Extension:Asksql
From mediawiki.org
Warning: The code or configuration described here poses a major security risk.
Problem: Vulnerable to SQL injection attacks, because it passes user input directly into SQL commands. This may lead to user accounts being hijacked, wiki content being compromised, private data being leaked, malware being injected, and the entire wiki content being erased, among other things.
Solution: make proper use of MediaWiki's database class instead of concatenating raw sql
Site administrators: You are advised against using it until this security issue is resolved.
Problem: Vulnerable to SQL injection attacks, because it passes user input directly into SQL commands. This may lead to user accounts being hijacked, wiki content being compromised, private data being leaked, malware being injected, and the entire wiki content being erased, among other things.
Solution: make proper use of MediaWiki's database class instead of concatenating raw sql
This extension is currently not actively maintained! Although it may still work, any bug reports or feature requests will more than likely be ignored.
If you are interested in taking on the task of developing and maintaining this extension, you can request repository ownership. As a courtesy, you may want to contact the author. You should also remove this template and list yourself as maintaining the extension in the page's {{Extension }} infobox.
Release status: unmaintained |
|
|---|---|
| Implementation | Special page , Database |
| Description | Allows SQL queries through a special page in the wiki, without opening phpMyAdmin etc. |
| Author(s) | Brion Vibber |
| Latest version | 2008年01月31日 (2008年01月31日) |
| MediaWiki | 1.12+ |
|
asksql |
|
| Licence | GNU General Public License (any version) |
| Download | |
| Translate the Asksql extension if it is available at translatewiki.net | |
Asksql extension allows you to do SQL queries through Special:Asksql in the wiki, without opening phpMyAdmin etc.
Warning Warning: Dangerous if not configured properly!
Installation
- Download and move the extracted
Asksqlfolder to yourextensions/directory.
Developers and code contributors should install the extension from Git instead, using:cdextensions/ gitclonehttps://gerrit.wikimedia.org/r/mediawiki/extensions/Asksql - Add the following code at the bottom of your LocalSettings.php file:
require_once "$IP/extensions/Asksql/Asksql.php"; $wgGroupPermissions['bureaucrat']['asksql'] = true;
- Yes Done – Navigate to
Special:Versionon your wiki to verify that the extension is successfully installed.
Configuration
On the individual pages for these settings, it says deprecated in 1.5, since this extension was split from core mediawiki in that version. If you've installed the extension, these settings apply regardless.
$wgAllowSysopQueries- Set to allow sysop queries (set totrueby default).$wgDBsqlpassword- The password for $wgDBsqluser.$wgDBsqluser- The SQL user used for queries.