SecurePoll can no longer add questions to new polls
Closed, ResolvedPublicBUG REPORT
Actions

Description

It looks like SecurePoll is using deprecated methods. A quick git bisect suggests that as of Iae9bb0 from T356544: Use Html::* instead of Xml::* in MediaWiki core, the field set to add new questions is no longer being generated. We need to fix this before the next election.

Acceptance Criteria:

Questions can be added to polls

Details

Related Changes in Gerrit:

Subject	Repo	Branch	Lines +/-
htmlform: Fix rendering contents for cloner fields	mediawiki/core	REL1_43	+100 -3
htmlform: Fix rendering contents for cloner fields	mediawiki/core	wmf/1.44.0-wmf.28	+100 -3
htmlform: Fix rendering contents for cloner fields	mediawiki/core	REL1_44	+100 -3
htmlform: Fix rendering contents for cloner fields	mediawiki/core	master	+100 -3

Customize query in gerrit

Related Objects

Mentioned In: T392341: CVE-2025-53483, CVE-2025-53484, CVE-2025-53485: SecurePoll is vulnerable to XSS, CSRF, and lack of authorisation
Mentioned Here: T356544: Use Html::* instead of Xml::* in MediaWiki core

Event Timeline

STran created this task.May 9 2025, 2:52 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptMay 9 2025, 2:52 PM

STran mentioned this in T392341: CVE-2025-53483, CVE-2025-53484, CVE-2025-53485: SecurePoll is vulnerable to XSS, CSRF, and lack of authorisation.May 9 2025, 2:54 PM

Novem_Linguae changed the subtype of this task from "Task" to "Bug Report".May 9 2025, 3:00 PM

Novem_Linguae added a project: Regression.

STran assigned this task to • mszabo.May 9 2025, 3:03 PM

STran added a project: Trust and Safety Product Sprint (Sprint Key Lime Pie (May 5 - May 23)).

STran moved this task from Priority Backlog to In Progress on the Trust and Safety Product Sprint (Sprint Key Lime Pie (May 5 - May 23)) board.

Change #1143860 had a related patch set uploaded (by Máté Szabó; author: Máté Szabó):

[mediawiki/core@master] htmlform: Fix rendering contents for cloner fields

https://gerrit.wikimedia.org/r/1143860

gerritbot added a project: Patch-For-Review.May 9 2025, 3:29 PM

• mszabo triaged this task as High priority.May 9 2025, 3:36 PM

• mszabo changed the task status from Open to In Progress.May 9 2025, 6:05 PM

• mszabo moved this task from In Progress to Needs Review on the Trust and Safety Product Sprint (Sprint Key Lime Pie (May 5 - May 23)) board.

Change #1143860 merged by jenkins-bot:

[mediawiki/core@master] htmlform: Fix rendering contents for cloner fields

https://gerrit.wikimedia.org/r/1143860

• mszabo closed this task as Resolved.May 9 2025, 6:44 PM

• mszabo moved this task from Needs Review to Done on the Trust and Safety Product Sprint (Sprint Key Lime Pie (May 5 - May 23)) board.

• mszabo moved this task from Backlog to Done on the MediaWiki-extensions-SecurePoll board.

ReleaseTaggerBot added a project: MW-1.45-notes (1.45.0-wmf.1; 2025-05-13).May 9 2025, 7:00 PM

Maintenance_bot removed a project: Patch-For-Review.May 9 2025, 7:30 PM

Thanks for fixing, and I'm sorry I missed that in review.

Change #1143890 had a related patch set uploaded (by Bartosz Dziewoński; author: Máté Szabó):

[mediawiki/core@REL1_44] htmlform: Fix rendering contents for cloner fields

https://gerrit.wikimedia.org/r/1143890

gerritbot added a project: Patch-For-Review.May 9 2025, 7:52 PM

Change #1143890 merged by jenkins-bot:

[mediawiki/core@REL1_44] htmlform: Fix rendering contents for cloner fields

https://gerrit.wikimedia.org/r/1143890

Maintenance_bot removed a project: Patch-For-Review.May 9 2025, 8:30 PM

ReleaseTaggerBot added a project: MW-1.44-notes.May 9 2025, 9:01 PM

Change #1144481 had a related patch set uploaded (by STran; author: Máté Szabó):

[mediawiki/core@wmf/1.44.0-wmf.28] htmlform: Fix rendering contents for cloner fields

https://gerrit.wikimedia.org/r/1144481

gerritbot added a project: Patch-For-Review.May 12 2025, 9:16 AM

Change #1144481 merged by jenkins-bot:

[mediawiki/core@wmf/1.44.0-wmf.28] htmlform: Fix rendering contents for cloner fields

https://gerrit.wikimedia.org/r/1144481

Mentioned in SAL (#wikimedia-operations) [2025-05-12T13:18:19Z] <lucaswerkmeister-wmde@deploy1003> Started scap sync-world: Backport for [[gerrit:1144481|htmlform: Fix rendering contents for cloner fields (T393790)]]

Mentioned in SAL (#wikimedia-operations) [2025-05-12T13:22:54Z] <lucaswerkmeister-wmde@deploy1003> stran, lucaswerkmeister-wmde: Backport for [[gerrit:1144481|htmlform: Fix rendering contents for cloner fields (T393790)]] synced to the testservers (https://wikitech.wikimedia.org/wiki/Mwdebug)

Maintenance_bot removed a project: Patch-For-Review.May 12 2025, 1:31 PM

Mentioned in SAL (#wikimedia-operations) [2025-05-12T13:33:10Z] <lucaswerkmeister-wmde@deploy1003> Finished scap sync-world: Backport for [[gerrit:1144481|htmlform: Fix rendering contents for cloner fields (T393790)]] (duration: 14m 50s)