MediaWiki 1.3.9 is a security and bug fix release.
A flaw in upload handling has been found which may allow upload and
execution of arbitrary scripts with the permissions of the web server.
Only wikis that have enabled uploads and have a vulnerable Apache
configuration will be affected, but to be safe all wikis should
upgrade.
Wikis with uploads available should either disable uploads or upgrade
to 1.3.9 immediately; if other files are customized and require merging
changes, includes/SpecialUpload.php may be replaced individually to add
the fix.
(It is also recommended to configure your web server to disable script
execution in the 'images' subdirectory where uploads are placed, which
prevents most attacks even if the wiki fails.)
Changes from 1.3.8:
* Backported "Templates used in this page"-feature of EditPage
* Allow "MySkin" as a default skin.
* (bug 938) Parse namespaces correctly on self-interwiki links
* (bug 1010) fix broken Commons image link on Classic & Cologne Blue
* (bug 1004) Norsk language names for interwiki links changed,
Nauruan language name changed
* Fix upload extension blacklist to protect against vulnerable
Apache configurations
Release notes:
http://sourceforge.net/project/shownotes.php?release_id=289468
Download:
http://prdownloads.sf.net/wikipedia/mediawiki-1.3.9.tar.gz?download
Wiki admin help mailing list:
http://mail.wikipedia.org/mailman/listinfo/mediawiki-l
Low-traffic release announcements mailing list:
http://mail.wikipedia.org/mailman/listinfo/mediawiki-announce
Bug report system:
http://bugzilla.wikipedia.org/
Play "stump the developers" live on IRC:
#mediawiki on irc.freenode.net
- -- brion vibber (brion @ pobox.com)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
MediaWiki 1.4beta3 is an experimental release, to help flush out
remaining major problems in the code prior to a final public 1.4.0
release. It is not recommended to use this beta on a public site unless
you're familiar with MediaWiki innards and are willing and able to help
diagnose and fix problems that come up.
Users of the earlier beta releases should upgrade as soon as possible,
particularly if uploads are enabled. A security vulnerability with
uploads on some Apache configurations has been fixed in this release.
=== Beta 3 fixes ===
* Hide RC patrol markers when patrol is disabled or not allowed to
patrol.
* Fix language selection for upgraded accounts
* (bug 1076) navigation links in QueryPage should be translated by
wgContLang.
* (bug 922) bogus DOS line endings in LanguageEl.php
* Fix index usage in contribs
* Caching and load limiting options for Recentchanges RSS/Atom feed
* (bug 1074) Add stock icons for non-image files in gallery/Newimages
* Add width and height attributes on thumbs in gallery/Newimages
* Enhance upload extension blacklist to protect against vulnerable
Apache configurations
Release notes:
http://sourceforge.net/project/shownotes.php?release_id=289469
Download:
http://prdownloads.sf.net/wikipedia/mediawiki-1.4beta3.tar.gz?download
Wiki admin help mailing list:
http://mail.wikipedia.org/mailman/listinfo/mediawiki-l
Low-traffic release announcements mailing list:
http://mail.wikipedia.org/mailman/listinfo/mediawiki-announce
Bug report system:
http://bugzilla.wikipedia.org/
Play "stump the developers" live on IRC:
#mediawiki on irc.freenode.net
- - -- brion vibber (brion @ pobox.com)
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (Darwin)
iD8DBQFBvNsRwRnhpk1wk44RAq4OAJ97aILWDHXV8b4jMbJNrHWvbsiG6wCfQjVS
Y3FFGLESXFkLUfmHsDK8J4Q=
=g/qo
-----END PGP SIGNATURE-----
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
MediaWiki 1.4beta2 is an experimental release, to help flush out
remaining major problems in the code prior to a final public 1.4.0
release. It is not recommended to use this beta on a public site unless
you're familiar with MediaWiki innards and are willing and able to help
diagnose and fix problems that come up.
All beta1 users should upgrade as soon as possible.
This release fixes separate input validation issues with image gallery
rendering and PostgreSQL. Other fixes include Recentchanges in PHP5,
whitelist-edit mode, table prefixes, page renaming, and other issues.
Additionally, startup time for cached page views is slightly faster.
Full release notes:
http://sourceforge.net/project/shownotes.php?release_id=288858
Download:
http://prdownloads.sf.net/wikipedia/mediawiki-1.4beta2.tar.gz?download
Wiki admin help mailing list:
http://mail.wikipedia.org/mailman/listinfo/mediawiki-l
Low-traffic release announcements mailing list:
http://mail.wikipedia.org/mailman/listinfo/mediawiki-announce
Bug report system:
http://bugzilla.wikipedia.org/
Play "stump the developers" live on IRC:
#mediawiki on irc.freenode.net
- -- brion vibber (brion @ pobox.com)
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (Darwin)
iD8DBQFBuUi/wRnhpk1wk44RAsIAAKCEVcU4a/SmYEvt1FbWQV3mQwBWvQCfbdqP
SufxRgGfzpUaKOwdwAy7akI=
=HXor
-----END PGP SIGNATURE-----
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
MediaWiki 1.4beta1 is an experimental release, to help flush out
remaining major problems in the code prior to a final public 1.4.0
release. It is not recommended to use this beta on a public site unless
you're familiar with MediaWiki innards and are willing and able to help
diagnose and fix problems that come up.
=== New features ===
* 'Recentchanges Patrol' to mark new edits that haven't yet been viewed.
* New, searchable deletion/upload/protection logs
* Image gallery generation (Special:Newimages and <gallery> tag)
* SVG rasterization support (requires external support)
* Users can select from the available localizations to override the
default user interface language.
* Traditional/Simplified Chinese conversion support
=== Installation and compatibility ===
* The default MonoBook theme now works with PHP 5.0
* Installation on systems with PHP's safe mode or other oddities
should work more reliably, as MonoBook no longer needs to
create a compiled template file for the wiki to run.
* A table prefix may be specified, to avoid conflicts with other
web applications forced to share a database.
* More thorough UTF-8 input validation; fixes non-ASCII uploaded
filenames from Safari.
* Command-line database upgrade script.
=== Customizability ===
* Default user options can now be overridden in LocalSettings.
* Skins system more modular: templates and CSS are now in /skins/
New skins can be dropped into this directory and used immediately.
* More extension hooks have been added.
* Authentication plugin hook.
* More internal code documentation, generated with phpdoc:
http://www.mediawiki.org/docs/html/
=== Optimization ===
* For many operations, MediaWiki 1.4 should run faster and use
less memory than MediaWiki 1.3. Page rendering is up to twice
as fast. (Use a PHP accelerator such as Turck MMCache for best
results with any PHP application, though!)
* The parser cache no longer requires memcached, and is enabled
by default. This avoids a lot of re-rendering of pages that
have been shown recently, greatly speeding longer page views.
* Support for compiled PHP modules to speed up page diff and
Unicode validation/normalization. (Requires ability to compile
and load PHP extensions).
=== What isn't ready yet ===
* A new user/groups permissions scheme has been held back to 1.5.
* An experimental SOAP interface will be made available as an extension
* PostgreSQL support is largely working, but search and installer
support are not complete. These are being actively worked on
and should come in later betas.
* E-mail notification of watched page changes and verification of
user-submitted e-mail addresses is not yet included. If updates
are available, this may make it into later betas.
* Log pages are not automatically imported into the new log table
at upgrade time. A script to import old text log entries is
incomplete, but may be available by the time 1.4 finishes.
* UI messages may be broken in Latin-1 mode in this release due to some
minor breakage in the language selection module.
Full release notes:
http://sourceforge.net/project/shownotes.php?release_id=287326
Download:
http://prdownloads.sf.net/wikipedia/mediawiki-1.4beta1.tar.gz?download
Wiki admin help mailing list:
http://mail.wikipedia.org/mailman/listinfo/mediawiki-l
Low-traffic release announcements mailing list:
http://mail.wikipedia.org/mailman/listinfo/mediawiki-announce
Bug report system:
http://bugzilla.wikipedia.org/
Play "stump the developers" live on IRC:
#mediawiki on irc.freenode.net
- -- brion vibber (brion @ pobox.com)
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (Darwin)
iD8DBQFBsHrUwRnhpk1wk44RAmVjAKCS/S0DALe1b8F8OPBwp6POhDdmnwCgiY2n
oXBwQheNUN0xPWUim5qs4FA=
=mkWR
-----END PGP SIGNATURE-----
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Since discussion & setup help traffic on MediaWiki-l has gotten heavier
than I'd originally expected, I've set up a low traffic
announcements-only list for those who want to be notified of updates
without cluttering their inboxes.
MediaWiki-announce will receive only notifications of new releases and
important security & bug fixes. Those messages will all be on
MediaWiki-l as well, so there's no need to subscribe to both lists.
To subscribe or unsubscribe to MediaWiki-announce:
http://mail.wikipedia.org/mailman/listinfo/mediawiki-announce
To subscribe or unsubscribe to MediaWiki-l:
http://mail.wikipedia.org/mailman/listinfo/mediawiki-l
- -- brion vibber (brion @ pobox.com)
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (Darwin)
iD8DBQFBsDkkwRnhpk1wk44RAtRDAJ9iRBPQHv0FnQVs24O9cjlGFmpsAwCeMFx2
7uTXgV1q4+khzJUuv8rnxIw=
=ZfaJ
-----END PGP SIGNATURE-----