[00:00:25] 3Collaboration-Team-Current, 10Echo, 10Flow, 10Thanks, 6Security: HTML tags in flow titles are leaked on echo notifications - https://phabricator.wikimedia.org/T120291#1850321 (10Catrope) I've split off the XSS bug into {T120324}. This bug isn't a security bug, and it's nontrivial to fix. Echo messages a... [00:00:26] 3Collaboration-Team-Current, 10Flow, 5Patch-For-Review, 7Security-Extensions, 5WMF-deploy-2015-12-08_(1.27.0-wmf.8): XSS in Flow topic titles - https://phabricator.wikimedia.org/T120324#1851000 (10Jdforrester-WMF) a:3Catrope [00:00:42] 6Collaboration-Team-Backlog, 10Echo, 10Flow, 10Thanks: HTML tags in flow titles are leaked on echo notifications - https://phabricator.wikimedia.org/T120291#1851003 (10Catrope) p:5Triage>3Normal [00:01:06] (03PS2) 10Catrope: [SECURITY] Escape HTML characters in topic titles [extensions/Flow] - 10https://gerrit.wikimedia.org/r/256858 (https://phabricator.wikimedia.org/T120324) [00:07:56] 6Collaboration-Team-Backlog, 10Echo, 10Flow, 10Thanks: wikitext in flow titles is parsed (e.g. ) on echo notifications - https://phabricator.wikimedia.org/T120291#1851026 (10Legoktm) [00:09:08] 6Collaboration-Team-Backlog, 10Echo, 10Flow, 10Thanks: wikitext in flow titles is parsed (e.g. ) on echo notifications - https://phabricator.wikimedia.org/T120291#1851030 (10Jdforrester-WMF) I'm not against downgrading Notification text to plaintext-only. [00:09:16] 6Collaboration-Team-Backlog, 10Flow, 10MobileFrontend: The "All" and "Other" tabs on MobileFrontend watchlist show Flow gibberish topic ID links instead of topic titles - https://phabricator.wikimedia.org/T93565#1851032 (10QuimGil) Can someone explain in simple terms why the human readable titles that appear... [00:15:11] 3Collaboration-Team-Current, 10Echo, 10MediaWiki-extensions-OpenStackManager: Write presentation models for notifications in OpenStackManager - https://phabricator.wikimedia.org/T116853#1851045 (10Mooeypoo) a:3Mooeypoo [00:15:40] (03CR) 10Legoktm: [C: 032] [SECURITY] Escape HTML characters in topic titles [extensions/Flow] - 10https://gerrit.wikimedia.org/r/256858 (https://phabricator.wikimedia.org/T120324) (owner: 10Catrope) [00:16:52] 3Collaboration-Team-Current, 10Echo, 5Patch-For-Review, 5WMF-deploy-2015-11-10_(1.27.0-wmf.6), 5WMF-deploy-2015-12-08_(1.27.0-wmf.8): Write presentation models for notifications in Echo - https://phabricator.wikimedia.org/T116843#1851052 (10Mooeypoo) [00:19:31] (03Merged) 10jenkins-bot: [SECURITY] Escape HTML characters in topic titles [extensions/Flow] - 10https://gerrit.wikimedia.org/r/256858 (https://phabricator.wikimedia.org/T120324) (owner: 10Catrope) [00:20:02] 3Collaboration-Team-Current, 10Echo, 7Design, 5Patch-For-Review, and 2 others: Allow marking Echo notifications as unread - https://phabricator.wikimedia.org/T73564#1851065 (10Mooeypoo) This is blocked on the back end, as well. [00:52:12] (03CR) 10Catrope: [C: 04-1] Add OOUI widgets for cross-wiki bundled notifications (0333 comments) [extensions/Echo] - 10https://gerrit.wikimedia.org/r/247017 (https://phabricator.wikimedia.org/T115419) (owner: 10Mooeypoo) [00:54:49] 3Collaboration-Team-Current, 10Flow, 5Patch-For-Review, 7Regression, 5WMF-deploy-2015-12-08_(1.27.0-wmf.8): [betalabs] Flow\Exception\WikitextException on clicking deleted topic link from View history - https://phabricator.wikimedia.org/T119133#1851147 (10Catrope) 5Open>3Resolved [01:06:47] 3Collaboration-Team-Current, 10Flow: Brackets appear in history when topic title that contains link is changed - https://phabricator.wikimedia.org/T120329#1851160 (10Catrope) 3NEW [01:07:19] 10Pywikibot-Flow: Update Pywikibot for Flow change to topic title markup - https://phabricator.wikimedia.org/T111221#1851174 (10Catrope) [01:07:24] 3Collaboration-Team-Current, 10Flow, 5Patch-For-Review, 7Regression, and 3 others: Allow links in Flow topic titles - https://phabricator.wikimedia.org/T59153#1851170 (10Catrope) 5Open>3Resolved >>! In T59153#1822120, @Etonkovidova wrote: > 4) >>Watchlist -- >> For the post/reply/edit, the link should... [01:12:10] 3Collaboration-Team-Current, 10Flow: Parsoid failures trying to save or preview posts with @ mentions on mw.org (curl error: 26) - https://phabricator.wikimedia.org/T117938#1851182 (10Catrope) 5Open>3Resolved [01:12:28] 3Collaboration-Team-Current, 10Echo, 7Tracking: Write presentation models for all notification types (tracking) - https://phabricator.wikimedia.org/T116834#1851185 (10Catrope) [01:12:29] 3Collaboration-Team-Current, 10Echo, 10MediaWiki-extensions-BounceHandler, 5Patch-For-Review, 5WMF-deploy-2015-12-08_(1.27.0-wmf.8): Write presentation model for BounceHandler - https://phabricator.wikimedia.org/T116851#1851184 (10Catrope) 5Open>3Resolved [01:12:37] 3Collaboration-Team-Current, 10Echo, 7Tracking: Write presentation models for all notification types (tracking) - https://phabricator.wikimedia.org/T116834#1759474 (10Catrope) [01:12:38] 3Collaboration-Team-Current, 10Echo, 10MediaWiki-extensions-EducationProgram, 5Patch-For-Review, 5WMF-deploy-2015-12-08_(1.27.0-wmf.8): Write presentation models for notifications in EducationProgram - https://phabricator.wikimedia.org/T116850#1851186 (10Catrope) 5Open>3Resolved [01:17:27] 3Collaboration-Team-Current, 10Flow, 7Easy, 5Patch-For-Review, 5WMF-deploy-2015-12-08_(1.27.0-wmf.8): Use a single-line text area, for Flow moderation reasons, and allow submit on Enter - https://phabricator.wikimedia.org/T116226#1851190 (10Catrope) 5Open>3Resolved [01:19:02] 3Collaboration-Team-Current, 10Echo, 5WMF-deploy-2015-12-08_(1.27.0-wmf.8): API should expose enough structured data about notifications that frontend can render them - https://phabricator.wikimedia.org/T115418#1851201 (10Catrope) 5Open>3Resolved [01:19:03] 6Collaboration-Team-Backlog, 10Echo: Notifications panel: simplify notification items - https://phabricator.wikimedia.org/T114357#1851202 (10Catrope) [02:10:32] 3Collaboration-Team-Current, 10Flow, 5MW-1.27-release-notes, 5Patch-For-Review, and 2 others: XSS in Flow topic titles - https://phabricator.wikimedia.org/T120324#1851277 (10Legoktm) I audited the other callers of `Linker::formatLinksInComment()` (CentralAuth and LQT) and they both call the Sanitizer first... [02:10:46] 3Collaboration-Team-Current, 10Flow, 5Patch-For-Review, 7Security-Extensions, 5WMF-deploy-2015-12-08_(1.27.0-wmf.8): XSS in Flow topic titles - https://phabricator.wikimedia.org/T120324#1851279 (10Legoktm) [09:51:13] 10Pywikibot-Flow: Update Pywikibot for Flow change to topic title markup - https://phabricator.wikimedia.org/T111221#1851786 (10Liuxinyu970226) [11:40:38] (03PS2) 10Addshore: Remove unused imports [extensions/Flow] - 10https://gerrit.wikimedia.org/r/256676 (owner: 10Thiemo Mättig (WMDE)) [11:43:34] (03CR) 10Addshore: [C: 032] Remove unused imports [extensions/Flow] - 10https://gerrit.wikimedia.org/r/256676 (owner: 10Thiemo Mättig (WMDE)) [11:47:18] (03Merged) 10jenkins-bot: Remove unused imports [extensions/Flow] - 10https://gerrit.wikimedia.org/r/256676 (owner: 10Thiemo Mättig (WMDE)) [13:36:57] (03CR) 10Sbisson: Flow notification presentation models (032 comments) [extensions/Flow] - 10https://gerrit.wikimedia.org/r/251512 (https://phabricator.wikimedia.org/T116845) (owner: 10Sbisson) [13:37:31] (03CR) 10Sbisson: Flow notification presentation models (032 comments) [extensions/Flow] - 10https://gerrit.wikimedia.org/r/251512 (https://phabricator.wikimedia.org/T116845) (owner: 10Sbisson) [13:38:02] (03PS21) 10Sbisson: Flow notification presentation models [extensions/Flow] - 10https://gerrit.wikimedia.org/r/251512 (https://phabricator.wikimedia.org/T116845) [13:46:37] (03CR) 10Sbisson: "Looks good. One very minor thing." (031 comment) [extensions/Echo] - 10https://gerrit.wikimedia.org/r/256138 (https://phabricator.wikimedia.org/T114237) (owner: 10Mooeypoo) [14:33:43] (03PS7) 10Sbisson: [WIP] Include Flow topics in Nuke [extensions/Flow] - 10https://gerrit.wikimedia.org/r/256448 (https://phabricator.wikimedia.org/T115695) [15:50:17] (03CR) 10Matthias Mullie: [C: 031] Presentation model for edit-user-talk (031 comment) [extensions/Echo] - 10https://gerrit.wikimedia.org/r/253599 (https://phabricator.wikimedia.org/T116843) (owner: 10Sbisson) [15:55:48] (03CR) 10Matthias Mullie: [C: 031] Presentation model for page-linked (032 comments) [extensions/Echo] - 10https://gerrit.wikimedia.org/r/253634 (https://phabricator.wikimedia.org/T116843) (owner: 10Sbisson) [15:56:53] (03CR) 10Sbisson: Presentation model for edit-user-talk (031 comment) [extensions/Echo] - 10https://gerrit.wikimedia.org/r/253599 (https://phabricator.wikimedia.org/T116843) (owner: 10Sbisson) [15:58:24] (03CR) 10Sbisson: Presentation model for page-linked (031 comment) [extensions/Echo] - 10https://gerrit.wikimedia.org/r/253634 (https://phabricator.wikimedia.org/T116843) (owner: 10Sbisson) [16:03:28] (03PS14) 10Sbisson: Presentation model for page-linked [extensions/Echo] - 10https://gerrit.wikimedia.org/r/253634 (https://phabricator.wikimedia.org/T116843) [16:06:12] (03CR) 10Matthias Mullie: Presentation model for edit-user-talk (031 comment) [extensions/Echo] - 10https://gerrit.wikimedia.org/r/253599 (https://phabricator.wikimedia.org/T116843) (owner: 10Sbisson) [16:09:24] (03CR) 10Sbisson: Presentation model for edit-user-talk (031 comment) [extensions/Echo] - 10https://gerrit.wikimedia.org/r/253599 (https://phabricator.wikimedia.org/T116843) (owner: 10Sbisson) [16:14:18] 3Collaboration-Team-Current, 10MediaWiki-extensions-WikibaseView, 10Wikidata: [Task] Decide whether we want to use OOJS - https://phabricator.wikimedia.org/T117862#1852538 (10Jonas) 5Open>3Resolved [16:59:09] matt_flaschen: I am checking https://phabricator.wikimedia.org/T120160 - looks ok to me in beta and in mediawiki. Anything specific to check? [16:59:40] matt_flaschen: or it was broken in any specific way? [17:14:01] 3Collaboration-Team-Current, 10Flow, 5Patch-For-Review, 7Security-Extensions, 5WMF-deploy-2015-12-08_(1.27.0-wmf.8): XSS in Flow topic titles - https://phabricator.wikimedia.org/T120324#1852655 (10csteipp) 5Open>3Resolved The issue is resolved, so I'm going to close this. SBisson, if there are ways... [17:17:18] etonkovidova, no notifications were sent. [17:17:36] matt_flaschen: I see - ok then [17:17:39] 3Collaboration-Team-Current, 10Gather, 5Patch-For-Review: Notifications are broken (not being sent) - https://phabricator.wikimedia.org/T120160#1852666 (10Mattflaschen) [17:18:02] 3Collaboration-Team-Current, 10Gather, 5Patch-For-Review: Notifications are broken (not being sent) - https://phabricator.wikimedia.org/T120160#1846911 (10Mattflaschen) [17:20:35] 3Collaboration-Team-Current, 10Flow: Links in Flow topic titles: html code displayed when page scrolls up - https://phabricator.wikimedia.org/T119537#1852677 (10Etonkovidova) For testing after the fix - look also at {T120324} to check for the XSS case, e.g. ``` ``` [17:20:59] 3Collaboration-Team-Current, 10Gather, 5Patch-For-Review: Notifications are broken (not being sent) - https://phabricator.wikimedia.org/T120160#1852680 (10Etonkovidova) Checked in betalabs and mediawiki. [17:21:27] 3Collaboration-Team-Current, 10Flow, 5Patch-For-Review, 7Security-Extensions, 5WMF-deploy-2015-12-08_(1.27.0-wmf.8): XSS in Flow topic titles - https://phabricator.wikimedia.org/T120324#1850988 (10Etonkovidova) Checked in betalabs - title, reply, board description, summary look fine. There is the same... [17:22:59] 3Collaboration-Team-Current, 10Flow, 5Patch-For-Review, 7Security-Extensions, 5WMF-deploy-2015-12-08_(1.27.0-wmf.8): XSS in Flow topic titles - https://phabricator.wikimedia.org/T120324#1852696 (10SBisson) > SBisson, if there are ways I can support the Collab team's QA process to make sure we don't have... [18:13:51] 3Collaboration-Team-Current, 10Gather: Notifications are broken (not being sent) - https://phabricator.wikimedia.org/T120160#1852808 (10Jdlrobson) [18:57:34] qui [18:57:48] quiddity: are you around? [18:58:11] stephanebisson, yes, just in another meeting. Whatsup? [18:58:24] quiddity: are you personally a Nuke user? [18:58:49] stephanebisson, i don't have any experience with it, no. legoktm might. [18:58:53] I'm wondering how often 500 pages are deleted at a time... [18:59:05] ah, idk. [18:59:05] hehe I am :P [19:00:17] stephanebisson: most of my nuke runs are 2-3 pages, (I have a script that automatically sends me to nuke after I block spambots) I think the most I've ever done was 50 images after someone uploaded a bunch of copyvios. Never 500.... [19:01:07] legoktm: deleting 500 Flow topics takes minutes... [19:01:36] I can make it better but I don't know if it's ever gonna be quick [19:01:47] hitting timeouts with really large nukes is expected [19:02:12] It's not great, but it's not a huge deal either IMO [19:02:12] I'm thinking about imposing a 20 or 30 limit for Flow topic [19:03:21] legoktm: on my local env. the page timed out but the deletion process continued for a while, is it how it's going to behave in prod? [19:03:55] I kept refreshing the search page and results were falling off as they were being deleted in the background... [19:04:07] no, it'll get killed on the backend too [19:04:37] people will know to resubmit the form though [19:06:03] so people have to do it in batches anyway [19:06:28] wouldn't it be better to have a reasonable lower limit and generally expect it to work? [19:11:14] not really, because the point of Nuke is that it does bulk stuff :) [19:35:36] (03PS8) 10Sbisson: [WIP] Include Flow topics in Nuke [extensions/Flow] - 10https://gerrit.wikimedia.org/r/256448 (https://phabricator.wikimedia.org/T115695) [19:36:32] (03PS9) 10Sbisson: Include Flow topics in Nuke [extensions/Flow] - 10https://gerrit.wikimedia.org/r/256448 (https://phabricator.wikimedia.org/T115695) [19:36:35] (03CR) 10jenkins-bot: [V: 04-1] Include Flow topics in Nuke [extensions/Flow] - 10https://gerrit.wikimedia.org/r/256448 (https://phabricator.wikimedia.org/T115695) (owner: 10Sbisson) [19:55:29] 3Collaboration-Team-Current, 10Echo: Incomplete GENDER support for notification-mention and related messages - https://phabricator.wikimedia.org/T119321#1853139 (10SBisson) p:5Triage>3Normal a:3SBisson [20:04:08] mooeypoo: how did you test your OpenStackManager presentation model? [20:04:43] stephanebisson, yes... ha, with difficulty [20:04:57] so I fetched the extension and hooked it up manually in local settings [20:05:12] then I *manually* ran: [20:05:13] EchoEvent::create( array( 'type' => 'osm-instance-deleted', 'title' => Title::newFromText( $project, NS_NOVA_RESOURCE ), 'agent' => $user, 'extra' => array( 'instanceName' => $instanceName, 'projectName' => $project ) ) ); [20:05:44] fair enough [20:05:48] and the other 3 event types (I actually have them written if you want) [20:06:04] please [20:06:28] where $project = "someProject"; $instanceName = "someInstance" and user was createFromName( 'Moriel' ) or something like that [20:06:37] hang on let me bunch it up [20:07:29] 3Collaboration-Team-Current, 10Echo, 7Tracking: Write presentation models for all notification types (tracking) - https://phabricator.wikimedia.org/T116834#1853203 (10Addshore) [20:07:32] 3Collaboration-Team-Current, 10Echo, 10MediaWiki-extensions-Newsletter, 5Patch-For-Review: Write presentation model for Newsletter - https://phabricator.wikimedia.org/T116856#1853201 (10Addshore) 5Open>3Resolved [20:09:04] stephanebisson, http://pastebin.com/ag0dDif7 [20:09:17] I ran these through maintainance/eval.php [20:09:30] oh oh [20:09:36] thanks [20:09:42] crap, also for this to work you need to fix up the user searcher, hang on [20:09:43] i forgot [20:09:57] Yeah don't forget [20:09:59] RoanKattouw to the rescue [20:10:21] I modified the user locator hook on her machine to basically be $user = User::newFromName( 'Moriel' ); $users[] = $user; return ture; [20:10:44] in efOpenStackGetDefaultNotifiedUsers [20:10:54] in OpenStackManager.php [20:11:03] got it [20:11:22] so the user you put in that function is the one you *send* to, and the $user in eval.php is the agent, so you can test that too [20:12:07] I tried the notifyAgent hack first but that didn't appear to work [20:12:25] Also the normal implementation of that hook causes fatals if you don't have AuthPlugin stuff installed and configured right [20:12:47] what is this extension doing ayway? [20:12:56] It's a very specific extension for wikitech [20:13:05] It's managing VM instances [20:13:13] for tool labs, I think? RoanKattouw has access, he knows more [20:13:38] stephanebisson: Wikimedia Labs has an OpenStack cluster (if you don't know what that is, think open source clone of AWS) and OSM is an extension on wikitech.wikimedia.org that lets users manage their VMs and security groups and stuff [20:13:48] It's a hack because OpenStack didn't have a web interface at the time [20:13:56] I think now they might have one, or maybe it's in development [20:14:10] In any case I'm not sure it supports all the permissions separation we do there [20:21:05] mooeypoo: what do you have to do to hook it up in localsettings? [20:21:19] oh in vagrant I have my settings in settings.d [20:21:39] and then I hooked it up normally: require_once( "$IP/extensions/OpenStackManager/OpenStackManager.php" ); [20:21:59] And then just take it out after you're done testing [20:22:14] it's a mess to install this extension fully, so I just wanted it running in the background as if it's installed [20:22:25] Pretend-install. [20:25:45] Matthias did something similar with EducationProgram, which is another special-purpose extension [20:39:32] stephanebisson, your mention of siebrand's review of the qqq made me go double-check and find a tiny error (I was using $3 twice in the explanation)... fixed it now [20:44:35] great [20:44:59] it's the fear of the Siebrand at work [20:45:49] Does this mean I pre-siebranded? [21:14:05] (03PS12) 10Mooeypoo: [wip] Add a demo special page to Echo notifications [extensions/Echo] - 10https://gerrit.wikimedia.org/r/254612 (https://phabricator.wikimedia.org/T115551) [21:14:31] (03CR) 10jenkins-bot: [V: 04-1] [wip] Add a demo special page to Echo notifications [extensions/Echo] - 10https://gerrit.wikimedia.org/r/254612 (https://phabricator.wikimedia.org/T115551) (owner: 10Mooeypoo) [21:53:58] (03PS1) 10Sbisson: Add gender support for the viewing user for mention notification [extensions/Echo] - 10https://gerrit.wikimedia.org/r/257006 (https://phabricator.wikimedia.org/T119321) [22:18:00] (03CR) 10Catrope: [C: 032] Add gender support for the viewing user for mention notification [extensions/Echo] - 10https://gerrit.wikimedia.org/r/257006 (https://phabricator.wikimedia.org/T119321) (owner: 10Sbisson) [22:21:49] (03Merged) 10jenkins-bot: Add gender support for the viewing user for mention notification [extensions/Echo] - 10https://gerrit.wikimedia.org/r/257006 (https://phabricator.wikimedia.org/T119321) (owner: 10Sbisson) [22:25:43] RoanKattouw: https://phabricator.wikimedia.org/T119773 [22:36:01] OK so the curl error is due to not running RESTbase, for sure [22:36:59] 3Collaboration-Team-Current, 10Flow, 10VisualEditor, 5WMF-deploy-2015-12-08_(1.27.0-wmf.8): [Regression pre-wmf.8] Insert a mention in any Flow editor (in VE mode) is broken (on master) - https://phabricator.wikimedia.org/T119773#1854214 (10Catrope) I reproduced the curl error locally, and it was caused by... [23:25:53] 3Collaboration-Team-Current, 10Flow, 10VisualEditor, 5Patch-For-Review, 5WMF-deploy-2015-12-08_(1.27.0-wmf.8): [Regression pre-wmf.8] Insert a mention in any Flow editor (in VE mode) is broken (on master) - https://phabricator.wikimedia.org/T119773#1854339 (10Catrope) a:3Catrope [23:26:29] 3Collaboration-Team-Current, 10Flow, 10VisualEditor, 5Patch-For-Review, 5WMF-deploy-2015-12-08_(1.27.0-wmf.8): [Regression pre-wmf.8] Insert a mention in any Flow editor (in VE mode) is broken (on master) - https://phabricator.wikimedia.org/T119773#1835424 (10Catrope) p:5Unbreak!>3Triage [23:26:37] 3Collaboration-Team-Current, 10Flow, 10VisualEditor, 5Patch-For-Review, 5WMF-deploy-2015-12-08_(1.27.0-wmf.8): [Regression pre-wmf.8] Insert a mention in any Flow editor (in VE mode) is broken (on master) - https://phabricator.wikimedia.org/T119773#1835424 (10Catrope) p:5Unbreak!>3Triage [23:26:43] 3Collaboration-Team-Current, 10Flow, 10VisualEditor, 5Patch-For-Review, 5WMF-deploy-2015-12-08_(1.27.0-wmf.8): [Regression pre-wmf.8] Insert a mention in any Flow editor (in VE mode) is broken (on master) - https://phabricator.wikimedia.org/T119773#1835424 (10Catrope) p:5Unbreak!>3Triage [23:26:44] wtf [23:26:51] Thanks Phabricator [23:27:05] Catrope claimed this task.Via Web · [23:27:07] Catrope lowered the priority of this task from "Unbreak Now!" to "Needs Triage". [23:27:08] Catrope lowered the priority of this task from "Unbreak Now!" to "Needs Triage". [23:27:10] Catrope moved this task to Needs Review on the Collaboration-Team-Current workboard. [23:27:11] Catrope moved this task to Needs Review on the Collaboration-Team-Current workboard. [23:27:36] 3Collaboration-Team-Current, 10Flow, 10VisualEditor, 5Patch-For-Review, 5WMF-deploy-2015-12-08_(1.27.0-wmf.8): [Regression pre-wmf.8] Insert a mention in any Flow editor (in VE mode) is broken (on master) - https://phabricator.wikimedia.org/T119773#1835424 (10Catrope) p:5Triage>3Unbreak! [23:31:03] 6Collaboration-Team-Backlog, 10Flow: Spread permission to move flow boards? - https://phabricator.wikimedia.org/T120468#1854360 (10Kghbln) 3NEW [23:33:09] James_F: Thoughts re https://phabricator.wikimedia.org/T120468#1854360 ? [23:34:28] 6Collaboration-Team-Backlog, 10Flow: Spread permission to move flow boards? - https://phabricator.wikimedia.org/T120468#1854375 (10Jdforrester-WMF) Let's just give flow-create rights to everyone. [23:37:09] 6Collaboration-Team-Backlog, 10Flow: Spread permission to move flow boards? - https://phabricator.wikimedia.org/T120468#1854381 (10Kghbln) Not exactly for me to decide, but yes, no objections from my side.