I'm going to merge this into T10517 which discusses making build variables extensible. See that task for some more discussion of similar issues.

Yes, this is consistent with running bin/storage upgrade from master, then switching to stable.

From a cursory read of CVE-2016-10045, it seems like PHP may be written in such a way that mail() can not be invoked safely. Silly PHP!

If this was available as a variable, wouldn't you have to make all those changes to Harbormaster build plans anyway? Why is it impossible to change the plans to use a constant, but possible to change them to use a variable?

Why does this need to be a variable? That is, why can't you just hard-code the value in place of having a variable?

This appears to be the fix:

Note that there is a Sender-related RCE in PHPMailer until Dec 2016, see T12046 for discussion.

Although this wording is a little unclear, commandeering makes you the author. A more precise wording would be something like "The current author for this revision is X. It was created on Y." but that's clunky and only smooths out this particular case.

Can you show us the output of these commands?

See some discussion starting here:

Yes. I think we had a similar element at some point, but removed it in a design update some time ago because it felt visually busy/redundant, particularly across other object types. If you do a lot of copy/pasting into Google Docs, the utility might overwhelm the visual repetition, though.

This will link both:

Concretely, since this is presumably about the WMF install and you already maintain patches, this is the one-line edit required to make the change you're asking for:

One vague idea is that it may be possible to use a Google Docs plugin. The "Google Apps Script" development environment was a bit of a test in patience the last time I used it, but basically you can write "Add-Ons" and publish them to the "Google Apps Store", and then users can install them. This is sort of the starting point:

After D17103, at HEAD of master:

I think the scenario is:

Oh, and D15263 was specifically to improve double-click behavior, although that was just me rather than external users (I double-click to select frequently).

@chad, you may have thoughts on this or remember related product stuff better than I do.

Yeah, I'm just going to merge this into T5505 since I think it's a subset of the first feature discussed there. This will probably be the major feature in the next iteration of Legalpad, since I think it's the most obvious thing we're missing:

Users @techhelpuk and @antivirussupportuk each created one new Calendar event this morning, offering help with anti-virus software instead of printers and encouraging users to call new numbers.

Hmm, I don't see that one in the upstream either. Maybe your origin is also a fork?

What does this show, when run in your local working copy?

Also, is metamta.email-body-limit set to something crazy? I think that only means main-body (not body + attachments) right now, but it should probably mean body + attachments + headers.

Oh, never mind, that's the Differential patch responding to the commit, so metamta.diffusion.byte-limit isn't relevant.

Thanks, I'll take a more in-depth look at this.

JIRA actually seems fine: arc, web UI, and both the integrations (link / post) work properly for me at HEAD of master.

Thanks, I think D17097 should fix this. It isn't intended, and is just a curious artifact of some other behaviors.

Alright, I'm actually having trouble reproducing this. Here's what I tried:

I wasn't immediately able to reproduce this:

I strongly suspect this report has enough information to let us replicate the issue locally, so you don't need to take any further action yet. I'll follow up if I have difficulty replicating it and we can figure out what differs between my synthetic test case and your real environment.

You can create your own link to tasks in a few seconds; the extension above will reduce this further. I don't plan to bring a global, hard-coded "Open Tasks" link to the upstream.

(2) and (3) are correct.

I think global + personal makes sense -- we'd want to put stuff like "New Bug Report" / "New Feature Request" there on this install, I think.

I think these are all reasonable things to want to do.

I see cat :)