Mailing List Archive: GuzzleHttp requires cURL, the allow_url_fopen ini setting, or a custom HTTP handler.

Hi Everyone,

I'm using MW 1.35.1 release tarball. We migrated to a new VM using
Ubuntu 20, x86_64, fully patched. I also updated composer
dependencies.

Below is a new error when we edit a wiki page and click Submit.
Preview is OK. We did not experience it on our CentOS 7 VM during
Submit.

We are in a hardened state. We can't meet Guzzle's requirements because:

open_basedir="/var/www/html/:/var/lib/php/"
allow_url_fopen=Off
allow_url_include=Off

Looking at Special:Version, Guzzle is described as "Guzzle is a PHP
HTTP client library." I don't believe our Mediawiki should be making
outbound requests like this. We disabled Guzzle by disabling
SpamBlacklist.

This brings a couple of questions:

* Why is Guzzle filtering Sysops or Administrator actions?
* Is there another way to get the Spam blacklist? Like a Systemd
service that runs once an hour?

Thanks in advance.

==========

[YGi84aU19iAalBwOJ8j4SAAAAAU]
/w/index.php?title=Main_Page&action=submit RuntimeException from line
119 of /var/www/html/w/vendor/guzzlehttp/guzzle/src/functions.php:
GuzzleHttp requires cURL, the allow_url_fopen ini setting, or a custom
HTTP handler.

Backtrace:

#0 /var/www/html/w/vendor/guzzlehttp/guzzle/src/HandlerStack.php(42):
GuzzleHttp\choose_handler()
#1 /var/www/html/w/includes/http/GuzzleHttpRequest.php(164):
GuzzleHttp\HandlerStack::create()
#2 /var/www/html/w/includes/http/HttpRequestFactory.php(186):
GuzzleHttpRequest->execute()
#3 /var/www/html/w/includes/http/HttpRequestFactory.php(208):
MediaWiki\Http\HttpRequestFactory->request()
#4 /var/www/html/w/extensions/SpamBlacklist/includes/BaseBlacklist.php(370):
MediaWiki\Http\HttpRequestFactory->get()
#5 /var/www/html/w/extensions/SpamBlacklist/includes/BaseBlacklist.php(329):
BaseBlacklist->getHttpText()
#6 /var/www/html/w/extensions/SpamBlacklist/includes/BaseBlacklist.php(294):
BaseBlacklist->buildSharedBlacklists()
#7 /var/www/html/w/includes/libs/objectcache/wancache/WANObjectCache.php(1529):
BaseBlacklist->{closure}()
#8 /var/www/html/w/includes/libs/objectcache/wancache/WANObjectCache.php(1376):
WANObjectCache->fetchOrRegenerate()
#9 /var/www/html/w/extensions/SpamBlacklist/includes/BaseBlacklist.php(295):
WANObjectCache->getWithSetCallback()
#10 /var/www/html/w/extensions/SpamBlacklist/includes/BaseBlacklist.php(224):
BaseBlacklist->getSharedBlacklists()
#11 /var/www/html/w/extensions/SpamBlacklist/includes/SpamBlacklist.php(89):
BaseBlacklist->getBlacklists()
#12 /var/www/html/w/extensions/SpamBlacklist/includes/SpamBlacklistHooks.php(45):
SpamBlacklist->filter()
#13 /var/www/html/w/includes/HookContainer/HookContainer.php(320):
SpamBlacklistHooks::filterMergedContent()
#14 /var/www/html/w/includes/HookContainer/HookContainer.php(131):
MediaWiki\HookContainer\HookContainer->callLegacyHook()
#15 /var/www/html/w/includes/HookContainer/HookRunner.php(1529):
MediaWiki\HookContainer\HookContainer->run()
#16 /var/www/html/w/includes/EditPage.php(1904):
MediaWiki\HookContainer\HookRunner->onEditFilterMergedContent()
#17 /var/www/html/w/includes/EditPage.php(2363): EditPage->runPostMergeFilters()
#18 /var/www/html/w/includes/EditPage.php(1724): EditPage->internalAttemptSave()
#19 /var/www/html/w/includes/EditPage.php(680): EditPage->attemptSave()
#20 /var/www/html/w/includes/actions/EditAction.php(71): EditPage->edit()
#21 /var/www/html/w/includes/actions/SubmitAction.php(38): EditAction->show()
#22 /var/www/html/w/includes/MediaWiki.php(527): SubmitAction->show()
#23 /var/www/html/w/includes/MediaWiki.php(313): MediaWiki->performAction()
#24 /var/www/html/w/includes/MediaWiki.php(940): MediaWiki->performRequest()
#25 /var/www/html/w/includes/MediaWiki.php(543): MediaWiki->main()
#26 /var/www/html/w/index.php(53): MediaWiki->run()
#27 /var/www/html/w/index.php(46): wfIndexMain()
#28 {main}

_______________________________________________
MediaWiki-l mailing list
To unsubscribe, go to:
https://lists.wikimedia.org/mailman/listinfo/mediawiki-l

Hi,

On 4/3/21 12:48 PM, Jeffrey Walton wrote:
> Looking at Special:Version, Guzzle is described as "Guzzle is a PHP
> HTTP client library." I don't believe our Mediawiki should be making
> outbound requests like this. We disabled Guzzle by disabling
> SpamBlacklist.

The default configuration of SpamBlacklist will use the Wikimedia spam
blacklist so it's useful out of the box. You can disable this
functionality by adjusting $wgBlacklistSettings.

> This brings a couple of questions:
>
> * Why is Guzzle filtering Sysops or Administrator actions?

The SpamBlacklist filters all users actions, see
<https://phabricator.wikimedia.org/T36928> for more details on why.

> * Is there another way to get the Spam blacklist? Like a Systemd
> service that runs once an hour?

Yes, the SpamBlacklist supports referencing a local file to use as
input, see the documentation[1]. You could easily set up a systemd timer
to automatically wget/curl the latest version of the blacklist.

[1] https://www.mediawiki.org/wiki/Extension:SpamBlacklist#Examples

-- Legoktm

_______________________________________________
MediaWiki-l mailing list
To unsubscribe, go to:
https://lists.wikimedia.org/mailman/listinfo/mediawiki-l