#dokuwiki

anonymiss@despora.de

If you use #Confluence instead of an #OpenSource #wiki then you are not real hackers!

The setup of #DokuWiki is quick and easy even for bloody noobs: https://www.dokuwiki.org

Background: https://www.bleepingcomputer.com/news/security/ukrainian-activists-hack-trigona-ransomware-gang-wipe-servers/

Ukrainian #Cyber Alliance hackers gained access to #Trigona #ransomware’s infrastructure by using a public #exploit for CVE-2023-22515, a critical #vulnerability in Confluence Data Center and Server that can be leveraged remotely to escalate privileges.

#news #software #fail #hack #hacker #cybercrime #problem #security #privacy #knowledge

fsfeberlin@libranet.de

Morgen, also am Samstag den 17. September, ist der #SoftwareFreedomDay. Ein Tag um die #FreieSoftware und die Community drum herum zu feiern.

In #Berlin wird es ab 12 Uhr dazu in der Lehrter Str. 53 Gelegenheit geben. Ab 13 Uhr gibt es spannende Vorträge zu Freier Software im Allgemeinen, und #Dokuwiki sowie der Erstellung von Videotutorials im Speziellen.

Hier geht es zum Programm https://wiki.softwarefreedomday.org/2022/Deutschland/Berlin/Berlin #SFD22

canoodle@nerdpol.ch

Rant: PHP & DokuWiki update upgrade problems - too much complexity: fixing one thing, while breaking another - why updates are hated

Nobody likes rants… just as Updates are (sometimes) hated, but (sometimes) necessary.

This is how (probably) the slogan: “never touch a running/working system” originated.

Once a system was fully tested (all used cases worked), an update came along a old functionality was not functioning anymore.

For security reasons: all machines/systems directly or indirectly exchanging messages with the wild west internet need to stay as up to date as possible.

the pros:

(+) First of DokuWiki is a nice software, it’s cool that it can do a lot of fancy stuff such as LDAP (?) if the user needs it.

(-) What is not cool, to have a lot of plugins installed per default, instead of starting with a bare minimum of software needed (software minimalism) and let the user add the software the user absolutely needs, because “too much software” pre-installed tend to make systems fail.

This time it happened in a “complex grown over years software” “tripple” upgrade situation:

  • php8 is out
  • DokuWiki “upgrade plugin” needs updating
  • DokuWiki itself needs updating

… things fell apart at the 1st step already, resulting in a still readable, but pretty ugly (missing CSS) version of what it was before.

culprit: with a stylesheed was not being properly generated:

url: http://localhost/projects/lib/exe/css.php?t=dokuwiki&tseed=djf83jhdfuz38odhfzho3z80ehilf

<br />
<b><span style="color: #ff9900;">Warning</span></b>: Undefined array key "speech" in <b>/path/to/dokuwiki/lib/exe/css.php</b> on line <b>83</b><br />
<br />
<b><span style="color: #ff0000;">Fatal error</span></b>: Array and string offset access syntax with curly braces is no longer supported in <b>/path/to/dokuwiki/vendor/marcusschwarz/lesserphp/lessc.inc.php</b> on line <b>761</b><br />

DokuWiki authors added the work of this author (https://www.maswaba.de/lesserphpdocs/) for whatever reason and { curly brackets } (now deprecated) were not updated in time to [ square brackets ].

As simple as that.

In the beginning: all the user wants is an easy editable file based wiki (it’s even there in the Dokuwiki slogan “it’s better when it is simple”)

Why exactly is this CSS compiler needed/active per default in the first place?

Has DokuWiki grown into unnecessary complex “bloatware” of over 5000 files?

<span style="color: #00ffff;">wget https://download.dokuwiki.org/out/dokuwiki-8186df5bcf8bba07ff8638254a75b094.tgz
tar fxvz dokuwiki-8186df5bcf8bba07ff8638254a75b094.tgz</span>
<span style="color: #00ffff;">find ./dokuwiki |wc -l</span>
<span style="color: #ff6600;">5579 files</span>

(much less than some PHP frameworks… but still a lot of files… with a lot of moving parts… all potential points of failure…)

violating UNIX K.I.S.S and leading to software failures

More complexity = more errors = less maintainability.

DokuWiki has gained functionalities of questionable qualities, such as the very faulty and thus pretty useless and annoying SPAM detection mechanism.

(every Wiki should be login & .htaccess protected, how to activate the DokuWiki (per default disabled) login screen, is the #1 most visited page of this blog X-D, already enough SPAM protection… so completely unnecessary to add such faulty functionality)

Even worse: @the-official-DokuWiki-forum, the forum software triggers admins (that are unable to read and blindly trust this faulty SPAM detection mechanism, that basically detects EVERY URL as spam) to block the user’s (maybe useful) contributions aka “overblocking”.

Be Brave New Web World.

Only solution: write your own tools that respect UNIX K.I.S.S principle and are therefore easy to fix and maintain and actually work, fast 🙂 (using minimal resources)

DokuWiki updates-upgrades: how it is supposed to look and work like:

how to fix this mess:

==== howto fix ====
<b>Warning</b>: Undefined array key "speech" in <b>/path/to/dokuwiki/lib/exe/css.php</b> on line <b>83</b>
(usually php-warnings are disabled, but if warnings are enabled, it will mess up the css's format)

=== in file: /lib/exe/css.php

== in line: 82 to 87

= change, from:
        // load user styles
        if(is_array($config_cascade['userstyle'][$mediatype])) {
            foreach($config_cascade['userstyle'][$mediatype] as $userstyle) {
                $files[$userstyle] = DOKU_BASE;
            }
        }
= change, to:
        // load user styles
        if(array_key_exists($mediatype, $config_cascade['userstyle']))
        {
            if(is_array($config_cascade['userstyle'][$mediatype])) {
                foreach($config_cascade['userstyle'][$mediatype] as $userstyle) {
                    $files[$userstyle] = DOKU_BASE;
                }
            }
        }

==== howto fix ====

<b>Fatal error</b>: Array and string offset access syntax with curly braces is no longer supported in <b>/path/to/dokuwiki/vendor/marcusschwarz/lesserphp/lessc.inc.php</b> on line <b>761</b>

=== in file:
/vendor/marcusschwarz/lesserphp/lessc.inc.php

== line: 761
= change, from:
   $subProp[1]{0} != $this->vPrefix)
= change, to:
   $subProp[1][0] != $this->vPrefix)

== line: 2762
= change, from:
   if (!is_string($tag) || $tag{0} != $this->lessc->mPrefix)
= change, to:
   if (!is_string($tag) || $tag[0] != $this->lessc->mPrefix)

== line: 2816
= change, from:
   if ($tag{0} == $this->lessc->vPrefix)
= change, to:
   if ($tag[0] == $this->lessc->vPrefix)

#linux #gnu #gnulinux #opensource #administration #sysops #dokuwiki #when #upgrades #fail #upgrade #complexity #unix #kiss

Originally posted at: https://dwaves.de/2022/06/30/rant-php-dokuwiki-update-upgrade-problems-too-much-complexity-fixing-one-thing-while-breaking-another-why-updates-are-hated/

canoodle@nerdpol.ch

PHP & DokuWiki update upgrade problems - too much complexity: fixing one thing, while breaking another - why updates are hated

Updates are hated, but sometimes necessary.

This is how (probably) the slogan: “never touch a running/working system” originated.

Once a system was fully tested (all used cases worked), an update came along a old functionality was not functioning anymore.

For security reasons: all machines/systems directly or indirectly exchanging messages with the wild west internet need to stay as up to date as possible.

the pros:

(+) First of DokuWiki is a nice software, it’s cool that it can do a lot of fancy stuff such as LDAP (?) if the user needs it.

(-) What is not cool, to have a lot of plugins installed per default, instead of starting with a bare minimum of software needed (software minimalism) and let the user add the software the user absolutely needs, because “too much software” pre-installed tend to make systems fail.

This time it happened in a “complex grown over years software” “tripple” upgrade situation:

  • php8 is out
  • DokuWiki “upgrade plugin” needs updating
  • DokuWiki itself needs updating

… things fell apart at the 1st step already, resulting in a still readable, but pretty ugly (missing CSS) version of what it was before.

culprit: with a stylesheed was not being properly generated:

url: http://localhost/projects/lib/exe/css.php?t=dokuwiki&tseed=djf83jhdfuz38odhfzho3z80ehilf

<br />
<b><span style="color: #ff9900;">Warning</span></b>: Undefined array key "speech" in <b>/path/to/dokuwiki/lib/exe/css.php</b> on line <b>83</b><br />
<br />
<b><span style="color: #ff0000;">Fatal error</span></b>: Array and string offset access syntax with curly braces is no longer supported in <b>/path/to/dokuwiki/vendor/marcusschwarz/lesserphp/lessc.inc.php</b> on line <b>761</b><br />

DokuWiki authors added the work of this author (https://www.maswaba.de/lesserphpdocs/) for whatever reason and { curly brackets } (now deprecated) were not updated in time to [ square brackets ].

As simple as that.

In the beginning: all the user wants is an easy editable file based wiki (it’s even there in the Dokuwiki slogan “it’s better when it is simple”)

Why exactly is this CSS compiler needed/active per default in the first place?

Has DokuWiki grown into unnecessary complex “bloatware” of over 5000 files?

<span style="color: #00ffff;">wget https://download.dokuwiki.org/out/dokuwiki-8186df5bcf8bba07ff8638254a75b094.tgz
tar fxvz dokuwiki-8186df5bcf8bba07ff8638254a75b094.tgz</span>
<span style="color: #00ffff;">find ./dokuwiki |wc -l</span>
<span style="color: #ff6600;">5579 files</span>

(much less than some PHP frameworks… but still a lot of files… with a lot of moving parts… all potential points of failure…)

violating UNIX K.I.S.S and leading to software failures

More complexity = more errors = less maintainability.

DokuWiki has gained functionalities of questionable qualities, such as the very faulty and thus SPAM detection mechanism.

(every Wiki should be login & .htaccess protected, how to activate the DokuWiki (per default disabled) login screen, is the #1 most visited page of this blog X-D, already enough SPAM protection… so completely unnecessary to add such faulty functionality)

Even worse: @the-official-DokuWiki-forum, the forum software triggers admins (that are unable to read and blindly trust this faulty SPAM detection mechanism, that basically detects EVERY URL as spam) to block the user’s (maybe useful) contributions aka “overblocking”.

Be Brave New Web World.

Only solution: write your own tools that respect UNIX K.I.S.S principle and are therefore easy to fix and maintain and actually work, fast 🙂 (using minimal resources)

how to fix this mess:

==== howto fix ====
<b>Warning</b>: Undefined array key "speech" in <b>/path/to/dokuwiki/lib/exe/css.php</b> on line <b>83</b>
(usually php-warnings are disabled, but if warnings are enabled, it will mess up the css's format)

=== in file: /lib/exe/css.php

== in line: 82 to 87

= change, from:
        // load user styles
        if(is_array($config_cascade['userstyle'][$mediatype])) {
            foreach($config_cascade['userstyle'][$mediatype] as $userstyle) {
                $files[$userstyle] = DOKU_BASE;
            }
        }
= change, to:
        // load user styles
        if(array_key_exists($mediatype, $config_cascade['userstyle']))
        {
            if(is_array($config_cascade['userstyle'][$mediatype])) {
                foreach($config_cascade['userstyle'][$mediatype] as $userstyle) {
                    $files[$userstyle] = DOKU_BASE;
                }
            }
        }

==== howto fix ====

<b>Fatal error</b>: Array and string offset access syntax with curly braces is no longer supported in <b>/path/to/dokuwiki/vendor/marcusschwarz/lesserphp/lessc.inc.php</b> on line <b>761</b>

=== in file:
/vendor/marcusschwarz/lesserphp/lessc.inc.php

== line: 761
= change, from:
   $subProp[1]{0} != $this->vPrefix)
= change, to:
   $subProp[1][0] != $this->vPrefix)

== line: 2762
= change, from:
   if (!is_string($tag) || $tag{0} != $this->lessc->mPrefix)
= change, to:
   if (!is_string($tag) || $tag[0] != $this->lessc->mPrefix)

== line: 2816
= change, from:
   if ($tag{0} == $this->lessc->vPrefix)
= change, to:
   if ($tag[0] == $this->lessc->vPrefix)

#linux #gnu #gnulinux #opensource #administration #sysops #dokuwiki #when #upgrades #fail #upgrade #complexity #unix #kiss

Originally posted at: https://dwaves.de/2022/06/30/php-dokuwiki-update-upgrade-problems-too-much-complexity-fixing-one-thing-while-breaking-another-why-updates-are-hated/