VersionControl:PRs/pickipedia/152
From PickiPedia: A knowledge base of bluegrass, old time psychedelic jams, and other public domain music
Jump to navigationJump to search
| State | 🔴 closed 2026-10-30 16:17:55 |
|---|---|
| Worked on by | not said |
| Moods | not said |
| Deploy | not said |
| Branch | preview-upload-progress-off → production, by magent-cryptograss
|
| Opened · last pushed | 2026-10-21 07:33:59 · 2026-10-21 07:33:54 |
Companion to maybelle-config#212. That PR turned off `session.upload_progress` for live PickiPedia. This one does the same for the image built from this repo's `Dockerfile`. Hunter runs that image for the preview wikis, and Caddy routes those publicly at `pickipedia.<user>.hunter.cryptograss.live`. Why: PHP's `session.upload_progress` use-after-free (CVE-2026-109618 / -109619) is reachable with default settings. MediaWiki never reads upload progress, so turning it off costs nothing. Exposure today is low. All five preview addresses returned 502 when I checked (21 Oct, 07:3xZ), so none was running. But any preview someone starts would otherwise come up with the setting on, publicly reachable, and in debug mode. Not built or tested here. It's two `echo` lines added to the existing ini block. 🤖 Generated with [Claude Code](https://claude.com/claude-code)