MediaWiki-announce

mediawiki-announce@lists.wikimedia.org

1 participants
334 discussions

Security Release Pre-Announcement (1.27, 1.26, 1.23)
by Chad Horohoe 19 Aug '16

19 Aug '16

Hi everyone, I would like to give everyone advance notice of a pending security release for all supported branches. The release will come out on Monday, August 22nd. There are several security fixes for core and one extension that will be included in this release, along with the normal backports that have made it into the branches already. The version numbers will be: 1.27.1 1.26.4 1.23.14 Please let me know if you have any other questions. Thanks and have a great weekend. -Chad

1 0

[ConfirmEdit][ReCaptcha] Call-to-Action: ReCaptcha module will be removed in the near future
by Florian Schmidt 04 Aug '16

04 Aug '16

Hi all together, first of all: If you don't use ConfirmEdit with the ReCaptcha (NOT the ReCaptchaNoCaptcha) module, you can STOP reading here :) TL;DR Please upgrade to the ReCaptchaNoCaptcha module to use a supported version in the future and please respond to [1], if you've an opinion about the deprecation/removal plan(s). Long version: As you may know, ConfirmEdit[2] (the MediaWiki extension that helps you to fight against spam) supports different CAPTCHA modules, such as a MathCaptcha (where the user has to solve a math problem) or QuestyCaptcha (where the user has to answer a pre-defined question). Another module is Google's ReCaptcha[3][4], in both versions, the old v1 and the newer v2 (also called NoCaptcha). In December 2014, Google announced a new version of the ReCaptcha CAPTCHA-service, called ReCaptcha NoCaptcha (or ReCaptcha v2). ConfirmEdit currently supports both versions, as Google did the same until recently. Now, as you can read on the FAQ page of ReCaptcha[5], Google stopped supporting the v1 of ReCaptcha. This means, that no new features are developed and that new keys registered for ReCaptcha will work with the new version 2 only. This let me come to the conclusion, that ReCaptcha v1 will not be supported by Google at all anymore in the near future. In order of this, we should ask our self, how long we want to support the old ReCaptcha module in ConfirmEdit (which, compared to the NoCaptcha module, _seems_ to be less effective). The mid-term plan is clear: remove the old ReCaptcha module. Now there are two ways to achieve this: * Deprecate the old reCaptcha in Version 1.27 of MediaWiki (would be a so called backport) and remove it in the upcoming 1.28 release * Deprecate the old reCaptcha in the upcoming Version 1.28 of MediaWiki and remove it: * in MediaWiki 1.29 or * when Google doesn't support the old reCaptcha anymore Because this is a huge problem for existing third-party wikis (and because we don't have any usage statistics), I'm not sure, which plan we should choose. That's why I sent this e-mail out, to get (hopefully) some responses and opinions. So, the call-to-Action: If you still use the old ReCaptcha module, please plan to upgrade to the new version 2 of ReCaptcha as soon as possible and let us know (the best way is a comment in the task[1]), if you need the old ReCaptcha version supported as long as Google supports it, or if you're fine with removing it in the upcoming 1.28 release of MediaWiki. To be absolutely clear: The ReCaptcha module will be removed, the only question is when: in MediaWiki 1.28 or in MediaWiki 1.29. If you've any questions, feel free to answer to this e-mail, add a comment to the linked task, contact me in IRC or write me an e-mail (if you need a private conversation). Thanks for your attention and for using ConfirmEdit! Best, Florian [1] https://phabricator.wikimedia.org/T142133 [2] https://www.mediawiki.org/wiki/Extension:ConfirmEdit [3] https://en.wikipedia.org/wiki/ReCAPTCHA [4] https://www.google.com/recaptcha/intro/index.html [5] https://developers.google.com/recaptcha/docs/faq

1 0

1.25 EOL announcement
by Chad Horohoe 29 Jun '16

29 Jun '16

Hi, With the release of MediaWiki 1.27, the lifetime of MediaWiki version 1.25.x has come to an end. Users still using MediaWiki 1.25.x are advised to upgrade to version 1.27.0, the latest stable and LTS version. --Chad Horohoe

1 0

MediaWiki 1.27 now available!
by Chad Horohoe 29 Jun '16

29 Jun '16

Hello everyone, I am happy to announce the availability the general release of MediaWiki 1.27! MediaWiki 1.27 includes all changes released in the smaller 1.27.0-wmf.* software deployments to Wikimedia sites over six months, totaling approximately 2800+ commits by around 165 authors. This is a large release that contains many new features and bug fixes. This will be a LTS release, supported until 2019 with security fixes. This is a summary of the major changes of interest to users and administrators: * https://www.mediawiki.org/wiki/MediaWiki_1.27 Of special note is AuthManager, which I explained in detail with second release candidate: * https://lists.wikimedia.org/pipermail/mediawiki-announce/2016-June/000190.h… You can always consult the RELEASE-NOTES-1.27 file for the full list of changes in this version. Full release notes: * https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_27/RELEASE-NOTES… * https://www.mediawiki.org/wiki/Release_notes/1.27 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.27/mediawiki-1.27.0.tar.gz https://releases.wikimedia.org/mediawiki/1.27/mediawiki-core-1.27.0.tar.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.27/mediawiki-1.27.0.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.27/mediawiki-core-1.27.0.tar.gz.… Public keys: https://www.mediawiki.org/keys/keys.html -Chad

1 0

Second release candidate for 1.27 (1.27.0-rc.1)
by Chad Horohoe 15 Jun '16

15 Jun '16

Hello everyone, I am happy to announce the availability of the second release candidate of the new MediaWiki 1.27 series! AuthManager has been backported!!! Since the first release candidate support for the new authentication/ authorization framework (AuthManager) was merged from master. This is a large architectural change, but users should hopefully see few changes. If you have extensions that make use of authentication or authorization hooks you will need to upgrade those as well to their REL1_27 versions or master branch (both available via Git or Extension Distributor). For a high level overview please see: * https://www.mediawiki.org/wiki/Manual:SessionManager_and_AuthManager If you have an extension that you maintain and will be updating: * https://www.mediawiki.org/wiki/Manual:SessionManager_and_AuthManager/Updati… As a result of this large change, I'm going to let the RC.1 stir around in the wild for 2 weeks before we do the final release. I know this is a delay for some, but I really think 1.27 will be a better release as a result. June 28th sounds like a fun day :) Now for the usual fun boilerplate: MediaWiki 1.27 includes all changes released in the smaller 1.27.0-wmf.* software deployments to Wikimedia sites over six months, totaling approximately 2800+ commits by around 165 authors. This is a large release that contains many new features and bug fixes. This will be a LTS release, supported until 2019 with security fixes. This is a summary of the major changes of interest to users and administrators: https://www.mediawiki.org/wiki/MediaWiki_1.27 You can always consult the RELEASE-NOTES-1.27 file for the full list of changes in this version. Full release notes: * https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_27/RELEASE-NOTES… * https://www.mediawiki.org/wiki/Release_notes/1.27 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.27/mediawiki-1.27.0-rc.1.tar.gz https://releases.wikimedia.org/mediawiki/1.27/mediawiki-1.27.0-rc.1.patch.gz https://releases.wikimedia.org/mediawiki/1.27/mediawiki-core-1.27.0-rc.1.ta… GPG signatures: https://releases.wikimedia.org/mediawiki/1.27/mediawiki-1.27.0-rc.1.tar.gz.… https://releases.wikimedia.org/mediawiki/1.27/mediawiki-1.27.0-rc.1.patch.g… https://releases.wikimedia.org/mediawiki/1.27/mediawiki-core-1.27.0-rc.1.ta… Public keys: https://www.mediawiki.org/keys/keys.html -Chad

1 0

First release candidate for 1.27 (1.27.0-rc.0)
by Chad Horohoe 01 Jun '16

01 Jun '16

Hello everyone, I am happy to announce the availability of the first release candidate of the new MediaWiki 1.27 series! MediaWiki 1.27 includes all changes released in the smaller 1.27.0-wmf.* software deployments to Wikimedia sites over six months, totaling approximately 2800+ commits by around 165 authors. This is a large release that contains many new features and bug fixes. This will be a LTS release, supported until 2019 with security fixes. This is a summary of the major changes of interest to users and administrators: https://www.mediawiki.org/wiki/MediaWiki_1.27 You can always consult the RELEASE-NOTES-1.27 file for the full list of changes in this version. Full release notes: * https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_27/RELEASE-NOTES… * https://www.mediawiki.org/wiki/Release_notes/1.27 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.27/mediawiki-1.27.0-rc.0.tar.gz http://download.wikimedia.org/mediawiki/1.27/mediawiki-core-1.27.0-rc.0.tar… GPG signatures: http://download.wikimedia.org/mediawiki/1.27/mediawiki-core-1.27.0-rc.0.tar… http://download.wikimedia.org/mediawiki/1.27/mediawiki-1.27.0-rc.0.tar.gz.s… Public keys: https://www.mediawiki.org/keys/keys.html -Chad

1 0

Security Release: 1.26.3, 1.25.6, and 1.23.14
by Chad 20 May '16

20 May '16

I would like to announce the release of MediaWiki 1.26.3, 1.25.6 and 1.23.14. These releases fix sixteen security issues in core, one issue in the bundled extension SyntaxHighlight_GeSHi and one issue in the non-bundled extension Scribunto. Download links are given at the end of this email. == Security fixes == * T122056: Old tokens are remaining valid within a new session * T127114: Login throttle can be tricked using non-canonicalized usernames * T123653: Cross-domain policy regexp is too narrow * T123071: Incorrectly identifying http link in a's href attributes, due to m modifier in regex * T129506: MediaWiki:Gadget-popups.js isn't renderable * T125283: Users occasionally logged in as different users after SessionManager deployment * T103239: Patrol allows click catching and patrolling of any page * T122807: [tracking] Check php crypto primatives * T98313: Graphs can leak tokens, leading to CSRF * T130947: Diff generation should use PoolCounter * T133507: Careless use of $wgExternalLinkTarget is insecure * T132874: API action=move is not rate limited This fix affects both core and SyntaxHighlight_GeSHi: * T110143: strip markers can be used to get around html attribute escaping in (many?) parser tags These two fixes are not applicable to 1.23.14 as the 1.23 branch does not contain pbkdf2 support. * T116030: Increase pbkdf2 parameter strengths * T127420: Pbkdf2Password does not check if hash_pbkdf2() succeeded This fix is already in master and the 1.27 release branch, and is just being backported to 1.23 and 1.25: * T126685: Globally throttle password attempts == Links to all mentioned tasks == https://phabricator.wikimedia.org/T122056 https://phabricator.wikimedia.org/T127114 https://phabricator.wikimedia.org/T123653 https://phabricator.wikimedia.org/T123071 https://phabricator.wikimedia.org/T129506 https://phabricator.wikimedia.org/T125283 https://phabricator.wikimedia.org/T103239 https://phabricator.wikimedia.org/T122807 https://phabricator.wikimedia.org/T98313 https://phabricator.wikimedia.org/T130947 https://phabricator.wikimedia.org/T133507 https://phabricator.wikimedia.org/T132874 https://phabricator.wikimedia.org/T110143 https://phabricator.wikimedia.org/T116030 https://phabricator.wikimedia.org/T127420 https://phabricator.wikimedia.org/T126685 == Release notes == Full release notes for 1.26.3: <https://www.mediawiki.org/wiki/Release_notes/1.26> Full release notes for 1.25.6: <https://www.mediawiki.org/wiki/Release_notes/1.25> Full release notes for 1.23.14: <https://www.mediawiki.org/wiki/Release_notes/1.23> For information about how to upgrade, see <https://www.mediawiki.org/wiki/Manual:Upgrading> ********************************************************************** 1.26.3 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.26/mediawiki-1.26.3.tar.gz https://releases.wikimedia.org/mediawiki/1.26/mediawiki-core-1.26.3.tar.gz Patch to previous version: https://releases.wikimedia.org/mediawiki/1.26/mediawiki-1.26.3.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.26/mediawiki-1.26.3.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.26/mediawiki-1.26.3.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.26/mediawiki-core-1.26.3.tar.gz.… Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** 1.25.6 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.25/mediawiki-1.25.6.tar.gz https://releases.wikimedia.org/mediawiki/1.25/mediawiki-core-1.25.6.tar.gz Patch to previous version: https://releases.wikimedia.org/mediawiki/1.25/mediawiki-1.25.6.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.25/mediawiki-1.25.6.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.25/mediawiki-1.25.6.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.25/mediawiki-core-1.25.6.tar.gz.… Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** 1.23.14 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.14.tar.gz https://releases.wikimedia.org/mediawiki/1.23/mediawiki-core-1.23.14.tar.gz Patch to previous version: https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.14.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.14.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.14.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.23/mediawiki-core-1.23.14.tar.gz… Public keys: https://www.mediawiki.org/keys/keys.html -Chad H. & Chris S.

1 0

MediaWiki Maintenance Releases: 1.26.2, 1.25.5, 1.24.6 and 1.23.13
by Chad 21 Dec '15

21 Dec '15

1 0

Security Release: 1.26.1, 1.25.4, 1.24.5 and 1.23.12
by Chad 18 Dec '15

18 Dec '15

I would like to announce the release of MediaWiki 1.26.1, 1.25.4, 1.24.5, and 1.23.12. These releases fix five security issues in core, in addition to other bug fixes. Download links are given at the end of this email == Security fixes == (T117899) SECURITY: $wgArticlePath can no longer be set to relative paths that do not begin with a slash. This enabled trivial XSS attacks. Configuration values such as "http://my.wiki.com/wiki/$1" are fine, as are "/wiki/$1". A value such as "$1" or "wiki/$1" is not and will now throw an error (T119309) SECURITY: Use hash_compare() for edit token comparison (T118032) SECURITY: Don't allow cURL to interpret POST parameters starting with '@' as file uploads (T115522) SECURITY: Passwords generated by User::randomPassword() can no longer be shorter than $wgMinimalPasswordLength (T97897) SECURITY: Improve IP parsing and trimming. Previous behavior could result in improper blocks being issued (T109724) SECURITY: Special:MyPage, Special:MyTalk, Special:MyContributions and related pages no longer use HTTP redirects and are now redirected by MediaWiki == Note about EOL of 1.24.x == Please note that 1.24.5 marks the end of support for the 1.24.x series of releases. Technically this ended a few weeks ago with the release of 1.26.0 but we dropped one final release of 1.24.x here to give it a nicer send off for those who have not yet upgraded. == Release notes == Full release notes for 1.26.1: <https://www.mediawiki.org/wiki/Release_notes/1.26> Full release notes for 1.25.4: <https://www.mediawiki.org/wiki/Release_notes/1.25> Full release notes for 1.24.5: <https://www.mediawiki.org/wiki/Release_notes/1.24> Full release notes for 1.23.12: <https://www.mediawiki.org/wiki/Release_notes/1.23> For information about how to upgrade, see <https://www.mediawiki.org/wiki/Manual:Upgrading> ********************************************************************** 1.26.1 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.26/mediawiki-1.26.1.tar.gz https://releases.wikimedia.org/mediawiki/1.26/mediawiki-core-1.26.1.tar.gz Patch to previous version: https://releases.wikimedia.org/mediawiki/1.26/mediawiki-1.26.1.patch.gz https://releases.wikimedia.org/mediawiki/1.26/mediawiki-i18n-1.26.1.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.26/mediawiki-1.26.1.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.26/mediawiki-1.26.1.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.26/mediawiki-core-1.26.1.tar.gz.… Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** 1.25.4 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.25/mediawiki-1.25.4.tar.gz https://releases.wikimedia.org/mediawiki/1.25/mediawiki-core-1.25.4.tar.gz Patch to previous version: https://releases.wikimedia.org/mediawiki/1.25/mediawiki-1.25.4.patch.gz https://releases.wikimedia.org/mediawiki/1.25/mediawiki-i18n-1.25.4.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.25/mediawiki-1.25.4.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.25/mediawiki-1.25.4.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.25/mediawiki-core-1.25.4.tar.gz.… Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** 1.24.5 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.24/mediawiki-1.24.5.tar.gz https://releases.wikimedia.org/mediawiki/1.24/mediawiki-core-1.24.5.tar.gz Patch to previous version: https://releases.wikimedia.org/mediawiki/1.24/mediawiki-1.24.5.patch.gz https://releases.wikimedia.org/mediawiki/1.24/mediawiki-i18n-1.24.5.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.24/mediawiki-1.24.5.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.24/mediawiki-1.24.5.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.24/mediawiki-core-1.24.5.tar.gz.… Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** 1.23.12 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.12.tar.gz https://releases.wikimedia.org/mediawiki/1.23/mediawiki-core-1.23.12.tar.gz Patch to previous version: https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.12.patch.gz https://releases.wikimedia.org/mediawiki/1.23/mediawiki-i18n-1.23.12.patch.… GPG signatures: https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.12.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.12.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.23/mediawiki-core-1.23.12.tar.gz… Public keys: https://www.mediawiki.org/keys/keys.html -Chad H. & Chris S.

1 0

Announcement: Security Release Tomorrow
by Chad 17 Dec '15

17 Dec '15

Hi all, Tomorrow we will be issuing a security release for all branches of MediaWiki 1.23 and beyond. The new releases will be: 1.23.12 1.24.5 1.25.4 1.26.1 Fixes will be available in the affected release branches and master. Tarballs will be uploaded for the indicated point releases as well. This release encompasses 6 fixes for core only, no bundled extensions are impacted. Have a great day, Chad H. & Chris S.

1 0

← Newer
1
...
12
13
14
15
16
17
18
...
34
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

MediaWiki-announce