BlueSpice Helpdesk - Recent changes [en]

Reference:OpenLayers

Margit.link-rodrigue — Thu, 01 Oct 2026 07:55:53 GMT

← Older revision		Revision as of 07:55, 1 October 2026
Line 10:		Line 10:
	\|docu=https://www.mediawiki.org/wiki/Extension:OpenLayers		\|docu=https://www.mediawiki.org/wiki/Extension:OpenLayers
	\|features=		\|features=
	The ~~extension~~ '''OpenLayers''' ~~makes~~ the OpenLayers module ~~available~~.		The '''OpenLayers''' extension provides the OpenLayers module.

			OpenLayers allows dynamic maps to be embedded into any webpage. It can display map tiles, vector data, and markers loaded from various sources. It is a completely free, open-source JavaScript solution released under the 2-clause BSD license (also known as the FreeBSD license).

			You can find more information about OpenLayers at [https://openlayers.org/ openlayers.org].
	}}		}}
	{{wcagCheck		{{wcagCheck

Manual:Extension/BlueSpicePermissionManager

Margit.link-rodrigue — Thu, 01 Oct 2026 07:13:22 GMT

← Older revision		Revision as of 07:13, 1 October 2026
Line 270:		Line 270:
	* Category pages: All pages in the namespace ''Category''		* Category pages: All pages in the namespace ''Category''

	=== ~~Limited transclusion~~ ===		=== Transclusion of read-restricted content ===
	~~If you explicitly assign the ''reader'' role (or any other role~~ that ~~contains the ''read'' permission)~~ in a namespace to ~~a group or groups,~~ that namespace ~~is automatically configured so that '''its content cannot be transcluded'''~~. ~~This is for security reasons, since MediaWiki does not check permissions when transcluding content~~.		Content that is transcluded from a page in a read-restricted namespace is only shown to users who have read-permissions in that namespace. All other users only see a linked reference to the source page.

	==Technical info==		==Technical info==

Pagedraft:Manual:Extension/SimpleCharts

Bhuber — Tue, 29 Sep 2026 14:04:21 GMT

Security:Security Advisories/BSSA-2026-06

Rvogel1 — Tue, 29 Sep 2026 06:03:44 GMT

← Older revision		Revision as of 06:03, 29 September 2026
(One intermediate revision by the same user not shown)
Line 29:		Line 29:
	\|-		\|-
	\|CVE-2026-100382		\|CVE-2026-100382
	\|~~<code>bluespice/wiki</code>~~		\|[[mediawikiwiki:Extension:External_Data\|Extension:ExternalData]]
	\|Remote Code Execution		\|Remote Code Execution
	\| style="" class="col-purple-bg" \|affected		\| style="" class="col-purple-bg" \|affected
Line 42:		Line 42:
	\| style="vertical-align:middle;text-align:left;" \|CVE-2026-100382		\| style="vertical-align:middle;text-align:left;" \|CVE-2026-100382
	\| style="vertical-align:middle;text-align:left;" class="col-purple-bg" \|Attackers with "read" permission can execute arbitrary commands in context of the <code>wiki-web</code> container		\| style="vertical-align:middle;text-align:left;" class="col-purple-bg" \|Attackers with "read" permission can execute arbitrary commands in context of the <code>wiki-web</code> container
	\| style="vertical-align:middle;text-align:left;" \|Deactivate Extension:ExternalData		\| style="vertical-align:middle;text-align:left;" \|Deactivate [[mediawikiwiki:Extension:External_Data\|Extension:ExternalData]]
	\|}		\|}

Line 52:		Line 52:
	* From 2026-09-26: mass automated scanning and exploitation, observed by us and other MediaWiki operators.		* From 2026-09-26: mass automated scanning and exploitation, observed by us and other MediaWiki operators.
	* Assume the exposure window runs '''from 2026-09-25 until the moment you applied the mitigation below'''.		* Assume the exposure window runs '''from 2026-09-25 until the moment you applied the mitigation below'''.
			* Since 2026-09-28, Extension:ExternalData has been disabled on all wikis hosted on <code>bluespice.cloud</code>. See also section [[#Effects_of_disabling\|Effects of disabling]].

	=== 2. Secure the evidence first ===		=== Secure the evidence first ===

	{{Textbox\|boxtype=important\|header='''Important:''' <code>docker compose down</code> removes the containers '''and their logs'''\|text=The nginx access log of <code>wiki-web</code> is written to stdout, so it only exists in the Docker log of the container. Save the evidence '''before''' you restart anything\|icon=yes}}		{{Textbox\|boxtype=important\|header='''Important:''' <code>docker compose down</code> removes the containers '''and their logs'''\|text=The nginx access log of <code>wiki-web</code> is written to stdout, so it only exists in the Docker log of the container. Save the evidence '''before''' you restart anything\|icon=yes}}

	=== 3. Detect an attack in the logs ===		=== Detect an attack in the logs ===
	Exploitation uses the parser function <code>#get_program_data</code>. It appears in the query string of requests to <code>api.php</code> or <code>index.php</code>.		Exploitation uses the parser function <code>#get_program_data</code>. It appears in the query string of requests to <code>api.php</code> or <code>index.php</code>.

Line 92:		Line 93:
	- ./040-BlueSpiceProDistribution.php:/app/bluespice/w/settings.d/040-BlueSpiceProDistribution.php:ro		- ./040-BlueSpiceProDistribution.php:/app/bluespice/w/settings.d/040-BlueSpiceProDistribution.php:ro
	# same for wiki-task and wiki-installer		# same for wiki-task and wiki-installer
	</syntaxhighlight>'''Drawback:''' the copied file is tied to the exact image version. After an update it would overwrite the new version's file. Remove this mount before or together with the next update~~. For this reason option B is preferred~~.		</syntaxhighlight>'''Drawback:''' the copied file is tied to the exact image version. After an update it would overwrite the new version's file. Remove this mount before or together with the next update.

	==== Effects of disabling ====		==== Effects of disabling ====
Line 102:		Line 103:
	./bluespice-deploy down		./bluespice-deploy down
	./bluespice-deploy up -d		./bluespice-deploy up -d
	</syntaxhighlight>{{Textbox\|boxtype=important\|header=\|text='''Never''' use <code>down -v</code> or <code>down --volumes</code>. Also do not delete <code>${DATADIR}</code>. That would delete the persistent wiki data.\|icon=yes}}Recreating the containers removes everything an attacker changed '''inside''' the containers. It does '''not''' clean the persistent data in <code>${DATADIR}</code> (database, uploads, configuration files on the volume)~~. Check those as described in section 7~~. '''Verify''' that the extension is disabled:<syntaxhighlight lang="bash">		</syntaxhighlight>{{Textbox\|boxtype=important\|header=\|text='''Never''' use <code>down -v</code> or <code>down --volumes</code>. Also do not delete <code>${DATADIR}</code>. That would delete the persistent wiki data.\|icon=yes}}Recreating the containers removes everything an attacker changed '''inside''' the containers. It does '''not''' clean the persistent data in <code>${DATADIR}</code> (database, uploads, configuration files on the volume). '''Verify''' that the extension is disabled:<syntaxhighlight lang="bash">
	docker exec bluespice-wiki-web grep -rn "ExternalData" /app/bluespice/w/settings.d/		docker exec bluespice-wiki-web grep -rn "ExternalData" /app/bluespice/w/settings.d/
	# Must NOT list "External Data":		# Must NOT list "External Data":
Line 136:		Line 137:
	# Remove any backdoor accounts, bot passwords and OAuth consumers you found. Revert manipulated interface pages.		# Remove any backdoor accounts, bot passwords and OAuth consumers you found. Revert manipulated interface pages.
	# Check the host and the network for unusual activity: outgoing connections of the Docker host, firewall logs and access to internal systems from the Docker network.		# Check the host and the network for unusual activity: outgoing connections of the Docker host, firewall logs and access to internal systems from the Docker network.

			=== See also ===

			* [https://lists.wikimedia.org/hyperkitty/list/mediawiki-l@lists.wikimedia.org/thread/5N55R3XNFE7BXQLGWKZI7Q4ZXZSF4C5I/ Thread on <code>mediawiki-l</code> mailing list] - contains additional information about the issue

Security:Security Advisories

Rvogel1 — Mon, 28 Sep 2026 14:37:52 GMT

← Older revision		Revision as of 14:37, 28 September 2026
Line 10:		Line 10:
	\|2026-09-28		\|2026-09-28
	\|Security vulnerability in ExternalData extension		\|Security vulnerability in ExternalData extension
	\|[https://~~access~~.~~redhat~~.~~com/security~~/cve/~~cve~~-2026-100382 CVE-2026-100382]		\|[https://www.strix.ai/cve/CVE-2026-100382 CVE-2026-100382]
	\|Remote code execution		\|Remote code execution
	\| style="" class="col-purple-bg" \|Critical		\| style="" class="col-purple-bg" \|Critical

Security:Security Advisories/BSSA-2026-06

Rvogel1 — Mon, 28 Sep 2026 14:37:25 GMT

← Older revision		Revision as of 14:37, 28 September 2026
Line 18:		Line 18:
	\|CVE		\|CVE
	\|		\|
	* [https://~~access~~.~~redhat~~.~~com/security~~/cve/~~cve~~-2026-100382 CVE-2026-100382]		* [https://www.strix.ai/cve/CVE-2026-100382 CVE-2026-100382]
	\|}		\|}

Security:Security Advisories

Mglaser — Mon, 28 Sep 2026 14:32:14 GMT

← Older revision		Revision as of 14:32, 28 September 2026
Line 6:		Line 6:
	! style="" \|Summary		! style="" \|Summary
	!Severity		!Severity
			\|-
			\|[[Security:Security Advisories/BSSA-2026-06\|BSSA-2026-06]]
			\|2026-09-28
			\|Security vulnerability in ExternalData extension
			\|[https://access.redhat.com/security/cve/cve-2026-100382 CVE-2026-100382]
			\|Remote code execution
			\| style="" class="col-purple-bg" \|Critical
	\|-		\|-
	\|[[Security:Security Advisories/BSSA-2026-05\|BSSA-2026-05]]		\|[[Security:Security Advisories/BSSA-2026-05\|BSSA-2026-05]]

Security:Security Advisories/BSSA-2026-06

Rvogel1 — Mon, 28 Sep 2026 13:44:18 GMT

@@ Line 41: / Line 41: @@
 |-
 | style="vertical-align:middle;text-align:left;" |CVE-2026-100382
-| style="vertical-align:middle;text-align:left;" class="col-purple-bg" |
+| style="vertical-align:middle;text-align:left;" class="col-purple-bg" |Attackers with "read" permission can execute arbitrary commands in context of the <code>wiki-web</code> container
-| style="vertical-align:middle;text-align:left;" |
+| style="vertical-align:middle;text-align:left;" |Deactivate Extension:ExternalData
 |}
 == Solution ==
-TBD

Security:Security Advisories/BSSA-2026-06

Rvogel1 — Mon, 28 Sep 2026 12:56:29 GMT

Created page with "{| class="wikitable" |+ ! ! |- |Date |2026-09-28 |- |Severity |reported "critical", BlueSpice assessment: '''critical''' |- |Affected |<code>bluespice/wiki</code> Docker image (all versions) |- |Fixed in |Unknown |- |CVE | * [https://access.redhat.com/security/cve/cve-2026-100382 CVE-2026-100382] |} == Problem == {| class="wikitable" style="width: 100%;" !'''CVE''' !'''Component''' !'''Type of vulnerability''' !'''BlueSpice 5''' |- |CVE-2026-100382 |<code>bluespice/wiki..."

New page

{| class="wikitable"
|+
!
!
|-
|Date
|2026-09-28
|-
|Severity
|reported "critical", BlueSpice assessment: '''critical'''
|-
|Affected
|<code>bluespice/wiki</code> Docker image (all versions)
|-
|Fixed in
|Unknown
|-
|CVE
|
* [https://access.redhat.com/security/cve/cve-2026-100382 CVE-2026-100382]
|}

== Problem ==
{| class="wikitable" style="width: 100%;"
!'''CVE'''
!'''Component'''
!'''Type of vulnerability'''
!'''BlueSpice 5'''
|-
|CVE-2026-100382
|<code>bluespice/wiki</code>
|Remote Code Execution
| style="" class="col-purple-bg" |affected
|}

== Impact assessment ==
{| class="wikitable" style="width: 100%;"
!CVE
!Assessment
!Mitigation without update
|-
| style="vertical-align:middle;text-align:left;" |CVE-2026-100382
| style="vertical-align:middle;text-align:left;" class="col-purple-bg" |
| style="vertical-align:middle;text-align:left;" |
|}

== Solution ==
TBD

Setup:Installation Guide/Advanced/Maintenance scripts

Margit.link-rodrigue — Fri, 25 Sep 2026 08:16:09 GMT

← Older revision		Revision as of 08:16, 25 September 2026
Line 19:		Line 19:

	* [[mediawikiwiki:Manual:CreateAndPromote.php\|createAndPromote.php]]: <br />creates a new user or modifies an existing user. For the corresponding user, the script can then grant additional rights (e.g. sysop, bureaucrat or bot rights) and change the user's password.		* [[mediawikiwiki:Manual:CreateAndPromote.php\|createAndPromote.php]]: <br />creates a new user or modifies an existing user. For the corresponding user, the script can then grant additional rights (e.g. sysop, bureaucrat or bot rights) and change the user's password.
	* [[Setup:Installation Guide/Advanced/Maintenance scripts/BlockInactiveUsers\|BlockInactiveUsers.php]]:{{Bsvs\|bsvTo=\|bsvFrom=5}} <br />automatically deactivates users based on their last login timestamp.



	__FORCETOC__		__FORCETOC__

Pagedraft:Manual:Extension/SimpleCharts

Margit.link-rodrigue — Tue, 15 Sep 2026 14:14:30 GMT

Pagedraft:Manual:Extension/KPIVisuals

Margit.link-rodrigue — Tue, 15 Sep 2026 14:12:08 GMT

Pagedraft:Manual:Extension/SpreadsheetFileReader

Margit.link-rodrigue — Tue, 15 Sep 2026 13:25:48 GMT

Manual:Extension/Forms/5.1.1

Hjing — Tue, 15 Sep 2026 12:59:41 GMT

Send email

← Older revision		Revision as of 12:59, 15 September 2026
Line 57:		Line 57:
	* '''Subject:''' Existing form fields can be used as variables here. The value is taken from the form.		* '''Subject:''' Existing form fields can be used as variables here. The value is taken from the form.

	* '''Content:''' As in the subject, existing form fields can also be used as variables here. The value is taken from the form.		* '''Content:''' As in the subject, existing form fields can also be used as variables here. The value is taken from the form. The content should be longer than 10 characters.


Line 63:		Line 63:
	{{int:Mailsubject\| {{{name}}}\|{{{surname}}} }}		{{int:Mailsubject\| {{{name}}}\|{{{surname}}} }}
	</syntaxhighlight>		</syntaxhighlight>


	==Adjust the styling==		==Adjust the styling==

Manual:Extension/Forms

Hjing — Tue, 15 Sep 2026 12:59:20 GMT

Alternative Target: E-mail

← Older revision		Revision as of 12:59, 15 September 2026
Line 67:		Line 67:
	* '''Subject:''' Existing form fields can be used as variables here. The value is taken from the form.		* '''Subject:''' Existing form fields can be used as variables here. The value is taken from the form.

	* '''Content:''' As in the subject, existing form fields can also be used as variables here. The value is taken from the form.		* '''Content:''' As in the subject, existing form fields can also be used as variables here. The value is taken from the form. The content should be longer than 10 characters.


Line 73:		Line 73:
	{{int:Mailsubject\| {{{name}}}\|{{{surname}}} }}		{{int:Mailsubject\| {{{name}}}\|{{{surname}}} }}
	</syntaxhighlight>		</syntaxhighlight>


	==Alternative Target: Template==		==Alternative Target: Template==

Pagedraft:Manual:Extension/SimpleCharts

Margit.link-rodrigue — Tue, 15 Sep 2026 12:48:18 GMT

Pagedraft:Manual:Extension/PageExcerpts

Margit.link-rodrigue — Tue, 15 Sep 2026 07:15:27 GMT

Pagedraft:Manual:Extension/KPIVisuals

Margit.link-rodrigue — Mon, 14 Sep 2026 15:38:48 GMT

Setup:System requirements

Margit.link-rodrigue — Mon, 07 Sep 2026 08:58:22 GMT

no content change, only re-ordering of content

← Older revision		Revision as of 08:58, 7 September 2026
Line 13:		Line 13:


			If you need a different type of installation, please [https://bluespice.com/contact/ contact us].\|icon=yes}}

			=== Operating System===
	BlueSpice supports Linux only. Native installation on Windows Server is no longer supported.		BlueSpice supports Linux only. Native installation on Windows Server is no longer supported.

			{{Textbox
	~~If you need a different type of~~ installation~~, please [https:~~//~~bluespice~~.~~com~~/~~contact/ contact us~~].\|icon=yes}}		\|boxtype=important
			\|header=No support for <code>ARM</code>
			\|text=Currently, installation is only supported on <code>x86</code>/<code>x64</code> architecture. This is especially true when using [[Setup:Installation_Guide/Docker\|Docker]].
			\|icon=yes
			}}

	=== Basic Hardware Requirements ===		=== Basic Hardware Requirements ===
Line 32:		Line 39:

	* OpenSearch 2.x with <code>ingest-attachments</code> plugin		* OpenSearch 2.x with <code>ingest-attachments</code> plugin
	~~{{Textbox~~
	~~\|boxtype=important~~
	~~\|header=No support for <code>ARM</code>~~
	~~\|text=Currently, installation is only supported on <code>x86</code>/<code>x64</code> architecture. This is especially true when using [[Setup:Installation_Guide/Docker\|Docker]].~~
	~~\|icon=yes~~
	}}

	[[de:Setup:Systemanforderungen]]		[[de:Setup:Systemanforderungen]]
	[[Category:Setup]]		[[Category:Setup]]

Archive:Accessibility/VPAT BS4

Margit.link-rodrigue — Mon, 07 Sep 2026 07:11:29 GMT

← Older revision		Revision as of 07:11, 7 September 2026
Line 1:		Line 1:
	{{Textbox\|boxtype=important\|header=Outdated report\|text=~~This page contains outdated information.~~ For the latest reports, see https://en.wiki.bluespice.com/wiki/Accessibility\|icon=yes}}		{{Textbox\|boxtype=important\|header=Outdated report\|text=For the latest reports, see https://en.wiki.bluespice.com/wiki/Accessibility\|icon=yes}}

	==Report Info==		==Report Info==