BlueSpice Helpdesk - User contributions [en]

Setup:Software Bill of Materials (SBOM)

2026-08-10T15:06:45Z

Rvogel1:

The BlueSpice Software Bill of Materials (SBOM) is upated for every release. It is formatted according to the [https://spdx.dev/ SPDX specification] and serialized as a JSON file.

== Accessing the SBOM ==
There are several steps to access and scan the SBOM. The necessary commands expect the following parameters:

{| class="wikitable"
!Parameter
!Possible values
|-
|edition
|<code>pro</code>, <code>farm</code>, <code>free</code>
|-
|version
|e.g. <code>5.1</code>, <code>5.2.6</code>
|-
|service
|Services differ depending on edition and version. Common services are:
<code>wiki</code>, <code>proxy</code>, <code>cache</code>, <code>pdf</code>, <code>search</code>, <code>diagram</code>, ...
|}

=== Main application image ===
Pull the '''application image''' for the desired edition and version:
<syntaxhighlight lang="bash">docker pull docker.bluespice.com/bluespice-$edition/wiki:$version</syntaxhighlight>

Inspect the attachments with ORAS ([https://oras.land/docs/commands/oras_login/ oras requires login data]):
<syntaxhighlight lang="bash">oras discover docker.bluespice.com/bluespice-$edition/wiki:$version</syntaxhighlight>

Example output:
<syntaxhighlight lang="shell-session">
> oras discover docker.bluespice.com/bluespice-farm/wiki:5.2.6
docker.bluespice.com/bluespice-farm/wiki@sha256:c683b74003ebedf40f0aa6c66fe858619dcbb036eeb191d3afc4385c3779260b
└── application/vnd.cyclonedx+json
└── sha256:3d7b0eca2caad4ac8a2f9e939186183722f43923ebdf6c07e38bb1fe58454058
└── [annotations]
└── org.opencontainers.image.created: "2026-08-03T15:18:42Z"
</syntaxhighlight>

Download the attachments (provide the actual sha of the attachment, e.g. <code>3d7b0e...58</code> from the example):
<syntaxhighlight lang="bash">
oras pull docker.bluespice.com/bluespice-$edition/wiki@sha265'shaofattachements'
</syntaxhighlight>

=== Companion service images ===
Pull the image for the desired version:
<syntaxhighlight lang="bash">docker pull docker.bluespice.com/bluespice/$service:$version</syntaxhighlight>

Inspect the attachments:
<syntaxhighlight lang="bash">oras discover docker.bluespice.com/bluespice/$service:$version</syntaxhighlight>

Download the attachments (provide the actual sha of the attachment)
<syntaxhighlight lang="bash">
oras pull docker.bluespice.com/bluespice/$service@sha265'shaofattachements'
</syntaxhighlight>

=== Perform a security scan ===
The previous commands have created a <code>sbom.json</code> file in the local directory. You can now scan it. Below is a scanning example for <code>trivy</code>:
<syntaxhighlight lang="bash">
docker run --rm \
-v "$PWD:/work:ro" \
aquasec/trivy \
sbom \
--severity CRITICAL \
--ignore-unfixed \
--exit-code 1 \
/work/sbom.json
</syntaxhighlight>

[[de:Setup:Software_Bill_of_Materials_(SBOM)]]

Setup:Software Bill of Materials (SBOM)

2026-08-07T14:12:27Z

Rvogel1:

The BlueSpice Software Bill of Materials (SBOM) is upated for every release. It is formatted according to the [https://spdx.dev/ SPDX specification] and serialized as a JSON file.

== Accessing the SBOM ==
There are several steps to access and scan the SBOM. The necessary commands expect the following parameters:

{| class="wikitable"
!Parameter
!Possible values
|-
|edition
|pro, farm, free
|-
|version
|e.g. 5.1, 5.4.3
|-
|service
|Services differ depending on edition and version. Common services are:
wiki-task, proxy, cache, pdf, search, formula, diagram,...
|}
First, pull the '''application image''' for the desired edition and version:<syntaxhighlight lang="bash">docker pull docker.bluespice.com/bluespice-$edition/wiki:$version</syntaxhighlight>Then, inspect the attachments with ORAS ([https://oras.land/docs/commands/oras_login/ oras requires login data]):<syntaxhighlight lang="bash">oras discover docker.bluespice.com/bluespice-$edition/wiki:$version</syntaxhighlight>Do the same for '''service images''':<br />Pull the image:<syntaxhighlight lang="bash">docker pull docker.bluespice.com/bluespice/$service:$version</syntaxhighlight>Inspect the attachments:<syntaxhighlight lang="bash">oras discover docker.bluespice.com/bluespice/$service:$version</syntaxhighlight>

Example:<syntaxhighlight lang="shell-session">
> oras discover docker.bluespice.com/bluespice-farm/wiki:5.2.6
docker.bluespice.com/bluespice-farm/wiki@sha256:c683b74003ebedf40f0aa6c66fe858619dcbb036eeb191d3afc4385c3779260b
└── application/vnd.cyclonedx+json
└── sha256:3d7b0eca2caad4ac8a2f9e939186183722f43923ebdf6c07e38bb1fe58454058
└── [annotations]
└── org.opencontainers.image.created: "2026-08-03T15:18:42Z"

</syntaxhighlight>

Download the attachments (provide the actual sha of the attachment, e.g. <code>3d7b0e...58</code> from the example):<syntaxhighlight lang="bash">
oras pull docker.bluespice.com/bluespice-$edition/wiki@sha265'shaofattachements'
</syntaxhighlight>or for services:<syntaxhighlight lang="bash">
oras pull docker.bluespice.com/bluespice/$service@sha265'shaofattachements'
</syntaxhighlight>

The SBOM file is located in your current folder as <code>sbom.json</code>.

You can now scan your SBOM files. Below is a scanning example for Trivy:<syntaxhighlight lang="bash">
docker run --rm \
-v "$PWD:/work:ro" \
aquasec/trivy \
sbom \
--severity CRITICAL \
--ignore-unfixed \
--exit-code 1 \
/work/sbom.json
</syntaxhighlight>

[[de:Setup:Software_Bill_of_Materials_(SBOM)]]

Setup:Software Bill of Materials (SBOM)

2026-08-07T14:07:02Z

Rvogel1:

The BlueSpice Software Bill of Materials (SBOM) is upated for every release. It is formatted according to the [https://spdx.dev/ SPDX specification] and serialized as a JSON file.

== Accessing the SBOM ==
There are several steps to access and scan the SBOM. The necessary commands expect the following parameters:

{| class="wikitable"
!Parameter
!Possible values
|-
|edition
|pro, farm, free
|-
|version
|e.g. 5.1, 5.4.3
|-
|service
|Services differ depending on edition and version. Common services are:
wiki-task, proxy, cache, pdf, search, formula, diagram,...
|}
First, pull the '''application image''' for the desired edition and version:<syntaxhighlight lang="bash">docker pull docker.bluespice.com/bluespice-$edition/wiki:$version</syntaxhighlight>Then, inspect the attachments with ORAS ([https://oras.land/docs/commands/oras_login/ oras requires login data]):<syntaxhighlight lang="bash">oras discover docker.bluespice.com/bluespice-$edition/wiki:$version</syntaxhighlight>Do the same for '''service images''':<br />Pull the image:<syntaxhighlight lang="bash">docker pull docker.bluespice.com/bluespice/$service:$version</syntaxhighlight>Inspect the attachments:<syntaxhighlight lang="bash">oras discover docker.bluespice.com/bluespice/$service:$version</syntaxhighlight>

Download the attachments (provide the actual sha of the attachment):<syntaxhighlight lang="bash">
oras pull docker.bluespice.com/bluespice-$edition/wiki@sha265'shaofattachements'
</syntaxhighlight>or for services:<syntaxhighlight lang="bash">
oras pull docker.bluespice.com/bluespice/$service@sha265'shaofattachements'
</syntaxhighlight>

The SBOM file is located in your current folder as <code>sbom.json</code>.

You can now scan your SBOM files. Below is a scanning example for Trivy:<syntaxhighlight lang="bash">
docker run --rm \
-v "$PWD:/work:ro" \
aquasec/trivy \
sbom \
--severity CRITICAL \
--ignore-unfixed \
--exit-code 1 \
/work/sbom.json
</syntaxhighlight>

[[de:Setup:Software_Bill_of_Materials_(SBOM)]]

Setup:Software Bill of Materials (SBOM)

2026-08-07T14:06:31Z

Rvogel1:

The BlueSpice Software Bill of Materials (SBOM) is upated for every release. It is formatted according to the [https://spdx.dev/ SPDX specification] and serialized as a JSON file.

== Accessing the SBOM ==
There are several steps to access and scan the SBOM. The necessary commands expect the following parameters:

{| class="wikitable"
!Parameter
!Possible values
|-
|edition
|pro, farm, free
|-
|version
|e.g. 5.1, 5.4.3
|-
|service
|Services differ depending on edition and version. Common services are:
wiki-task, proxy, cache, pdf, search, formula, diagram,...
|}
First, pull the '''application image''' for the desired edition and version:<syntaxhighlight lang="bash">docker pull docker.bluespice.com/bluespice-$edition/wiki:$version</syntaxhighlight>Then, inspect the attachments with ORAS ([https://oras.land/docs/commands/oras_login/ oras requires login data]):<syntaxhighlight lang="bash">oras discover docker.bluespice.com/bluespice-$edition/wiki:$version</syntaxhighlight>Do the same for '''service images''':<br />Pull the image:<syntaxhighlight lang="bash">docker pull docker.bluespice.com/bluespice/$service:$version</syntaxhighlight>Inspect the attachments:<syntaxhighlight lang="bash">oras discover docker.bluespice.com/bluespice/$service:$version</syntaxhighlight>

Download the attachments (provide the actual sha of the attachment):<syntaxhighlight lang="bash">
oras pull docker.bluespice.com/bluespice-$edition/wiki@sha265'shaofattachements'
</syntaxhighlight>or for services:<syntaxhighlight lang="bash">
oras pull docker.bluespice.com/bluespice/$service@sha265'shaofattachements'
</syntaxhighlight>

The SBOM file is located in your current folder as <code>sbom.json</code>.

You can now scan your SBOM files. Below is a scanning example for Trivy:<syntaxhighlight lang="bash">
docker run --rm \
-v "$PWD:/work:ro" \
aquasec/trivy:0.72.0 \
sbom \
--severity CRITICAL \
--ignore-unfixed \
--exit-code 1 \
/work/sbom.json
</syntaxhighlight>

[[de:Setup:Software_Bill_of_Materials_(SBOM)]]

Setup:Software Bill of Materials (SBOM)

2026-08-07T13:18:27Z

Rvogel1:

The BlueSpice Software Bill of Materials (SBOM) is upated for every release. It is formatted according to the [https://spdx.dev/ SPDX specification] and serialized as a JSON file.

== Accessing the SBOM ==
There are several steps to access and scan the SBOM. The necessary commands expect the following parameters:

{| class="wikitable"
!Parameter
!Possible values
|-
|edition
|pro, farm, free
|-
|version
|e.g. 5.1, 5.4.3
|-
|service
|Services differ depending on edition and version. Common services are:
wiki-task, proxy, cache, pdf, search, formula, diagram,...
|}
First, pull the '''application image''' for the desired edition and version:<syntaxhighlight lang="bash">docker pull docker.bluespice.com/bluespice-$edition/wiki:$version</syntaxhighlight>Then, inspect the attachments with ORAS ([https://oras.land/docs/commands/oras_login/ oras requires login data]):<syntaxhighlight lang="bash">oras discover docker.bluespice.com/bluespice-$edition/wiki:$version</syntaxhighlight>Do the same for '''service images''':<br />Pull the image:<syntaxhighlight lang="bash">docker pull docker.bluespice.com/bluespice/$service:$version</syntaxhighlight>Inspect the attachments:<syntaxhighlight lang="bash">oras discover docker.bluespice.com/bluespice/$service:$version</syntaxhighlight>

Download the attachments (provide the actual sha-string):<syntaxhighlight lang="bash">
oras pull docker.bluespice.com/bluespice-$edition/wiki@sha265'shaofattachements'
</syntaxhighlight>or for services:<syntaxhighlight lang="bash">
oras pull docker.bluespice.com/bluespice/$service@sha265'shaofattachements'
</syntaxhighlight>

The SBOM file is located in your current folder as <code>sbom.json</code>.

You can now scan your SBOM files. Below is a scanning example for Trivy:<syntaxhighlight lang="bash">
docker run --rm \ -v "$PWD:/work:ro" \ aquasec/trivy:0.72.0 \ sbom \ --severity CRITICAL \ --ignore-unfixed \ --exit-code 1 \ /work/sbom.json
</syntaxhighlight>

[[de:Setup:Software_Bill_of_Materials_(SBOM)]]

Setup:Software Bill of Materials (SBOM)

2026-08-07T13:15:27Z

Rvogel1:

The BlueSpice Software Bill of Materials (SBOM) is upated for every release. It is formatted according to the [https://spdx.dev/ SPDX specification] and serialized as a JSON file.

== Accessing the SBOM ==
There are several steps to access and scan the SBOM. The necessary commands expect the following parameters:

{| class="wikitable"
!Parameter
!Possible values
|-
|edition
|pro, farm, free
|-
|version
|e.g. 5.1, 5.4.3
|-
|service
|Services differ depending on edition and version. Common services are:
wiki-task, proxy, cache, pdf, search, formula, diagram,...
|}
First, pull the '''application image''' for the desired edition and version:<syntaxhighlight lang="bash">docker pull docker.bluespice.com /bluespice-$edition/wiki:$version</syntaxhighlight>Then, inspect the attachments with ORAS ([https://oras.land/docs/commands/oras_login/ oras requires login data]):<syntaxhighlight lang="bash">oras discover docker.bluespice.com /bluespice-$edition/wiki:$version</syntaxhighlight>Do the same for '''service images''':<br />Pull the image:<syntaxhighlight lang="bash">docker pull docker.bluespice.com/bluespice/$service:$version</syntaxhighlight>Inspect the attachments:<syntaxhighlight lang="bash">oras discover docker.bluespice.com/bluespice/$service:$version</syntaxhighlight>

Download the attachments (provide the actual sha-string):<syntaxhighlight lang="bash">
oras pull docker.bluespice.com /bluespice-$edition/wiki@sha265'shaofattachements'
</syntaxhighlight>or for services:<syntaxhighlight lang="bash">
oras pull docker.bluespice.com/bluespice/$service@sha265'shaofattachements'
</syntaxhighlight>

The SBOM file is located in your current folder as <code>sbom.json</code>.

You can now scan your SBOM files. Below is a scanning example for Trivy:<syntaxhighlight lang="bash">
docker run --rm \ -v "$PWD:/work:ro" \ aquasec/trivy:0.72.0 \ sbom \ --severity CRITICAL \ --ignore-unfixed \ --exit-code 1 \ /work/sbom.json
</syntaxhighlight>

[[de:Setup:Software_Bill_of_Materials_(SBOM)]]

Setup:Installation Guide/Docker

2026-08-04T06:02:34Z

Rvogel1:

== Overview ==
Starting with version 4.5, BlueSpice MediaWiki can be installed with a stack of Docker container images.

Everything is built in a modular way to allow different types of setups.

The most common cases are:
# "All-in-one" (with and without Let's Encrypt)
# Custom database and search service
# Custom load balancer / proxy

== Architecture ==
<drawio filename="Setup:Installation_Guide_Docker-Achitecture" alt="Diagram of BlueSpice Docker Stack Architecture" />

'''Notes'''
* Internal HTTP connections may use non-standard ports. Those are noted next to the respective services.
** HTTP (in-secure) is only used for internal communication within the virtual network the stack is operated in. All connections to the client use TLS.
* Proprietary ports (esp. for database connections) are noted next to the respective services.
* There may be additional services and ports in use, based on the setup. Some examples:
** When using LDAP based authentication an LDAPS connection (port <code>636</code>) is used from the <code>bluespice/wiki</code> containers to the LDAP-Server
** When using Kerberos authentication, a connection (port <code>88</code>) is used from the <code>bluespice/kerberos-proxy</code> containers to the Kerberos-Server
** When using DeepL or OpenAI services, a HTTPS connection (port <code>443</code>) is used from the <code>bluespice/wiki</code> containers to to the respective service
** When using OpenIDConnect authentication, a HTTPS connection (port <code>443</code>) is used from the <code>bluespice/wiki</code> "task" container to to the authentication provider
** When using "Let's Encrypt" Certbot, a HTTPS connection (port <code>443</code>) is used from the <code>acme-companion</code> container to the "Let's Encrypt" service

== Step 1: Get the stack ==
Load project <code>bluespice-deploy</code> from https://github.com/hallowelt/bluespice-deploy/releases/latest and enter the sub-directory <code>compose</code> for Docker Compose files.

For example, run:
<syntaxhighlight lang="sh">
wget https://github.com/hallowelt/bluespice-deploy/archive/refs/tags/5.2.6.zip \
&& unzip 5.2.6.zip \
&& cd bluespice-deploy-5.2.6/compose
</syntaxhighlight>
{{Textbox|boxtype=note|header=Use one consistent version number|text=The tag number 5.2.5 in this command (could be 5.1.9, 5.2.4 etc. as well) should also be used as the <code>VERSION=</code> number in Step 2.|icon=yes}}

The directory contains the following files:
{| class="wikitable"
|+
! style="width:375px;" |Filename
! style="" |Type
! style="" |Comment
|-
| style="width:375px;" |<code>bluespice-deploy</code>
| style="" |shell script
| style="" |Start-up script, wrapping command <code>docker compose</code> and service <code>yml</code> files.<br>Additional service <code>yml</code> files can be loaded by adding <code>-f <filename> </code>.
|-
| style="width:375px;" |<code>docker-compose.main.yml</code>
| style="" |yml
| style="" |Main containers of the wiki (<code>wiki-web</code> and <code>wiki-task</code>).
|-
| style="width:375px;" |<code>docker-compose.persistent-data-services.yml</code>
| style="" |yml
| style="" |Containers of database and search services, storing persistent data onto the file system.<br />Optionally with external MySQL/MariaDB and OpenSearch one can skip loading this <code>.yml</code> in <code>bluespice-deploy</code>. Please then wire your services properly in the <code>.env</code> file.
|-
| style="width:375px;" |<code>docker-compose.stateless-services.yml</code>
| style="" |yml
| style="" |Containers for caching, PDF rendering, formula-rendering and diagram editing.
|-
| style="width:375px;" |<code>docker-compose.helper-service.yml</code>
| style="" |yml
| style="" |Helper containers for file system preparation and automated BlueSpice upgrade.<br>These containers exit automatically after finishing tasks.
|-
| style="width:375px;" |<code>docker-compose.proxy.yml</code>
| style="" |yml
| style="" |Container of proxy service. Can be replaced by existing proxy/load-balancer infrastructure.
|-
| style="width:375px;" |<code>docker-compose.proxy-letsencrypt.yml</code>
| style="" |yml
| style="" |Additional service for auto-renewal of "Let's Encrypt" certificates.<br>Only required when using the Let's Encrypt service and having no other TLS termination.
|-
| style="width:375px;" |<code>docker-compose.kerberos-proxy.yml</code>
| style="" |yml
| style="" |Additional proxy for Kerberos based authentication.
|-
| style="width:375px;" |<code>docker-compose.collabpads-service.yml</code>
|yml
|Containers of back-end services for [[Manual:Extension/CollabPads|CollabPads]] (included in Pro and Farm editions).
|-
| style="width:375px;" |<code>.env.sample</code>
| style="" |text
| style="" |Sample for creating <code>.env</code> that defines key environment variables.
|-
| style="width:375px;" |<code>bluespice.service.demo</code>
| style="" |service script
| style="" |Demo-file for control the BlueSpice stack as a <code>systemctl</code> service.<br>One can create e.g a <code>/etc/systemd/system/bluespice.service</code>.
|}

== Step 2: Set up environment variables ==
Create your <code>.env</code> based on the sample file <code>.env.sample</code>.

Example:
<pre>
# set or use your data directory
DATADIR=/data/bluespice
VERSION=5.2.5
EDITION=free
BACKUP_HOUR=04

WIKI_NAME=BlueSpice
WIKI_LANG=en
WIKI_PASSWORDSENDER=no-reply@wiki.company.local
WIKI_EMERGENCYCONTACT=no-reply@wiki.company.local
WIKI_HOST=wiki.company.local
WIKI_PORT=443
WIKI_PROTOCOL=https
WIKI_BASE_PATH=

DB_USER=set_or_use_your_db_user_name
DB_PASS=SET_OR_USE_YOUR_DB_PASS_WORD
DB_ROOT_USER=root
DB_ROOT_PASS=$DB_PASS
DB_HOST=database
DB_NAME=bluespice
DB_PREFIX=

SMTP_HOST=mail.company.local
SMTP_PORT=25
SMTP_USER=...
SMTP_PASS=...
SMTP_ID_HOST=...

LETSENCRYPT=false
</pre>
{{Textbox|boxtype=note|header=Different editions|text=This config works for all editions, but the main image of Pro or Farm edition needs to be obtained differently, see [[{{FULLPAGENAME}}/Pro and Farm edition|Pro and Farm edition]]|icon=yes}}

== Step 3: Start the stack ==
Use <code>bluespice-deploy up -d</code> to start the stack. Once all containers are shown as "ready" you can navigate to <code>$WIKI_PROTOCOL://$WIKI_HOST:$WIKI_PORT</code> (e.g. <code><nowiki>https://wiki.company.local</nowiki></code>) in your preferred web browser and start using the application.

When starting the stack the first time, the <code>wiki-task</code> container will automatically perform the installation. It may take a couple of minutes for the process to set up the database and complete. Once it is finished, the password for the default <code>Admin</code> user can be found in <code>$DATADIR/wiki/initialAdminPassword</code>.

== Additional options ==

=== Add Customizations to containers ===
Since tag 5.1.4 and tag 5.2.0 of project <code>bluespice-deploy</code>, we allow to edit and maintain a separate <code>docker-compose.override.yml</code> which will be ignored by git.

This way you can add your own Container-Configurations and be able to maintain your git status up to date. Just place the file next to the other <code>docker-compose.*.yml</code> s and run <code>./bluespice-deploy up -d</code>.

Example:<syntaxhighlight lang="yaml">
services:
wiki-web:
volumes:
- /backup/:/data/backup
wiki-task:
volumes:
- /backup/:/data/backup
</syntaxhighlight>

=== Configs for <code>LocalSettings.php</code> ===
Instead of exposing the <code>LocalSettings.php</code> for [[mediawikiwiki:Manual:LocalSettings.php|adding additional configurations]], the stack offers two entry points. After the initial installation, you can add your configs to two files in <code>${DATADIR}/wiki/bluespice/</code>:

* <code>pre-init-settings.php</code> - Set configs before the initialization of BlueSpice's debug logging, libraries, skins, extensions and default settings. Configs set here can be picked up by the init process.
* <code>post-init-settings.php</code> - Set configs after the initialization, manipulating configs that have been set by the init process.
For example, if you add the following lines to <code>pre-init-settings.php</code>, you can then read outputted debug logs (if any) in <code>${DATADIR}/wiki/bluespice/logs/debug.log</code>:<syntaxhighlight lang="php">
$GLOBALS['bsgDebugLogGroups']['exception'] = "/data/bluespice/logs/debug.log";
$wgShowExceptionDetails = true;
</syntaxhighlight>

=== Maintenance scripts ===
To run [[Setup:Installation Guide/Advanced/Maintenance scripts|maintenance scripts]] from MediaWiki or from other extensions, please use the <code>wiki-task</code> container, which handles all back-end jobs and processes. You can connect into the container in two different ways:

* run <code>./bluespice-deploy exec -it wiki-task bash</code> in the <code>compose</code> directory for Docker Compose files
* or alternatively, run <code>docker exec -it bluespice-wiki-task bash</code> wherever you are on the host machine

Inside the container you can enter the wiki's code base with <code>cd /app/bluespice/w</code> , where one can run scripts like <code>php maintenance/run.php update --quick</code>, <code>php extensions/BlueSpiceExtendedSearch/maintenance/updateWikiPageIndex.php</code> and so on.

=== SSL certificates ===
To use a Let's Encrypt certificate for your domain name, set <code>LETSENCRYPT=true</code> in your <code>.env</code> file.

To use a self-signend certificate for your domain name, put its <code>.crt</code> and <code>.key</code> files in <code>${DATADIR}/proxy/certs</code>. For example, with <code>wiki.company.local</code> you should prepare <code>wiki.company.local.crt</code> and <code>wiki.company.local.key</code> files.

=== Kerberos proxy ===
For implicit authentication using Kerberos, an additional proxy must be used: <code>bluespice/kerberos-proxy</code> . The file <code>docker-compose.kerberos-proxy.yml</code> contains a common configuration. It can be used '''instead of''' the regular <code>docker-compose.proxy.yml</code> file inside <code>bluespice-deploy</code> .

Make sure to have the files

* <code>${DATADIR}/kerberos/krb5.conf</code>
* <code>${DATADIR}/kerberos/kerberos.keytab</code>

set up properly.

The file <code>${DATADIR}/wiki/bluespice/pre-init-settings.php</code> can then be used to set up [[mediawikiwiki:LDAP_hub|"Extension:Auth_remoteuser" and the LDAP stack extensions]].

=== SAML authentication ===
During the initial installation a certificate for message signing will automatically be created. It can be found in <code>${DATADIR}/wiki/simplesamlphp/certs/</code>.

In order to configure a remote IdP, one must copy the IdP metadata XML to a file called <code>${DATADIR}/wiki/simplesamlphp/saml_idp_metadata.xml</code>. The SP metadata can then be obtained via <code><nowiki>https://{{$WIKI_HOST}}/_sp/module.php/saml/sp/metadata.php/default-sp</nowiki></code>. It must be configured in the remote IdP.

{{Textbox
|boxtype=tip
|header=Test authentication
|text= You can test authentication directly within the SimpleSAMLphp application. To do so, navigate to <code><nowiki>https://{{$WIKI_HOST}}/_sp/module.php/admin</nowiki></code> and log in with <code>admin</code> and the <code>INTERNAL_SIMPLESAMLPHP_ADMIN_PASS</code> found in <code>${DATADIR}/wiki/.wikienv</code>
|icon=yes
}}

Next, the extensions "PluggableAuth" and "SimpleSAMLphp" must be enabled on the wiki. To do so, add

<syntaxhighlight lang="php">
wfLoadExtensions( [
'PluggableAuth',
'SimpleSAMLphp'
] );
</syntaxhighlight>[[File:Setup:SAML ConfigManager EN 01.png|thumb|300x300px]]to the <code>${DATADIR}/wiki/bluespice/post-init-settings.php</code>. Run

./bluespice-deploy exec wiki-task /app/bluespice/w/maintenance/update.php --quick

to complete the installation.

After that, the authentication plugin configuration can be applied in [[Manual:Extension/BlueSpiceConfigManager|Special:BlueSpiceConfigManager]] under "Authentication".

=== OpenID Connect authentication ===

The extensions "PluggableAuth" and "OpenIDConnect" must be enabled on the wiki. To do so, add<syntaxhighlight lang="php">
wfLoadExtensions( [
'PluggableAuth',
'OpenIDConnect'
] );
</syntaxhighlight>to the <code>${DATADIR}/wiki/bluespice/post-init-settings.php</code>. Run

./bluespice-deploy exec wiki-task /app/bluespice/w/maintenance/update.php --quick

to complete the installation.

After that, the authentication plugin configuration can be applied in [[Manual:Extension/BlueSpiceConfigManager|Special:BlueSpiceConfigManager]] under "Authentication".

[[de:Setup:Installationsanleitung/Docker]]

Reference:BlueSpiceInterwikiSearch

2026-07-31T13:06:41Z

Rvogel1:

{{BSExtensionInfo
|desc=Simultaneous search in multiple wikis
|status=stable
|developer=HalloWelt
|type=BlueSpice
|edition=BlueSpice pro (deactivated), BlueSpice farm (deactivated)
|compatible=BlueSpice
|license=GPL v3
|docu=Manual:Extension/BlueSpiceInterwikiSearch
|active=Yes
|features=
'''InterwikiSearch''' alows simultaneously searching other BlueSpice wikis.
==Usage / features==
If BlueSpiceInterwikiSearch is enabled and configured on the wiki, the <code>Special:SearchCenter</code>, shows results from other wikis. Results are shown as buttons on top of the results list.

==Technical information==
===Configuration===
To set up this service, wiki administrator must add following settings into LocalSettings.php:
<pre>
$GLOBALS['bsgBlueSpiceInterwikiSearch']['Wiki_name'] = [
"name" => "Wiki name", // Will be displayed as the wiki name in the results
"api-endpoint" => "http://other.wiki.com/w/api.php",
"search-on-wiki-url" => "http://other.wiki.com/wiki/Special:SearchCenter" // URL to the SearchCenter SpecialPage on target wiki
];
</pre>{{Messagebox|boxtype=note|Note text=This does not apply to [[Manual:Extension/BlueSpiceWikiFarm|BlueSpiceWikiFarm]] users, BlueSpiceInterwikiSearch within a WikiFarm is handled separately.}}

== Demo ==

Try out InterwikiSearch in our [https://en.demo.bluespice.com demo]
}}

{{wcagCheck
|wcagStatus=2-testing complete
|wcagCheckedfor=Web, Authoring tool
|wcagTestdate=2022-10-10
|wcagLevel=AA
|wcagSupport=partially supports
|wcagWorkaround=no
|wcagComments=Interwiki links are commonly not used. Only relevant for wikis that connect search to other wikis.

Web: screen reader needs label for interwiki search results announced. Ticket: erm30061

Authoring tool: Standard ext-js pagination issue: buttons not announced to screen readers.
|extensionType=extended
|extensionFocus=reader
}}

Security:Security Advisories/BSSA-2026-05

2026-07-27T12:50:07Z

Rvogel1:

{| class="wikitable"
|+
!
!
|-
|Date
|2026-07-27
|-
|Severity
|reported "high", BlueSpice assessment: '''not affected / low'''
|-
|Affected
|<code>bluespice/search</code> Docker image (all versions)
<code>bluespice/ai</code> Docker image (5.3.x)
|-
|Fixed in
|Unknown
|-
|CVE
|
* [https://access.redhat.com/security/cve/cve-2025-14813 CVE-2025-14813]
* [https://nvd.nist.gov/vuln/detail/CVE-2025-65896 CVE-2025-65896]
* [https://nvd.nist.gov/vuln/detail/CVE-2026-59873 CVE-2026-59873]
* [https://advisories.gitlab.com/composer/phpoffice/phpspreadsheet/CVE-2026-59933/ CVE-2026-59933]
|}

==Problem==
{| class="wikitable"
!'''CVE'''
!'''Component'''
!'''Type of vulnerability'''
!'''BlueSpice 5'''
|-
|CVE-2025-14813
|<code>bluespice/search</code>
|Use of a Broken or Risky Cryptographic Algorithm
| style="" class="col-green-bg" |not affected
|-
|CVE-2025-65896
|<code>bluespice/ai</code>
|SQL Injection via dictionary as params
| style="" class="col-green-bg" |not affected
|-
|CVE-2026-59873
|<code>bluespice/ai</code>, <code>bluespice/chat</code>, <code>bluespice/formula</code>, <code>bluespice/wire</code>
|Allocation of Resources Without Limits or Throttling
| style="" class="col-green-bg" |not affected
|-
|CVE-2026-59933
|
* Extension:BlueSpiceUEModuleTable2Excel
* Extension:DataTransfer
* Extension:SemanticResultFormats
|
* Uncontrolled Resource Consumption
* Loop with Unreachable Exit Condition ('Infinite Loop')
| style="" class="col-orange-bg" |low
|}

==Impact assessment==
{| class="wikitable" style="width: 100%;"
!CVE
!Assessment
!Mitigation without update
|-
| style="vertical-align:middle;text-align:left;" |CVE-2025-14813
| style="vertical-align:middle;text-align:left;" class="col-green-bg" |The code is only used by Tika when processing Encrypted PDFs and Office files, which we don't support. In addition the code affected in particular is probably not used and the described attack vector ("capture ciphertext") and impact ("perform cryptanalysis and uncover the underlying data") is not applicable in this use case.
| style="vertical-align:middle;text-align:left;" |No action required.
|-
|CVE-2025-65896
| style="" class="col-green-bg" |Asyncmy is only used as the DB API layer for SQLAlchemy to connect to MySQL, SQLAlchemy enforces a "format" parameter style, which only uses "%s" placeholder strings for SQL queries. This is opposed to inserting values via a dictionary, meaning no impact from this CVE is possible.
|No action required.
|-
|CVE-2026-59873
| style="" class="col-green-bg" |None of the code makes use of the affected package / code (<code>node-tar</code>). In all but <code>bluespice/formula</code> it is just part of the base image content. In <code>bluespice/formula</code>, it is a transient dependency, but also not used. Not even in the dependency code.
|No action required.
|-
|CVE-2026-59933
| style="" class="col-orange-bg" |Extension:BlueSpiceUEModuleTable2Excel and Extension:SemanticResultFormats don't use affected code at all. Only Extension:DataTransfer may be affected.
|If concerned temporarily disable Special:ImportSpreadsheet via <code>$DATA/wiki/bluespice/pre-init-settings.php</code>.
\Hooks::register( 'SpecialPage_initList', static function( &$specialPages ) {
unset( $list['ImportSpreadsheet'] );
});
|}

== Solution ==
No immediate action required. If concerned about CVE-2026-59933, apply the temporary fix. CVE-2026-59933 will be fixed in one of the next patch releases.

Security:Security Advisories/BSSA-2026-05

2026-07-27T09:45:17Z

Rvogel1:

Security:Security Advisories/BSSA-2026-05

2026-07-27T09:26:21Z

Rvogel1:

{| class="wikitable"
|+
!
!
|-
|Date
|2026-07-17
|-
|Severity
|reported "high", BlueSpice assessment: '''not affected'''
|-
|Affected
|<code>bluespice/search</code> Docker image (all versions)
<code>bluespice/ai</code> Docker image (5.3.x)
|-
|Fixed in
|Unknown
|-
|CVE
|
* [https://access.redhat.com/security/cve/cve-2025-14813 CVE-2025-14813]
* [https://nvd.nist.gov/vuln/detail/CVE-2025-65896 CVE-2025-65896]
* [https://nvd.nist.gov/vuln/detail/CVE-2026-59873 CVE-2026-59873]
|}

==Problem==
{| class="wikitable"
!'''CVE'''
!'''Component'''
!'''Type of vulnerability'''
!'''BlueSpice 5'''
|-
|CVE-2025-14813
|<code>bluespice/search</code>
|Use of a Broken or Risky Cryptographic Algorithm
| style="" class="col-green-bg" |not affected
|-
|CVE-2025-65896
|<code>bluespice/ai</code>
|SQL Injection via dictionary as params
| style="" class="col-green-bg" |not affected
|-
|CVE-2026-59873
|<code>bluespice/ai</code>, <code>bluespice/chat</code>, <code>bluespice/formula</code>, <code>bluespice/wire</code>
|Allocation of Resources Without Limits or Throttling
| style="" class="col-green-bg" |not affected
|}

==Impact assessment==
{| class="wikitable" style="width: 100%;"
!CVE
!Assessment
!Mitigation without update
|-
| style="vertical-align:middle;text-align:left;" |CVE-2025-14813
| style="vertical-align:middle;text-align:left;" class="col-green-bg" |The code is only used by Tika when processing Encrypted PDFs and Office files, which we don't support. In addition the code affected in particular is probably not used and the described attack vector ("capture ciphertext") and impact ("perform cryptanalysis and uncover the underlying data") is not applicable in this use case.
| style="vertical-align:middle;text-align:left;" |No action required.
|-
|CVE-2025-65896
| style="" class="col-green-bg" |Asyncmy is only used as the DB API layer for SQLAlchemy to connect to MySQL, SQLAlchemy enforces a "format" parameter style, which only uses "%s" placeholder strings for SQL queries. This is opposed to inserting values via a dictionary, meaning no impact from this CVE is possible.
|No action required.
|-
|CVE-2026-59873
| style="" class="col-green-bg" |None of the code makes use of the affected package / code (<code>node-tar</code>). In all but <code>bluespice/formula</code> it is just part of the base image content. In <code>bluespice/formula</code>, it is a transient dependency, but also not used. Not even in the dependency code.
|No action required.
|}

== Solution ==
No immediate action required.

Security:Security Advisories/BSSA-2026-05

2026-07-17T13:39:04Z

Rvogel1:

{| class="wikitable"
|+
!
!
|-
|Date
|2026-07-17
|-
|Severity
|reported "high", BlueSpice assessment: '''not affected'''
|-
|Affected
|<code>bluespice/search</code> Docker image (all versions)
|-
|Fixed in
|Unknown
|-
|CVE
|
* [https://access.redhat.com/security/cve/cve-2025-14813 CVE-2025-14813]
|}

==Problem==
{| class="wikitable"
!'''CVE'''
!'''Component'''
!'''Type of vulnerability'''
!'''BlueSpice 5'''
|-
|CVE-2025-14813
|<code>bluespice/search</code>
|Use of a Broken or Risky Cryptographic Algorithm
| style="" class="col-green-bg" |not affected
|}

==Impact assessment==
{| class="wikitable" style="width: 100%;"
!CVE
!Assessment
!Mitigation without update
|-
| style="vertical-align:middle;text-align:left;" |CVE-2025-14813
| style="vertical-align:middle;text-align:left;" class="col-green-bg" |The code is only used by Tika when processing Encrypted PDFs and Office files, which we don't support. In addition the code affected in particular is probably not used and the described attack vector ("capture ciphertext") and impact ("perform cryptanalysis and uncover the underlying data") is not applicable in this use case.
| style="vertical-align:middle;text-align:left;" |No action required.
|}

== Solution ==
No immediate action required.

Security:Security Advisories/BSSA-2026-05

2026-07-17T13:36:47Z

Rvogel1: Created page with "{| class="wikitable" |+ ! ! |- |Date |2026-06-22 |- |Severity |reported "high", BlueSpice assessment: '''not affected''' |- |Affected |<code>bluespice/migrate-confluence</code> Docker image (all versions) |- |Fixed in |Next regular update |- |CVE | * [https://nvd.nist.gov/vuln/detail/CVE-2026-8376 CVE-2026-8376] |} ==Problem== {| class="wikitable" !'''CVE''' !'''Component''' !'''Type of vulnerability''' !'''BlueSpice 5''' |- |CVE-2026-8376 |<code>bluespice/migrate-confl..."

{| class="wikitable"
|+
!
!
|-
|Date
|2026-06-22
|-
|Severity
|reported "high", BlueSpice assessment: '''not affected'''
|-
|Affected
|<code>bluespice/migrate-confluence</code> Docker image (all versions)
|-
|Fixed in
|Next regular update
|-
|CVE
|
* [https://nvd.nist.gov/vuln/detail/CVE-2026-8376 CVE-2026-8376]
|}

==Problem==
{| class="wikitable"
!'''CVE'''
!'''Component'''
!'''Type of vulnerability'''
!'''BlueSpice 5'''
|-
|CVE-2026-8376
|<code>bluespice/migrate-confluence</code>
|Heap Buffer Overflow (Perl regex compilation, 32-bit only)
| style="" class="col-green-bg" |not affected
|}

==Impact assessment==
{| class="wikitable" style="width: 100%;"
!CVE
!Assessment
!Mitigation without update
|-
| style="vertical-align:middle;text-align:left;" |CVE-2026-8376
| style="vertical-align:middle;text-align:left;" class="col-green-bg" |Not affected. The vulnerability only applies to 32-bit Perl builds; the <code>bluespice/migrate-confluence</code> Docker image uses a 64-bit base image and therefore runs a 64-bit Perl. Additionally, the regular expressions used in the application are part of the application logic and cannot be injected by an attacker.
| style="vertical-align:middle;text-align:left;" |No action required.
|}

== Solution ==
No immediate action required. The affected library will be updated in the next regular release.

Development/SAML 2.0 IdP

2026-07-14T11:34:22Z

Rvogel1:

Create the following files and folders within your <code>$DATADIR</code>
<syntaxhighlight lang="text">
└── saml-idp
├── saml-config.php
├── saml-sp-metadata.php
└── saml-users.php

</syntaxhighlight>

Add the following content to the files

<div class="toccolours mw-collapsible mw-collapsed">
<code>saml-config.php</code>
<div class="mw-collapsible-content"><syntaxhighlight lang="php"><?php

// See https://github.com/kristophjunge/docker-test-saml-idp/blob/master/config/simplesamlphp/config.php

$idPbaseUrl = 'https://' . getenv( 'DEV_SHARED_IDP_HOST' );
$config = [
'baseurlpath' => $idPbaseUrl . '/_samlidp/simplesaml/',
'certdir' => 'cert/',
'loggingdir' => 'log/',
'datadir' => 'data/',
'tempdir' => '/tmp/simplesaml',
'debug' => true,
'showerrors' => true,
'errorreporting' => true,
'debug.validatexml' => false,
'auth.adminpassword' => 'secret',
'admin.protectindexpage' => false,
'admin.protectmetadata' => false,
'secretsalt' => 'defaultsecretsalt',
'technicalcontact_name' => 'Administrator',
'technicalcontact_email' => 'na@example.invalid',
'timezone' => NULL,
'logging.level' => SimpleSAML_Logger::DEBUG,
'logging.handler' => 'errorlog',
'logging.facility' => 168,
'logging.processname' => 'simplesamlphp',
'logging.logfile' => 'simplesamlphp.log',
'statistics.out' => [],
'database.dsn' => 'mysql:host=localhost;dbname=saml',
'database.username' => 'simplesamlphp',
'database.password' => 'secret',
'database.prefix' => '',
'database.persistent' => false,
'database.slaves' => [],
'enable.saml20-idp' => true,
'enable.shib13-idp' => true,
'enable.adfs-idp' => false,
'enable.wsfed-sp' => false,
'enable.authmemcookie' => false,
'session.duration' => 28800,
'session.datastore.timeout' => 14400,
'session.state.timeout' => 3600,
'session.cookie.name' => 'SimpleSAMLSessionIDIdp',
'session.cookie.lifetime' => 0,
'session.cookie.path' => '/',
'session.cookie.domain' => NULL,
'session.cookie.secure' => false,
'enable.http_post' => false,
'session.phpsession.cookiename' => 'PHPSESSIDIDP',
'session.phpsession.savepath' => NULL,
'session.phpsession.httponly' => true,
'session.authtoken.cookiename' => 'SimpleSAMLAuthTokenIdp',
'session.rememberme.enable' => false,
'session.rememberme.checked' => false,
'session.rememberme.lifetime' => 1209600,
'language.available' =>
[
0 => 'en',
1 => 'no',
2 => 'nn',
3 => 'se',
4 => 'da',
5 => 'de',
6 => 'sv',
7 => 'fi',
8 => 'es',
9 => 'fr',
10 => 'it',
11 => 'nl',
12 => 'lb',
13 => 'cs',
14 => 'sl',
15 => 'lt',
16 => 'hr',
17 => 'hu',
18 => 'pl',
19 => 'pt',
20 => 'pt-br',
21 => 'tr',
22 => 'ja',
23 => 'zh',
24 => 'zh-tw',
25 => 'ru',
26 => 'et',
27 => 'he',
28 => 'id',
29 => 'sr',
30 => 'lv',
31 => 'ro',
32 => 'eu',
],
'language.rtl' =>
[
0 => 'ar',
1 => 'dv',
2 => 'fa',
3 => 'ur',
4 => 'he',
],
'language.default' => 'en',
'language.parameter.name' => 'language',
'language.parameter.setcookie' => true,
'language.cookie.name' => 'language',
'language.cookie.domain' => NULL,
'language.cookie.path' => '/',
'language.cookie.lifetime' => 77760000,
'attributes.extradictionary' => NULL,
'theme.use' => 'default',
'default-wsfed-idp' => 'urn:federation:pingfederate:localhost',
'idpdisco.enableremember' => true,
'idpdisco.rememberchecked' => true,
'idpdisco.validate' => true,
'idpdisco.extDiscoveryStorage' => NULL,
'idpdisco.layout' => 'dropdown',
'shib13.signresponse' => true,
'authproc.idp' =>
[
30 => 'core:LanguageAdaptor',
45 =>
[
'class' => 'core:StatisticsWithAttribute',
'attributename' => 'realm',
'type' => 'saml20-idp-SSO',
],
50 => 'core:AttributeLimit',
99 => 'core:LanguageAdaptor',
],
'authproc.sp' =>
[
90 => 'core:LanguageAdaptor',
],
'metadata.sources' =>
[
[
'type' => 'flatfile',
],
],
'store.type' => 'phpsession',
'store.sql.dsn' => 'sqlite:/path/to/sqlitedatabase.sq3',
'store.sql.username' => NULL,
'store.sql.password' => NULL,
'store.sql.prefix' => 'SimpleSAMLphp',
'memcache_store.servers' =>
[
[
[
'hostname' => 'localhost',
],
],
],
'memcache_store.prefix' => NULL,
'memcache_store.expires' => 129600,
'metadata.sign.enable' => false,
'metadata.sign.privatekey' => NULL,
'metadata.sign.privatekey_pass' => NULL,
'metadata.sign.certificate' => NULL,
'proxy' => NULL,
'trusted.url.domains' => [],
];</syntaxhighlight></div>
</div>

<div class="toccolours mw-collapsible mw-collapsed">
<code>saml-sp-metadata.php</code>
<div class="mw-collapsible-content"><syntaxhighlight lang="php"><?php

#SIMPLESAMLPHP_SP_ENTITY_ID: https://${DEV_SHARED_IDP_HOST}/simplesaml/saml2/idp/metadata.php
#SIMPLESAMLPHP_SP_ASSERTION_CONSUMER_SERVICE: https://${DEV_PROD_EU_HOST}/_sp/module.php/saml/sp/saml2-acs.php/default-sp
#SIMPLESAMLPHP_SP_SINGLE_LOGOUT_SERVICE: https://${DEV_PROD_EU_HOST}/_sp/module.php/saml/sp/saml2-logout.php/default-sp

$idpHost = getenv( 'DEV_SHARED_IDP_HOST' );
$spHosts = getenv( 'DEV_SP_HOSTS' ) ?? '';
$spHosts = explode( ',', $spHosts );
$spHosts = array_map( 'trim', $spHosts );

$metadata = [];

foreach ( $spHosts as $spHostAndName ) {
$spParts = explode( '###', $spHostAndName );
$spHost = $spParts[0];
$spName = $spParts[1];
$metadata["https://$spHost"] = array(
'AssertionConsumerService' => "https://$spHost/_sp/module.php/saml/sp/saml2-acs.php/$spName",
'SingleLogoutService' => "https://$spHost/_sp/module.php/saml/sp/saml2-logout.php/$spName",
);
}
</syntaxhighlight></div>
</div>

<div class="toccolours mw-collapsible mw-collapsed">
<code>saml-users.php</code>
<div class="mw-collapsible-content"><syntaxhighlight lang="php"><?php

// See https://github.com/kristophjunge/docker-test-saml-idp/blob/master/config/simplesamlphp/authsources.php

$pass = getenv( 'DB_ROOT_PASS' );

$config = [
'admin' => [
'core:AdminPassword',
],
'example-userpass' => [
// First element must be a string which identifies the authentication source.
'exampleauth:UserPass',

"alice@example.invalid:$pass" => [
'username' => [ 'alice@example.invalid' ],
'name' => [ 'Alice' ],
'email' => [ 'alice@example.invalid' ],
'groups' => [ 'wiki-contributor', 'wiki-admin' ]
],
"bob@example.invalid:$pass" => [
'username' => [ 'bob@example.invalid' ],
'name' => [ 'Bob' ],
'email' => [ 'bob@example.invalid' ],
'groups' => [ 'wiki-contributor' ]
],
"charlie@example.invalid:$pass" => [
'username' => [ 'charlie@example.invalid' ],
'name' => [ 'Charlie' ],
'email' => [ 'charlie@example.invalid' ],
'groups' => [ 'wiki-admin' ]
]
],
];</syntaxhighlight></div>
</div>

In your <code>docker-compose.override.yml</code> add<syntaxhighlight lang="yaml">
samlidp:
image: kristophjunge/test-saml-idp
container_name: ${COMPOSE_PROJECT_NAME:-bluespice}-samlidp
volumes:
- ${DATADIR}/saml-idp/saml-config.php:/var/www/simplesamlphp/config/config.php
- ${DATADIR}/saml-idp/saml-users.php:/var/www/simplesamlphp/config/authsources.php
- ${DATADIR}/saml-idp/saml-sp-metadata.php:/var/www/simplesamlphp/metadata/saml20-sp-remote.php
environment:
VIRTUAL_HOST: ${WIKI_HOST}
VIRTUAL_PATH: /_samlidp/
VIRTUAL_PORT: 8080
VIRTUAL_DEST: /
DEV_SHARED_IDP_HOST: ${WIKI_HOST}
DEV_SP_HOSTS: ${WIKI_HOST}###default-sp
restart: no
</syntaxhighlight>
After starting the stack with <code>./bluespice-deploy up -d</code> you can
* access the IdP via https://localhost/_samlidp/simplesaml/module.php/core/frontpage_welcome.php (metadata at https://localhost/_samlidp/simplesaml/saml2/idp/metadata.php )
* test authentication on the SP via https://localhost/_sp/module.php/admin/test/default-sp (metadata at https://localhost/_sp/module.php/saml/sp/metadata/default-sp )

To wire your wiki application, create a new file <code>settings.d/099-SAML-dev.local.php</code> within your <code>$CODEDIR</code>
<syntaxhighlight lang="php"><?php

$GLOBALS['wgExtensionFunctions'][] = function () {
$GLOBALS['wgPluggableAuth_EnableAutoLogin'] = true;
$GLOBALS['wgPluggableAuth_Config']['Log in with SAML'] = [
'plugin' => 'SimpleSAMLphp',
'data' => [
'authSourceId' => 'default-sp',
'usernameAttribute' => 'name',
'realNameAttribute' => 'name',
'emailAttribute' => 'email'
],
'groupsyncs' => [
[
'type' => 'mapped',
'map' => [
'editor' => [
'groups' => 'wiki-contributor'
],
'sysop' => [
'groups' => 'wiki-admin'
]
]
]
]

];
};
</syntaxhighlight>

Development/SAML 2.0 IdP

2026-07-14T11:33:17Z

Rvogel1:

Create the following files and folders within your <code>$DATADIR</code>
<syntaxhighlight lang="text">
└── saml-idp
├── saml-config.php
├── saml-sp-metadata.php
└── saml-users.php

</syntaxhighlight>

Add the following content to the files

<div class="toccolours mw-collapsible mw-collapsed">
<code>saml-config.php</code>
<div class="mw-collapsible-content"><syntaxhighlight lang="php"><?php

// See https://github.com/kristophjunge/docker-test-saml-idp/blob/master/config/simplesamlphp/config.php

$idPbaseUrl = 'https://' . getenv( 'DEV_SHARED_IDP_HOST' );
$config = [
'baseurlpath' => $idPbaseUrl . '/_samlidp/simplesaml/',
'certdir' => 'cert/',
'loggingdir' => 'log/',
'datadir' => 'data/',
'tempdir' => '/tmp/simplesaml',
'debug' => true,
'showerrors' => true,
'errorreporting' => true,
'debug.validatexml' => false,
'auth.adminpassword' => 'secret',
'admin.protectindexpage' => false,
'admin.protectmetadata' => false,
'secretsalt' => 'defaultsecretsalt',
'technicalcontact_name' => 'Administrator',
'technicalcontact_email' => 'na@example.invalid',
'timezone' => NULL,
'logging.level' => SimpleSAML_Logger::DEBUG,
'logging.handler' => 'errorlog',
'logging.facility' => 168,
'logging.processname' => 'simplesamlphp',
'logging.logfile' => 'simplesamlphp.log',
'statistics.out' => [],
'database.dsn' => 'mysql:host=localhost;dbname=saml',
'database.username' => 'simplesamlphp',
'database.password' => 'secret',
'database.prefix' => '',
'database.persistent' => false,
'database.slaves' => [],
'enable.saml20-idp' => true,
'enable.shib13-idp' => true,
'enable.adfs-idp' => false,
'enable.wsfed-sp' => false,
'enable.authmemcookie' => false,
'session.duration' => 28800,
'session.datastore.timeout' => 14400,
'session.state.timeout' => 3600,
'session.cookie.name' => 'SimpleSAMLSessionIDIdp',
'session.cookie.lifetime' => 0,
'session.cookie.path' => '/',
'session.cookie.domain' => NULL,
'session.cookie.secure' => false,
'enable.http_post' => false,
'session.phpsession.cookiename' => 'PHPSESSIDIDP',
'session.phpsession.savepath' => NULL,
'session.phpsession.httponly' => true,
'session.authtoken.cookiename' => 'SimpleSAMLAuthTokenIdp',
'session.rememberme.enable' => false,
'session.rememberme.checked' => false,
'session.rememberme.lifetime' => 1209600,
'language.available' =>
[
0 => 'en',
1 => 'no',
2 => 'nn',
3 => 'se',
4 => 'da',
5 => 'de',
6 => 'sv',
7 => 'fi',
8 => 'es',
9 => 'fr',
10 => 'it',
11 => 'nl',
12 => 'lb',
13 => 'cs',
14 => 'sl',
15 => 'lt',
16 => 'hr',
17 => 'hu',
18 => 'pl',
19 => 'pt',
20 => 'pt-br',
21 => 'tr',
22 => 'ja',
23 => 'zh',
24 => 'zh-tw',
25 => 'ru',
26 => 'et',
27 => 'he',
28 => 'id',
29 => 'sr',
30 => 'lv',
31 => 'ro',
32 => 'eu',
],
'language.rtl' =>
[
0 => 'ar',
1 => 'dv',
2 => 'fa',
3 => 'ur',
4 => 'he',
],
'language.default' => 'en',
'language.parameter.name' => 'language',
'language.parameter.setcookie' => true,
'language.cookie.name' => 'language',
'language.cookie.domain' => NULL,
'language.cookie.path' => '/',
'language.cookie.lifetime' => 77760000,
'attributes.extradictionary' => NULL,
'theme.use' => 'default',
'default-wsfed-idp' => 'urn:federation:pingfederate:localhost',
'idpdisco.enableremember' => true,
'idpdisco.rememberchecked' => true,
'idpdisco.validate' => true,
'idpdisco.extDiscoveryStorage' => NULL,
'idpdisco.layout' => 'dropdown',
'shib13.signresponse' => true,
'authproc.idp' =>
[
30 => 'core:LanguageAdaptor',
45 =>
[
'class' => 'core:StatisticsWithAttribute',
'attributename' => 'realm',
'type' => 'saml20-idp-SSO',
],
50 => 'core:AttributeLimit',
99 => 'core:LanguageAdaptor',
],
'authproc.sp' =>
[
90 => 'core:LanguageAdaptor',
],
'metadata.sources' =>
[
[
'type' => 'flatfile',
],
],
'store.type' => 'phpsession',
'store.sql.dsn' => 'sqlite:/path/to/sqlitedatabase.sq3',
'store.sql.username' => NULL,
'store.sql.password' => NULL,
'store.sql.prefix' => 'SimpleSAMLphp',
'memcache_store.servers' =>
[
[
[
'hostname' => 'localhost',
],
],
],
'memcache_store.prefix' => NULL,
'memcache_store.expires' => 129600,
'metadata.sign.enable' => false,
'metadata.sign.privatekey' => NULL,
'metadata.sign.privatekey_pass' => NULL,
'metadata.sign.certificate' => NULL,
'proxy' => NULL,
'trusted.url.domains' => [],
];
</syntaxhighlight></div>
</div>

<div class="toccolours mw-collapsible mw-collapsed">
<code>saml-sp-metadata.php</code>
<div class="mw-collapsible-content"><syntaxhighlight lang="php"><?php

#SIMPLESAMLPHP_SP_ENTITY_ID: https://${DEV_SHARED_IDP_HOST}/simplesaml/saml2/idp/metadata.php
#SIMPLESAMLPHP_SP_ASSERTION_CONSUMER_SERVICE: https://${DEV_PROD_EU_HOST}/_sp/module.php/saml/sp/saml2-acs.php/default-sp
#SIMPLESAMLPHP_SP_SINGLE_LOGOUT_SERVICE: https://${DEV_PROD_EU_HOST}/_sp/module.php/saml/sp/saml2-logout.php/default-sp

# Test authn: https://mydev.localhost/_sp/module.php/admin/test/default-sp

$idpHost = getenv( 'DEV_SHARED_IDP_HOST' );
$spHosts = getenv( 'DEV_SP_HOSTS' ) ?? '';
$spHosts = explode( ',', $spHosts );
$spHosts = array_map( 'trim', $spHosts );

$metadata = [];

foreach ( $spHosts as $spHostAndName ) {
$spParts = explode( '###', $spHostAndName );
$spHost = $spParts[0];
$spName = $spParts[1];
$metadata["https://$spHost"] = array(
'AssertionConsumerService' => "https://$spHost/_sp/module.php/saml/sp/saml2-acs.php/$spName",
'SingleLogoutService' => "https://$spHost/_sp/module.php/saml/sp/saml2-logout.php/$spName",
);
}
</syntaxhighlight></div>
</div>

<div class="toccolours mw-collapsible mw-collapsed">
<code>saml-users.php</code>
<div class="mw-collapsible-content"><syntaxhighlight lang="php"><?php

// See https://github.com/kristophjunge/docker-test-saml-idp/blob/master/config/simplesamlphp/authsources.php

$pass = getenv( 'DB_ROOT_PASS' );

$config = [
'admin' => [
'core:AdminPassword',
],
'example-userpass' => [
// First element must be a string which identifies the authentication source.
'exampleauth:UserPass',

"alice@example.invalid:$pass" => [
'username' => [ 'alice@example.invalid' ],
'name' => [ 'Alice' ],
'email' => [ 'alice@example.invalid' ],
'groups' => [ 'wiki-contributor', 'wiki-admin' ]
],
"bob@example.invalid:$pass" => [
'username' => [ 'bob@example.invalid' ],
'name' => [ 'Bob' ],
'email' => [ 'bob@example.invalid' ],
'groups' => [ 'wiki-contributor' ]
],
"charlie@example.invalid:$pass" => [
'username' => [ 'charlie@example.invalid' ],
'name' => [ 'Charlie' ],
'email' => [ 'charlie@example.invalid' ],
'groups' => [ 'wiki-admin' ]
]
],
];</syntaxhighlight></div>
</div>

In your <code>docker-compose.override.yml</code> add<syntaxhighlight lang="yaml">
samlidp:
image: kristophjunge/test-saml-idp
container_name: ${COMPOSE_PROJECT_NAME:-bluespice}-samlidp
volumes:
- ${DATADIR}/saml-idp/saml-config.php:/var/www/simplesamlphp/config/config.php
- ${DATADIR}/saml-idp/saml-users.php:/var/www/simplesamlphp/config/authsources.php
- ${DATADIR}/saml-idp/saml-sp-metadata.php:/var/www/simplesamlphp/metadata/saml20-sp-remote.php
environment:
VIRTUAL_HOST: ${WIKI_HOST}
VIRTUAL_PATH: /_samlidp/
VIRTUAL_PORT: 8080
VIRTUAL_DEST: /
DEV_SHARED_IDP_HOST: ${WIKI_HOST}
DEV_SP_HOSTS: ${WIKI_HOST}###default-sp
restart: no
</syntaxhighlight>
After starting the stack with <code>./bluespice-deploy up -d</code> you can
* access the IdP via https://localhost/_samlidp/simplesaml/module.php/core/frontpage_welcome.php (metadata at https://localhost/_samlidp/simplesaml/saml2/idp/metadata.php )
* test authentication on the SP via https://localhost/_sp/module.php/admin/test/default-sp (metadata at https://localhost/_sp/module.php/saml/sp/metadata/default-sp )

To wire your wiki application, create a new file <code>settings.d/099-SAML-dev.local.php</code> within your <code>$CODEDIR</code>
<syntaxhighlight lang="php"><?php

$GLOBALS['wgExtensionFunctions'][] = function () {
$GLOBALS['wgPluggableAuth_EnableAutoLogin'] = true;
$GLOBALS['wgPluggableAuth_Config']['Log in with SAML'] = [
'plugin' => 'SimpleSAMLphp',
'data' => [
'authSourceId' => 'default-sp',
'usernameAttribute' => 'name',
'realNameAttribute' => 'name',
'emailAttribute' => 'email'
],
'groupsyncs' => [
[
'type' => 'mapped',
'map' => [
'editor' => [
'groups' => 'wiki-contributor'
],
'sysop' => [
'groups' => 'wiki-admin'
]
]
]
]

];
};
</syntaxhighlight>

Development/SAML 2.0 IdP

2026-07-14T11:31:56Z

Rvogel1:

Create the following files and folders within your <code>$DATADIR</code>
<syntaxhighlight lang="text">
└── saml-idp
├── saml-config.php
├── saml-sp-metadata.php
└── saml-users.php

</syntaxhighlight>

Add the following content to the files

<div class="toccolours mw-collapsible mw-collapsed">
<code>saml-config.php</code>
<div class="mw-collapsible-content"><syntaxhighlight lang="php"><?php

// See https://github.com/kristophjunge/docker-test-saml-idp/blob/master/config/simplesamlphp/config.php

$idPbaseUrl = 'https://' . getenv( 'DEV_SHARED_IDP_HOST' );
$config = [
'baseurlpath' => $idPbaseUrl . '/_samlidp/simplesaml/',
'certdir' => 'cert/',
'loggingdir' => 'log/',
'datadir' => 'data/',
'tempdir' => '/tmp/simplesaml',
'debug' => true,
'showerrors' => true,
'errorreporting' => true,
'debug.validatexml' => false,
'auth.adminpassword' => 'secret',
'admin.protectindexpage' => false,
'admin.protectmetadata' => false,
'secretsalt' => 'defaultsecretsalt',
'technicalcontact_name' => 'Administrator',
'technicalcontact_email' => 'na@example.invalid',
'timezone' => NULL,
'logging.level' => SimpleSAML_Logger::DEBUG,
'logging.handler' => 'errorlog',
'logging.facility' => 168,
'logging.processname' => 'simplesamlphp',
'logging.logfile' => 'simplesamlphp.log',
'statistics.out' => [],
'database.dsn' => 'mysql:host=localhost;dbname=saml',
'database.username' => 'simplesamlphp',
'database.password' => 'secret',
'database.prefix' => '',
'database.persistent' => false,
'database.slaves' => [],
'enable.saml20-idp' => true,
'enable.shib13-idp' => true,
'enable.adfs-idp' => false,
'enable.wsfed-sp' => false,
'enable.authmemcookie' => false,
'session.duration' => 28800,
'session.datastore.timeout' => 14400,
'session.state.timeout' => 3600,
'session.cookie.name' => 'SimpleSAMLSessionIDIdp',
'session.cookie.lifetime' => 0,
'session.cookie.path' => '/',
'session.cookie.domain' => NULL,
'session.cookie.secure' => false,
'enable.http_post' => false,
'session.phpsession.cookiename' => 'PHPSESSIDIDP',
'session.phpsession.savepath' => NULL,
'session.phpsession.httponly' => true,
'session.authtoken.cookiename' => 'SimpleSAMLAuthTokenIdp',
'session.rememberme.enable' => false,
'session.rememberme.checked' => false,
'session.rememberme.lifetime' => 1209600,
'language.available' =>
[
0 => 'en',
1 => 'no',
2 => 'nn',
3 => 'se',
4 => 'da',
5 => 'de',
6 => 'sv',
7 => 'fi',
8 => 'es',
9 => 'fr',
10 => 'it',
11 => 'nl',
12 => 'lb',
13 => 'cs',
14 => 'sl',
15 => 'lt',
16 => 'hr',
17 => 'hu',
18 => 'pl',
19 => 'pt',
20 => 'pt-br',
21 => 'tr',
22 => 'ja',
23 => 'zh',
24 => 'zh-tw',
25 => 'ru',
26 => 'et',
27 => 'he',
28 => 'id',
29 => 'sr',
30 => 'lv',
31 => 'ro',
32 => 'eu',
],
'language.rtl' =>
[
0 => 'ar',
1 => 'dv',
2 => 'fa',
3 => 'ur',
4 => 'he',
],
'language.default' => 'en',
'language.parameter.name' => 'language',
'language.parameter.setcookie' => true,
'language.cookie.name' => 'language',
'language.cookie.domain' => NULL,
'language.cookie.path' => '/',
'language.cookie.lifetime' => 77760000,
'attributes.extradictionary' => NULL,
'theme.use' => 'default',
'default-wsfed-idp' => 'urn:federation:pingfederate:localhost',
'idpdisco.enableremember' => true,
'idpdisco.rememberchecked' => true,
'idpdisco.validate' => true,
'idpdisco.extDiscoveryStorage' => NULL,
'idpdisco.layout' => 'dropdown',
'shib13.signresponse' => true,
'authproc.idp' =>
[
30 => 'core:LanguageAdaptor',
45 =>
[
'class' => 'core:StatisticsWithAttribute',
'attributename' => 'realm',
'type' => 'saml20-idp-SSO',
],
50 => 'core:AttributeLimit',
99 => 'core:LanguageAdaptor',
],
'authproc.sp' =>
[
90 => 'core:LanguageAdaptor',
],
'metadata.sources' =>
[
[
'type' => 'flatfile',
],
],
'store.type' => 'phpsession',
'store.sql.dsn' => 'sqlite:/path/to/sqlitedatabase.sq3',
'store.sql.username' => NULL,
'store.sql.password' => NULL,
'store.sql.prefix' => 'SimpleSAMLphp',
'memcache_store.servers' =>
[
[
[
'hostname' => 'localhost',
],
],
],
'memcache_store.prefix' => NULL,
'memcache_store.expires' => 129600,
'metadata.sign.enable' => false,
'metadata.sign.privatekey' => NULL,
'metadata.sign.privatekey_pass' => NULL,
'metadata.sign.certificate' => NULL,
'proxy' => NULL,
'trusted.url.domains' => [],
];
</syntaxhighlight></div>
</div>

<div class="toccolours mw-collapsible mw-collapsed">
<code>saml-sp-metadata.php</code>
<div class="mw-collapsible-content"><syntaxhighlight lang="php"><?php

#SIMPLESAMLPHP_SP_ENTITY_ID: https://${DEV_SHARED_IDP_HOST}/simplesaml/saml2/idp/metadata.php
#SIMPLESAMLPHP_SP_ASSERTION_CONSUMER_SERVICE: https://${DEV_PROD_EU_HOST}/_sp/module.php/saml/sp/saml2-acs.php/default-sp
#SIMPLESAMLPHP_SP_SINGLE_LOGOUT_SERVICE: https://${DEV_PROD_EU_HOST}/_sp/module.php/saml/sp/saml2-logout.php/default-sp

# Test authn: https://mydev.localhost/_sp/module.php/admin/test/default-sp

$idpHost = getenv( 'DEV_SHARED_IDP_HOST' );
$spHosts = getenv( 'DEV_SP_HOSTS' ) ?? '';
$spHosts = explode( ',', $spHosts );
$spHosts = array_map( 'trim', $spHosts );

$metadata = [];

foreach ( $spHosts as $spHostAndName ) {
$spParts = explode( '###', $spHostAndName );
$spHost = $spParts[0];
$spName = $spParts[1];
$metadata["https://$spHost"] = array(
'AssertionConsumerService' => "https://$spHost/_sp/module.php/saml/sp/saml2-acs.php/$spName",
'SingleLogoutService' => "https://$spHost/_sp/module.php/saml/sp/saml2-logout.php/$spName",
);
}
</syntaxhighlight></div>
</div>

<div class="toccolours mw-collapsible mw-collapsed">
<code>saml-users.php</code>
<div class="mw-collapsible-content"><syntaxhighlight lang="php"><?php

// See https://github.com/kristophjunge/docker-test-saml-idp/blob/master/config/simplesamlphp/authsources.php

$pass = getenv( 'DB_ROOT_PASS' );

$config = [
'admin' => [
'core:AdminPassword',
],
'example-userpass' => [
// First element must be a string which identifies the authentication source.
'exampleauth:UserPass',

"alice@example.invalid:$pass" => [
'username' => [ 'alice@example.invalid' ],
'name' => [ 'Alice' ],
'email' => [ 'alice@example.invalid' ],
'groups' => [ 'wiki-contributor', 'wiki-admin' ]
],
"bob@example.invalid:$pass" => [
'username' => [ 'bob@example.invalid' ],
'name' => [ 'Bob' ],
'email' => [ 'bob@example.invalid' ],
'groups' => [ 'wiki-contributor' ]
],
"charlie@example.invalid:$pass" => [
'username' => [ 'charlie@example.invalid' ],
'name' => [ 'Charlie' ],
'email' => [ 'charlie@example.invalid' ],
'groups' => [ 'wiki-admin' ]
]
],
];
</syntaxhighlight></div>
</div>

In your <code>docker-compose.override.yml</code> add<syntaxhighlight lang="yaml">
samlidp:
image: kristophjunge/test-saml-idp
container_name: ${COMPOSE_PROJECT_NAME:-bluespice}-samlidp
volumes:
- ${DATADIR}/saml-idp/saml-config.php:/var/www/simplesamlphp/config/config.php
- ${DATADIR}/saml-idp/saml-users.php:/var/www/simplesamlphp/config/authsources.php
- ${DATADIR}/saml-idp/saml-sp-metadata.php:/var/www/simplesamlphp/metadata/saml20-sp-remote.php
environment:
VIRTUAL_HOST: ${WIKI_HOST}
VIRTUAL_PATH: /_samlidp/
VIRTUAL_PORT: 8080
VIRTUAL_DEST: /
DEV_SHARED_IDP_HOST: ${WIKI_HOST}
DEV_SP_HOSTS: ${WIKI_HOST}###default-sp
restart: no
</syntaxhighlight>
After starting the stack with <code>./bluespice-deploy up -d</code> you can
* access the IdP via https://localhost/_samlidp/simplesaml/module.php/core/frontpage_welcome.php (metadata at https://localhost/_samlidp/simplesaml/saml2/idp/metadata.php )
* test authentication on the SP via https://localhost/_sp/module.php/admin/test/default-sp (metadata at https://localhost/_sp/module.php/saml/sp/metadata/default-sp )

To wire your wiki application, create a new file <code>settings.d/099-SAML-dev.local.php</code> within your <code>$CODEDIR</code>
<syntaxhighlight lang="php"><?php

$GLOBALS['wgExtensionFunctions'][] = function () {
$GLOBALS['wgPluggableAuth_EnableAutoLogin'] = true;
$GLOBALS['wgPluggableAuth_Config']['Log in with SAML'] = [
'plugin' => 'SimpleSAMLphp',
'data' => [
'authSourceId' => 'default-sp',
'usernameAttribute' => 'username',
'realNameAttribute' => 'name',
'emailAttribute' => 'email'
],
'groupsyncs' => [
[
'type' => 'mapped',
'map' => [
'editor' => [
'groups' => 'wiki-contributor'
],
'sysop' => [
'groups' => 'wiki-admin'
]
]
]
]

];
};
</syntaxhighlight>

Development/SAML 2.0 IdP

2026-07-14T11:25:38Z

Rvogel1:

Create the following files and folders within your <code>$DATADIR</code>
<syntaxhighlight lang="text">
└── saml-idp
├── saml-config.php
├── saml-sp-metadata.php
└── saml-users.php

</syntaxhighlight>

Add the following content to the files

<div class="toccolours mw-collapsible mw-collapsed">
<code>saml-config.php</code>
<div class="mw-collapsible-content"><syntaxhighlight lang="php"><?php

// See https://github.com/kristophjunge/docker-test-saml-idp/blob/master/config/simplesamlphp/config.php

$idPbaseUrl = 'https://' . getenv( 'DEV_SHARED_IDP_HOST' );
$config = [
'baseurlpath' => $idPbaseUrl . '/_samlidp/simplesaml/',
'certdir' => 'cert/',
'loggingdir' => 'log/',
'datadir' => 'data/',
'tempdir' => '/tmp/simplesaml',
'debug' => true,
'showerrors' => true,
'errorreporting' => true,
'debug.validatexml' => false,
'auth.adminpassword' => 'secret',
'admin.protectindexpage' => false,
'admin.protectmetadata' => false,
'secretsalt' => 'defaultsecretsalt',
'technicalcontact_name' => 'Administrator',
'technicalcontact_email' => 'na@example.invalid',
'timezone' => NULL,
'logging.level' => SimpleSAML_Logger::DEBUG,
'logging.handler' => 'errorlog',
'logging.facility' => 168,
'logging.processname' => 'simplesamlphp',
'logging.logfile' => 'simplesamlphp.log',
'statistics.out' => [],
'database.dsn' => 'mysql:host=localhost;dbname=saml',
'database.username' => 'simplesamlphp',
'database.password' => 'secret',
'database.prefix' => '',
'database.persistent' => false,
'database.slaves' => [],
'enable.saml20-idp' => true,
'enable.shib13-idp' => true,
'enable.adfs-idp' => false,
'enable.wsfed-sp' => false,
'enable.authmemcookie' => false,
'session.duration' => 28800,
'session.datastore.timeout' => 14400,
'session.state.timeout' => 3600,
'session.cookie.name' => 'SimpleSAMLSessionIDIdp',
'session.cookie.lifetime' => 0,
'session.cookie.path' => '/',
'session.cookie.domain' => NULL,
'session.cookie.secure' => false,
'enable.http_post' => false,
'session.phpsession.cookiename' => 'PHPSESSIDIDP',
'session.phpsession.savepath' => NULL,
'session.phpsession.httponly' => true,
'session.authtoken.cookiename' => 'SimpleSAMLAuthTokenIdp',
'session.rememberme.enable' => false,
'session.rememberme.checked' => false,
'session.rememberme.lifetime' => 1209600,
'language.available' =>
[
0 => 'en',
1 => 'no',
2 => 'nn',
3 => 'se',
4 => 'da',
5 => 'de',
6 => 'sv',
7 => 'fi',
8 => 'es',
9 => 'fr',
10 => 'it',
11 => 'nl',
12 => 'lb',
13 => 'cs',
14 => 'sl',
15 => 'lt',
16 => 'hr',
17 => 'hu',
18 => 'pl',
19 => 'pt',
20 => 'pt-br',
21 => 'tr',
22 => 'ja',
23 => 'zh',
24 => 'zh-tw',
25 => 'ru',
26 => 'et',
27 => 'he',
28 => 'id',
29 => 'sr',
30 => 'lv',
31 => 'ro',
32 => 'eu',
],
'language.rtl' =>
[
0 => 'ar',
1 => 'dv',
2 => 'fa',
3 => 'ur',
4 => 'he',
],
'language.default' => 'en',
'language.parameter.name' => 'language',
'language.parameter.setcookie' => true,
'language.cookie.name' => 'language',
'language.cookie.domain' => NULL,
'language.cookie.path' => '/',
'language.cookie.lifetime' => 77760000,
'attributes.extradictionary' => NULL,
'theme.use' => 'default',
'default-wsfed-idp' => 'urn:federation:pingfederate:localhost',
'idpdisco.enableremember' => true,
'idpdisco.rememberchecked' => true,
'idpdisco.validate' => true,
'idpdisco.extDiscoveryStorage' => NULL,
'idpdisco.layout' => 'dropdown',
'shib13.signresponse' => true,
'authproc.idp' =>
[
30 => 'core:LanguageAdaptor',
45 =>
[
'class' => 'core:StatisticsWithAttribute',
'attributename' => 'realm',
'type' => 'saml20-idp-SSO',
],
50 => 'core:AttributeLimit',
99 => 'core:LanguageAdaptor',
],
'authproc.sp' =>
[
90 => 'core:LanguageAdaptor',
],
'metadata.sources' =>
[
[
'type' => 'flatfile',
],
],
'store.type' => 'phpsession',
'store.sql.dsn' => 'sqlite:/path/to/sqlitedatabase.sq3',
'store.sql.username' => NULL,
'store.sql.password' => NULL,
'store.sql.prefix' => 'SimpleSAMLphp',
'memcache_store.servers' =>
[
[
[
'hostname' => 'localhost',
],
],
],
'memcache_store.prefix' => NULL,
'memcache_store.expires' => 129600,
'metadata.sign.enable' => false,
'metadata.sign.privatekey' => NULL,
'metadata.sign.privatekey_pass' => NULL,
'metadata.sign.certificate' => NULL,
'proxy' => NULL,
'trusted.url.domains' => [],
];
</syntaxhighlight></div>
</div>

<div class="toccolours mw-collapsible mw-collapsed">
<code>saml-sp-metadata.php</code>
<div class="mw-collapsible-content"><syntaxhighlight lang="php"><?php

#SIMPLESAMLPHP_SP_ENTITY_ID: https://${DEV_SHARED_IDP_HOST}/simplesaml/saml2/idp/metadata.php
#SIMPLESAMLPHP_SP_ASSERTION_CONSUMER_SERVICE: https://${DEV_PROD_EU_HOST}/_sp/module.php/saml/sp/saml2-acs.php/default-sp
#SIMPLESAMLPHP_SP_SINGLE_LOGOUT_SERVICE: https://${DEV_PROD_EU_HOST}/_sp/module.php/saml/sp/saml2-logout.php/default-sp

# Test authn: https://mydev.localhost/_sp/module.php/admin/test/default-sp

$idpHost = getenv( 'DEV_SHARED_IDP_HOST' );
$spHosts = getenv( 'DEV_SP_HOSTS' ) ?? '';
$spHosts = explode( ',', $spHosts );
$spHosts = array_map( 'trim', $spHosts );

$metadata = [];

foreach ( $spHosts as $spHostAndName ) {
$spParts = explode( '###', $spHostAndName );
$spHost = $spParts[0];
$spName = $spParts[1];
$metadata["https://$spHost"] = array(
'AssertionConsumerService' => "https://$spHost/_sp/module.php/saml/sp/saml2-acs.php/$spName",
'SingleLogoutService' => "https://$spHost/_sp/module.php/saml/sp/saml2-logout.php/$spName",
);
}
</syntaxhighlight></div>
</div>

<div class="toccolours mw-collapsible mw-collapsed">
<code>saml-users.php</code>
<div class="mw-collapsible-content"><syntaxhighlight lang="php"><?php

// See https://github.com/kristophjunge/docker-test-saml-idp/blob/master/config/simplesamlphp/authsources.php

$pass = getenv( 'DB_ROOT_PASS' );

$config = [
'admin' => [
'core:AdminPassword',
],
'example-userpass' => [
// First element must be a string which identifies the authentication source.
'exampleauth:UserPass',

"alice@example.invalid:$pass" => [
'username' => [ 'alice@example.invalid' ],
'name' => [ 'Alice' ],
'email' => [ 'alice@example.invalid' ],
'groups' => [ 'wiki-contributor', 'wiki-admin' ]
],
"bob@example.invalid:$pass" => [
'username' => [ 'bob@example.invalid' ],
'name' => [ 'Bob' ],
'email' => [ 'bob@example.invalid' ],
'groups' => [ 'wiki-contributor' ]
],
"charlie@example.invalid:$pass" => [
'username' => [ 'charlie@example.invalid' ],
'name' => [ 'Charlie' ],
'email' => [ 'charlie@example.invalid' ],
'groups' => [ 'wiki-admin' ]
]
],
];
</syntaxhighlight></div>
</div>

In your <code>docker-compose.override.yml</code> add<syntaxhighlight lang="yaml">
samlidp:
image: kristophjunge/test-saml-idp
container_name: ${COMPOSE_PROJECT_NAME:-bluespice}-samlidp
volumes:
- ${DATADIR}/saml-idp/saml-config.php:/var/www/simplesamlphp/config/config.php
- ${DATADIR}/saml-idp/saml-users.php:/var/www/simplesamlphp/config/authsources.php
- ${DATADIR}/saml-idp/saml-sp-metadata.php:/var/www/simplesamlphp/metadata/saml20-sp-remote.php
environment:
VIRTUAL_HOST: ${WIKI_HOST}
VIRTUAL_PATH: /_samlidp/
VIRTUAL_PORT: 8080
VIRTUAL_DEST: /
DEV_SHARED_IDP_HOST: ${WIKI_HOST}
DEV_SP_HOSTS: ${WIKI_HOST}###default-sp
restart: no
</syntaxhighlight>
After

Within your <code>$CODEDIR</code>, create a new file

<div class="toccolours mw-collapsible mw-collapsed">
<code>settings.d/099-SAML-dev.local.php</code>
<div class="mw-collapsible-content"><syntaxhighlight lang="php"><?php

$GLOBALS['wgExtensionFunctions'][] = function () {
$GLOBALS['wgPluggableAuth_EnableAutoLogin'] = true;
$GLOBALS['wgPluggableAuth_Config']['Log in with SAML'] = [
'plugin' => 'SimpleSAMLphp',
'data' => [
'authSourceId' => 'default-sp',
'usernameAttribute' => 'username',
'realNameAttribute' => 'name',
'emailAttribute' => 'email'
],
'groupsyncs' => [
[
'type' => 'mapped',
'map' => [
'editor' => [
'groups' => 'wiki-contributor'
],
'sysop' => [
'groups' => 'wiki-admin'
]
]
]
]

];
};
</syntaxhighlight></div>
</div>

Development/SAML 2.0 IdP

2026-07-14T11:24:36Z

Rvogel1:

Development/SAML 2.0 IdP

2026-07-14T11:22:35Z

Rvogel1: Created page with "Create the following files and folders within your <code>$DATADIR</code> <syntaxhighlight lang="text"> └── saml-idp ├── saml-config.php ├── saml-sp-metadata.php └── saml-users.php </syntaxhighlight> Add the following content to the files <div class="toccolours mw-collapsible mw-collapsed"> <code>saml-sp-metadata.php</code> <div class="mw-collapsible-content"><syntaxhighlight lang="php"><?php #SIMPLESAMLPHP_SP_ENTITY_ID: https://${D..."

Development

2026-07-14T11:09:24Z

Rvogel1:

Development/S3 filestore service

2026-07-14T11:08:39Z

Rvogel1: Created page with "When working on the S3 filestore features, a developer needs a local S3 service. One can add the following to <code>docker-compose.override.yml</code><syntaxhighlight lang="yaml"> x-common-dev: &x-common ... environment: FILESTORE_HOST: filestore FILESTORE_PORT: 9000 FILESTORE_PROTOCOL: http FILESTORE_ACCESS_KEY: ${FILESTORE_ACCESS_KEY} FILESTORE_SECRET_KEY: ${FILESTORE_SECRET_KEY} FILESTORE_BUCKET_NAME: ${FILESTORE_BUCKET_NAME:-bluespice} F..."

When working on the S3 filestore features, a developer needs a local S3 service. One can add the following to <code>docker-compose.override.yml</code><syntaxhighlight lang="yaml">
x-common-dev: &x-common
...
environment:
FILESTORE_HOST: filestore
FILESTORE_PORT: 9000
FILESTORE_PROTOCOL: http
FILESTORE_ACCESS_KEY: ${FILESTORE_ACCESS_KEY}
FILESTORE_SECRET_KEY: ${FILESTORE_SECRET_KEY}
FILESTORE_BUCKET_NAME: ${FILESTORE_BUCKET_NAME:-bluespice}
FILESTORE_REGION: ${FILESTORE_REGION:-eu-north-1}
...

filestore:
image: minio/minio:latest
container_name: ${COMPOSE_PROJECT_NAME:-bluespice}-filestore
command: server /data --console-address ":9001"
environment:
MINIO_ROOT_USER: ${FILESTORE_ACCESS_KEY}
MINIO_ROOT_PASSWORD: ${FILESTORE_SECRET_KEY}
ports:
- "9000:9000"
- "9001:9001"
volumes:
- ${DATADIR}/filestore:/data
restart: no
</syntaxhighlight>In <code>.env</code>, add<syntaxhighlight lang="text">FILESTORE_ACCESS_KEY=...
FILESTORE_SECRET_KEY=...
FILESTORE_BUCKET_NAME=bluespice
FILESTORE_REGION=eu-north-1</syntaxhighlight>After a <code>./bluespice-deploy up -d</code> you can access the MINIO webinterface in your browser at <code><nowiki>http://localhost:9001</nowiki></code>. Use the values of <code>FILESTORE_ACCESS_KEY</code> and <code>FILESTORE_SECRET_KEY</code> to log in.

You will need to ''manually create'' a bucket with the name of <code>FILESTORE_BUCKET_NAME</code>.

Development

2026-07-14T11:08:29Z

Rvogel1:

Development

2026-07-10T06:17:57Z

Rvogel1: /* Add S3 filestore service */

{{Textbox|boxtype=warning|header=Do not apply to production environments!|text=This page contains information about how to set up a '''local development environment''' for BlueSpice. None of this is supposed to be used on an production system!|icon=yes}}

== Local development environment based on <code>bluespice-deploy</code> ==
A developer can use the [[Setup:Installation Guide/Docker|default deployment stack]] and alter is to quickly set up a development environment. To do so, first clone the stack to your local machine and navigate into it:
<syntaxhighlight lang="text">
git clone -b 5.2.x git@github.com:hallowelt/bluespice-deploy.git
cd bluespice-deploy/compose
</syntaxhighlight>

Create a proper <code>.env</code> file from the <code>.env.sample</code> and alter/add the following lines:
<syntaxhighlight lang="text">
DATADIR=~/workspace/REL1_43-5.2.x/data
CODEDIR=~/workspace/REL1_43-5.2.x/code
SMTP_HOST=mailhog
SMTP_PORT=1025
</syntaxhighlight>

Create a <code>docker-compose.override.yml</code> file with the following content:
<syntaxhighlight lang="yaml">
x-common-dev: &x-common
image: docker.bluespice.com/bluespice-qa/wiki:latest
volumes:
- ${CODEDIR}:/app/bluespice/w/

services:

wiki-installer:
<<: *x-common

wiki-web:
<<: *x-common
restart: no

wiki-task:
<<: *x-common
restart: no

mailhog:
image: mailhog/mailhog
container_name: ${COMPOSE_PROJECT_NAME:-bluespice}-mailhog
environment:
VIRTUAL_HOST: ${WIKI_HOST}
VIRTUAL_PATH: /_mailhog/
VIRTUAL_PORT: 8025
VIRTUAL_DEST: /
restart: no

cache:
restart: no

collabpads:
restart: no

collabpads-database:
restart: no

database:
restart: no

diagram:
restart: no

formula:
restart: no

pdf:
restart: no

proxy:
restart: no

search:
restart: no

wire:
restart: no
</syntaxhighlight>

This will make the stack use your local codebase from <code>$CODEDIR</code> and also expose a Mailhog web interface on <code>$Wiki_HOST/_mailhog</code>.

In addition, if you want to work with a custom build of the <code>bluespice/wiki</code> container, you can add an <code>image:</code> entry to the respective services. Example
<syntaxhighlight lang="yaml">
wiki-installer:
image: bluespice/wiki:dev
...
wiki-web:
image: bluespice/wiki:dev
...

wiki-task:
image: bluespice/wiki:dev
...
</syntaxhighlight>or you set<blockquote>BLUESPICE_WIKI_IMAGE=bluespice/wiki:dev</blockquote>in your <code>.env</code>-File

=== Add S3 <code>filestore</code> service ===
When working on the S3 filestore features, a developer needs a local S3 service. One can add the following to <code>docker-compose.override.yml</code> <syntaxhighlight lang="yaml">
x-common-dev: &x-common
...
environment:
FILESTORE_HOST: filestore
FILESTORE_PORT: 9000
FILESTORE_PROTOCOL: http
FILESTORE_ACCESS_KEY: ${FILESTORE_ACCESS_KEY}
FILESTORE_SECRET_KEY: ${FILESTORE_SECRET_KEY}
FILESTORE_BUCKET_NAME: ${FILESTORE_BUCKET_NAME:-bluespice}
FILESTORE_REGION: ${FILESTORE_REGION:-eu-north-1}
...

filestore:
image: minio/minio:latest
container_name: ${COMPOSE_PROJECT_NAME:-bluespice}-filestore
command: server /data --console-address ":9001"
environment:
MINIO_ROOT_USER: ${FILESTORE_ACCESS_KEY}
MINIO_ROOT_PASSWORD: ${FILESTORE_SECRET_KEY}
ports:
- "9000:9000"
- "9001:9001"
volumes:
- ${DATADIR}/filestore:/data
restart: no
</syntaxhighlight>In <code>.env</code>, add <syntaxhighlight lang="text">FILESTORE_ACCESS_KEY=...
FILESTORE_SECRET_KEY=...
FILESTORE_BUCKET_NAME=bluespice
FILESTORE_REGION=eu-north-1</syntaxhighlight>After a <code>./bluespice-deploy up -d</code> you can access the MINIO webinterface in your browser at <code><nowiki>http://localhost:9001</nowiki></code>. Use the values of <code>FILESTORE_ACCESS_KEY</code> and <code>FILESTORE_SECRET_KEY</code> to log in.

You will need to ''manually create'' a bucket with the name of <code>FILESTORE_BUCKET_NAME</code>.

== Local development environment based on <code>bluespice-containers</code> ==
As an alternative, one can use https://github.com/BlueSpice-Wiki/bluespice-containers . This is especially useful when working on the various individual services.

Development

2026-07-10T06:16:54Z

Rvogel1: /* Add S3 filestore service */

{{Textbox|boxtype=warning|header=Do not apply to production environments!|text=This page contains information about how to set up a '''local development environment''' for BlueSpice. None of this is supposed to be used on an production system!|icon=yes}}

== Local development environment based on <code>bluespice-deploy</code> ==
A developer can use the [[Setup:Installation Guide/Docker|default deployment stack]] and alter is to quickly set up a development environment. To do so, first clone the stack to your local machine and navigate into it:
<syntaxhighlight lang="text">
git clone -b 5.2.x git@github.com:hallowelt/bluespice-deploy.git
cd bluespice-deploy/compose
</syntaxhighlight>

Create a proper <code>.env</code> file from the <code>.env.sample</code> and alter/add the following lines:
<syntaxhighlight lang="text">
DATADIR=~/workspace/REL1_43-5.2.x/data
CODEDIR=~/workspace/REL1_43-5.2.x/code
SMTP_HOST=mailhog
SMTP_PORT=1025
</syntaxhighlight>

Create a <code>docker-compose.override.yml</code> file with the following content:
<syntaxhighlight lang="yaml">
x-common-dev: &x-common
image: docker.bluespice.com/bluespice-qa/wiki:latest
volumes:
- ${CODEDIR}:/app/bluespice/w/

services:

wiki-installer:
<<: *x-common

wiki-web:
<<: *x-common
restart: no

wiki-task:
<<: *x-common
restart: no

mailhog:
image: mailhog/mailhog
container_name: ${COMPOSE_PROJECT_NAME:-bluespice}-mailhog
environment:
VIRTUAL_HOST: ${WIKI_HOST}
VIRTUAL_PATH: /_mailhog/
VIRTUAL_PORT: 8025
VIRTUAL_DEST: /
restart: no

cache:
restart: no

collabpads:
restart: no

collabpads-database:
restart: no

database:
restart: no

diagram:
restart: no

formula:
restart: no

pdf:
restart: no

proxy:
restart: no

search:
restart: no

wire:
restart: no
</syntaxhighlight>

This will make the stack use your local codebase from <code>$CODEDIR</code> and also expose a Mailhog web interface on <code>$Wiki_HOST/_mailhog</code>.

In addition, if you want to work with a custom build of the <code>bluespice/wiki</code> container, you can add an <code>image:</code> entry to the respective services. Example
<syntaxhighlight lang="yaml">
wiki-installer:
image: bluespice/wiki:dev
...
wiki-web:
image: bluespice/wiki:dev
...

wiki-task:
image: bluespice/wiki:dev
...
</syntaxhighlight>or you set<blockquote>BLUESPICE_WIKI_IMAGE=bluespice/wiki:dev</blockquote>in your <code>.env</code>-File

=== Add S3 <code>filestore</code> service ===
When working on the S3 filestore features, a developer needs a local S3 service. One can add the following to <code>docker-compose.override.yml</code> <syntaxhighlight lang="yaml">
x-common-dev: &x-common
...
environment:
FILESTORE_HOST: filestore
FILESTORE_PORT: 9000
FILESTORE_PROTOCOL: http
FILESTORE_ACCESS_KEY: ${FILESTORE_ACCESS_KEY}
FILESTORE_SECRET_KEY: ${FILESTORE_SECRET_KEY}
FILESTORE_BUCKET_NAME: ${FILESTORE_BUCKET_NAME:-bluespice}
FILESTORE_REGION: ${FILESTORE_REGION:-eu-north-1}
...

filestore:
image: minio/minio:latest
container_name: ${COMPOSE_PROJECT_NAME:-bluespice}-filestore
command: server /data --console-address ":9001"
environment:
MINIO_ROOT_USER: ${FILESTORE_ACCESS_KEY}
MINIO_ROOT_PASSWORD: ${FILESTORE_SECRET_KEY}
ports:
- "9000:9000"
- "9001:9001"
volumes:
- ${DATADIR}/filestore:/data
restart: no
</syntaxhighlight>In <code>.env</code>, add <syntaxhighlight lang="text">
FILESTORE_ACCESS_KEY=...
FILESTORE_SECRET_KEY=...
FILESTORE_BUCKET_NAME=bluespice
FILESTORE_REGION=eu-north-1
</syntaxhighlight>After a <code>./bluespice-deploy up -d</code> you can access the MINIO webinterface in your browser at <code><nowiki>http://localhost:9001</nowiki></code>. Use the values of <code>FILESTORE_ACCESS_KEY</code> and <code>FILESTORE_SECRET_KEY</code> to log in.

== Local development environment based on <code>bluespice-containers</code> ==
As an alternative, one can use https://github.com/BlueSpice-Wiki/bluespice-containers . This is especially useful when working on the various individual services.

Development

2026-07-10T06:11:56Z

Rvogel1:

{{Textbox|boxtype=warning|header=Do not apply to production environments!|text=This page contains information about how to set up a '''local development environment''' for BlueSpice. None of this is supposed to be used on an production system!|icon=yes}}

== Local development environment based on <code>bluespice-deploy</code> ==
A developer can use the [[Setup:Installation Guide/Docker|default deployment stack]] and alter is to quickly set up a development environment. To do so, first clone the stack to your local machine and navigate into it:
<syntaxhighlight lang="text">
git clone -b 5.2.x git@github.com:hallowelt/bluespice-deploy.git
cd bluespice-deploy/compose
</syntaxhighlight>

Create a proper <code>.env</code> file from the <code>.env.sample</code> and alter/add the following lines:
<syntaxhighlight lang="text">
DATADIR=~/workspace/REL1_43-5.2.x/data
CODEDIR=~/workspace/REL1_43-5.2.x/code
SMTP_HOST=mailhog
SMTP_PORT=1025
</syntaxhighlight>

Create a <code>docker-compose.override.yml</code> file with the following content:
<syntaxhighlight lang="yaml">
x-common-dev: &x-common
image: docker.bluespice.com/bluespice-qa/wiki:latest
volumes:
- ${CODEDIR}:/app/bluespice/w/

services:

wiki-installer:
<<: *x-common

wiki-web:
<<: *x-common
restart: no

wiki-task:
<<: *x-common
restart: no

mailhog:
image: mailhog/mailhog
container_name: ${COMPOSE_PROJECT_NAME:-bluespice}-mailhog
environment:
VIRTUAL_HOST: ${WIKI_HOST}
VIRTUAL_PATH: /_mailhog/
VIRTUAL_PORT: 8025
VIRTUAL_DEST: /
restart: no

cache:
restart: no

collabpads:
restart: no

collabpads-database:
restart: no

database:
restart: no

diagram:
restart: no

formula:
restart: no

pdf:
restart: no

proxy:
restart: no

search:
restart: no

wire:
restart: no
</syntaxhighlight>

This will make the stack use your local codebase from <code>$CODEDIR</code> and also expose a Mailhog web interface on <code>$Wiki_HOST/_mailhog</code>.

In addition, if you want to work with a custom build of the <code>bluespice/wiki</code> container, you can add an <code>image:</code> entry to the respective services. Example
<syntaxhighlight lang="yaml">
wiki-installer:
image: bluespice/wiki:dev
...
wiki-web:
image: bluespice/wiki:dev
...

wiki-task:
image: bluespice/wiki:dev
...
</syntaxhighlight>or you set<blockquote>BLUESPICE_WIKI_IMAGE=bluespice/wiki:dev</blockquote>in your <code>.env</code>-File

=== Add S3 <code>filestore</code> service ===
When working on the S3 filestore features, a developer needs a <syntaxhighlight lang="yaml">
x-common-dev: &x-common
...
environment:
FILESTORE_HOST: filestore
FILESTORE_PORT: 9000
FILESTORE_PROTOCOL: http
FILESTORE_ACCESS_KEY: ${FILESTORE_ACCESS_KEY}
FILESTORE_SECRET_KEY: ${FILESTORE_SECRET_KEY}
FILESTORE_BUCKET_NAME: ${FILESTORE_BUCKET_NAME:-bluespice}
FILESTORE_REGION: ${FILESTORE_REGION:-eu-north-1}
...

filestore:
image: minio/minio:latest
container_name: ${COMPOSE_PROJECT_NAME:-bluespice}-filestore
command: server /data --console-address ":9001"
environment:
MINIO_ROOT_USER: ${FILESTORE_ACCESS_KEY}
MINIO_ROOT_PASSWORD: ${FILESTORE_SECRET_KEY}
ports:
- "9000:9000"
- "9001:9001"
volumes:
- ${DATADIR}/filestore:/data
restart: no
</syntaxhighlight>In <code>.env</code> <syntaxhighlight lang="text">
FILESTORE_ACCESS_KEY=...
FILESTORE_SECRET_KEY=...
FILESTORE_BUCKET_NAME=bluespice
FILESTORE_REGION=eu-north-1
</syntaxhighlight>After a <code>/bluespice-deploy up -d</code> you can access the MINIO webinterface in your browser at <code><nowiki>http://localhost:9001</nowiki></code>. Use the values of <code>FILESTORE_ACCESS_KEY</code> and <code>FILESTORE_SECRET_KEY</code> to log in.

== Local development environment based on <code>bluespice-containers</code> ==
As an alternative, one can use https://github.com/BlueSpice-Wiki/bluespice-containers . This is especially useful when working on the various individual services.

Development

2026-07-10T06:08:39Z

Rvogel1:

This page contains information about how to set up a local development environment for BlueSpice.

== Local development environment based on <code>bluespice-deploy</code> ==
A developer can use the [[Setup:Installation Guide/Docker|default deployment stack]] and alter is to quickly set up a development environment. To do so, first clone the stack to your local machine and navigate into it:
<syntaxhighlight lang="text">
git clone -b 5.2.x git@github.com:hallowelt/bluespice-deploy.git
cd bluespice-deploy/compose
</syntaxhighlight>

Create a proper <code>.env</code> file from the <code>.env.sample</code> and alter/add the following lines:
<syntaxhighlight lang="text">
DATADIR=~/workspace/REL1_43-5.2.x/data
CODEDIR=~/workspace/REL1_43-5.2.x/code
SMTP_HOST=mailhog
SMTP_PORT=1025
</syntaxhighlight>

Create a <code>docker-compose.override.yml</code> file with the following content:
<syntaxhighlight lang="yaml">
x-common-dev: &x-common
image: docker.bluespice.com/bluespice-qa/wiki:latest
volumes:
- ${CODEDIR}:/app/bluespice/w/

services:

wiki-installer:
<<: *x-common

wiki-web:
<<: *x-common
restart: no

wiki-task:
<<: *x-common
restart: no

mailhog:
image: mailhog/mailhog
container_name: ${COMPOSE_PROJECT_NAME:-bluespice}-mailhog
environment:
VIRTUAL_HOST: ${WIKI_HOST}
VIRTUAL_PATH: /_mailhog/
VIRTUAL_PORT: 8025
VIRTUAL_DEST: /
restart: no

cache:
restart: no

collabpads:
restart: no

collabpads-database:
restart: no

database:
restart: no

diagram:
restart: no

formula:
restart: no

pdf:
restart: no

proxy:
restart: no

search:
restart: no

wire:
restart: no
</syntaxhighlight>

This will make the stack use your local codebase from <code>$CODEDIR</code> and also expose a Mailhog web interface on <code>$Wiki_HOST/_mailhog</code>.

In addition, if you want to work with a custom build of the <code>bluespice/wiki</code> container, you can add an <code>image:</code> entry to the respective services. Example
<syntaxhighlight lang="yaml">
wiki-installer:
image: bluespice/wiki:dev
...
wiki-web:
image: bluespice/wiki:dev
...

wiki-task:
image: bluespice/wiki:dev
...
</syntaxhighlight>or you set<blockquote>BLUESPICE_WIKI_IMAGE=bluespice/wiki:dev</blockquote>in your <code>.env</code>-File

=== Add S3 <code>filestore</code> service ===
When working on the S3 filestore features, a developer needs a <syntaxhighlight lang="yaml">
x-common-dev: &x-common
...
environment:
FILESTORE_HOST: filestore
FILESTORE_PORT: 9000
FILESTORE_PROTOCOL: http
FILESTORE_ACCESS_KEY: ${FILESTORE_ACCESS_KEY}
FILESTORE_SECRET_KEY: ${FILESTORE_SECRET_KEY}
FILESTORE_BUCKET_NAME: ${FILESTORE_BUCKET_NAME:-bluespice}
FILESTORE_REGION: ${FILESTORE_REGION:-eu-north-1}
...

filestore:
image: minio/minio:latest
container_name: ${COMPOSE_PROJECT_NAME:-bluespice}-filestore
command: server /data --console-address ":9001"
environment:
MINIO_ROOT_USER: ${FILESTORE_ACCESS_KEY}
MINIO_ROOT_PASSWORD: ${FILESTORE_SECRET_KEY}
ports:
- "9000:9000"
- "9001:9001"
volumes:
- ${DATADIR}/filestore:/data
restart: no
</syntaxhighlight>In <code>.env</code> <syntaxhighlight lang="text">
FILESTORE_ACCESS_KEY=...
FILESTORE_SECRET_KEY=...
FILESTORE_BUCKET_NAME=bluespice
FILESTORE_REGION=eu-north-1
</syntaxhighlight>After a <code>/bluespice-deploy up -d</code> you can access the MINIO webinterface in your browser at <code><nowiki>http://localhost:9001</nowiki></code>. Use the values of <code>FILESTORE_ACCESS_KEY</code> and <code>FILESTORE_SECRET_KEY</code> to log in.

Security:Security Advisories

2026-06-22T08:41:06Z

Rvogel1:

{| class="wikitable sortable" style="width:100%;"
! style="" |Release name
! style="" |Release date
! style="" |Title
! style="" |References
! style="" |Summary
!Severity
|-
|[[Security:Security Advisories/BSSA-2026-04|BSSA-2026-04]]
|2026-06-22
|Security vulnerabilities in Confluence Migration Tool container image
|[https://nvd.nist.gov/vuln/detail/CVE-2026-8376 CVE-2026-8376]
|Heap buffer overflow vulnerability in Perl Regexes
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2026-03|BSSA-2026-03]]
|2026-06-08
|Security vulnerabilities in containers of the Cloudogu stack
|[https://nvd.nist.gov/vuln/detail/CVE-2026-31789 CVE-2026-31789], [https://nvd.nist.gov/vuln/detail/CVE-2026-43512 CVE-2026-43512], [https://nvd.nist.gov/vuln/detail/CVE-2026-7261 CVE-2026-7261]
|Heap buffer overflow in OpenSSL, Apache Tomcat DIGEST authentication bypass and PHP SOAP server session persistence vulnerability
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2026-02|BSSA-2026-02]]
|2026-03-04
|Security vulnerability in BlueSpice Database container and NSFileRepo extension.
|[https://avd.aquasec.com/nvd/2025/cve-2025-15467 CVE-2025-15467],
[https://avd.aquasec.com/nvd/2026/cve-2026-24732 CVE-2026-24732]
|Buffer Overflow; Information disclosure
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2026-01|BSSA-2026-01]]
|2026-01-28
|Security vulnerability in BlueSpice Collabpads database container.
|[https://avd.aquasec.com/nvd/2025/cve-2025-14847 CVE-2025-14847]
|Read of uninitialized heap memory
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2025-07|BSSA-2025-07]]
|2025-12-10
|Security vulnerability in BlueSpice Search container.
|[https://avd.aquasec.com/nvd/2025/cve-2025-66516 CVE-2025-66516]
|XML Entity Injection
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2025-06|BSSA-2025-06]]
|2025-10-28
|Security vulnerabilities in various MediaWiki extensions that are actually part of the BlueSpice distribution
|[https://www.cve.org/CVERecord?id=CVE-2024-56171 CVE-2024-56171], [https://www.cve.org/CVERecord?id=CVE-2025-3277 CVE-2025-3277], [https://www.cve.org/CVERecord?id=CVE-2025-6965 CVE-2025-6965], [https://www.cve.org/CVERecord?id=CVE-2025-11173 CVE-2025-11173], [https://www.cve.org/CVERecord?id=CVE-2025-11175 CVE-2025-11175],
[https://www.cve.org/CVERecord?id=CVE-2025-53625 CVE-2025-53625],
[https://www.cve.org/CVERecord?id=CVE-2025-54370 CVE-2025-54370],
[https://www.cve.org/CVERecord?id=CVE-2025-54874 CVE-2025-54874],
[https://www.cve.org/CVERecord?id=CVE-2025-59839 CVE-2025-59839],
[https://www.cve.org/CVERecord?id=CVE-2025-61634 CVE-2025-61634],
[https://www.cve.org/CVERecord?id=CVE-2025-61635 CVE-2025-61635],
[https://www.cve.org/CVERecord?id=CVE-2025-61636 CVE-2025-61636],
[https://www.cve.org/CVERecord?id=CVE-2025-61637 CVE-2025-61637],
[https://www.cve.org/CVERecord?id=CVE-2025-61638 CVE-2025-61638],
[https://www.cve.org/CVERecord?id=CVE-2025-61639 CVE-2025-61639],
[https://www.cve.org/CVERecord?id=CVE-2025-61640 CVE-2025-61640],
[https://www.cve.org/CVERecord?id=CVE-2025-61641 CVE-2025-61641],
[https://www.cve.org/CVERecord?id=CVE-2025-61642 CVE-2025-61642],
[https://www.cve.org/CVERecord?id=CVE-2025-61643 CVE-2025-61643],
[https://www.cve.org/CVERecord?id=CVE-2025-61646 CVE-2025-61646],
[https://www.cve.org/CVERecord?id=CVE-2025-61652 CVE-2025-61652],
[https://www.cve.org/CVERecord?id=CVE-2025-61653 CVE-2025-61653],
[https://www.cve.org/CVERecord?id=CVE-2025-61655 CVE-2025-61655],
[https://www.cve.org/CVERecord?id=CVE-2025-61655 CVE-2025-61655],
[https://www.cve.org/CVERecord?id=CVE-2025-61656 CVE-2025-61656],
[https://www.cve.org/CVERecord?id=CVE-2025-61656 CVE-2025-61656],
[https://www.cve.org/CVERecord?id=CVE-2025-61657 CVE-2025-61657],
[https://www.cve.org/CVERecord?id=CVE-2025-7458 CVE-2025-7458]
|Denial Of Service,
Cross-Site Scripting (XSS),
Information Disclosure,
Bypass authn at content check,
Server-side Request Forgery,
Arbitrary Code Execution,
Memory Corruption,
Use-After-Free,
Arbitrary SQL Execution
| style="" class="col-red-bg" |High
|-
|[[Security:Security Advisories/BSSA-2025-05|BSSA-2025-05]]
|2025-09-19
|XSS in Extension:AtMentions, Extension:BlueSpiceAvatars, Extension:BlueSpiceWhoIsOnline and Extension:CognitiveProcessDesigner
|[https://www.cve.org/CVERecord?id=CVE-2025-46703 CVE-2025-46703], [https://www.cve.org/CVERecord?id=CVE-2025-48007 CVE-2025-48007], [https://www.cve.org/CVERecord?id=CVE-2025-57880 CVE-2025-57880], [https://www.cve.org/CVERecord?id=CVE-2025-58114 CVE-2025-58114]
|
| style="" class="col-orange-bg" |Medium
|-
|[[Security:Security Advisories/BSSA-2025-04|BSSA-2025-04]]
|2025-09-18
|Security vulnerabilities in services <code>bluespice/search</code>, <code>bluespice/formular</code> and <code>bluespice/wiki</code>
|[https://nvd.nist.gov/vuln/detail/CVE-2025-54988 CVE-2025-54988], [https://avd.aquasec.com/nvd/2025/cve-2025-7783 CVE-2025-7783], [https://avd.aquasec.com/nvd/cve-2025-58050 CVE-2025-58050], [https://avd.aquasec.com/nvd/cve-2025-49794 CVE-2025-49794], [https://avd.aquasec.com/nvd/cve-2025-49796 CVE-2025-49796]
|Denial-of-Service, Information Disclosure
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2025-03|BSSA-2025-03]]
|2025-07-28
|Security vulnerabilities in Extension:Scribunto, Extension:TabberNeue, Extension:TwoColConflict and Extension:Quiz
|[https://www.cve.org/CVERecord?id=CVE-2025-53501 CVE-2025-53501], [https://www.cve.org/CVERecord?id=CVE-2025-53494 CVE-2025-53494], [https://www.cve.org/CVERecord?id=CVE-2025-53093 CVE-2025-53093], [https://www.cve.org/CVERecord?id=CVE-2025-7057 CVE-2025-7057]
|Information Disclosure,
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2025-02|BSSA-2025-02]]
| style="" |2025-04-17
| style="" |Security vulnerabilities in Extension:OAuth
| style="" |[https://www.cve.org/CVERecord?id=CVE-2025-32068 CVE-2025-32068], [https://www.cve.org/CVERecord?id=CVE-2025-32074 CVE-2025-32074]
| style="" |Allows unauthorized access to the wiki, Cross-Site Scripting (XSS)
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2025-01|BSSA-2025-01]]
| style="" |2025-01-20
| style="" |Security vulnerabilities in Extension:DataTransfer
| style="" |[https://www.cve.org/CVERecord?id=CVE-2025-23081 CVE-2025-23081]
| style="" |Allows Cross Site Request Forgery, Cross-Site Scripting (XSS)
| style="" class="col-orange-bg" |Medium
|-
|[[Security:Security Advisories/BSSA-2023-02|BSSA-2023-02]]
|2023-10-30
|Security vulnerabilities in Extension:BlueSpiceAvatars
|[https://www.cve.org/cverecord?id=CVE-2023-42431 CVE-2023-42431]
|Allows Cross-Site Scripting (XSS)
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2023-01|BSSA-2023-01]]
| style="" |2023-07-25
| style="" |Ghostscript vulnerability
| style="" |[https://www.cve.org/CVERecord?id=CVE-2023-36664 CVE-2023-36664]
| style="" |Code can be executed on the server via a manipulated PDF
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2022-08|BSSA-2022-08]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-3895 CVE-2022-3895]
| style="" |Arbitrary HTML injection through use of interface elements
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2022-07|BSSA-2022-07]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-3958 CVE-2022-3958]
| style="" |Arbitrary HTML injection through personal menu items
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2022-06|BSSA-2022-06]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-3893 CVE-2022-3893]
| style="" |Arbitrary HTML injection through the custom menu
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2022-05|BSSA-2022-05]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-42001 CVE-2022-42001]
| style="" |Arbitrary HTML injection through the book navigation
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2022-04|BSSA-2022-04]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-41789 CVE-2022-41789], [https://www.cve.org/CVERecord?id=CVE-2022-41814 CVE-2022-41814], [https://www.cve.org/CVERecord?id=CVE-2022-42000 CVE-2022-42000]
| style="" |Arbitrary HTML injection through user preferences
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2022-03|BSSA-2022-03]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-41611 CVE-2022-41611]
| style="" |Arbitrary HTML injection through main navigation
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2022-02|BSSA-2022-02]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-2511 CVE-2022-2511]
| style="" |Arbitrary HTML injection through the 'title' parameter
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2022-01|BSSA-2022-01]]
| style="" |2022-01-31
| style="" |XSS attack vector in Search Center
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-2510 CVE-2022-2510]
| style="" |JavaScript in search field is reflected back to the browser.
| style="" class="col-orange-bg" |Medium
|}

Security:Security Advisories/BSSA-2026-04

2026-06-22T08:38:42Z

Security:Security Advisories

2026-06-08T09:06:59Z

Rvogel1:

{| class="wikitable sortable" style="width:100%;"
! style="" |Release name
! style="" |Release date
! style="" |Title
! style="" |References
! style="" |Summary
!Severity
|-
|[[Security:Security Advisories/BSSA-2026-03|BSSA-2026-03]]
|2026-06-08
|Security vulnerabilities in containers of the Cloudogu stack
|[https://nvd.nist.gov/vuln/detail/CVE-2026-31789 CVE-2026-31789], [https://nvd.nist.gov/vuln/detail/CVE-2026-43512 CVE-2026-43512], [https://nvd.nist.gov/vuln/detail/CVE-2026-7261 CVE-2026-7261]
|Heap buffer overflow in OpenSSL, Apache Tomcat DIGEST authentication bypass and PHP SOAP server session persistence vulnerability
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2026-02|BSSA-2026-02]]
|2026-03-04
|Security vulnerability in BlueSpice Database container and NSFileRepo extension.
|[https://avd.aquasec.com/nvd/2025/cve-2025-15467 CVE-2025-15467],
[https://avd.aquasec.com/nvd/2026/cve-2026-24732 CVE-2026-24732]
|Buffer Overflow; Information disclosure
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2026-01|BSSA-2026-01]]
|2026-01-28
|Security vulnerability in BlueSpice Collabpads database container.
|[https://avd.aquasec.com/nvd/2025/cve-2025-14847 CVE-2025-14847]
|Read of uninitialized heap memory
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2025-07|BSSA-2025-07]]
|2025-12-10
|Security vulnerability in BlueSpice Search container.
|[https://avd.aquasec.com/nvd/2025/cve-2025-66516 CVE-2025-66516]
|XML Entity Injection
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2025-06|BSSA-2025-06]]
|2025-10-28
|Security vulnerabilities in various MediaWiki extensions that are actually part of the BlueSpice distribution
|[https://www.cve.org/CVERecord?id=CVE-2024-56171 CVE-2024-56171], [https://www.cve.org/CVERecord?id=CVE-2025-3277 CVE-2025-3277], [https://www.cve.org/CVERecord?id=CVE-2025-6965 CVE-2025-6965], [https://www.cve.org/CVERecord?id=CVE-2025-11173 CVE-2025-11173], [https://www.cve.org/CVERecord?id=CVE-2025-11175 CVE-2025-11175],
[https://www.cve.org/CVERecord?id=CVE-2025-53625 CVE-2025-53625],
[https://www.cve.org/CVERecord?id=CVE-2025-54370 CVE-2025-54370],
[https://www.cve.org/CVERecord?id=CVE-2025-54874 CVE-2025-54874],
[https://www.cve.org/CVERecord?id=CVE-2025-59839 CVE-2025-59839],
[https://www.cve.org/CVERecord?id=CVE-2025-61634 CVE-2025-61634],
[https://www.cve.org/CVERecord?id=CVE-2025-61635 CVE-2025-61635],
[https://www.cve.org/CVERecord?id=CVE-2025-61636 CVE-2025-61636],
[https://www.cve.org/CVERecord?id=CVE-2025-61637 CVE-2025-61637],
[https://www.cve.org/CVERecord?id=CVE-2025-61638 CVE-2025-61638],
[https://www.cve.org/CVERecord?id=CVE-2025-61639 CVE-2025-61639],
[https://www.cve.org/CVERecord?id=CVE-2025-61640 CVE-2025-61640],
[https://www.cve.org/CVERecord?id=CVE-2025-61641 CVE-2025-61641],
[https://www.cve.org/CVERecord?id=CVE-2025-61642 CVE-2025-61642],
[https://www.cve.org/CVERecord?id=CVE-2025-61643 CVE-2025-61643],
[https://www.cve.org/CVERecord?id=CVE-2025-61646 CVE-2025-61646],
[https://www.cve.org/CVERecord?id=CVE-2025-61652 CVE-2025-61652],
[https://www.cve.org/CVERecord?id=CVE-2025-61653 CVE-2025-61653],
[https://www.cve.org/CVERecord?id=CVE-2025-61655 CVE-2025-61655],
[https://www.cve.org/CVERecord?id=CVE-2025-61655 CVE-2025-61655],
[https://www.cve.org/CVERecord?id=CVE-2025-61656 CVE-2025-61656],
[https://www.cve.org/CVERecord?id=CVE-2025-61656 CVE-2025-61656],
[https://www.cve.org/CVERecord?id=CVE-2025-61657 CVE-2025-61657],
[https://www.cve.org/CVERecord?id=CVE-2025-7458 CVE-2025-7458]
|Denial Of Service,
Cross-Site Scripting (XSS),
Information Disclosure,
Bypass authn at content check,
Server-side Request Forgery,
Arbitrary Code Execution,
Memory Corruption,
Use-After-Free,
Arbitrary SQL Execution
| style="" class="col-red-bg" |High
|-
|[[Security:Security Advisories/BSSA-2025-05|BSSA-2025-05]]
|2025-09-19
|XSS in Extension:AtMentions, Extension:BlueSpiceAvatars, Extension:BlueSpiceWhoIsOnline and Extension:CognitiveProcessDesigner
|[https://www.cve.org/CVERecord?id=CVE-2025-46703 CVE-2025-46703], [https://www.cve.org/CVERecord?id=CVE-2025-48007 CVE-2025-48007], [https://www.cve.org/CVERecord?id=CVE-2025-57880 CVE-2025-57880], [https://www.cve.org/CVERecord?id=CVE-2025-58114 CVE-2025-58114]
|
| style="" class="col-orange-bg" |Medium
|-
|[[Security:Security Advisories/BSSA-2025-04|BSSA-2025-04]]
|2025-09-18
|Security vulnerabilities in services <code>bluespice/search</code>, <code>bluespice/formular</code> and <code>bluespice/wiki</code>
|[https://nvd.nist.gov/vuln/detail/CVE-2025-54988 CVE-2025-54988], [https://avd.aquasec.com/nvd/2025/cve-2025-7783 CVE-2025-7783], [https://avd.aquasec.com/nvd/cve-2025-58050 CVE-2025-58050], [https://avd.aquasec.com/nvd/cve-2025-49794 CVE-2025-49794], [https://avd.aquasec.com/nvd/cve-2025-49796 CVE-2025-49796]
|Denial-of-Service, Information Disclosure
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2025-03|BSSA-2025-03]]
|2025-07-28
|Security vulnerabilities in Extension:Scribunto, Extension:TabberNeue, Extension:TwoColConflict and Extension:Quiz
|[https://www.cve.org/CVERecord?id=CVE-2025-53501 CVE-2025-53501], [https://www.cve.org/CVERecord?id=CVE-2025-53494 CVE-2025-53494], [https://www.cve.org/CVERecord?id=CVE-2025-53093 CVE-2025-53093], [https://www.cve.org/CVERecord?id=CVE-2025-7057 CVE-2025-7057]
|Information Disclosure,
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2025-02|BSSA-2025-02]]
| style="" |2025-04-17
| style="" |Security vulnerabilities in Extension:OAuth
| style="" |[https://www.cve.org/CVERecord?id=CVE-2025-32068 CVE-2025-32068], [https://www.cve.org/CVERecord?id=CVE-2025-32074 CVE-2025-32074]
| style="" |Allows unauthorized access to the wiki, Cross-Site Scripting (XSS)
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2025-01|BSSA-2025-01]]
| style="" |2025-01-20
| style="" |Security vulnerabilities in Extension:DataTransfer
| style="" |[https://www.cve.org/CVERecord?id=CVE-2025-23081 CVE-2025-23081]
| style="" |Allows Cross Site Request Forgery, Cross-Site Scripting (XSS)
| style="" class="col-orange-bg" |Medium
|-
|[[Security:Security Advisories/BSSA-2023-02|BSSA-2023-02]]
|2023-10-30
|Security vulnerabilities in Extension:BlueSpiceAvatars
|[https://www.cve.org/cverecord?id=CVE-2023-42431 CVE-2023-42431]
|Allows Cross-Site Scripting (XSS)
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2023-01|BSSA-2023-01]]
| style="" |2023-07-25
| style="" |Ghostscript vulnerability
| style="" |[https://www.cve.org/CVERecord?id=CVE-2023-36664 CVE-2023-36664]
| style="" |Code can be executed on the server via a manipulated PDF
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2022-08|BSSA-2022-08]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-3895 CVE-2022-3895]
| style="" |Arbitrary HTML injection through use of interface elements
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2022-07|BSSA-2022-07]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-3958 CVE-2022-3958]
| style="" |Arbitrary HTML injection through personal menu items
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2022-06|BSSA-2022-06]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-3893 CVE-2022-3893]
| style="" |Arbitrary HTML injection through the custom menu
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2022-05|BSSA-2022-05]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-42001 CVE-2022-42001]
| style="" |Arbitrary HTML injection through the book navigation
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2022-04|BSSA-2022-04]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-41789 CVE-2022-41789], [https://www.cve.org/CVERecord?id=CVE-2022-41814 CVE-2022-41814], [https://www.cve.org/CVERecord?id=CVE-2022-42000 CVE-2022-42000]
| style="" |Arbitrary HTML injection through user preferences
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2022-03|BSSA-2022-03]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-41611 CVE-2022-41611]
| style="" |Arbitrary HTML injection through main navigation
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2022-02|BSSA-2022-02]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-2511 CVE-2022-2511]
| style="" |Arbitrary HTML injection through the 'title' parameter
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2022-01|BSSA-2022-01]]
| style="" |2022-01-31
| style="" |XSS attack vector in Search Center
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-2510 CVE-2022-2510]
| style="" |JavaScript in search field is reflected back to the browser.
| style="" class="col-orange-bg" |Medium
|}

Security:Security Advisories/BSSA-2026-03

2026-06-08T09:02:50Z

Rvogel1:

{| class="wikitable"
|+
!
!
|-
|Date
|2026-06-08
|-
|Severity
|reported "medium/high", BlueSpice assessment: '''not affected'''
|-
|Affected
|Cloudogu Container Images (library present, not exploitable)
|-
|Fixed in
|Next regular update
|-
|CVE
|
* [https://nvd.nist.gov/vuln/detail/CVE-2026-31789 CVE-2026-31789]
* [https://nvd.nist.gov/vuln/detail/CVE-2026-43512 CVE-2026-43512]
* [https://nvd.nist.gov/vuln/detail/CVE-2026-7261 CVE-2026-7261]
|}

==Problem==
{| class="wikitable"
!'''CVE'''
!'''Component'''
!'''Type of vulnerability'''
!'''BlueSpice 5'''
|-
|CVE-2026-31789
|<code>hallowelt/bluespice-mathoid</code>, <code>hallowelt/bluespice-collabpadsbackend</code>, <code>hallowelt/mongodb</code>
|Heap Buffer Overflow (OpenSSL, 32-bit only)
| style="" class="col-green-bg" |not affected
|-
|CVE-2026-43512
|<code>hallowelt/bluespice-pdfrenderer</code>, <code>hallowelt/drawio</code>
|Authentication Bypass (Apache Tomcat DIGEST)
| style="" class="col-green-bg" |not affected
|-
|CVE-2026-7261
|<code>hallowelt/bluespice</code>
|PHP SOAP Server Session Persistence
| style="" class="col-green-bg" |not affected
|}

==Impact assessment==
{| class="wikitable" style="width: 100%;"
!CVE
!Assessment
!Mitigation without update
|-
| style="vertical-align:middle;text-align:left;" |CVE-2026-31789
| style="vertical-align:middle;text-align:left;" class="col-green-bg" |Not affected. The vulnerability only applies to 32-bit platforms. Additionally, the way OpenSSL is used in the affected container images does not expose any exploitable attack surface.
| style="vertical-align:middle;text-align:left;" |No action required.
|-
| style="vertical-align:middle;text-align:left;" |CVE-2026-43512
| style="vertical-align:middle;text-align:left;" class="col-green-bg" |Not affected. Neither <code>bluespice-pdfrenderer</code> nor <code>drawio</code> use DIGEST authentication. Access to both services is anonymous by design.
| style="vertical-align:middle;text-align:left;" |No action required.
|-
| style="vertical-align:middle;text-align:left;" |CVE-2026-7261
| style="vertical-align:middle;text-align:left;" class="col-green-bg" |Not affected. BlueSpice does not use a PHP SOAP server, and the affected <code>SOAP_PERSISTENCE_SESSION</code> setting is not in use.
| style="vertical-align:middle;text-align:left;" |No action required.
|}

== Solution ==
No immediate action required. The affected libraries will be updated in the next regular release.

Security:Security Advisories/BSSA-2026-03

2026-06-08T09:00:07Z

Rvogel1: Created page with "{| class="wikitable" |+ ! ! |- |Date |2026-06-08 |- |Severity |reported "medium/high", BlueSpice assessment: '''not affected''' |- |Affected |Cloudogu Container Images (library present, not exploitable) |- |Fixed in |Next regular update |- |CVE | * [https://nvd.nist.gov/vuln/detail/CVE-2026-31789 CVE-2026-31789] * [https://nvd.nist.gov/vuln/detail/CVE-2026-43512 CVE-2026-43512] * [https://nvd.nist.gov/vuln/detail/CVE-2026-7261 CVE-2026-7261] |- |Validated by |RV, FS |}..."

{| class="wikitable"
|+
!
!
|-
|Date
|2026-06-08
|-
|Severity
|reported "medium/high", BlueSpice assessment: '''not affected'''
|-
|Affected
|Cloudogu Container Images (library present, not exploitable)
|-
|Fixed in
|Next regular update
|-
|CVE
|
* [https://nvd.nist.gov/vuln/detail/CVE-2026-31789 CVE-2026-31789]
* [https://nvd.nist.gov/vuln/detail/CVE-2026-43512 CVE-2026-43512]
* [https://nvd.nist.gov/vuln/detail/CVE-2026-7261 CVE-2026-7261]
|-
|Validated by
|RV, FS
|}

==Problem==
{| class="wikitable"
!'''CVE'''
!'''Component'''
!'''Type of vulnerability'''
!'''BlueSpice 5'''
!'''BlueSpice 4'''
|-
|CVE-2026-31789
|<code>hallowelt/bluespice-mathoid</code>, <code>hallowelt/bluespice-collabpadsbackend</code>, <code>hallowelt/mongodb</code>
|Heap Buffer Overflow (OpenSSL, 32-bit only)
| style="" class="col-green-bg" |not affected
| style="" class="col-green-bg" |not affected
|-
|CVE-2026-43512
|<code>hallowelt/bluespice-pdfrenderer</code>, <code>hallowelt/drawio</code>
|Authentication Bypass (Apache Tomcat DIGEST)
| style="" class="col-green-bg" |not affected
| style="" class="col-green-bg" |not affected
|-
|CVE-2026-7261
|<code>hallowelt/bluespice</code>
|PHP SOAP Server Session Persistence
| style="" class="col-green-bg" |not affected
| style="" class="col-green-bg" |not affected
|}

==Impact assessment==
{| class="wikitable" style="width: 100%;"
!CVE
!Assessment
!Mitigation without update
|-
| style="vertical-align:middle;text-align:left;" |CVE-2026-31789
| style="vertical-align:middle;text-align:left;" class="col-green-bg" |Not affected. The vulnerability only applies to 32-bit platforms. Additionally, the way OpenSSL is used in the affected container images does not expose any exploitable attack surface.
| style="vertical-align:middle;text-align:left;" |No action required.
|-
| style="vertical-align:middle;text-align:left;" |CVE-2026-43512
| style="vertical-align:middle;text-align:left;" class="col-green-bg" |Not affected. Neither <code>bluespice-pdfrenderer</code> nor <code>drawio</code> use DIGEST authentication. Access to both services is anonymous by design.
| style="vertical-align:middle;text-align:left;" |No action required.
|-
| style="vertical-align:middle;text-align:left;" |CVE-2026-7261
| style="vertical-align:middle;text-align:left;" class="col-green-bg" |Not affected. BlueSpice does not use a PHP SOAP server, and the affected <code>SOAP_PERSISTENCE_SESSION</code> setting is not in use.
| style="vertical-align:middle;text-align:left;" |No action required.
|}

== Solution ==
No immediate action required. The affected libraries will be updated in the next regular release.

Setup:Installation Guide/Docker

2026-05-28T06:56:24Z

Rvogel1:

== Overview ==
Starting with version 4.5, BlueSpice MediaWiki can be installed with a stack of Docker container images.

Everything is built in a modular way to allow different types of setups.

The most common cases are:
# "All-in-one" (with and without Let's Encrypt)
# Custom database and search service
# Custom load balancer / proxy

== Architecture ==
<drawio filename="Setup:Installation_Guide_Docker-Achitecture" alt="Diagram of BlueSpice Docker Stack Architecture" />

'''Notes'''
* Internal HTTP connections may use non-standard ports. Those are noted next to the respective services.
** HTTP (in-secure) is only used for internal communication within the virtual network the stack is operated in. All connections to the client use TLS.
* Proprietary ports (esp. for database connections) are noted next to the respective services.
* There may be additional services and ports in use, based on the setup. Some examples:
** When using LDAP based authentication an LDAPS connection (port <code>636</code>) is used from the <code>bluespice/wiki</code> containers to the LDAP-Server
** When using Kerberos authentication, a connection (port <code>88</code>) is used from the <code>bluespice/kerberos-proxy</code> containers to the Kerberos-Server
** When using DeepL or OpenAI services, a HTTPS connection (port <code>443</code>) is used from the <code>bluespice/wiki</code> containers to to the respective service
** When using OpenIDConnect authentication, a HTTPS connection (port <code>443</code>) is used from the <code>bluespice/wiki</code> "task" container to to the authentication provider
** When using "Let's Encrypt" Certbot, a HTTPS connection (port <code>443</code>) is used from the <code>acme-companion</code> container to the "Let's Encrypt" service

== Step 1: Get the stack ==
Load project <code>bluespice-deploy</code> from https://github.com/hallowelt/bluespice-deploy/releases/latest and enter the sub-directory <code>compose</code> for Docker Compose files.

For example, run:
<syntaxhighlight lang="sh">
wget https://github.com/hallowelt/bluespice-deploy/archive/refs/tags/5.2.4.zip \
&& unzip 5.2.4.zip \
&& cd bluespice-deploy-5.2.4/compose
</syntaxhighlight>
{{Textbox|boxtype=note|header=Use one consistent version number|text=The tag number 5.2.3 in this command (could be 5.1.4, 5.1.5, 5.2.1 etc. as well) should also be used as the <code>VERSION=</code> number in Step 2.|icon=yes}}

The directory contains the following files:
{| class="wikitable"
|+
! style="width:375px;" |Filename
! style="" |Type
! style="" |Comment
|-
| style="width:375px;" |<code>bluespice-deploy</code>
| style="" |shell script
| style="" |Start-up script, wrapping command <code>docker compose</code> and service <code>yml</code> files.<br>Additional service <code>yml</code> files can be loaded by adding <code>-f <filename> </code>.
|-
| style="width:375px;" |<code>docker-compose.main.yml</code>
| style="" |yml
| style="" |Main containers of the wiki (<code>wiki-web</code> and <code>wiki-task</code>).
|-
| style="width:375px;" |<code>docker-compose.persistent-data-services.yml</code>
| style="" |yml
| style="" |Containers of database and search services, storing persistent data onto the file system.<br />Optionally with external MySQL/MariaDB and OpenSearch one can skip loading this <code>.yml</code> in <code>bluespice-deploy</code>. Please then wire your services properly in the <code>.env</code> file.
|-
| style="width:375px;" |<code>docker-compose.stateless-services.yml</code>
| style="" |yml
| style="" |Containers for caching, PDF rendering, formula-rendering and diagram editing.
|-
| style="width:375px;" |<code>docker-compose.helper-service.yml</code>
| style="" |yml
| style="" |Helper containers for file system preparation and automated BlueSpice upgrade.<br>These containers exit automatically after finishing tasks.
|-
| style="width:375px;" |<code>docker-compose.proxy.yml</code>
| style="" |yml
| style="" |Container of proxy service. Can be replaced by existing proxy/load-balancer infrastructure.
|-
| style="width:375px;" |<code>docker-compose.proxy-letsencrypt.yml</code>
| style="" |yml
| style="" |Additional service for auto-renewal of "Let's Encrypt" certificates.<br>Only required when using the Let's Encrypt service and having no other TLS termination.
|-
| style="width:375px;" |<code>docker-compose.kerberos-proxy.yml</code>
| style="" |yml
| style="" |Additional proxy for Kerberos based authentication.
|-
| style="width:375px;" |<code>docker-compose.collabpads-service.yml</code>
|yml
|Containers of back-end services for [[Manual:Extension/CollabPads|CollabPads]] (included in Pro and Farm editions).
|-
| style="width:375px;" |<code>.env.sample</code>
| style="" |text
| style="" |Sample for creating <code>.env</code> that defines key environment variables.
|-
| style="width:375px;" |<code>bluespice.service.demo</code>
| style="" |service script
| style="" |Demo-file for control the BlueSpice stack as a <code>systemctl</code> service.<br>One can create e.g a <code>/etc/systemd/system/bluespice.service</code>.
|}

== Step 2: Set up environment variables ==
Create your <code>.env</code> based on the sample file <code>.env.sample</code>.

Example:
<pre>
# set or use your data directory
DATADIR=/data/bluespice
VERSION=5.2.2
EDITION=free
BACKUP_HOUR=04

WIKI_NAME=BlueSpice
WIKI_LANG=en
WIKI_PASSWORDSENDER=no-reply@wiki.company.local
WIKI_EMERGENCYCONTACT=no-reply@wiki.company.local
WIKI_HOST=wiki.company.local
WIKI_PORT=443
WIKI_PROTOCOL=https
WIKI_BASE_PATH=

DB_USER=set_or_use_your_db_user_name
DB_PASS=SET_OR_USE_YOUR_DB_PASS_WORD
DB_ROOT_USER=root
DB_ROOT_PASS=$DB_PASS
DB_HOST=database
DB_NAME=bluespice
DB_PREFIX=

SMTP_HOST=mail.company.local
SMTP_PORT=25
SMTP_USER=...
SMTP_PASS=...
SMTP_ID_HOST=...

LETSENCRYPT=false
</pre>
{{Textbox|boxtype=note|header=Different editions|text=This config works for all editions, but the main image of Pro or Farm edition needs to be obtained differently, see [[{{FULLPAGENAME}}/Pro and Farm edition|Pro and Farm edition]]|icon=yes}}

== Step 3: Start the stack ==
Use <code>bluespice-deploy up -d</code> to start the stack. Once all containers are shown as "ready" you can navigate to <code>$WIKI_PROTOCOL://$WIKI_HOST:$WIKI_PORT</code> (e.g. <code><nowiki>https://wiki.company.local</nowiki></code>) in your preferred web browser and start using the application.

When starting the stack the first time, the <code>wiki-task</code> container will automatically perform the installation. It may take a couple of minutes for the process to set up the database and complete. Once it is finished, the password for the default <code>Admin</code> user can be found in <code>$DATADIR/wiki/initialAdminPassword</code>.

== Additional options ==

=== Add Customizations to containers ===
Since tag 5.1.4 and tag 5.2.0 of project <code>bluespice-deploy</code>, we allow to edit and maintain a separate <code>docker-compose.override.yml</code> which will be ignored by git.

This way you can add your own Container-Configurations and be able to maintain your git status up to date. Just place the file next to the other <code>docker-compose.*.yml</code> s and run <code>./bluespice-deploy up -d</code>.

Example:<syntaxhighlight lang="yaml">
services:
wiki-web:
volumes:
- /backup/:/data/backup
wiki-task:
volumes:
- /backup/:/data/backup
</syntaxhighlight>

=== Configs for <code>LocalSettings.php</code> ===
Instead of exposing the <code>LocalSettings.php</code> for [[mediawikiwiki:Manual:LocalSettings.php|adding additional configurations]], the stack offers two entry points. After the initial installation, you can add your configs to two files in <code>${DATADIR}/wiki/bluespice/</code>:

* <code>pre-init-settings.php</code> - Set configs before the initialization of BlueSpice's debug logging, libraries, skins, extensions and default settings. Configs set here can be picked up by the init process.
* <code>post-init-settings.php</code> - Set configs after the initialization, manipulating configs that have been set by the init process.
For example, if you add the following lines to <code>pre-init-settings.php</code>, you can then read outputted debug logs (if any) in <code>${DATADIR}/wiki/bluespice/logs/debug.log</code>:<syntaxhighlight lang="php">
$GLOBALS['bsgDebugLogGroups']['exception'] = "/data/bluespice/logs/debug.log";
$wgShowExceptionDetails = true;
</syntaxhighlight>

=== Maintenance scripts ===
To run [[Setup:Installation Guide/Advanced/Maintenance scripts|maintenance scripts]] from MediaWiki or from other extensions, please use the <code>wiki-task</code> container, which handles all back-end jobs and processes. You can connect into the container in two different ways:

* run <code>./bluespice-deploy exec -it wiki-task bash</code> in the <code>compose</code> directory for Docker Compose files
* or alternatively, run <code>docker exec -it bluespice-wiki-task bash</code> wherever you are on the host machine

Inside the container you can enter the wiki's code base with <code>cd /app/bluespice/w</code> , where one can run scripts like <code>php maintenance/run.php update --quick</code>, <code>php extensions/BlueSpiceExtendedSearch/maintenance/updateWikiPageIndex.php</code> and so on.

=== SSL certificates ===
To use a Let's Encrypt certificate for your domain name, set <code>LETSENCRYPT=true</code> in your <code>.env</code> file.

To use a self-signend certificate for your domain name, put its <code>.crt</code> and <code>.key</code> files in <code>${DATADIR}/proxy/certs</code>. For example, with <code>wiki.company.local</code> you should prepare <code>wiki.company.local.crt</code> and <code>wiki.company.local.key</code> files.

=== Kerberos proxy ===
For implicit authentication using Kerberos, an additional proxy must be used: <code>bluespice/kerberos-proxy</code> . The file <code>docker-compose.kerberos-proxy.yml</code> contains a common configuration. It can be used '''instead of''' the regular <code>docker-compose.proxy.yml</code> file inside <code>bluespice-deploy</code> .

Make sure to have the files

* <code>${DATADIR}/kerberos/krb5.conf</code>
* <code>${DATADIR}/kerberos/kerberos.keytab</code>

set up properly.

The file <code>${DATADIR}/wiki/bluespice/pre-init-settings.php</code> can then be used to set up [[mediawikiwiki:LDAP_hub|"Extension:Auth_remoteuser" and the LDAP stack extensions]].

=== SAML authentication ===
During the initial installation a certificate for message signing will automatically be created. It can be found in <code>${DATADIR}/wiki/simplesamlphp/certs/</code>.

In order to configure a remote IdP, one must copy the IdP metadata XML to a file called <code>${DATADIR}/wiki/simplesamlphp/saml_idp_metadata.xml</code>. The SP metadata can then be obtained via <code><nowiki>https://{{$WIKI_HOST}}/_sp/module.php/saml/sp/metadata.php/default-sp</nowiki></code>. It must be configured in the remote IdP.

{{Textbox
|boxtype=tip
|header=Test authentication
|text= You can test authentication directly within the SimpleSAMLphp application. To do so, navigate to <code><nowiki>https://{{$WIKI_HOST}}/_sp/module.php/admin</nowiki></code> and log in with <code>admin</code> and the <code>INTERNAL_SIMPLESAMLPHP_ADMIN_PASS</code> found in <code>${DATADIR}/wiki/.wikienv</code>
|icon=yes
}}

Next, the extensions "PluggableAuth" and "SimpleSAMLphp" must be enabled on the wiki. To do so, add

<syntaxhighlight lang="php">
wfLoadExtensions( [
'PluggableAuth',
'SimpleSAMLphp'
] );
</syntaxhighlight>[[File:Setup:SAML ConfigManager EN 01.png|thumb|300x300px]]to the <code>${DATADIR}/wiki/bluespice/post-init-settings.php</code>. Run

./bluespice-deploy exec wiki-task /app/bluespice/w/maintenance/update.php --quick

to complete the installation.

After that, the authentication plugin configuration can be applied in [[Manual:Extension/BlueSpiceConfigManager|Special:BlueSpiceConfigManager]] under "Authentication".

=== OpenID Connect authentication ===

The extensions "PluggableAuth" and "OpenIDConnect" must be enabled on the wiki. To do so, add<syntaxhighlight lang="php">
wfLoadExtensions( [
'PluggableAuth',
'OpenIDConnect'
] );
</syntaxhighlight>to the <code>${DATADIR}/wiki/bluespice/post-init-settings.php</code>. Run

./bluespice-deploy exec wiki-task /app/bluespice/w/maintenance/update.php --quick

to complete the installation.

After that, the authentication plugin configuration can be applied in [[Manual:Extension/BlueSpiceConfigManager|Special:BlueSpiceConfigManager]] under "Authentication".

[[de:Setup:Installationsanleitung/Docker]]

User:Rvogel1

2026-05-05T08:16:31Z

Rvogel1: User profile edited

Setup:Installation Guide/Docker

2026-04-21T08:54:52Z

Rvogel1: /* Step 1: Get the stack */

== Overview ==
Starting with version 4.5, BlueSpice MediaWiki can be installed with a stack of Docker container images.

Everything is built in a modular way to allow different types of setups.

The most common cases are:
# "All-in-one" (with and without Let's Encrypt)
# Custom database and search service
# Custom load balancer / proxy

== Architecture ==
<drawio filename="Setup:Installation_Guide_Docker-Achitecture" alt="Diagram of BlueSpice Docker Stack Architecture" />

'''Notes'''
* Internal HTTP connections may use non-standard ports. Those are noted next to the respective services.
** HTTP (in-secure) is only used for internal communication within the virtual network the stack is operated in. All connections to the client use TLS.
* Proprietary ports (esp. for database connections) are noted next to the respective services.
* There may be additional services and ports in use, based on the setup. Some examples:
** When using LDAP based authentication an LDAPS connection (port <code>636</code>) is used from the <code>bluespice/wiki</code> containers to the LDAP-Server
** When using Kerberos authentication, a connection (port <code>88</code>) is used from the <code>bluespice/kerberos-proxy</code> containers to the Kerberos-Server
** When using DeepL or OpenAI services, a HTTPS connection (port <code>443</code>) is used from the <code>bluespice/wiki</code> containers to to the respective service
** When using OpenIDConnect authentication, a HTTPS connection (port <code>443</code>) is used from the <code>bluespice/wiki</code> "task" container to to the authentication provider
** When using "Let's Encrypt" Certbot, a HTTPS connection (port <code>443</code>) is used from the <code>acme-companion</code> container to the "Let's Encrypt" service

== Step 1: Get the stack ==
Load project <code>bluespice-deploy</code> from https://github.com/hallowelt/bluespice-deploy/releases/latest and enter the sub-directory <code>compose</code> for Docker Compose files.

For example, run:
<syntaxhighlight lang=sh>
wget https://github.com/hallowelt/bluespice-deploy/archive/refs/tags/5.2.3.zip \
&& unzip 5.2.3.zip \
&& cd bluespice-deploy-5.2.3/compose
</syntaxhighlight>
{{Textbox|boxtype=note|header=Use one consistent version number|text=The tag number 5.2.3 in this command (could be 5.1.4, 5.1.5, 5.2.1 etc. as well) should also be used as the <code>VERSION=</code> number in Step 2.|icon=yes}}

The directory contains the following files:
{| class="wikitable"
|+
! style="width:375px;" |Filename
! style="" |Type
! style="" |Comment
|-
| style="width:375px;" |<code>bluespice-deploy</code>
| style="" |shell script
| style="" |Start-up script, wrapping command <code>docker compose</code> and service <code>yml</code> files.<br>Additional service <code>yml</code> files can be loaded by adding <code>-f <filename> </code>.
|-
| style="width:375px;" |<code>docker-compose.main.yml</code>
| style="" |yml
| style="" |Main containers of the wiki (<code>wiki-web</code> and <code>wiki-task</code>).
|-
| style="width:375px;" |<code>docker-compose.persistent-data-services.yml</code>
| style="" |yml
| style="" |Containers of database and search services, storing persistent data onto the file system.<br />Optionally with external MySQL/MariaDB and OpenSearch one can skip loading this <code>.yml</code> in <code>bluespice-deploy</code>. Please then wire your services properly in the <code>.env</code> file.
|-
| style="width:375px;" |<code>docker-compose.stateless-services.yml</code>
| style="" |yml
| style="" |Containers for caching, PDF rendering, formula-rendering and diagram editing.
|-
| style="width:375px;" |<code>docker-compose.helper-service.yml</code>
| style="" |yml
| style="" |Helper containers for file system preparation and automated BlueSpice upgrade.<br>These containers exit automatically after finishing tasks.
|-
| style="width:375px;" |<code>docker-compose.proxy.yml</code>
| style="" |yml
| style="" |Container of proxy service. Can be replaced by existing proxy/load-balancer infrastructure.
|-
| style="width:375px;" |<code>docker-compose.proxy-letsencrypt.yml</code>
| style="" |yml
| style="" |Additional service for auto-renewal of "Let's Encrypt" certificates.<br>Only required when using the Let's Encrypt service and having no other TLS termination.
|-
| style="width:375px;" |<code>docker-compose.kerberos-proxy.yml</code>
| style="" |yml
| style="" |Additional proxy for Kerberos based authentication.
|-
| style="width:375px;" |<code>docker-compose.collabpads-service.yml</code>
|yml
|Containers of back-end services for [[Manual:Extension/CollabPads|CollabPads]] (included in Pro and Farm editions).
|-
| style="width:375px;" |<code>.env.sample</code>
| style="" |text
| style="" |Sample for creating <code>.env</code> that defines key environment variables.
|-
| style="width:375px;" |<code>bluespice.service.demo</code>
| style="" |service script
| style="" |Demo-file for control the BlueSpice stack as a <code>systemctl</code> service.<br>One can create e.g a <code>/etc/systemd/system/bluespice.service</code>.
|}

== Step 2: Set up environment variables ==
Create your <code>.env</code> based on the sample file <code>.env.sample</code>.

Example:
<pre>
# set or use your data directory
DATADIR=/data/bluespice
VERSION=5.2.2
EDITION=free
BACKUP_HOUR=04

WIKI_NAME=BlueSpice
WIKI_LANG=en
WIKI_PASSWORDSENDER=no-reply@wiki.company.local
WIKI_EMERGENCYCONTACT=no-reply@wiki.company.local
WIKI_HOST=wiki.company.local
WIKI_PORT=443
WIKI_PROTOCOL=https
WIKI_BASE_PATH=

DB_USER=set_or_use_your_db_user_name
DB_PASS=SET_OR_USE_YOUR_DB_PASS_WORD
DB_ROOT_USER=root
DB_ROOT_PASS=$DB_PASS
DB_HOST=database
DB_NAME=bluespice
DB_PREFIX=

SMTP_HOST=mail.company.local
SMTP_PORT=25
SMTP_USER=...
SMTP_PASS=...
SMTP_ID_HOST=...

LETSENCRYPT=false
</pre>
{{Textbox|boxtype=note|header=Different editions|text=This config works for all editions, but the main image of Pro or Farm edition needs to be obtained differently, see [[{{FULLPAGENAME}}/Pro and Farm edition|Pro and Farm edition]]|icon=yes}}

== Step 3: Start the stack ==
Use <code>bluespice-deploy up -d</code> to start the stack. Once all containers are shown as "ready" you can navigate to <code>$WIKI_PROTOCOL://$WIKI_HOST:$WIKI_PORT</code> (e.g. <code><nowiki>https://wiki.company.local</nowiki></code>) in your preferred web browser and start using the application.

When starting the stack the first time, the <code>wiki-task</code> container will automatically perform the installation. It may take a couple of minutes for the process to set up the database and complete. Once it is finished, the password for the default <code>Admin</code> user can be found in <code>$DATADIR/wiki/initialAdminPassword</code>.

== Additional options ==

=== Add Customizations to containers ===
Since tag 5.1.4 and tag 5.2.0 of project <code>bluespice-deploy</code>, we allow to edit and maintain a separate <code>docker-compose.override.yml</code> which will be ignored by git.

This way you can add your own Container-Configurations and be able to maintain your git status up to date. Just place the file next to the other <code>docker-compose.*.yml</code> s and run <code>./bluespice-deploy up -d</code>.

Example:<syntaxhighlight lang="yaml">
services:
wiki-web:
volumes:
- /backup/:/data/backup
wiki-task:
volumes:
- /backup/:/data/backup
</syntaxhighlight>

=== Configs for <code>LocalSettings.php</code> ===
Instead of exposing the <code>LocalSettings.php</code> for [[mediawikiwiki:Manual:LocalSettings.php|adding additional configurations]], the stack offers two entry points. After the initial installation, you can add your configs to two files in <code>${DATADIR}/wiki/bluespice/</code>:

* <code>pre-init-settings.php</code> - Set configs before the initialization of BlueSpice's debug logging, libraries, skins, extensions and default settings. Configs set here can be picked up by the init process.
* <code>post-init-settings.php</code> - Set configs after the initialization, manipulating configs that have been set by the init process.
For example, if you add the following lines to <code>pre-init-settings.php</code>, you can then read outputted debug logs (if any) in <code>${DATADIR}/wiki/bluespice/logs/debug.log</code>:<syntaxhighlight lang="php">
$GLOBALS['bsgDebugLogGroups']['exception'] = "/data/bluespice/logs/debug.log";
$wgShowExceptionDetails = true;
</syntaxhighlight>

=== Maintenance scripts ===
To run [[Setup:Installation Guide/Advanced/Maintenance scripts|maintenance scripts]] from MediaWiki or from other extensions, please use the <code>wiki-task</code> container, which handles all back-end jobs and processes. You can connect into the container in two different ways:

* run <code>./bluespice-deploy exec -it wiki-task bash</code> in the <code>compose</code> directory for Docker Compose files
* or alternatively, run <code>docker exec -it bluespice-wiki-task bash</code> wherever you are on the host machine

Inside the container you can enter the wiki's code base with <code>cd /app/bluespice/w</code> , where one can run scripts like <code>php maintenance/run.php update --quick</code>, <code>php extensions/BlueSpiceExtendedSearch/maintenance/updateWikiPageIndex.php</code> and so on.

=== SSL certificates ===
To use a Let's Encrypt certificate for your domain name, set <code>LETSENCRYPT=true</code> in your <code>.env</code> file.

To use a self-signend certificate for your domain name, put its <code>.crt</code> and <code>.key</code> files in <code>${DATADIR}/proxy/certs</code>. For example, with <code>wiki.company.local</code> you should prepare <code>wiki.company.local.crt</code> and <code>wiki.company.local.key</code> files.

=== Kerberos proxy ===
For implicit authentication using Kerberos, an additional proxy must be used: <code>bluespice/kerberos-proxy</code> . The file <code>docker-compose.kerberos-proxy.yml</code> contains a common configuration. It can be used '''instead of''' the regular <code>docker-compose.proxy.yml</code> file inside <code>bluespice-deploy</code> .

Make sure to have the files

* <code>${DATADIR}/kerberos/krb5.conf</code>
* <code>${DATADIR}/kerberos/kerberos.keytab</code>

set up properly.

The file <code>${DATADIR}/wiki/bluespice/pre-init-settings.php</code> can then be used to set up [[mediawikiwiki:LDAP_hub|"Extension:Auth_remoteuser" and the LDAP stack extensions]].

=== SAML authentication ===
During the initial installation a certificate for message signing will automatically be created. It can be found in <code>${DATADIR}/wiki/simplesamlphp/certs/</code>.

In order to configure a remote IdP, one must copy the IdP metadata XML to a file called <code>${DATADIR}/wiki/simplesamlphp/saml_idp_metadata.xml</code>. The SP metadata can then be obtained via <code><nowiki>https://{{$WIKI_HOST}}/_sp/module.php/saml/sp/metadata.php/default-sp</nowiki></code>. It must be configured in the remote IdP.

{{Textbox
|boxtype=tip
|header=Test authentication
|text= You can test authentication directly within the SimpleSAMLphp application. To do so, navigate to <code><nowiki>https://{{$WIKI_HOST}}/_sp/module.php/admin</nowiki></code> and log in with <code>admin</code> and the <code>INTERNAL_SIMPLESAMLPHP_ADMIN_PASS</code> found in <code>${DATADIR}/wiki/.wikienv</code>
|icon=yes
}}

Next, the extensions "PluggableAuth" and "SimpleSAMLphp" must be enabled on the wiki. To do so, add

<syntaxhighlight lang="php">
wfLoadExtensions( [
'PluggableAuth',
'SimpleSAMLphp'
] );
</syntaxhighlight>[[File:Setup:SAML ConfigManager EN 01.png|thumb|300x300px]]to the <code>${DATADIR}/wiki/bluespice/post-init-settings.php</code>. Run

./bluespice-deploy exec wiki-task /app/bluespice/w/maintenance/update.php --quick

to complete the installation.

After that, the authentication plugin configuration can be applied in [[Manual:Extension/BlueSpiceConfigManager|Special:BlueSpiceConfigManager]] under "Authentication".

=== OpenID Connect authentication ===

The extensions "PluggableAuth" and "OpenIDConnect" must be enabled on the wiki. To do so, add<syntaxhighlight lang="php">
wfLoadExtensions( [
'PluggableAuth',
'OpenIDConnect'
] );
</syntaxhighlight>to the <code>${DATADIR}/wiki/bluespice/post-init-settings.php</code>. Run

./bluespice-deploy exec wiki-task /app/bluespice/w/maintenance/update.php --quick

to complete the installation.

After that, the authentication plugin configuration can be applied in [[Manual:Extension/BlueSpiceConfigManager|Special:BlueSpiceConfigManager]] under "Authentication".

[[de:Setup:Installationsanleitung/Docker]]

Development

2026-03-17T07:03:30Z

Rvogel1:

Security:Security Advisories

2026-03-04T15:36:17Z

Rvogel1:

{| class="wikitable sortable" style="width:100%;"
! style="" |Release name
! style="" |Release date
! style="" |Title
! style="" |References
! style="" |Summary
!Severity
|-
|[[Security:Security Advisories/BSSA-2026-02|BSSA-2026-02]]
|2026-03-04
|Security vulnerability in BlueSpice Database container and NSFileRepo extension.
|[https://avd.aquasec.com/nvd/2025/cve-2025-15467 CVE-2025-15467],
[https://avd.aquasec.com/nvd/2026/cve-2026-24732 CVE-2026-24732]
|Buffer Overflow; Information disclosure
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2026-01|BSSA-2026-01]]
|2026-01-28
|Security vulnerability in BlueSpice Collabpads database container.
|[https://avd.aquasec.com/nvd/2025/cve-2025-14847 CVE-2025-14847]
|Read of uninitialized heap memory
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2025-07|BSSA-2025-07]]
|2025-12-10
|Security vulnerability in BlueSpice Search container.
|[https://avd.aquasec.com/nvd/2025/cve-2025-66516 CVE-2025-66516]
|XML Entity Injection
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2025-06|BSSA-2025-06]]
|2025-10-28
|Security vulnerabilities in various MediaWiki extensions that are actually part of the BlueSpice distribution
|[https://www.cve.org/CVERecord?id=CVE-2024-56171 CVE-2024-56171], [https://www.cve.org/CVERecord?id=CVE-2025-3277 CVE-2025-3277], [https://www.cve.org/CVERecord?id=CVE-2025-6965 CVE-2025-6965], [https://www.cve.org/CVERecord?id=CVE-2025-11173 CVE-2025-11173], [https://www.cve.org/CVERecord?id=CVE-2025-11175 CVE-2025-11175],
[https://www.cve.org/CVERecord?id=CVE-2025-53625 CVE-2025-53625],
[https://www.cve.org/CVERecord?id=CVE-2025-54370 CVE-2025-54370],
[https://www.cve.org/CVERecord?id=CVE-2025-54874 CVE-2025-54874],
[https://www.cve.org/CVERecord?id=CVE-2025-59839 CVE-2025-59839],
[https://www.cve.org/CVERecord?id=CVE-2025-61634 CVE-2025-61634],
[https://www.cve.org/CVERecord?id=CVE-2025-61635 CVE-2025-61635],
[https://www.cve.org/CVERecord?id=CVE-2025-61636 CVE-2025-61636],
[https://www.cve.org/CVERecord?id=CVE-2025-61637 CVE-2025-61637],
[https://www.cve.org/CVERecord?id=CVE-2025-61638 CVE-2025-61638],
[https://www.cve.org/CVERecord?id=CVE-2025-61639 CVE-2025-61639],
[https://www.cve.org/CVERecord?id=CVE-2025-61640 CVE-2025-61640],
[https://www.cve.org/CVERecord?id=CVE-2025-61641 CVE-2025-61641],
[https://www.cve.org/CVERecord?id=CVE-2025-61642 CVE-2025-61642],
[https://www.cve.org/CVERecord?id=CVE-2025-61643 CVE-2025-61643],
[https://www.cve.org/CVERecord?id=CVE-2025-61646 CVE-2025-61646],
[https://www.cve.org/CVERecord?id=CVE-2025-61652 CVE-2025-61652],
[https://www.cve.org/CVERecord?id=CVE-2025-61653 CVE-2025-61653],
[https://www.cve.org/CVERecord?id=CVE-2025-61655 CVE-2025-61655],
[https://www.cve.org/CVERecord?id=CVE-2025-61655 CVE-2025-61655],
[https://www.cve.org/CVERecord?id=CVE-2025-61656 CVE-2025-61656],
[https://www.cve.org/CVERecord?id=CVE-2025-61656 CVE-2025-61656],
[https://www.cve.org/CVERecord?id=CVE-2025-61657 CVE-2025-61657],
[https://www.cve.org/CVERecord?id=CVE-2025-7458 CVE-2025-7458]
|Denial Of Service,
Cross-Site Scripting (XSS),
Information Disclosure,
Bypass authn at content check,
Server-side Request Forgery,
Arbitrary Code Execution,
Memory Corruption,
Use-After-Free,
Arbitrary SQL Execution
| style="" class="col-red-bg" |High
|-
|[[Security:Security Advisories/BSSA-2025-05|BSSA-2025-05]]
|2025-09-19
|XSS in Extension:AtMentions, Extension:BlueSpiceAvatars, Extension:BlueSpiceWhoIsOnline and Extension:CognitiveProcessDesigner
|[https://www.cve.org/CVERecord?id=CVE-2025-46703 CVE-2025-46703], [https://www.cve.org/CVERecord?id=CVE-2025-48007 CVE-2025-48007], [https://www.cve.org/CVERecord?id=CVE-2025-57880 CVE-2025-57880], [https://www.cve.org/CVERecord?id=CVE-2025-58114 CVE-2025-58114]
|
| style="" class="col-orange-bg" |Medium
|-
|[[Security:Security Advisories/BSSA-2025-04|BSSA-2025-04]]
|2025-09-18
|Security vulnerabilities in services <code>bluespice/search</code>, <code>bluespice/formular</code> and <code>bluespice/wiki</code>
|[https://nvd.nist.gov/vuln/detail/CVE-2025-54988 CVE-2025-54988], [https://avd.aquasec.com/nvd/2025/cve-2025-7783 CVE-2025-7783], [https://avd.aquasec.com/nvd/cve-2025-58050 CVE-2025-58050], [https://avd.aquasec.com/nvd/cve-2025-49794 CVE-2025-49794], [https://avd.aquasec.com/nvd/cve-2025-49796 CVE-2025-49796]
|Denial-of-Service, Information Disclosure
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2025-03|BSSA-2025-03]]
|2025-07-28
|Security vulnerabilities in Extension:Scribunto, Extension:TabberNeue, Extension:TwoColConflict and Extension:Quiz
|[https://www.cve.org/CVERecord?id=CVE-2025-53501 CVE-2025-53501], [https://www.cve.org/CVERecord?id=CVE-2025-53494 CVE-2025-53494], [https://www.cve.org/CVERecord?id=CVE-2025-53093 CVE-2025-53093], [https://www.cve.org/CVERecord?id=CVE-2025-7057 CVE-2025-7057]
|Information Disclosure,
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2025-02|BSSA-2025-02]]
| style="" |2025-04-17
| style="" |Security vulnerabilities in Extension:OAuth
| style="" |[https://www.cve.org/CVERecord?id=CVE-2025-32068 CVE-2025-32068], [https://www.cve.org/CVERecord?id=CVE-2025-32074 CVE-2025-32074]
| style="" |Allows unauthorized access to the wiki, Cross-Site Scripting (XSS)
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2025-01|BSSA-2025-01]]
| style="" |2025-01-20
| style="" |Security vulnerabilities in Extension:DataTransfer
| style="" |[https://www.cve.org/CVERecord?id=CVE-2025-23081 CVE-2025-23081]
| style="" |Allows Cross Site Request Forgery, Cross-Site Scripting (XSS)
| style="" class="col-orange-bg" |Medium
|-
|[[Security:Security Advisories/BSSA-2023-02|BSSA-2023-02]]
|2023-10-30
|Security vulnerabilities in Extension:BlueSpiceAvatars
|[https://www.cve.org/cverecord?id=CVE-2023-42431 CVE-2023-42431]
|Allows Cross-Site Scripting (XSS)
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2023-01|BSSA-2023-01]]
| style="" |2023-07-25
| style="" |Ghostscript vulnerability
| style="" |[https://www.cve.org/CVERecord?id=CVE-2023-36664 CVE-2023-36664]
| style="" |Code can be executed on the server via a manipulated PDF
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2022-08|BSSA-2022-08]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-3895 CVE-2022-3895]
| style="" |Arbitrary HTML injection through use of interface elements
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2022-07|BSSA-2022-07]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-3958 CVE-2022-3958]
| style="" |Arbitrary HTML injection through personal menu items
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2022-06|BSSA-2022-06]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-3893 CVE-2022-3893]
| style="" |Arbitrary HTML injection through the custom menu
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2022-05|BSSA-2022-05]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-42001 CVE-2022-42001]
| style="" |Arbitrary HTML injection through the book navigation
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2022-04|BSSA-2022-04]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-41789 CVE-2022-41789], [https://www.cve.org/CVERecord?id=CVE-2022-41814 CVE-2022-41814], [https://www.cve.org/CVERecord?id=CVE-2022-42000 CVE-2022-42000]
| style="" |Arbitrary HTML injection through user preferences
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2022-03|BSSA-2022-03]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-41611 CVE-2022-41611]
| style="" |Arbitrary HTML injection through main navigation
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2022-02|BSSA-2022-02]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-2511 CVE-2022-2511]
| style="" |Arbitrary HTML injection through the 'title' parameter
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2022-01|BSSA-2022-01]]
| style="" |2022-01-31
| style="" |XSS attack vector in Search Center
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-2510 CVE-2022-2510]
| style="" |JavaScript in search field is reflected back to the browser.
| style="" class="col-orange-bg" |Medium
|}

Security:Security Advisories/BSSA-2026-02

2026-03-04T15:32:37Z

Rvogel1:

{| class="wikitable"
|+
!
!
|-
|Date
|2026-03-04
|-
|Severity
|reported "high", BlueSpice assessment: '''low'''
|-
|Affected
| Services in LTS version < 5.1.5
BlueSpice PRO/FARM < 5.1.4

BlueSpice PRO/FARM < 5.2.0
|-
|Fixed in
|BlueSpice PRO/FARM 5.1.4
BlueSpice PRO/FARM 5.2.1
|-
|CVE
|
* [https://avd.aquasec.com/nvd/2025/cve-2025-15467/ CVE-2025-15467]
* [https://avd.aquasec.com/nvd/2026/cve-2026-24732 CVE-2026-24732]
|}

==Problem==
{| class="wikitable"
!'''CVE'''
!'''Component'''
!'''Type of vulnerability'''
!'''BlueSpice 5'''
!'''BlueSpice 4'''
|-
|CVE-2025-15467
|Container <code>bluespice/database</code>
|Buffer Overflow
| style="" class="col-purple-bg" |affected
| style="" class="col-purple-bg" |affected
|-
|CVE-2026-24732
|Extension:NSFileRepo
|Information Disclosure
| style="" class="col-purple-bg" |affected
| style="" class="col-green-bg" |not affected
|}

==Impact assessment==
{| class="wikitable" style="width: 100%;"
!CVE
!Assessment
!Mitigation without update
|-
| style="vertical-align:middle;text-align:left;" |CVE-2025-15467
| style="vertical-align:middle;text-align:left;" class="col-orange-bg" |Low, as by default configuration of <code>bluespice-deploy</code>, this is not exploitable
| style="vertical-align:middle;text-align:left;" |Make sure the service has no access to the internet. This is the default configuration of BlueSpice setups
|-
|CVE-2026-24732
| style="" class="col-orange-bg" |Low, as by default configuration of BlueSpice MediaWiki, this is not exploitable. The affected type of configuration is considered an edge-case.
|Make sure <code>$wgGroupPermissions['*']['read']</code> is set to <code>false</code> in the <code>LocalSettings.php</code>.
|}

== Solution ==
Update to BlueSpice 5.1.4+ or 5.2.1+

Security:Security Advisories/BSSA-2026-02

2026-03-04T13:01:32Z

Rvogel1:

{| class="wikitable"
|+
!
!
|-
|Date
|2026-03-04
|-
|Severity
|reported "high", BlueSpice assessment: '''low'''
|-
|Affected
| Services in LTS version < 5.1.5
BlueSpice PRO/FARM < 5.1.5
BlueSpice PRO/FARM < 5.2.0
|-
|Fixed in
|BlueSpice PRO/FARM 5.1.4
BlueSpice PRO/FARM 5.2.1
|-
|CVE
|
* [https://avd.aquasec.com/nvd/2025/cve-2025-15467/ CVE-2025-15467]
* [https://avd.aquasec.com/nvd/2026/cve-2026-24732 CVE-2026-24732]
|}

==Problem==
{| class="wikitable"
!'''CVE'''
!'''Component'''
!'''Type of vulnerability'''
!'''BlueSpice 5'''
!'''BlueSpice 4'''
|-
|CVE-2025-15467
|Container <code>bluespice/database</code>
|Buffer Overflow
| style="" class="col-purple-bg" |affected
| style="" class="col-purple-bg" |affected
|-
|CVE-2026-24732
|
|Information Disclosure
| style="" class="col-purple-bg" |affected
| style="" class="col-green-bg" |not affected
|}

==Impact assessment==
{| class="wikitable" style="width: 100%;"
!CVE
!Assessment
!Mitigation without update
|-
| style="vertical-align:middle;text-align:left;" |CVE-2025-15467
| style="vertical-align:middle;text-align:left;" class="col-orange-bg" |Low
| style="vertical-align:middle;text-align:left;" |Make sure the service has no access to the internet. This is the default configuration of BlueSpice setups
|-
|CVE-2026-24732
| style="" class="col-purple-bg" |Medium
|None
|}

== Solution ==
To mitigate <code>CVE-2026-24732</code> , please update to

Security:Security Advisories/BSSA-2026-02

2026-03-04T13:00:54Z

Rvogel1:

{| class="wikitable"
|+
!
!
|-
|Date
|2026-01-29
|-
|Severity
|reported "high", BlueSpice assessment: '''low'''
|-
|Affected
| Services in LTS version < 5.1.5
BlueSpice PRO/FARM < 5.1.5
BlueSpice PRO/FARM < 5.2.0
|-
|Fixed in
|BlueSpice PRO/FARM 5.1.4
BlueSpice PRO/FARM 5.2.1
|-
|CVE
|
* [https://avd.aquasec.com/nvd/2025/cve-2025-15467/ CVE-2025-15467]
* [https://avd.aquasec.com/nvd/2026/cve-2026-24732 CVE-2026-24732]
|}

==Problem==
{| class="wikitable"
!'''CVE'''
!'''Component'''
!'''Type of vulnerability'''
!'''BlueSpice 5'''
!'''BlueSpice 4'''
|-
|CVE-2025-15467
|Container <code>bluespice/database</code>
|Buffer Overflow
| style="" class="col-purple-bg" |affected
| style="" class="col-purple-bg" |affected
|-
|CVE-2026-24732
|
|Information Disclosure
| style="" class="col-purple-bg" |affected
| style="" class="col-green-bg" |not affected
|}

==Impact assessment==
{| class="wikitable" style="width: 100%;"
!CVE
!Assessment
!Mitigation without update
|-
| style="vertical-align:middle;text-align:left;" |CVE-2025-15467
| style="vertical-align:middle;text-align:left;" class="col-orange-bg" |Low
| style="vertical-align:middle;text-align:left;" |Make sure the service has no access to the internet. This is the default configuration of BlueSpice setups
|-
|CVE-2026-24732
| style="" class="col-purple-bg" |Medium
|None
|}

== Solution ==
To mitigate <code>CVE-2026-24732</code> , please update to

Security:Security Advisories/BSSA-2026-01

2026-03-04T12:52:08Z

Rvogel1: Undo previous change; Will go into dedicated BSSA

{| class="wikitable"
|+
!
!
|-
|Date
|2026-01-29
|-
|Severity
|reported "high", BlueSpice assessment: '''low'''
|-
|Affected
| Services in current LTS version < 5.1.4
|-
|Fixed in
|5.2.1, 5.1.5
|-
|CVE
| [https://avd.aquasec.com/nvd/2025/cve-2025-14847 CVE-2025-14847]
|}

==Problem==
* Service <code>collabpads-database</code> (image name: <code>mongo</code> ) - [https://avd.aquasec.com/nvd/2025/cve-2025-14847 CVE-2025-14847]

==Impact assessment==
* Service <code>collabpads-database</code> (image name: <code>mongo</code> )
** A unauthenticated MongoDB client can attack the service if reachable. By default BlueSpice setup, the service runs only in the background and can not be accessed from outside the virtual network. So not even unauthenticated access is possible from any external location.

== Solution ==
To mitigate <code>CVE-2025-14847</code> use one of the following options:

# Make sure the service has no access to the internet. This is the default configuration of BlueSpice setups.
# Update the <code>mongo</code> docker image via BlueSpice's deploy tool: <code>bluespice-deploy pull collabpads-database && bluespice-deploy up -d</code>
# Update to version >=5.1.5 or >=5.2.1 of the BlueSpice images

Security:Security Advisories/BSSA-2026-02

2026-03-04T12:20:41Z

Rvogel1: Created page with "{| class="wikitable" |+ ! ! |- |Date |2026-01-29 |- |Severity |reported "high", BlueSpice assessment: '''low''' |- |Affected | Services in current LTS version < 5.1.4 |- |Fixed in | |- |CVE | * [https://avd.aquasec.com/nvd/2025/cve-2025-14847 CVE-2025-14847] * [https://avd.aquasec.com/nvd/2025/cve-2025-15467/ CVE-2025-15467] |} ==Problem== {| class="wikitable" !'''CVE''' !'''Component''' !'''Type of vulnerability''' !'''BlueSpice 5''' !'''BlueSpice 4''' |- |CVE-2025-148..."

{| class="wikitable"
|+
!
!
|-
|Date
|2026-01-29
|-
|Severity
|reported "high", BlueSpice assessment: '''low'''
|-
|Affected
| Services in current LTS version < 5.1.4
|-
|Fixed in
|
|-
|CVE
|
* [https://avd.aquasec.com/nvd/2025/cve-2025-14847 CVE-2025-14847]
* [https://avd.aquasec.com/nvd/2025/cve-2025-15467/ CVE-2025-15467]
|}

==Problem==
{| class="wikitable"
!'''CVE'''
!'''Component'''
!'''Type of vulnerability'''
!'''BlueSpice 5'''
!'''BlueSpice 4'''
|-
|CVE-2025-14847
|<code>container collabpads-database(image:mongo:8.0)</code>
|Information Disclosure
| style="" class="col-purple-bg" |affected
| style="" class="col-purple-bg" |affected
|-
|CVE-2025-15467
|Container <code>bluespice/database</code>
|Buffer Overflow
| style="" class="col-purple-bg" |affected
| style="" class="col-purple-bg" |affected
|}

==Impact assessment==
* Service <code>collabpads-database</code> (image name: <code>mongo</code> )
** A unauthenticated MongoDB client can attack the service if reachable. By default BlueSpice setup, the service runs only in the background and can not be accessed from outside the virtual network. So not even unauthenticated access is possible from any external location.
{| class="wikitable" style="width: 100%;"
!CVE
!Assessment
!Mitigation without update
|-
| style="vertical-align:middle;text-align:left;" |CVE-2025-14847
| style="vertical-align:middle;text-align:left;" class="col-orange-bg" |Low
| style="vertical-align:middle;text-align:left;" |Make sure the service has no access to the internet. This is the default configuration of BlueSpice setups
|-
|CVE-2025-15467
| style="" class="col-orange-bg" |Low
|Make sure the service has no access to the internet. This is the default configuration of BlueSpice setups
|}

== Solution ==
To mitigate <code>CVE-2025-14847</code> use one of the following options:

# Make sure the service has no access to the internet. This is the default configuration of BlueSpice setups.
# Update the <code>mongo</code> docker image via BlueSpice's deploy tool: <code>bluespice-deploy pull collabpads-database && bluespice-deploy up -d</code>

Confluence migration

2026-02-27T09:59:22Z

Rvogel1: /* Roadmap */

''Hallo Welt!'' has created a migration tool that can be used to import Confluence spaces into a MediaWiki or BlueSpice installation. This is a command line tool and you need access to your MediaWiki or BlueSpice server environment.

==Migration tool==
The [https://github.com/hallowelt/migrate-confluence?tab=readme-ov-file#migrate-confluence-xml-export-to-mediawiki-import-data migration tool can be found on GitHub] and is [https://github.com/hallowelt/migrate-confluence?tab=readme-ov-file#migrate-confluence-xml-export-to-mediawiki-import-data documented there].

==Extensions==
The output generated by the tool contains certain elements that require '''additional extensions''' to activate. These extensions are already included in a BlueSpice Pro installation:

#[[mediawikiwiki:Extension:TemplateStyles|TemplateStyles]]
#[[mediawikiwiki:Extension:ParserFunctions|ParserFunctions]]
#[[mediawikiwiki:Extension:SimpleTasks|SimpleTasks]]
#[[mediawikiwiki:Extension:Semantic_MediaWiki|Semantic MediaWiki]]
#[[mediawikiwiki:Extension:Header_Tabs|HeaderTabs]]
#[[mediawikiwiki:Extension:SubPageList|SubPageList]]

==Macro check==
On the BlueSpice website, you can use a [https://bluespice.com/confluence-migration-process/#confluence-migration-input-desktop macro check] to see which Confluence macros are not automatically converted. If an important macro is marked as unsupported, the content can most likely still be transferred.
[[File:Confluence macro check.png|alt=Textarea for adding a list of macros (with step-by-step instructions)|center|thumb|650x650px|Macro check]]

== Not migrated ==
The following Confluence elements are excluded from the migration:

*User identities
*Comments
*Various macros
*Various layouts
*Blog posts
*Files in an area that cannot be assigned to a page

== Roadmap ==
* March '26: Provide Docker Container (ERM46685) - Eases installation and allows for better automation
* March/April '26: Allow for parallel processing (ERM45405) - Speeds up conversion of large Confluence exports
* March/April '26: Migrate blogs posts to [[mw:Extension:SimpleBlogPage]] pages (ERM46628) - Additional content
* March/April '26: Migrate page comments to [[mw:Extension:CommentStreams]] threads (ERM46627) - Additional content
* April '26: Add support for historic page and file revisions (ERM35013) - Additional content

==More information==

*https://bluespice.com/migration-from-confluence-to-bluespice-mediawiki/
*https://bluespice.com/mediawiki-versus-confluence-not-a-question-of-features/

[[de:Confluence Migration]]
[[Category:Setup]]

Confluence migration

2026-02-27T09:57:46Z

Rvogel1:

''Hallo Welt!'' has created a migration tool that can be used to import Confluence spaces into a MediaWiki or BlueSpice installation. This is a command line tool and you need access to your MediaWiki or BlueSpice server environment.

==Migration tool==
The [https://github.com/hallowelt/migrate-confluence?tab=readme-ov-file#migrate-confluence-xml-export-to-mediawiki-import-data migration tool can be found on GitHub] and is [https://github.com/hallowelt/migrate-confluence?tab=readme-ov-file#migrate-confluence-xml-export-to-mediawiki-import-data documented there].

==Extensions==
The output generated by the tool contains certain elements that require '''additional extensions''' to activate. These extensions are already included in a BlueSpice Pro installation:

#[[mediawikiwiki:Extension:TemplateStyles|TemplateStyles]]
#[[mediawikiwiki:Extension:ParserFunctions|ParserFunctions]]
#[[mediawikiwiki:Extension:SimpleTasks|SimpleTasks]]
#[[mediawikiwiki:Extension:Semantic_MediaWiki|Semantic MediaWiki]]
#[[mediawikiwiki:Extension:Header_Tabs|HeaderTabs]]
#[[mediawikiwiki:Extension:SubPageList|SubPageList]]

==Macro check==
On the BlueSpice website, you can use a [https://bluespice.com/confluence-migration-process/#confluence-migration-input-desktop macro check] to see which Confluence macros are not automatically converted. If an important macro is marked as unsupported, the content can most likely still be transferred.
[[File:Confluence macro check.png|alt=Textarea for adding a list of macros (with step-by-step instructions)|center|thumb|650x650px|Macro check]]

== Not migrated ==
The following Confluence elements are excluded from the migration:

*User identities
*Comments
*Various macros
*Various layouts
*Blog posts
*Files in an area that cannot be assigned to a page

== Roadmap ==
# Provide Docker Container (ERM46685) - Eases installation and allows for better automation
# Allow for parallel processing (ERM45405) - Speeds up conversion of large Confluence exports
# Migrate blogs posts to [[mw:Extension:SimpleBlogPage]] pages (ERM46628) - Additional content
# Migrate page comments to [[mw:Extension:CommentStreams]] threads (ERM46627) - Additional content
# Add support for historic page and file revisions (ERM35013) - Additional content

==More information==

*https://bluespice.com/migration-from-confluence-to-bluespice-mediawiki/
*https://bluespice.com/mediawiki-versus-confluence-not-a-question-of-features/

[[de:Confluence Migration]]
[[Category:Setup]]

Confluence migration

2026-02-27T09:54:22Z

Rvogel1:

''Hallo Welt!'' has created a migration tool that can be used to import Confluence spaces into a MediaWiki or BlueSpice installation. This is a command line tool and you need access to your MediaWiki or BlueSpice server environment.

==Migration tool==
The [https://github.com/hallowelt/migrate-confluence?tab=readme-ov-file#migrate-confluence-xml-export-to-mediawiki-import-data migration tool can be found on GitHub] and is [https://github.com/hallowelt/migrate-confluence?tab=readme-ov-file#migrate-confluence-xml-export-to-mediawiki-import-data documented there].

==Extensions==
The output generated by the tool contains certain elements that require '''additional extensions''' to activate. These extensions are already included in a BlueSpice Pro installation:

#[[mediawikiwiki:Extension:TemplateStyles|TemplateStyles]]
#[[mediawikiwiki:Extension:ParserFunctions|ParserFunctions]]
#[[mediawikiwiki:Extension:SimpleTasks|SimpleTasks]]
#[[mediawikiwiki:Extension:Semantic_MediaWiki|Semantic MediaWiki]]
#[[mediawikiwiki:Extension:Header_Tabs|HeaderTabs]]
#[[mediawikiwiki:Extension:SubPageList|SubPageList]]

==Macro check==
On the BlueSpice website, you can use a [https://bluespice.com/confluence-migration-process/#confluence-migration-input-desktop macro check] to see which Confluence macros are not automatically converted. If an important macro is marked as unsupported, the content can most likely still be transferred.
[[File:Confluence macro check.png|alt=Textarea for adding a list of macros (with step-by-step instructions)|center|thumb|650x650px|Macro check]]

== Not migrated ==
The following Confluence elements are excluded from the migration:

*User identities
*Comments
*Various macros
*Various layouts
*Blog posts
*Files in an area that cannot be assigned to a page

== Roadmap ==
# Provide Docker Container - Eases installation and allows for better automation
# Allow for parallel processing (ERM45405) - Speeds up conversion of large Confluence exports
# Migrate blogs posts to [[mw:Extension:SimpleBlogPage]] pages (ERM46628) - Additional content
# Migrate page comments to [[mw:Extension:CommentStreams]] threads (ERM46627) - Additional content
# Add support for historic page and file revisions (ERM35013) - Additional content

==More information==

*https://bluespice.com/migration-from-confluence-to-bluespice-mediawiki/
*https://bluespice.com/mediawiki-versus-confluence-not-a-question-of-features/

[[de:Confluence Migration]]
[[Category:Setup]]

Development

2026-02-23T16:19:05Z

Rvogel1: Created page with "This page contains information about how to set up a local development environment for BlueSpice. == Local development environment based on <code>bluespice-deploy</code> == A developer can use the default deployment stack and alter is to quickly set up a development environment. To do so, first clone the stack to your local machine and navigate into it: <syntaxhighlight lang="text"> git clone -b 5.2.x git@github.com:hallowelt/bluespic..."

Security:Security Advisories

2026-01-28T14:39:45Z

Rvogel1:

{| class="wikitable sortable" style="width:100%;"
! style="" |Release name
! style="" |Release date
! style="" |Title
! style="" |References
! style="" |Summary
!Severity
|-
|[[Security:Security Advisories/BSSA-2026-01|BSSA-2026-01]]
|2026-01-28
|Security vulnerability in BlueSpice Collabpads database container.
|[https://avd.aquasec.com/nvd/2025/cve-2025-14847 CVE-2025-14847]
|Read of uninitialized heap memory
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2025-07|BSSA-2025-07]]
|2025-12-10
|Security vulnerability in BlueSpice Search container.
|[https://avd.aquasec.com/nvd/2025/cve-2025-66516 CVE-2025-66516]
|XML Entity Injection
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2025-06|BSSA-2025-06]]
|2025-10-28
|Security vulnerabilities in various MediaWiki extensions that are actually part of the BlueSpice distribution
|[https://www.cve.org/CVERecord?id=CVE-2024-56171 CVE-2024-56171], [https://www.cve.org/CVERecord?id=CVE-2025-3277 CVE-2025-3277], [https://www.cve.org/CVERecord?id=CVE-2025-6965 CVE-2025-6965], [https://www.cve.org/CVERecord?id=CVE-2025-11173 CVE-2025-11173], [https://www.cve.org/CVERecord?id=CVE-2025-11175 CVE-2025-11175],
[https://www.cve.org/CVERecord?id=CVE-2025-53625 CVE-2025-53625],
[https://www.cve.org/CVERecord?id=CVE-2025-54370 CVE-2025-54370],
[https://www.cve.org/CVERecord?id=CVE-2025-54874 CVE-2025-54874],
[https://www.cve.org/CVERecord?id=CVE-2025-59839 CVE-2025-59839],
[https://www.cve.org/CVERecord?id=CVE-2025-61634 CVE-2025-61634],
[https://www.cve.org/CVERecord?id=CVE-2025-61635 CVE-2025-61635],
[https://www.cve.org/CVERecord?id=CVE-2025-61636 CVE-2025-61636],
[https://www.cve.org/CVERecord?id=CVE-2025-61637 CVE-2025-61637],
[https://www.cve.org/CVERecord?id=CVE-2025-61638 CVE-2025-61638],
[https://www.cve.org/CVERecord?id=CVE-2025-61639 CVE-2025-61639],
[https://www.cve.org/CVERecord?id=CVE-2025-61640 CVE-2025-61640],
[https://www.cve.org/CVERecord?id=CVE-2025-61641 CVE-2025-61641],
[https://www.cve.org/CVERecord?id=CVE-2025-61642 CVE-2025-61642],
[https://www.cve.org/CVERecord?id=CVE-2025-61643 CVE-2025-61643],
[https://www.cve.org/CVERecord?id=CVE-2025-61646 CVE-2025-61646],
[https://www.cve.org/CVERecord?id=CVE-2025-61652 CVE-2025-61652],
[https://www.cve.org/CVERecord?id=CVE-2025-61653 CVE-2025-61653],
[https://www.cve.org/CVERecord?id=CVE-2025-61655 CVE-2025-61655],
[https://www.cve.org/CVERecord?id=CVE-2025-61655 CVE-2025-61655],
[https://www.cve.org/CVERecord?id=CVE-2025-61656 CVE-2025-61656],
[https://www.cve.org/CVERecord?id=CVE-2025-61656 CVE-2025-61656],
[https://www.cve.org/CVERecord?id=CVE-2025-61657 CVE-2025-61657],
[https://www.cve.org/CVERecord?id=CVE-2025-7458 CVE-2025-7458]
|Denial Of Service,
Cross-Site Scripting (XSS),
Information Disclosure,
Bypass authn at content check,
Server-side Request Forgery,
Arbitrary Code Execution,
Memory Corruption,
Use-After-Free,
Arbitrary SQL Execution
| style="" class="col-red-bg" |High
|-
|[[Security:Security Advisories/BSSA-2025-05|BSSA-2025-05]]
|2025-09-19
|XSS in Extension:AtMentions, Extension:BlueSpiceAvatars, Extension:BlueSpiceWhoIsOnline and Extension:CognitiveProcessDesigner
|[https://www.cve.org/CVERecord?id=CVE-2025-46703 CVE-2025-46703], [https://www.cve.org/CVERecord?id=CVE-2025-48007 CVE-2025-48007], [https://www.cve.org/CVERecord?id=CVE-2025-57880 CVE-2025-57880], [https://www.cve.org/CVERecord?id=CVE-2025-58114 CVE-2025-58114]
|
| style="" class="col-orange-bg" |Medium
|-
|[[Security:Security Advisories/BSSA-2025-04|BSSA-2025-04]]
|2025-09-18
|Security vulnerabilities in services <code>bluespice/search</code>, <code>bluespice/formular</code> and <code>bluespice/wiki</code>
|[https://nvd.nist.gov/vuln/detail/CVE-2025-54988 CVE-2025-54988], [https://avd.aquasec.com/nvd/2025/cve-2025-7783 CVE-2025-7783], [https://avd.aquasec.com/nvd/cve-2025-58050 CVE-2025-58050], [https://avd.aquasec.com/nvd/cve-2025-49794 CVE-2025-49794], [https://avd.aquasec.com/nvd/cve-2025-49796 CVE-2025-49796]
|Denial-of-Service, Information Disclosure
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2025-03|BSSA-2025-03]]
|2025-07-28
|Security vulnerabilities in Extension:Scribunto, Extension:TabberNeue, Extension:TwoColConflict and Extension:Quiz
|[https://www.cve.org/CVERecord?id=CVE-2025-53501 CVE-2025-53501], [https://www.cve.org/CVERecord?id=CVE-2025-53494 CVE-2025-53494], [https://www.cve.org/CVERecord?id=CVE-2025-53093 CVE-2025-53093], [https://www.cve.org/CVERecord?id=CVE-2025-7057 CVE-2025-7057]
|Information Disclosure,
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2025-02|BSSA-2025-02]]
| style="" |2025-04-17
| style="" |Security vulnerabilities in Extension:OAuth
| style="" |[https://www.cve.org/CVERecord?id=CVE-2025-32068 CVE-2025-32068], [https://www.cve.org/CVERecord?id=CVE-2025-32074 CVE-2025-32074]
| style="" |Allows unauthorized access to the wiki, Cross-Site Scripting (XSS)
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2025-01|BSSA-2025-01]]
| style="" |2025-01-20
| style="" |Security vulnerabilities in Extension:DataTransfer
| style="" |[https://www.cve.org/CVERecord?id=CVE-2025-23081 CVE-2025-23081]
| style="" |Allows Cross Site Request Forgery, Cross-Site Scripting (XSS)
| style="" class="col-orange-bg" |Medium
|-
|[[Security:Security Advisories/BSSA-2023-02|BSSA-2023-02]]
|2023-10-30
|Security vulnerabilities in Extension:BlueSpiceAvatars
|[https://www.cve.org/cverecord?id=CVE-2023-42431 CVE-2023-42431]
|Allows Cross-Site Scripting (XSS)
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2023-01|BSSA-2023-01]]
| style="" |2023-07-25
| style="" |Ghostscript vulnerability
| style="" |[https://www.cve.org/CVERecord?id=CVE-2023-36664 CVE-2023-36664]
| style="" |Code can be executed on the server via a manipulated PDF
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2022-08|BSSA-2022-08]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-3895 CVE-2022-3895]
| style="" |Arbitrary HTML injection through use of interface elements
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2022-07|BSSA-2022-07]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-3958 CVE-2022-3958]
| style="" |Arbitrary HTML injection through personal menu items
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2022-06|BSSA-2022-06]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-3893 CVE-2022-3893]
| style="" |Arbitrary HTML injection through the custom menu
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2022-05|BSSA-2022-05]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-42001 CVE-2022-42001]
| style="" |Arbitrary HTML injection through the book navigation
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2022-04|BSSA-2022-04]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-41789 CVE-2022-41789], [https://www.cve.org/CVERecord?id=CVE-2022-41814 CVE-2022-41814], [https://www.cve.org/CVERecord?id=CVE-2022-42000 CVE-2022-42000]
| style="" |Arbitrary HTML injection through user preferences
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2022-03|BSSA-2022-03]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-41611 CVE-2022-41611]
| style="" |Arbitrary HTML injection through main navigation
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2022-02|BSSA-2022-02]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-2511 CVE-2022-2511]
| style="" |Arbitrary HTML injection through the 'title' parameter
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2022-01|BSSA-2022-01]]
| style="" |2022-01-31
| style="" |XSS attack vector in Search Center
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-2510 CVE-2022-2510]
| style="" |JavaScript in search field is reflected back to the browser.
| style="" class="col-orange-bg" |Medium
|}

Security:Security Advisories/BSSA-2026-01

2026-01-28T14:32:17Z

Rvogel1:

{| class="wikitable"
|+
!
!
|-
|Date
|2026-01-29
|-
|Severity
|reported "high", BlueSpice assessment: '''low'''
|-
|Affected
| Services in current LTS version < 5.1.4
|-
|Fixed in
|5.2.1, 5.1.5
|-
|CVE
| [https://avd.aquasec.com/nvd/2025/cve-2025-14847 CVE-2025-14847]
|}

==Problem==
* Service <code>collabpads-database</code> (image name: <code>mongo</code> ) - [https://avd.aquasec.com/nvd/2025/cve-2025-14847 CVE-2025-14847]

==Impact assessment==
* Service <code>collabpads-database</code> (image name: <code>mongo</code> )
** A unauthenticated MongoDB client can attack the service if reachable. By default BlueSpice setup, the service runs only in the background and can not be accessed from outside the virtual network. So not even unauthenticated access is possible from any external location.

== Solution ==
To mitigate <code>CVE-2025-14847</code> use one of the following options:

# Make sure the service has no access to the internet. This is the default configuration of BlueSpice setups.
# Update the <code>mongo</code> docker image via BlueSpice's deploy tool: <code>bluespice-deploy pull collabpads-database && bluespice-deploy up -d</code>
# Update to version >=5.1.5 or >=5.2.1 of the BlueSpice images

Setup:Installation Guide/Docker

2026-01-22T14:02:42Z

Rvogel1:

== Overview ==
Starting with version 4.5, BlueSpice MediaWiki can be installed with a stack of Docker container images.

Everything is built in a modular way to allow different types of setups.

The most common cases are:
# "All-in-one" (with and without Let's Encrypt)
# Custom database and search service
# Custom load balancer / proxy

== Architecture ==
<drawio filename="Setup:Installation_Guide_Docker-Achitecture" alt="Diagram of BlueSpice Docker Stack Architecture" />

'''Notes'''
* Internal HTTP connections may use non-standard ports. Those are noted next to the respective services.
** HTTP (in-secure) is only used for internal communication within the virtual network the stack is operated in. All connections to the client use TLS.
* Proprietary ports (esp. for database connections) are noted next to the respective services.
* There may be additional services and ports in use, based on the setup. Some examples:
** When using LDAP based authentication an LDAPS connection (port <code>636</code>) is used from the <code>bluespice/wiki</code> containers to the LDAP-Server
** When using Kerberos authentication, a connection (port <code>88</code>) is used from the <code>bluespice/kerberos-proxy</code> containers to the Kerberos-Server
** When using DeepL or OpenAI services, a HTTPS connection (port <code>443</code>) is used from the <code>bluespice/wiki</code> containers to to the respective service
** When using OpenIDConnect authentication, a HTTPS connection (port <code>443</code>) is used from the <code>bluespice/wiki</code> "task" container to to the authentication provider
** When using "Let's Encrypt" Certbot, a HTTPS connection (port <code>443</code>) is used from the <code>acme-companion</code> container to the "Let's Encrypt" service

== Step 1: Get the stack ==
Load project <code>bluespice-deploy</code> from https://github.com/hallowelt/bluespice-deploy/releases/latest and enter the sub-directory <code>compose</code> for Docker Compose files.

For example, run:
<syntaxhighlight lang=sh>
wget https://github.com/hallowelt/bluespice-deploy/archive/refs/tags/5.2.1.zip \
&& unzip 5.2.1.zip \
&& cd bluespice-deploy-5.2.1/compose
</syntaxhighlight>

The directory contains the following files:
{| class="wikitable"
|+
! style="width:375px;" |Filename
! style="" |Type
! style="" |Comment
|-
| style="width:375px;" |<code>bluespice-deploy</code>
| style="" |shell script
| style="" |Start-up script, wrapping command <code>docker compose</code> and service <code>yml</code> files.<br>Additional service <code>yml</code> files can be loaded by adding <code>-f <filename> </code>.
|-
| style="width:375px;" |<code>docker-compose.main.yml</code>
| style="" |yml
| style="" |Main containers of the wiki (<code>wiki-web</code> and <code>wiki-task</code>).
|-
| style="width:375px;" |<code>docker-compose.persistent-data-services.yml</code>
| style="" |yml
| style="" |Containers of database and search services, storing persistent data onto the file system.<br />Optionally with external MySQL/MariaDB and OpenSearch one can skip loading this <code>.yml</code> in <code>bluespice-deploy</code>. Please then wire your services properly in the <code>.env</code> file.
|-
| style="width:375px;" |<code>docker-compose.stateless-services.yml</code>
| style="" |yml
| style="" |Containers for caching, PDF rendering, formula-rendering and diagram editing.
|-
| style="width:375px;" |<code>docker-compose.helper-service.yml</code>
| style="" |yml
| style="" |Helper containers for file system preparation and automated BlueSpice upgrade.<br>These containers exit automatically after finishing tasks.
|-
| style="width:375px;" |<code>docker-compose.proxy.yml</code>
| style="" |yml
| style="" |Container of proxy service. Can be replaced by existing proxy/load-balancer infrastructure.
|-
| style="width:375px;" |<code>docker-compose.proxy-letsencrypt.yml</code>
| style="" |yml
| style="" |Additional service for auto-renewal of "Let's Encrypt" certificates.<br>Only required when using the Let's Encrypt service and having no other TLS termination.
|-
| style="width:375px;" |<code>docker-compose.kerberos-proxy.yml</code>
| style="" |yml
| style="" |Additional proxy for Kerberos based authentication.
|-
| style="width:375px;" |<code>docker-compose.collabpads-service.yml</code>
|yml
|Containers of back-end services for [[Manual:Extension/CollabPads|CollabPads]] (included in Pro and Farm editions).
|-
| style="width:375px;" |<code>.env.sample</code>
| style="" |text
| style="" |Sample for creating <code>.env</code> that defines key environment variables.
|-
| style="width:375px;" |<code>bluespice.service.demo</code>
| style="" |service script
| style="" |Demo-file for control the BlueSpice stack as a <code>systemctl</code> service.<br>One can create e.g a <code>/etc/systemd/system/bluespice.service</code>.
|}

== Step 2: Set up environment variables ==
Create your <code>.env</code> based on the sample file <code>.env.sample</code>.

Example:
<pre>
# set or use your data directory
DATADIR=/data/bluespice
VERSION=5.1.3
EDITION=free
BACKUP_HOUR=04

WIKI_NAME=BlueSpice
WIKI_LANG=en
WIKI_PASSWORDSENDER=no-reply@wiki.company.local
WIKI_EMERGENCYCONTACT=no-reply@wiki.company.local
WIKI_HOST=wiki.company.local
WIKI_PORT=443
WIKI_PROTOCOL=https
WIKI_BASE_PATH=

DB_USER=set_or_use_your_db_user_name
DB_PASS=SET_OR_USE_YOUR_DB_PASS_WORD
DB_ROOT_USER=root
DB_ROOT_PASS=$DB_PASS
DB_HOST=database
DB_NAME=bluespice
DB_PREFIX=

SMTP_HOST=mail.company.local
SMTP_PORT=25
SMTP_USER=...
SMTP_PASS=...
SMTP_ID_HOST=...

LETSENCRYPT=false
</pre>
{{Textbox|boxtype=note|header=Different editions|text=This config works for all editions, but the main image of Pro or Farm edition needs to be obtained differently, see [[{{FULLPAGENAME}}/Pro and Farm edition|Pro and Farm edition]]|icon=yes}}

== Step 3: Start the stack ==
Use <code>bluespice-deploy up -d</code> to start the stack. Once all containers are shown as "ready" you can navigate to <code>$WIKI_PROTOCOL://$WIKI_HOST:$WIKI_PORT</code> (e.g. <code><nowiki>https://wiki.company.local</nowiki></code>) in your preferred web browser and start using the application.

When starting the stack the first time, the <code>wiki-task</code> container will automatically perform the installation. It may take a couple of minutes for the process to set up the database and complete. Once it is finished, the password for the default <code>Admin</code> user can be found in <code>$DATADIR/wiki/initialAdminPassword</code>.

== Additional options ==

=== Add Customizations to containers ===
Starting with bluespice-deploy 5.1.4 and 5.2.0 Branches, we allow to edit and maintan a separate <code>docker-compose.override,yml</code> which will be ignored by git.

This way you can add your own Container-Configurations and be able to maintain your git status up to date. just place the file next to the other docker-compose.*.ymls and run ./bluespice-deploy up -d

Example:<syntaxhighlight lang="yaml">
services:
wiki-web:
volumes:
- /backup/:/data/backup
wiki-task:
volumes:
- /backup/:/data/backup
</syntaxhighlight>

=== Configs for <code>LocalSettings.php</code> ===
Instead of exposing the <code>LocalSettings.php</code> for [[mediawikiwiki:Manual:LocalSettings.php|adding additional configurations]], the stack offers two entry points. After the initial installation, you can add your configs to two files in <code>${DATADIR}/wiki/bluespice/</code>:

* <code>pre-init-settings.php</code> - Set configs before the initialization of BlueSpice's debug logging, libraries, skins, extensions and default settings. Configs set here can be picked up by the init process.
* <code>post-init-settings.php</code> - Set configs after the initialization, manipulating configs that have been set by the init process.
For example, if you add the following lines to <code>pre-init-settings.php</code>, you can then read outputted debug logs (if any) in <code>${DATADIR}/wiki/bluespice/logs/debug.log</code>:<syntaxhighlight lang="php">
$GLOBALS['bsgDebugLogGroups']['exception'] = "/data/bluespice/logs/debug.log";
$wgShowExceptionDetails = true;
</syntaxhighlight>

=== Maintenance scripts ===
To run [[Setup:Installation Guide/Advanced/Maintenance scripts|maintenance scripts]] from MediaWiki or from other extensions, please use the <code>wiki-task</code> container, which handles all back-end jobs and processes. You can connect into the container in two different ways:

* run <code>./bluespice-deploy exec -it wiki-task bash</code> in the <code>compose</code> directory for Docker Compose files
* or alternatively, run <code>docker exec -it bluespice-wiki-task bash</code> wherever you are on the host machine

Inside the container you can enter the wiki's code base with <code>cd /app/bluespice/w</code> , where one can run scripts like <code>php maintenance/run.php update --quick</code>, <code>php extensions/BlueSpiceExtendedSearch/maintenance/updateWikiPageIndex.php</code> and so on.

=== SSL certificates ===
To use a Let's Encrypt certificate for your domain name, set <code>LETSENCRYPT=true</code> in your <code>.env</code> file.

To use a self-signend certificate for your domain name, put its <code>.crt</code> and <code>.key</code> files in <code>${DATADIR}/proxy/certs</code>. For example, with <code>wiki.company.local</code> you should prepare <code>wiki.company.local.crt</code> and <code>wiki.company.local.key</code> files.

=== Kerberos proxy ===
For implicit authentication using Kerberos, an additional proxy must be used: <code>bluespice/kerberos-proxy</code> . The file <code>docker-compose.kerberos-proxy.yml</code> contains a common configuration. It can be used '''instead of''' the regular <code>docker-compose.proxy.yml</code> file inside <code>bluespice-deploy</code> .

Make sure to have the files

* <code>${DATADIR}/kerberos/krb5.conf</code>
* <code>${DATADIR}/kerberos/kerberos.keytab</code>

set up properly.

The file <code>${DATADIR}/wiki/bluespice/pre-init-settings.php</code> can then be used to set up [[mediawikiwiki:LDAP_hub|"Extension:Auth_remoteuser" and the LDAP stack extensions]].

=== SAML authentication ===
During the initial installation a certificate for message signing will automatically be created. It can be found in <code>${DATADIR}/wiki/simplesamlphp/certs/</code>.

In order to configure a remote IdP, one must copy the IdP metadata XML to a file called <code>${DATADIR}/wiki/simplesamlphp/saml_idp_metadata.xml</code>. The SP metadata can then be obtained via <code><nowiki>https://{{$WIKI_HOST}}/_sp/module.php/saml/sp/metadata.php/default-sp</nowiki></code>. It must be configured in the remote IdP.

{{Textbox
|boxtype=tip
|header=Test authentication
|text= You can test authentication directly within the SimpleSAMLphp application. To do so, navigate to <code><nowiki>https://{{$WIKI_HOST}}/_sp/module.php/admin</nowiki></code> and log in with <code>admin</code> and the <code>INTERNAL_SIMPLESAMLPHP_ADMIN_PASS</code> found in <code>${DATADIR}/wiki/.wikienv</code>
|icon=yes
}}

Next, the extensions "PluggableAuth" and "SimpleSAMLphp" must be enabled on the wiki. To do so, add

<syntaxhighlight lang="php">
wfLoadExtensions( [
'PluggableAuth',
'SimpleSAMLphp'
] );
</syntaxhighlight>[[File:Setup:SAML ConfigManager EN 01.png|thumb|300x300px]]to the <code>${DATADIR}/wiki/bluespice/post-init-settings.php</code>. Run

./bluespice-deploy exec wiki-task /app/bluespice/w/maintenance/update.php --quick

to complete the installation.

After that, the authentication plugin configuration can be applied in [[Manual:Extension/BlueSpiceConfigManager|Special:BlueSpiceConfigManager]] under "Authentication".

=== OpenID Connect authentication ===

The extensions "PluggableAuth" and "OpenIDConnect" must be enabled on the wiki. To do so, add<syntaxhighlight lang="php">
wfLoadExtensions( [
'PluggableAuth',
'OpenIDConnect'
] );
</syntaxhighlight>to the <code>${DATADIR}/wiki/bluespice/post-init-settings.php</code>. Run

./bluespice-deploy exec wiki-task /app/bluespice/w/maintenance/update.php --quick

to complete the installation.

After that, the authentication plugin configuration can be applied in [[Manual:Extension/BlueSpiceConfigManager|Special:BlueSpiceConfigManager]] under "Authentication".

[[de:Setup:Installationsanleitung/Docker]]

Setup:Installation Guide/Docker

2026-01-22T14:00:52Z

Rvogel1:

== Overview ==
Starting with version 4.5, BlueSpice MediaWiki can be installed with a stack of Docker container images.

Everything is built in a modular way to allow different types of setups.

The most common cases are:
# "All-in-one" (with and without Let's Encrypt)
# Custom database and search service
# Custom load balancer / proxy

== Architecture ==
<drawio filename="Setup:Installation_Guide_Docker-Achitecture" alt="Diagram of BlueSpice Docker Stack Architecture" />

'''Notes'''
* Internal HTTP connections may use non-standard ports. Those are noted next to the respective services.
** HTTP (in-secure) is only used for internal communication within the virtual network the stack is operated in. All connections to the client use TLS.
* Proprietary ports (esp. for database connections) are noted next to the respective services.
* There may be additional services and ports in use, based on the setup. Some examples:
** When using LDAP based authentication an LDAPS connection (port <code>636</code>) is used from the <code>bluespice/wiki</code> containers to the LDAP-Server
** When using Kerberos authentication, a connection (port <code>88</code>) is used from the <code>bluespice/kerberos-proxy</code> containers to the Kerberos-Server
** When using DeepL or OpenAI services, a HTTPS connection (port <code>443</code>) is used from the <code>bluespice/wiki</code> containers to to the respective service
** When using OpenIDConnect authentication, a HTTPS connection (port <code>443</code>) is used from the <code>bluespice/wiki</code> "task" container to to the authentication provider
** When using "Let's Encrypt" Certbot, a HTTPS connection (port <code>443</code>) is used from the <code>acme-companion</code> container to the "Let's Encrypt" service

== Step 1: Get the stack ==
Load project <code>bluespice-deploy</code> from https://github.com/hallowelt/bluespice-deploy/releases/latest and enter the sub-directory <code>compose</code> for Docker Compose files.

For example, run:
<syntaxhighlight lang=sh>
wget https://github.com/hallowelt/bluespice-deploy/archive/refs/tags/5.2.1.zip \
&& unzip 5.2.1.zip \
&& cd bluespice-deploy-5.2.1/compose
</syntaxhighlight>

The directory contains the following files:
{| class="wikitable"
|+
! style="width:375px;" |Filename
! style="" |Type
! style="" |Comment
|-
| style="width:375px;" |<code>bluespice-deploy</code>
| style="" |shell script
| style="" |Start-up script, wrapping command <code>docker compose</code> and service <code>yml</code> files.<br>Additional service <code>yml</code> files can be loaded by adding <code>-f <filename> </code>.
|-
| style="width:375px;" |<code>docker-compose.main.yml</code>
| style="" |yml
| style="" |Main containers of the wiki (<code>wiki-web</code> and <code>wiki-task</code>).
|-
| style="width:375px;" |<code>docker-compose.persistent-data-services.yml</code>
| style="" |yml
| style="" |Containers of database and search services, storing persistent data onto the file system.<br />Optionally with external MySQL/MariaDB and OpenSearch one can skip loading this <code>.yml</code> in <code>bluespice-deploy</code>. Please then wire your services properly in the <code>.env</code> file.
|-
| style="width:375px;" |<code>docker-compose.stateless-services.yml</code>
| style="" |yml
| style="" |Containers for caching, PDF rendering, formula-rendering and diagram editing.
|-
| style="width:375px;" |<code>docker-compose.helper-service.yml</code>
| style="" |yml
| style="" |Helper containers for file system preparation and automated BlueSpice upgrade.<br>These containers exit automatically after finishing tasks.
|-
| style="width:375px;" |<code>docker-compose.proxy.yml</code>
| style="" |yml
| style="" |Container of proxy service. Can be replaced by existing proxy/load-balancer infrastructure.
|-
| style="width:375px;" |<code>docker-compose.proxy-letsencrypt.yml</code>
| style="" |yml
| style="" |Additional service for auto-renewal of "Let's Encrypt" certificates.<br>Only required when using the Let's Encrypt service and having no other TLS termination.
|-
| style="width:375px;" |<code>docker-compose.kerberos-proxy.yml</code>
| style="" |yml
| style="" |Additional proxy for Kerberos based authentication.
|-
| style="width:375px;" |<code>docker-compose.collabpads-service.yml</code>
|yml
|Containers of back-end services for [[Manual:Extension/CollabPads|CollabPads]] (included in Pro and Farm editions).
|-
| style="width:375px;" |<code>.env.sample</code>
| style="" |text
| style="" |Sample for creating <code>.env</code> that defines key environment variables.
|-
| style="width:375px;" |<code>bluespice.service.demo</code>
| style="" |service script
| style="" |Demo-file for control the BlueSpice stack as a <code>systemctl</code> service.<br>One can create e.g a <code>/etc/systemd/system/bluespice.service</code>.
|}

== Step 2: Set up environment variables ==
Create your <code>.env</code> based on the sample file <code>.env.sample</code>.

Example:
<pre>
# set or use your data directory
DATADIR=/data/bluespice
VERSION=5.1.3
EDITION=free
BACKUP_HOUR=04

WIKI_NAME=BlueSpice
WIKI_LANG=en
WIKI_PASSWORDSENDER=no-reply@wiki.company.local
WIKI_EMERGENCYCONTACT=no-reply@wiki.company.local
WIKI_HOST=wiki.company.local
WIKI_PORT=443
WIKI_PROTOCOL=https
WIKI_BASE_PATH=

DB_USER=set_or_use_your_db_user_name
DB_PASS=SET_OR_USE_YOUR_DB_PASS_WORD
DB_ROOT_USER=root
DB_ROOT_PASS=$DB_PASS
DB_HOST=database
DB_NAME=bluespice
DB_PREFIX=

SMTP_HOST=mail.company.local
SMTP_PORT=25
SMTP_USER=...
SMTP_PASS=...
SMTP_ID_HOST=...

LETSENCRYPT=false
</pre>
{{Textbox|boxtype=note|header=Different editions|text=This config works for all editions, but the main image of Pro or Farm edition needs to be obtained differently, see [[{{FULLPAGENAME}}/Pro and Farm edition|Pro and Farm edition]]|icon=yes}}

== Step 3: Start the stack ==
Use <code>bluespice-deploy up -d</code> to start the stack. Once all containers are shown as "ready" you can navigate to <code>$WIKI_PROTOCOL://$WIKI_HOST:$WIKI_PORT</code> (e.g. <code><nowiki>https://wiki.company.local</nowiki></code>) in your preferred web browser and start using the application.

When starting the stack the first time, the <code>wiki-task</code> container will automatically perform the installation. It may take a couple of minutes for the process to set up the database and complete. Once it is finished, the password for the default <code>Admin</code> user can be found in <code>$DATADIR/wiki/initialAdminPassword</code>.

== Additional options ==

=== Add Customizations to containers ===
Starting with bluespice-deploy 5.1.4 and 5.2.0 Branches, we allow to edit and maintan a separate <code>docker-compose.override,yml</code> which will be ignored by git.

This way you can add your own Container-Configurations and be able to maintain your git status up to date. just place the file next to the other docker-compose.*.ymls and run ./bluespice-deploy up -d

Example:<syntaxhighlight lang="yaml">
services:
wiki-web:
volumes:
- /code/extensions/X:/app/bluespice/w/extensions/X
- /backup/:/data/backup
wiki-task:
volumes:
- /backup/:/data/backup
- /code/extensions/X:/app/bluespice/w/extensions/X
</syntaxhighlight>

=== Configs for <code>LocalSettings.php</code> ===
Instead of exposing the <code>LocalSettings.php</code> for [[mediawikiwiki:Manual:LocalSettings.php|adding additional configurations]], the stack offers two entry points. After the initial installation, you can add your configs to two files in <code>${DATADIR}/wiki/bluespice/</code>:

* <code>pre-init-settings.php</code> - Set configs before the initialization of BlueSpice's debug logging, libraries, skins, extensions and default settings. Configs set here can be picked up by the init process.
* <code>post-init-settings.php</code> - Set configs after the initialization, manipulating configs that have been set by the init process.
For example, if you add the following lines to <code>pre-init-settings.php</code>, you can then read outputted debug logs (if any) in <code>${DATADIR}/wiki/bluespice/logs/debug.log</code>:<syntaxhighlight lang="php">
$GLOBALS['bsgDebugLogGroups']['exception'] = "/data/bluespice/logs/debug.log";
$wgShowExceptionDetails = true;
</syntaxhighlight>

=== Maintenance scripts ===
To run [[Setup:Installation Guide/Advanced/Maintenance scripts|maintenance scripts]] from MediaWiki or from other extensions, please use the <code>wiki-task</code> container, which handles all back-end jobs and processes. You can connect into the container in two different ways:

* run <code>./bluespice-deploy exec -it wiki-task bash</code> in the <code>compose</code> directory for Docker Compose files
* or alternatively, run <code>docker exec -it bluespice-wiki-task bash</code> wherever you are on the host machine

Inside the container you can enter the wiki's code base with <code>cd /app/bluespice/w</code> , where one can run scripts like <code>php maintenance/run.php update --quick</code>, <code>php extensions/BlueSpiceExtendedSearch/maintenance/updateWikiPageIndex.php</code> and so on.

=== SSL certificates ===
To use a Let's Encrypt certificate for your domain name, set <code>LETSENCRYPT=true</code> in your <code>.env</code> file.

To use a self-signend certificate for your domain name, put its <code>.crt</code> and <code>.key</code> files in <code>${DATADIR}/proxy/certs</code>. For example, with <code>wiki.company.local</code> you should prepare <code>wiki.company.local.crt</code> and <code>wiki.company.local.key</code> files.

=== Kerberos proxy ===
For implicit authentication using Kerberos, an additional proxy must be used: <code>bluespice/kerberos-proxy</code> . The file <code>docker-compose.kerberos-proxy.yml</code> contains a common configuration. It can be used '''instead of''' the regular <code>docker-compose.proxy.yml</code> file inside <code>bluespice-deploy</code> .

Make sure to have the files

* <code>${DATADIR}/kerberos/krb5.conf</code>
* <code>${DATADIR}/kerberos/kerberos.keytab</code>

set up properly.

The file <code>${DATADIR}/wiki/bluespice/pre-init-settings.php</code> can then be used to set up [[mediawikiwiki:LDAP_hub|"Extension:Auth_remoteuser" and the LDAP stack extensions]].

=== SAML authentication ===
During the initial installation a certificate for message signing will automatically be created. It can be found in <code>${DATADIR}/wiki/simplesamlphp/certs/</code>.

In order to configure a remote IdP, one must copy the IdP metadata XML to a file called <code>${DATADIR}/wiki/simplesamlphp/saml_idp_metadata.xml</code>. The SP metadata can then be obtained via <code><nowiki>https://{{$WIKI_HOST}}/_sp/module.php/saml/sp/metadata.php/default-sp</nowiki></code>. It must be configured in the remote IdP.

{{Textbox
|boxtype=tip
|header=Test authentication
|text= You can test authentication directly within the SimpleSAMLphp application. To do so, navigate to <code><nowiki>https://{{$WIKI_HOST}}/_sp/module.php/admin</nowiki></code> and log in with <code>admin</code> and the <code>INTERNAL_SIMPLESAMLPHP_ADMIN_PASS</code> found in <code>${DATADIR}/wiki/.wikienv</code>
|icon=yes
}}

Next, the extensions "PluggableAuth" and "SimpleSAMLphp" must be enabled on the wiki. To do so, add

<syntaxhighlight lang="php">
wfLoadExtensions( [
'PluggableAuth',
'SimpleSAMLphp'
] );
</syntaxhighlight>[[File:Setup:SAML ConfigManager EN 01.png|thumb|300x300px]]to the <code>${DATADIR}/wiki/bluespice/post-init-settings.php</code>. Run

./bluespice-deploy exec wiki-task /app/bluespice/w/maintenance/update.php --quick

to complete the installation.

After that, the authentication plugin configuration can be applied in [[Manual:Extension/BlueSpiceConfigManager|Special:BlueSpiceConfigManager]] under "Authentication".

=== OpenID Connect authentication ===

The extensions "PluggableAuth" and "OpenIDConnect" must be enabled on the wiki. To do so, add<syntaxhighlight lang="php">
wfLoadExtensions( [
'PluggableAuth',
'OpenIDConnect'
] );
</syntaxhighlight>to the <code>${DATADIR}/wiki/bluespice/post-init-settings.php</code>. Run

./bluespice-deploy exec wiki-task /app/bluespice/w/maintenance/update.php --quick

to complete the installation.

After that, the authentication plugin configuration can be applied in [[Manual:Extension/BlueSpiceConfigManager|Special:BlueSpiceConfigManager]] under "Authentication".

[[de:Setup:Installationsanleitung/Docker]]

Security:Security Advisories

2025-12-08T15:43:40Z

Rvogel1:

{| class="wikitable sortable" style="width:100%;"
! style="" |Release name
! style="" |Release date
! style="" |Title
! style="" |References
! style="" |Summary
!Severity
|-
|[[Security:Security Advisories/BSSA-2025-06|BSSA-2025-06]]
|2025-10-28
|Security vulnerabilities in various MediaWiki extensions that are actually part of the BlueSpice distribution
|[https://www.cve.org/CVERecord?id=CVE-2024-56171 CVE-2024-56171], [https://www.cve.org/CVERecord?id=CVE-2025-3277 CVE-2025-3277], [https://www.cve.org/CVERecord?id=CVE-2025-6965 CVE-2025-6965], [https://www.cve.org/CVERecord?id=CVE-2025-11173 CVE-2025-11173], [https://www.cve.org/CVERecord?id=CVE-2025-11175 CVE-2025-11175],
[https://www.cve.org/CVERecord?id=CVE-2025-53625 CVE-2025-53625],
[https://www.cve.org/CVERecord?id=CVE-2025-54370 CVE-2025-54370],
[https://www.cve.org/CVERecord?id=CVE-2025-54874 CVE-2025-54874],
[https://www.cve.org/CVERecord?id=CVE-2025-59839 CVE-2025-59839],
[https://www.cve.org/CVERecord?id=CVE-2025-61634 CVE-2025-61634],
[https://www.cve.org/CVERecord?id=CVE-2025-61635 CVE-2025-61635],
[https://www.cve.org/CVERecord?id=CVE-2025-61636 CVE-2025-61636],
[https://www.cve.org/CVERecord?id=CVE-2025-61637 CVE-2025-61637],
[https://www.cve.org/CVERecord?id=CVE-2025-61638 CVE-2025-61638],
[https://www.cve.org/CVERecord?id=CVE-2025-61639 CVE-2025-61639],
[https://www.cve.org/CVERecord?id=CVE-2025-61640 CVE-2025-61640],
[https://www.cve.org/CVERecord?id=CVE-2025-61641 CVE-2025-61641],
[https://www.cve.org/CVERecord?id=CVE-2025-61642 CVE-2025-61642],
[https://www.cve.org/CVERecord?id=CVE-2025-61643 CVE-2025-61643],
[https://www.cve.org/CVERecord?id=CVE-2025-61646 CVE-2025-61646],
[https://www.cve.org/CVERecord?id=CVE-2025-61652 CVE-2025-61652],
[https://www.cve.org/CVERecord?id=CVE-2025-61653 CVE-2025-61653],
[https://www.cve.org/CVERecord?id=CVE-2025-61655 CVE-2025-61655],
[https://www.cve.org/CVERecord?id=CVE-2025-61655 CVE-2025-61655],
[https://www.cve.org/CVERecord?id=CVE-2025-61656 CVE-2025-61656],
[https://www.cve.org/CVERecord?id=CVE-2025-61656 CVE-2025-61656],
[https://www.cve.org/CVERecord?id=CVE-2025-61657 CVE-2025-61657],
[https://www.cve.org/CVERecord?id=CVE-2025-7458 CVE-2025-7458]
|Denial Of Service,
Cross-Site Scripting (XSS),
Information Disclosure,
Bypass authn at content check,
Server-side Request Forgery,
Arbitrary Code Execution,
Memory Corruption,
Use-After-Free,
Arbitrary SQL Execution
| style="" class="col-red-bg" |High
|-
|[[Security:Security Advisories/BSSA-2025-05|BSSA-2025-05]]
|2025-09-19
|XSS in Extension:AtMentions, Extension:BlueSpiceAvatars, Extension:BlueSpiceWhoIsOnline and Extension:CognitiveProcessDesigner
|[https://www.cve.org/CVERecord?id=CVE-2025-46703 CVE-2025-46703], [https://www.cve.org/CVERecord?id=CVE-2025-48007 CVE-2025-48007], [https://www.cve.org/CVERecord?id=CVE-2025-57880 CVE-2025-57880], [https://www.cve.org/CVERecord?id=CVE-2025-58114 CVE-2025-58114]
|
| style="" class="col-orange-bg" |Medium
|-
|[[Security:Security Advisories/BSSA-2025-04|BSSA-2025-04]]
|2025-09-18
|Security vulnerabilities in services <code>bluespice/search</code>, <code>bluespice/formular</code> and <code>bluespice/wiki</code>
|[https://nvd.nist.gov/vuln/detail/CVE-2025-54988 CVE-2025-54988], [https://avd.aquasec.com/nvd/2025/cve-2025-7783 CVE-2025-7783], [https://avd.aquasec.com/nvd/cve-2025-58050 CVE-2025-58050], [https://avd.aquasec.com/nvd/cve-2025-49794 CVE-2025-49794], [https://avd.aquasec.com/nvd/cve-2025-49796 CVE-2025-49796]
|Denial-of-Service, Information Disclosure
| style="" class="col-green-bg" |Low
|-
|[[Security:Security Advisories/BSSA-2025-03|BSSA-2025-03]]
|2025-07-28
|Security vulnerabilities in Extension:Scribunto, Extension:TabberNeue, Extension:TwoColConflict and Extension:Quiz
|[https://www.cve.org/CVERecord?id=CVE-2025-53501 CVE-2025-53501], [https://www.cve.org/CVERecord?id=CVE-2025-53494 CVE-2025-53494], [https://www.cve.org/CVERecord?id=CVE-2025-53093 CVE-2025-53093], [https://www.cve.org/CVERecord?id=CVE-2025-7057 CVE-2025-7057]
|Information Disclosure,
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2025-02|BSSA-2025-02]]
| style="" |2025-04-17
| style="" |Security vulnerabilities in Extension:OAuth
| style="" |[https://www.cve.org/CVERecord?id=CVE-2025-32068 CVE-2025-32068], [https://www.cve.org/CVERecord?id=CVE-2025-32074 CVE-2025-32074]
| style="" |Allows unauthorized access to the wiki, Cross-Site Scripting (XSS)
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2025-01|BSSA-2025-01]]
| style="" |2025-01-20
| style="" |Security vulnerabilities in Extension:DataTransfer
| style="" |[https://www.cve.org/CVERecord?id=CVE-2025-23081 CVE-2025-23081]
| style="" |Allows Cross Site Request Forgery, Cross-Site Scripting (XSS)
| style="" class="col-orange-bg" |Medium
|-
|[[Security:Security Advisories/BSSA-2023-02|BSSA-2023-02]]
|2023-10-30
|Security vulnerabilities in Extension:BlueSpiceAvatars
|[https://www.cve.org/cverecord?id=CVE-2023-42431 CVE-2023-42431]
|Allows Cross-Site Scripting (XSS)
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2023-01|BSSA-2023-01]]
| style="" |2023-07-25
| style="" |Ghostscript vulnerability
| style="" |[https://www.cve.org/CVERecord?id=CVE-2023-36664 CVE-2023-36664]
| style="" |Code can be executed on the server via a manipulated PDF
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2022-08|BSSA-2022-08]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-3895 CVE-2022-3895]
| style="" |Arbitrary HTML injection through use of interface elements
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2022-07|BSSA-2022-07]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-3958 CVE-2022-3958]
| style="" |Arbitrary HTML injection through personal menu items
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2022-06|BSSA-2022-06]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-3893 CVE-2022-3893]
| style="" |Arbitrary HTML injection through the custom menu
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2022-05|BSSA-2022-05]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-42001 CVE-2022-42001]
| style="" |Arbitrary HTML injection through the book navigation
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2022-04|BSSA-2022-04]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-41789 CVE-2022-41789], [https://www.cve.org/CVERecord?id=CVE-2022-41814 CVE-2022-41814], [https://www.cve.org/CVERecord?id=CVE-2022-42000 CVE-2022-42000]
| style="" |Arbitrary HTML injection through user preferences
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2022-03|BSSA-2022-03]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-41611 CVE-2022-41611]
| style="" |Arbitrary HTML injection through main navigation
| style="" class="col-green-bg" |Low
|-
| style="" |[[Security:Security Advisories/BSSA-2022-02|BSSA-2022-02]]
| style="" |2022-11-15
| style="" |XSS attack vector on regular pages
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-2511 CVE-2022-2511]
| style="" |Arbitrary HTML injection through the 'title' parameter
| style="" class="col-orange-bg" |Medium
|-
| style="" |[[Security:Security Advisories/BSSA-2022-01|BSSA-2022-01]]
| style="" |2022-01-31
| style="" |XSS attack vector in Search Center
| style="" |[https://www.cve.org/CVERecord?id=CVE-2022-2510 CVE-2022-2510]
| style="" |JavaScript in search field is reflected back to the browser.
| style="" class="col-orange-bg" |Medium
|}