⚓ T161647 RFC: Deprecate using php serialization inside MediaWiki

⚓ T161647 RFC: Deprecate using php serialization inside MediaWiki
Page Menu
Phabricator
Create Task
Maniphest
T161647
RFC: Deprecate using php serialization inside MediaWiki
Closed, Resolved
Public
Actions
Edit Task
Edit Related Tasks...
Create Subtask
Edit Parent Tasks
Edit Subtasks
Merge Duplicates In
Close As Duplicate
Edit Related Objects...
Edit Commits
Edit Mocks
Mute Notifications
Protect as security issue
Assigned To
daniel
Authored By
Bawolff
Mar 28 2017, 8:53 PM
2017-03-28 20:53:49 (UTC+0)
Tags
Services (watching)
TechCom-RFC (TechCom-RFC-Closed)
(Implemented)
Platform Team Legacy (Watching / External)
TechCom
(In progress)
Security
Patch-For-Review
Referenced Files
None
Subscribers
Agabi10
Aklapper
Bawolff
brooke
Catrope
daniel
GWicke
View All 22 Subscribers
Description
The first version of this convention has since been published.
See
mw:Coding conventions/PHP § Don't use built in serialization
Problem statement
PHP
unserialize()
and
serialize()
can execute code when given malicious input. In most cases this serialization format is unnecessary. As a hardening measure against making a mistake that could result in remote code execution, we should avoid this format, even in cases where the serialized data is stored in a trusted data-store (such as the db).
Threats this rfc is intended to counter:
A bug in MediaWiki allows a user to inject untrusted data into an unserialize call. Removing unserialize reduces the potential for mistakes.
An attacker somehow obtains write access to either the database or memcache, and wants to extend his/her access to arbitrary code execution.
Proposed guideline
This RFC proposes the following:
New code SHOULD use JSON instead of PHP serialization whenever possible for serializing data.
Serialization of primitive values and key-value structures MUST never use PHP serialization.
Any edge cases that require use of serialize or unserialize complicated classes, MUST protect the serialized blob with HMAC (e.g. keyed to
$wgSecretKey
) to protect against malicious modifications of the blob. This logic should be implemented in a class (e.g.
MWSerializeWrapper
) to avoid copy-pasted code all over the place
Using unserialize is fine if the data never leaves the current process. In particular
$clone = unserialize( serialize( $obj ) )
In addition to the new guideline for new code, this RFC proposes that we start to (slowly) convert existing uses of PHP serialization including old data in the db. Most likely by using JSON. The eventual goal being to remove all legacy uses of php
unserialize()
Good first candidates for conversion:
LocalisationCache
MediaHandler metadata. This is particularly risky because the API will unserialize regardless of which MediaHandler class is in use.
Things still allowed under this RFC
Using php serialization on data that we never ingest (
unserialize
) is fine. In particular the php serialization output format of the API is outside of the scope of this RFC.
Using unserialize is fine if the data never leaves the current process. In particular using
$clone = unserialize( serialize( $obj ) )
as a hack to create a deep clone is fine.
Unanswered questions
How to deal with memcached. We could potentially use a custom memcache client - we already have a php implementation. Its unclear what sort of performance loss there would be compared to using the memcache php extension. We could also potentially modify the php memcache extension to do what we want. php Memcache also has a Memcached::SERIALIZER_JSON which is perhaps what we are looking for. More investigation is needed
Redis is similar to memcached. There is a SERIALIZER_NONE option we could perhaps use, and handle the serialization ourselves.
Details
Related Changes in Gerrit:
Subject
Repo
Branch
Lines +/-
Make Content JsonCodecable
mediawiki/core
REL1_43
+441
-2
Make Content JsonCodecable
mediawiki/core
REL1_44
+441
-2
Warn if PHP serialization of ParserOutput occurs
mediawiki/core
master
+7
-0
Turn on JSON serialization of Content in PageEditStashContent
mediawiki/core
master
+7
-4
Turn on JSON serialization for PageEditStash
mediawiki/core
master
+5
-7
Make Content JsonCodecable
mediawiki/core
master
+441
-2
Prepare to use JSON serialization for PageEditStash
mediawiki/core
master
+333
-92
Customize query in gerrit
Related Objects
Search...
Task Graph
Mentions
Status
Subtype
Assigned
Task
Resolved
daniel
T161647
RFC: Deprecate using php serialization inside MediaWiki
Open
None
T181555
Remove use of PHP serialization in revision storage
Resolved
Anomie
T183419
Determine how to update old compressed ExternalStore entries for T181555
Resolved
cscott
T398656
PageEditStash (and Content) should use JSON serialization
Open
None
T398151
Switch log_params serialization to json
Mentioned In
T407403: Error: Invalid serialization data for DatePeriod object
T381769: Potential RCE in Extension:ArticleFeedbackv5
T325707: Make the Message classes JSON serializable
T325703: Switch Echo serialization format from PHP to JSON
T323236: PHP Warning: Class RawMessage has no unserializer
T234455: Implement our own Memcached client to support pipelined operations (remove dependency on PECL)
T269034: 1.37 Remove support for PHP serialization from ParserCache
T303194: Gadgets extensions should not cache serialized PHP objects
T296610: MediumSpecificBagOStuff->guessSerialValueSize infinite loop when storing Title object (Special:Homepage throws "Maximum function nesting reached")
T291124: PHP Notice: Undefined index: format
T259111: PHP Notice: unserialize(): Error at offset 65519 of 65535 bytes (in LiquidThreads)
T274190: Make value objects in AbuseFilter JSON-Serializable
T274189: Remove usage of PHP serialization from WANObjectCache
T263579: Change ParserCache serialization format to JSON
T233963: Add serialization options to RESTBagOStuff
T233537: Document and communicate potentially breaking session storage serialization change
T233146: Cannot enable 2FA on testwiki
T222099: Staging release of RESTBagOStuff using Kask
T213802: Investigate ways to reduce the size of translate-groups cache key
T213006: Create a script to update afl_var_dump, drop back-compat code
T210528: PHP/HHVM serialization incompatibility in some situations when using Serializable
T203781: Allow Parser::VERSION to be bumped without immediately resetting the ParserCache
T199371: Improve security, stability, performance and scalability of MediaWiki (TEC1)
T197252: Can't correctly unserialize cached EntityRevision on WikibaseClient (Wikipedia)
T187153: Special:Abuselog throws when viewing details or examining (BadMethodCallException: Call get getId() on null)
T192946: Make gwtoolsetUploadMediafileJob JSON-serializable
T192945: Make EchoNotification job JSON-serializable
T192111: Make TranslationsUpdateJob JSON-serializable
T191024: Exception thrown while running DataSender::sendData in cluster codfw: Data should be a Document, a Script or an array containing Documents and/or Scripts
T190379: RFC: Re-establish the development policies
T185652: AutoProxyBlock uses unserialization on externally obtained php code
T169328: Protect against PHP code execution via memcached/unserialize
Mentioned Here
T169328: Protect against PHP code execution via memcached/unserialize
T161453: Having LocalisationCache directory default to system tmp directory is insecure
Event Timeline
There are a very large number of changes, so older changes are hidden.
Show Older Changes
daniel
moved this task from
Under discussion
to
P1: Define
on the
TechCom-RFC
board.
Jun 27 2017, 10:35 AM
2017-06-27 10:35:49 (UTC+0)
daniel
mentioned this in
T169328: Protect against PHP code execution via memcached/unserialize
Jun 30 2017, 12:41 PM
2017-06-30 12:41:12 (UTC+0)
Comment Actions
I have filed
T169328: Protect against PHP code execution via memcached/unserialize
for the memcached issue. It should not be part of this RFC. Making it policy to avoid unserialize() in PHP code is sensible regardless of the shortcomings of PHP's memcached library.
Ricordisamoa
subscribed.
Jul 4 2017, 9:11 AM
2017-07-04 09:11:17 (UTC+0)
daniel
moved this task from
P1: Define
to
P5: Last Call
on the
TechCom-RFC
board.
Jul 10 2017, 5:43 PM
2017-07-10 17:43:07 (UTC+0)
Comment Actions
As per the ArchCom meeting on July 5th, this RFC is entering the Last Call period. It will be approved for implementation if now pertinent issues remain unaddressed by July 19.
daniel
edited projects, added
TechCom-RFC (TechCom-RFC-Closed)
; removed
TechCom-RFC
Jul 20 2017, 1:04 PM
2017-07-20 13:04:45 (UTC+0)
Comment Actions
As per the ArchCom meeting on July 19th, this RFC has been approved for implementation. No concerns where raised during the last call period.
@Bawolff
now that this has been approved, can you turn this into a guideline on mediawiki.org? It should fit somehow with
I suppose, and it should also be mentioned on
CCicalese_WMF
added a project:
MediaWiki-Platform-Team-Archived (MWPT-Q2-Oct-Dec-2017)
Oct 13 2017, 9:23 PM
2017-10-13 21:23:07 (UTC+0)
Krinkle
moved this task from
Untriaged
to
Approved
on the
TechCom-RFC (TechCom-RFC-Closed)
board.
Nov 4 2017, 12:41 AM
2017-11-04 00:41:19 (UTC+0)
Anomie
created subtask
T181555: Remove use of PHP serialization in revision storage
Nov 28 2017, 7:13 PM
2017-11-28 19:13:03 (UTC+0)
Tgr
subscribed.
Dec 20 2017, 9:19 PM
2017-12-20 21:19:10 (UTC+0)
Comment Actions
PHP 7 introduces a class whitelist to
unserialize
. That protects against userland attacks, although not necessarily against PHP bugs. So I guess not a reason to reconsider but a good way to secure
unserialize
calls kept for B/C, once we bump the required PHP version.
Agabi10
subscribed.
Dec 20 2017, 11:47 PM
2017-12-20 23:47:24 (UTC+0)
CCicalese_WMF
moved this task from
MWPT-Q2-Oct-Dec-2017
to
Backlog
on the
MediaWiki-Platform-Team-Archived
board.
Dec 22 2017, 1:32 AM
2017-12-22 01:32:00 (UTC+0)
CCicalese_WMF
edited projects, added
MediaWiki-Platform-Team-Archived
; removed
MediaWiki-Platform-Team-Archived (MWPT-Q2-Oct-Dec-2017)
CCicalese_WMF
moved this task from
Backlog
to
MWPT-Q3-Jan-Mar-2018
on the
MediaWiki-Platform-Team-Archived
board.
CCicalese_WMF
edited projects, added
MediaWiki-Platform-Team-Archived (MWPT-Q3-Jan-Mar-2018)
; removed
MediaWiki-Platform-Team-Archived
Krinkle
moved this task from
Approved
to
In progress
on the
TechCom-RFC (TechCom-RFC-Closed)
board.
Jan 4 2018, 8:21 PM
2018-01-04 20:21:55 (UTC+0)
Mainframe98
mentioned this in
T185652: AutoProxyBlock uses unserialization on externally obtained php code
Jan 24 2018, 6:40 PM
2018-01-24 18:40:42 (UTC+0)
cicalese
moved this task from
Ready
to
In Progress
on the
MediaWiki-Platform-Team-Archived (MWPT-Q3-Jan-Mar-2018)
board.
Feb 11 2018, 10:33 PM
2018-02-11 22:33:17 (UTC+0)
CCicalese_WMF
moved this task from
In Progress
to
Watching
on the
MediaWiki-Platform-Team-Archived (MWPT-Q3-Jan-Mar-2018)
board.
Feb 27 2018, 2:49 AM
2018-02-27 02:49:41 (UTC+0)
Krinkle
mentioned this in
T190379: RFC: Re-establish the development policies
Mar 22 2018, 1:58 AM
2018-03-22 01:58:44 (UTC+0)
Pchelolo
mentioned this in
T191024: Exception thrown while running DataSender::sendData in cluster codfw: Data should be a Document, a Script or an array containing Documents and/or Scripts
Mar 29 2018, 4:08 PM
2018-03-29 16:08:24 (UTC+0)
CCicalese_WMF
edited projects, added
MediaWiki-Platform-Team-Archived (MWPT-Q4-Apr-Jun-2018)
; removed
MediaWiki-Platform-Team-Archived (MWPT-Q3-Jan-Mar-2018)
Apr 4 2018, 6:53 PM
2018-04-04 18:53:47 (UTC+0)
CCicalese_WMF
moved this task from
Ready
to
Watching
on the
MediaWiki-Platform-Team-Archived (MWPT-Q4-Apr-Jun-2018)
board.
Apr 4 2018, 6:55 PM
2018-04-04 18:55:56 (UTC+0)
Pchelolo
mentioned this in
T192111: Make TranslationsUpdateJob JSON-serializable
Apr 12 2018, 8:47 PM
2018-04-12 20:47:28 (UTC+0)
Pchelolo
mentioned this in
T192945: Make EchoNotification job JSON-serializable
Apr 24 2018, 5:48 PM
2018-04-24 17:48:45 (UTC+0)
Pchelolo
mentioned this in
T192946: Make gwtoolsetUploadMediafileJob JSON-serializable
daniel
mentioned this in
T187153: Special:Abuselog throws when viewing details or examining (BadMethodCallException: Call get getId() on null)
May 7 2018, 11:05 AM
2018-05-07 11:05:07 (UTC+0)
daniel
mentioned this in
T197252: Can't correctly unserialize cached EntityRevision on WikibaseClient (Wikipedia)
Jun 15 2018, 1:46 PM
2018-06-15 13:46:28 (UTC+0)
daniel
added a comment.
Jun 20 2018, 5:46 PM
2018-06-20 17:46:03 (UTC+0)
Comment Actions
This may be relevant:
Smalyshev
added a comment.
Jun 20 2018, 7:06 PM
2018-06-20 19:06:13 (UTC+0)
Comment Actions
Yes, this may reduce attack surface and eliminate the obvious and known issues. Though I can not promise there are no attacks that don't use classes that we need (or that classes that we may use are 100% secure against serialization attacks). Serialize is just too powerful and complex to be secure with arbitrary data...
OTOH, I think now that we are PHP 7 it may be worth checking into this just to have one more security layer there.
CCicalese_WMF
mentioned this in
T199371: Improve security, stability, performance and scalability of MediaWiki (TEC1)
Jul 11 2018, 9:33 PM
2018-07-11 21:33:39 (UTC+0)
CCicalese_WMF
removed a project:
MediaWiki-Platform-Team-Archived (MWPT-Q4-Apr-Jun-2018)
Jul 11 2018, 10:40 PM
2018-07-11 22:40:24 (UTC+0)
WMDE-leszek
subscribed.
Jul 18 2018, 11:04 AM
2018-07-18 11:04:14 (UTC+0)
xSavitar
subscribed.
Aug 12 2018, 10:21 PM
2018-08-12 22:21:57 (UTC+0)
Tgr
mentioned this in
T203781: Allow Parser::VERSION to be bumped without immediately resetting the ParserCache
Sep 7 2018, 5:09 PM
2018-09-07 17:09:27 (UTC+0)
Anomie
mentioned this in
T210528: PHP/HHVM serialization incompatibility in some situations when using Serializable
Nov 27 2018, 6:41 PM
2018-11-27 18:41:08 (UTC+0)
mobrovac
added a project:
Platform Team Legacy (Watching / External)
Dec 20 2018, 12:04 PM
2018-12-20 12:04:06 (UTC+0)
Daimona
mentioned this in
T213006: Create a script to update afl_var_dump, drop back-compat code
Jan 6 2019, 1:38 PM
2019-01-06 13:38:42 (UTC+0)
Tgr
added a comment.
Feb 9 2019, 2:41 AM
2019-02-09 02:41:47 (UTC+0)
Comment Actions
In
T161647#3852558
@Tgr
wrote:
PHP 7 introduces a class whitelist to
unserialize
. That protects against userland attacks, although not necessarily against PHP bugs.
Now that we have switched to PHP7, it would be a quick win to add an empty whitelist everywhere where we don't expect classes (MediaHandler, HistoryBlob, Message, SiteConfiguration (hopefully), LogEntry/RecentChanges, probably more).
sbassett
subscribed.
Feb 11 2019, 2:55 PM
2019-02-11 14:55:58 (UTC+0)
Nikerabbit
mentioned this in
T213802: Investigate ways to reduce the size of translate-groups cache key
Mar 7 2019, 1:54 PM
2019-03-07 13:54:01 (UTC+0)
Krinkle
added a project:
TechCom
Apr 9 2019, 1:42 AM
2019-04-09 01:42:54 (UTC+0)
Krinkle
subscribed.
Comment Actions
Tagging for TechCom internally to talk about this week. Specifically, what are the next steps? To document at
daniel
added a comment.
Apr 11 2019, 8:58 PM
2019-04-11 20:58:31 (UTC+0)
Comment Actions
I proposed an addition to the PHP coding conventions here:
Please chime in.
Pastakhov
subscribed.
Apr 17 2019, 7:22 PM
2019-04-17 19:22:33 (UTC+0)
daniel
moved this task from
Inbox
to
In progress
on the
TechCom
board.
Apr 17 2019, 8:32 PM
2019-04-17 20:32:50 (UTC+0)
Krinkle
closed this task as
Resolved
May 9 2019, 11:45 PM
2019-05-09 23:45:41 (UTC+0)
Krinkle
assigned this task to
daniel
Krinkle
updated the task description.
(Show Details)
daniel
mentioned this in
T222099: Staging release of RESTBagOStuff using Kask
Sep 19 2019, 9:09 PM
2019-09-19 21:09:57 (UTC+0)
Reedy
mentioned this in
T233146: Cannot enable 2FA on testwiki
Sep 19 2019, 9:29 PM
2019-09-19 21:29:07 (UTC+0)
BPirkle
mentioned this in
T233537: Document and communicate potentially breaking session storage serialization change
Sep 22 2019, 7:56 PM
2019-09-22 19:56:55 (UTC+0)
BPirkle
mentioned this in
T233963: Add serialization options to RESTBagOStuff
Sep 26 2019, 4:03 PM
2019-09-26 16:03:22 (UTC+0)
Krinkle
moved this task from
In progress
to
Implemented
on the
TechCom-RFC (TechCom-RFC-Closed)
board.
Oct 16 2019, 10:19 PM
2019-10-16 22:19:10 (UTC+0)
chasemp
added a project:
Security
Feb 10 2020, 10:58 PM
2020-02-10 22:58:51 (UTC+0)
chasemp
removed a project:
acl*security
Feb 20 2020, 8:17 PM
2020-02-20 20:17:29 (UTC+0)
daniel
mentioned this in
T263579: Change ParserCache serialization format to JSON
Oct 7 2020, 9:21 AM
2020-10-07 09:21:53 (UTC+0)
Aklapper
removed a subscriber:
Anomie
Oct 16 2020, 5:42 PM
2020-10-16 17:42:08 (UTC+0)
gerritbot
added a comment.
Feb 8 2021, 2:38 PM
2021-02-08 14:38:37 (UTC+0)
Comment Actions
Change 662714 had a related patch set uploaded (by Daniel Kinzler; owner: Daniel Kinzler):
[mediawiki/core@master] DNM: WANObjectCache: warn on non-JSONic values.
gerritbot
added a project:
Patch-For-Review
Feb 8 2021, 2:38 PM
2021-02-08 14:38:38 (UTC+0)
daniel
mentioned this in
T274189: Remove usage of PHP serialization from WANObjectCache
Feb 8 2021, 8:56 PM
2021-02-08 20:56:26 (UTC+0)
daniel
mentioned this in
T274190: Make value objects in AbuseFilter JSON-Serializable
Feb 8 2021, 9:00 PM
2021-02-08 21:00:38 (UTC+0)
Daimona
mentioned this in
T259111: PHP Notice: unserialize(): Error at offset 65519 of 65535 bytes (in LiquidThreads)
Mar 8 2021, 3:35 PM
2021-03-08 15:35:51 (UTC+0)
hashar
mentioned this in
T291124: PHP Notice: Undefined index: format
Sep 16 2021, 7:17 AM
2021-09-16 07:17:50 (UTC+0)
Tgr
mentioned this in
T296610: MediumSpecificBagOStuff->guessSerialValueSize infinite loop when storing Title object (Special:Homepage throws "Maximum function nesting reached")
Nov 29 2021, 6:42 AM
2021-11-29 06:42:25 (UTC+0)
Krinkle
mentioned this in
T303194: Gadgets extensions should not cache serialized PHP objects
Mar 7 2022, 4:19 PM
2022-03-07 16:19:08 (UTC+0)
Krinkle
mentioned this in
T269034: 1.37 Remove support for PHP serialization from ParserCache
Jun 8 2022, 5:34 PM
2022-06-08 17:34:06 (UTC+0)
Krinkle
mentioned this in
T234455: Implement our own Memcached client to support pipelined operations (remove dependency on PECL)
Oct 4 2022, 9:14 PM
2022-10-04 21:14:34 (UTC+0)
Reedy
mentioned this in
T323236: PHP Warning: Class RawMessage has no unserializer
Nov 21 2022, 2:03 AM
2022-11-21 02:03:16 (UTC+0)
Tgr
mentioned this in
T325703: Switch Echo serialization format from PHP to JSON
Dec 21 2022, 1:16 AM
2022-12-21 01:16:05 (UTC+0)
Reedy
mentioned this in
T325707: Make the Message classes JSON serializable
Dec 21 2022, 1:48 AM
2022-12-21 01:48:12 (UTC+0)
BlankEclair
mentioned this in
T381769: Potential RCE in Extension:ArticleFeedbackv5
Dec 9 2024, 1:25 PM
2024-12-09 13:25:08 (UTC+0)
cscott
added a subtask:
T398656: PageEditStash (and Content) should use JSON serialization
Jul 3 2025, 6:45 PM
2025-07-03 18:45:21 (UTC+0)
gerritbot
added a comment.
Jul 3 2025, 7:47 PM
2025-07-03 19:47:28 (UTC+0)
Comment Actions
Change #1165581 had a related patch set uploaded (by C. Scott Ananian; author: C. Scott Ananian):
[mediawiki/core@master] Use JSON serialization for PageEditStash
gerritbot
added a comment.
Jul 3 2025, 7:47 PM
2025-07-03 19:47:30 (UTC+0)
Comment Actions
Change #1165572 had a related patch set uploaded (by C. Scott Ananian; author: C. Scott Ananian):
[mediawiki/core@master] Warn if PHP serialization of ParserOutput occurs
gerritbot
added a comment.
Jul 3 2025, 7:47 PM
2025-07-03 19:47:31 (UTC+0)
Comment Actions
Change #1165592 had a related patch set uploaded (by C. Scott Ananian; author: C. Scott Ananian):
[mediawiki/core@master] Make Content JsonCodecable
gerritbot
added a comment.
Jul 3 2025, 7:47 PM
2025-07-03 19:47:33 (UTC+0)
Comment Actions
Change #1166243 had a related patch set uploaded (by C. Scott Ananian; author: C. Scott Ananian):
[mediawiki/core@master] Turn on JSON serialization for PageEditStash
gerritbot
added a comment.
Jul 3 2025, 7:47 PM
2025-07-03 19:47:36 (UTC+0)
Comment Actions
Change #1166244 had a related patch set uploaded (by C. Scott Ananian; author: C. Scott Ananian):
[mediawiki/core@master] Turn on JSON serialization of Content in PageEditStashContent
Ladsgroup
added a subtask:
T398151: Switch log_params serialization to json
Jul 3 2025, 10:17 PM
2025-07-03 22:17:05 (UTC+0)
gerritbot
added a comment.
Aug 19 2025, 8:57 PM
2025-08-19 20:57:23 (UTC+0)
Comment Actions
Change #1165581
merged
by jenkins-bot:
[mediawiki/core@master] Prepare to use JSON serialization for PageEditStash
gerritbot
added a comment.
Aug 20 2025, 9:23 PM
2025-08-20 21:23:33 (UTC+0)
Comment Actions
Change #1165592
merged
by jenkins-bot:
[mediawiki/core@master] Make Content JsonCodecable
gerritbot
added a comment.
Aug 29 2025, 5:21 PM
2025-08-29 17:21:47 (UTC+0)
Comment Actions
Change #1166243
merged
by jenkins-bot:
[mediawiki/core@master] Turn on JSON serialization for PageEditStash
gerritbot
added a comment.
Aug 29 2025, 5:21 PM
2025-08-29 17:21:55 (UTC+0)
Comment Actions
Change #1166244
merged
by jenkins-bot:
[mediawiki/core@master] Turn on JSON serialization of Content in PageEditStashContent
gerritbot
added a comment.
Sep 3 2025, 6:28 PM
2025-09-03 18:28:32 (UTC+0)
Comment Actions
Change #1165572
merged
by jenkins-bot:
[mediawiki/core@master] Warn if PHP serialization of ParserOutput occurs
gerritbot
added a comment.
Sep 5 2025, 7:44 PM
2025-09-05 19:44:29 (UTC+0)
Comment Actions
Change #1185190 had a related patch set uploaded (by C. Scott Ananian; author: C. Scott Ananian):
[mediawiki/core@REL1_43] Make Content JsonCodecable
gerritbot
added a comment.
Sep 5 2025, 7:44 PM
2025-09-05 19:44:57 (UTC+0)
Comment Actions
Change #1185191 had a related patch set uploaded (by C. Scott Ananian; author: C. Scott Ananian):
[mediawiki/core@REL1_44] Make Content JsonCodecable
gerritbot
added a comment.
Sep 8 2025, 5:21 PM
2025-09-08 17:21:03 (UTC+0)
Comment Actions
Change #1185191
merged
by jenkins-bot:
[mediawiki/core@REL1_44] Make Content JsonCodecable
gerritbot
added a comment.
Sep 8 2025, 5:24 PM
2025-09-08 17:24:34 (UTC+0)
Comment Actions
Change #1185190
merged
by jenkins-bot:
[mediawiki/core@REL1_43] Make Content JsonCodecable
cscott
closed subtask
T398656: PageEditStash (and Content) should use JSON serialization
as
Resolved
Sep 29 2025, 3:55 PM
2025-09-29 15:55:09 (UTC+0)
bd808
mentioned this in
T407403: Error: Invalid serialization data for DatePeriod object
Oct 15 2025, 8:29 PM
2025-10-15 20:29:49 (UTC+0)
Log In to Comment
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct.
Wikimedia Foundation
Code of Conduct
Disclaimer
CC-BY-SA
GPL
Credits