768894 - Kuma Security Review

Status: RESOLVED DUPLICATE of bug 662860

(mozilla.org :: Security Assurance: Review Request, task)

Description

[John Karahalis [:openjck]]

I just started as the MDN project manager two weeks ago. Please don't kill me. /me ducks under table.

This is a large project. From what I understand, Adam is aware of our work but an official security bug has not yet been submitted.

Contact:
John Karahalis ([e-mail])

Description:
Kuma is a custom wiki platform for the Mozilla Developer Network. Previously, we used Mindtouch (http://www.mindtouch.com/) to power the site. Kuma supports everything you would expect a wiki to support -- user login, editing pages, uploading files, and much more.

More information:
https://wiki.mozilla.org/MDN/Kuma

Urgency:
The goal is to launch Kuma on July 15, 2012.

Related Goals:
* Organization wide: Grow Mozilla
* Developer Engagement: Provide a highly available, flexible MDN site to meet developer needs

Does this affect any product or service the Mozilla ships to end users?
Yes, the Mozilla Developer Network.

Are there any portions of the project that interact with 3rd party services?
No.

Will your application/service collect user data? If so, please describe?
Email addresses, edit contributions, anything listed on user profile pages (https://developer.mozilla.org/en-US/profiles/John%20Karahalis)

Desired date of review:
As soon as possible.

Comment 1

[John Karahalis [:openjck]]

Code lives at:
https://github.com/mozilla/kuma

Developer instance at:
https://developer-dev.allizom.org/en-US/

Comment 2

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

Is this the same as 662860?

Comment 3

[John Karahalis [:openjck]]

Looks like I don't have access to bug 662860.

Comment 4

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

:openjck - I added you to the bug

Comment 5

[John Karahalis [:openjck]]

Thanks. That does look to be the same thing. I'll mark this one as dupe and copy some new information over.

Comment 7

[Adam Muntner [:adamm] (use NEEDINFO)]

Is this still a comprehensive list of the features?

https://bugzilla.mozilla.org/show_bug.cgi?id=662860#c2

Comment 8

[John Karahalis [:openjck]]

Unfortunately, that is out of date.

The most accurate list of features is the repo history itself, though the team has done a pretty good job opening a bug for each feature.

I can put together a more up-to-date feature list if it would help. Warning though, it will be long.

Comment 9

[John Karahalis [:openjck]]

Also, it was discovered that we already have a bug for this. Please see bug 662860, which this bug is marked as a dupe of.