function testIsUnspecified() { + $domain = new DatabaseDomain( null, null, '' ); + $this->assertTrue( $domain->isUnspecified() ); + $domain = new DatabaseDomain( 'mywiki', null, '' ); + $this->assertFalse( $domain->isUnspecified() ); + $domain = new DatabaseDomain( 'mywiki', null, '' ); + $this->assertFalse( $domain->isUnspecified() ); + } } diff -Nru mediawiki-1.31.6/tests/selenium/specs/page.js mediawiki-1.31.7/tests/selenium/specs/page.js --- mediawiki-1.31.6/tests/selenium/specs/page.js 2019-12-19 13:38:15.000000000 +0000 +++ mediawiki-1.31.7/tests/selenium/specs/page.js 2020-03-26 17:18:24.000000000 +0000 @@ -27,7 +27,8 @@ name = getTestString(); } ); - it( 'should be creatable', function () { + // Disable due to broken/flakiness (T247580) + it.skip( 'should be creatable', function () { // create EditPage.edit( name, content ); @@ -38,7 +39,8 @@ } ); - it( 'should be re-creatable', function () { + // Disable due to broken/flakiness (T247580) + it.skip( 'should be re-creatable', function () { let initialContent = getTestString(); // create @@ -60,7 +62,8 @@ } ); - it( 'should be editable', function () { + // Disable due to broken/flakiness (T247580) + it.skip( 'should be editable', function () { // create browser.call( function () { @@ -89,7 +92,8 @@ } ); - it( 'should be deletable', function () { + // Disable due to broken/flakiness (T247580) + it.skip( 'should be deletable', function () { // login UserLoginPage.loginAdmin(); @@ -110,7 +114,8 @@ } ); - it( 'should be restorable', function () { + // Disable due to broken/flakiness (T247580) + it.skip( 'should be restorable', function () { // login UserLoginPage.loginAdmin(); diff -Nru mediawiki-1.31.6/tests/selenium/specs/user.js mediawiki-1.31.7/tests/selenium/specs/user.js --- mediawiki-1.31.6/tests/selenium/specs/user.js 2019-12-19 13:38:15.000000000 +0000 +++ mediawiki-1.31.7/tests/selenium/specs/user.js 2020-03-26 17:18:24.000000000 +0000 @@ -21,7 +21,8 @@ password = Math.random().toString(); } ); - it( 'should be able to create account', function () { + // Disable due to broken/flakiness (T247580) + it.skip( 'should be able to create account', function () { // create CreateAccountPage.createAccount( username, password ); @@ -31,7 +32,8 @@ } ); - it( 'should be able to log in', function () { + // Disable due to broken/flakiness (T247580) + it.skip( 'should be able to log in', function () { // create browser.call( function () { @@ -46,8 +48,8 @@ } ); - it( 'should be able to change preferences', function () { - + // Disabled due to flakiness (T199446) + it.skip( 'should be able to change preferences', function () { var realName = Math.random().toString(); // create