Revision as of 07:31, 28 March 2018

Mahara is developed by a world-wide team of programmers, translators, designers and enthusiastic amateurs. Many individuals and groups have contributed to Mahara so far.

Core Teams

Community

Security researchers

Mahara code

This is a list of security researchers that have contributed to Mahara itself. These people have followed the responsible disclosure practise after finding security vulnerabilities in the Mahara codebase.

Aaron Barnes - @spastk
Abdullah Hussam Gazi - Facebook
Abhishek Dashora - Facebook
Ahmad Ashraff - @yappare
Ahmed Jerbi - Facebook
Ajay Singh Negi personal website - @ajaysinghnegi
Anurag Srivastava - @hexachordanu
C Vishnu Vardhan Reddy (Vishnu_dfx) - Facebook
chbi - personal website
陈瑞琦 (Chen Ruiqi) - team website
Dushyant Sahu
Dylan S. Hailey - @TibitXimer
Emanuel Bronshtein - @e3amn2l
FaisaL Ahmed - website
Hammad Mahmood - Facebook
Hamid Ashraf - @hamihax
Himanshu Kumar Das - @mehimansu
Jaume Llopis Pujal - @JKS___
Kamil Sevi - @kamilsevi
Kirtikumar Anandrao Ramchandani - Facebook
M.R.Vignesh Kumar - @vigneshkumarmr
Mahmut Esat Yildirim - website
Mike Haworth
Mushraf Mustafa - Facebook
Narendra Bhati (R00t Sh3ll), Web Security Geeks - @NarendraBhatiB
Nitin Goplani - LinkedIn
Prashant Negi - @prashantnegi_
Rafay Baloch - personal website
Roman Mironov - LinkedIn
SaifAllah benMassaoud - Facebook
Sajibe Kanti - Facebook
Saurabh Chandrakant Nemade - Facebook
Sergey Markov
Shekhar Suman - website
Siddhesh Gawde - Facebook
Tom Forbes - personal website
Vineet Kumar - Twitter
Wan Ikram - @rinakikun
Wen-Chang Chien (簡文章) - Launchpad
Yuji Tounai - @yousukezan
Zeeshan - Facebook

Mahara project infrastructure

This second list is of security researchers who have reported security issues with the configuration or version of software used on the infrastructure of the Mahara project which can include all the websites (mahara.org, wiki.mahara.org, manual.mahara.org, langpacks.mahara.org, reviews.mahara.org, git.mahara.org, test.mahara.org) and the servers that host those websites.

These people have followed the responsible disclosure practise after finding security vulnerabilities in the Mahara project infrastructure.

mahara.org vulnerable to the BEAST SSL/TLS attack
- Adam Ziaja (http://adamziaja.com)
A problem in the custom DuckDuckGo search setup on mahara.org
- David Vieira-Kurz of MajorSeurity - @secalert
mahara.org servers exposing web server version
- Emanuel Bronshtein - @e3amn2l
Directory listings active on wiki.mahara.org
- Parveen Yadav (https://www.facebook.com/proXy.test) & Ankit Bharathan
mahara.org vulnerable to the CCS SSL/TLS attack (https://www.openssl.org/news/secadv_20140605.txt)
- S. Venkatesh - @pranavvenkats
SHA-1 intermediate SSL certificates on some *.mahara.org sites
- Mohamed Chamli (https://www.facebook.com/TnMcH)
SPF not setup for @mahara.org email
- Ashesh Kumar (https://www.facebook.com/ashesh1708)
- Ketan Patil (http://www.infobittechnologies.com/)
SSL configuration on mahara.org still allowing TLSv1 128 bit RC4-SHA
- SaifAllah benMassaoud (https://www.facebook.com/WhiteHatSecuri)
SSL configuration on mahara.org still allowing TLS_RSA_WITH_RC4_128_SHA and TLS_ECDHE_RSA_WITH_RC4_128_SHA
- Shawar Khan (http://shawarkhan.com)
mahara.org printing full requested URL on error pages, which could potentially be part of a very weak phishing attack
- Girish Sp - @Girish0777
X-XSS-Protection header is not set (Bug report to improve security allaround)
- SaifAllah benMassaoud - Facebook
- Zeeshan - Facebook
SPF record for mahara.org breaks length limit
- Rohit Kumar - @rohittourister Facebook https://www.infooby.com
Some 301 redirects on mahara.org used Host field of HTTP request rather than hard-coded URL; potential for a cache poisoning attack
- Vikram Singh Rathore of Torrid Networks Pvt Ltd
Content spoofing on 404 page
- Taimoor Abid - Facebook
Strict-Transport-Security header was not set
- Kyaw Thiha - Linkedin
Extend spam protection with DMARC / DKIM
- Pal Patel - Facebook
Proxy protection to prevent bypassing of X-Frame-Options
- Mushraf Mustafa - Facebook
Set Certificate Authority Authorization
- Shwetabh Suman - Facebook
DNSSEC and Domain Registry Protection (DRP is not available for .org domains though)
- Kirtikumar Anandrao Ramchandani - Facebook
Preloading of HSTS and increasing max age for wiki.mahara.org
- Ratnadip Gajbhiye - Facebook
Password auto-complete enabled
- Kirtikumar Anandrao Ramchandani - Facebook
Host header attack on wiki.mahara.org
- Thrivikram Gujarathi - LinkedIn

Organizations

A large part of the development on Mahara would not be possible without the funding from institutions and organizations.

Mahara 18.04 (not yet released)

Mahara 17.10

Mahara 17.04

Mahara 16.10

Mahara 16.04

Mahara 15.10

Mahara 15.04

Mahara 15.04 was released on 17 April 2015.

Mahara 1.10

Mahara 1.10 was released on 21 October 2014.

Mahara 1.9

Mahara 1.9 was released on 15 April 2014.

Mahara 1.8

Mahara 1.8 was released on 24 October 2013.

Mahara 1.7

Mahara 1.7 was released on 19 April 2013.

Mahara 1.6

Mahara 1.6 was released on 17 April 2012.

Mahara 1.5

Mahara 1.5 was released on 13 June 2011.

Pre Mahara 1.5

The University of Glasgow have funded several pieces of work for us, including View Templates, part of Import/Export (the HTML export is thanks to them), and various bug fixes.

GLISI / Ray Merrill funded enhancements to Mahara's groups, and Ray has provided much invaluable guidance around Mahara's usability.

With JISC funding we were able to add import/export functionality to the Mahara e-portfolio system, as part of the 1.2 release. This work was sponsored by the University of London Computer Centre, University of Glasgow and JISC Cetis.

A collaborative group in the State of New Hampshire funded the ability to submit Mahara Views for assessment in Moodle, through a grant from the New Hampshire Department of Education.

Cambridge University School of Clinical Medicine sponsored the development of the plugin Problems & Conditions.

The BScE at the University of Luxembourg funded the development of the tag cloud, improvements to the feedback function in the 1.2 and 1.3 releases, and bug fixes for Mac servers.

Birmingham City University funded the initial development work for Collections and Plans (new features in Mahara 1.3). They also supported the development of locking down blog posts and files that are used in submitted views.

Lancaster University Network Services (LUNS Ltd.) was funded by Cumbria and Lancashire Education Online (CLEO) to design several features.

The New Zealand Ministry of Education funded a large number of features and usability changes to Mahara 1.4 and 1.5 that were implemented by Catalyst IT

@@ Line 33: / Line 33: @@
 * Dylan S. Hailey - [http://www.twitter.com/tibitximer @TibitXimer]
 * Emanuel Bronshtein - [https://twitter.com/e3amn2l @e3amn2l]
-* FaisaL Ahmed - [http://faisalahmed.me/ personal website]
+* FaisaL Ahmed - [http://faisalahmed.me/ website]
 * Hammad Mahmood - [http://facebook.com/hammad.mahmood.14019 Facebook]
 * Hamid Ashraf - [https://twitter.com/hamihax @hamihax]
@@ Line 41: / Line 41: @@
 * Kirtikumar Anandrao Ramchandani - [https://m.facebook.com/kirti.ar Facebook]
 * M.R.Vignesh Kumar - [https://twitter.com/vigneshkumarmr @vigneshkumarmr]
-* Mahmut Esat Yildirim - [http://www.mahmutesat.com personal website]
+* Mahmut Esat Yildirim - [http://www.mahmutesat.com website]
 * Mike Haworth
 * Mushraf Mustafa - [http://Facebook.com/mushrafmustafaofficial Facebook]
@@ Line 53: / Line 53: @@
 * Saurabh Chandrakant Nemade - [https://facebook.com/saurabh.nemade Facebook]
 * Sergey Markov
+* Shekhar Suman - [http://iosec.in/ website]
 * Siddhesh Gawde - [http://www.facebook.com/pen3t3r Facebook]
 * Tom Forbes - [http://tomforb.es personal website]

Contributors: Difference between revisions

From Mahara Wiki