MediaWiki-announce

mediawiki-announce@lists.wikimedia.org

1 participants
334 discussions

MediaWiki 1.26 Now Available
by Chad 25 Nov '15

25 Nov '15

Hello everyone, I am happy to announce the availability of the first stable release of the new MediaWiki 1.26 series. MediaWiki 1.26 includes all changes released in the smaller 1.26wmf* software deployments to Wikimedia sites over six months, totaling approximately 3000+ commits by around 120 authors. This is a large release that contains many new features and bug fixes. This is a summary of the major changes of interest to users and administrators: https://www.mediawiki.org/wiki/MediaWiki_1.26 You can always consult the RELEASE-NOTES-1.26 file for the full list of changes in this version. Full release notes: * https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_26/RELEASE-NOTES… * https://www.mediawiki.org/wiki/Release_notes/1.26 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.26/mediawiki-1.26.0.tar.gz http://download.wikimedia.org/mediawiki/1.26/mediawiki-core-1.26.0.tar.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.26/mediawiki-core-1.26.0.tar.gz.s… http://download.wikimedia.org/mediawiki/1.26/mediawiki-1.26.0.tar.gz.sig Public keys: https://www.mediawiki.org/keys/keys.html -Chad

1 0

End of HTTP support for InstantCommons
by Gergo Tisza 27 Oct '15

27 Oct '15

Wikimedia has recently switched to HTTPS [1]; due to some unexpected problems this caused for third-party wikis, the domains used by the InstantCommons [2] feature continued to support HTTP. That ends now; in a few day, these connections will be redirected to HTTPS. MediaWiki was updated to correctly deal with this in 1.25.2, 1.24.3, and 1.23.10 [3]; if you use InstantCommons with an older version of MediaWiki, you should upgrade. The latest version (1.25.3, 1.24.4 and 1.23.11 [4]) includes some improvements to MediaWiki's HTTPS support on platforms where cURL is not available; if you are encountering problems, make sure you use this version. If you absolutely cannot upgrade, you can find workarounds in T102566 [5]. [1] http://blog.wikimedia.org/2015/06/12/securing-wikimedia-sites-with-https/ [2] https://www.mediawiki.org/wiki/InstantCommons [3] https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-August/000179… [4] https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-October/00018… [5] https://phabricator.wikimedia.org/T102566

1 0

Extension Security Release: OAuth, Echo, PageTriage
by Chad 16 Oct '15

16 Oct '15

Hi all, In addition to the security release for MediaWiki core earlier today, I'd like to announce security fixes available for the following 3 extensions: * Extension:PageTriage - MediaWiki user Grunny discovered a DOM-based XSS in the way the extension handled page titles. <https://phabricator.wikimedia.org/T111029> * Extension:Echo - Internal review discovered that Echo could display deleted or suppressed usernames when the username was previously used to Thank users. <https://phabricator.wikimedia.org/T110553> * Extension:OAuth - Wikipedia user Sitic discovered that the OAuth extension did not correctly enforce the IP restrictions of a Consumer when using previously negotiated credentials. <https://phabricator.wikimedia.org/T103022> * Extension:OAuth - Wikipedia user Sitic discovered that OAuth would accept a valid signature from any Consumer when checking the authorization signature. This allowed a registered Consumer who gained access to another Consumer's users access tokens and secrets to use those credentials. <https://phabricator.wikimedia.org/T103023> ********************************************************************** Extension:PageTriage ********************************************************************** Information and Download: https://www.mediawiki.org/wiki/Extension:PageTriage ********************************************************************** Extension:Echo ********************************************************************** Information and Download: https://www.mediawiki.org/wiki/Extension:Echo ********************************************************************** Extension:OAuth ********************************************************************** Information and Download: https://www.mediawiki.org/wiki/Extension:OAuth None of these extensions are bundled but they are in use on Wikimedia sites hence the announcement. Fixes are in all supported branches in Git and are thus available from ExtensionDistributor. -Chad

1 0

Security Release: 1.25.3, 1.24.4 and 1.23.11
by Chad 16 Oct '15

16 Oct '15

I would like to announce the release of MediaWiki 1.25.3, 1.24.4, and 1.23.11. These releases fix five security issues in core, in addition to other bug fixes. Download links are given at the end of this email == Security fixes == * Wikipedia user RobinHood70 reported two issues in the chunked upload API. The API failed to correctly stop adding new chunks to the upload when the reported size was exceeded (T91203), allowing a malicious users to upload add an infinite number of chunks for a single file upload. Additionally, a malicious user could upload chunks of 1 byte for very large files, potentially creating a very large number of files on the server's filesystem (T91205). <https://phabricator.wikimedia.org/T91203> <https://phabricator.wikimedia.org/T91205> * Internal review discovered that it is not possible to throttle file uploads. <https://phabricator.wikimedia.org/T91850> * Internal review discovered a missing authorization check when removing suppression from a revision. This allowed users with the 'viewsuppressed' user right but not the appropriate 'suppressrevision' user right to unsuppress revisions. <https://phabricator.wikimedia.org/T95589> * Richard Stanway from teamliquid.net reported that thumbnails of PNG files generated with ImageMagick contained the local file path in the image metadata. <https://phabricator.wikimedia.org/T108616> == Bug Fixes in 1.25.3 == * Fix having multiple callbacks for a single hook. <https://phabricator.wikimedia.org/T98975> * maintenance/refreshLinks.php did not always remove all links pointing to nonexistent pages. <https://phabricator.wikimedia.org/T107632> * $wgEmergencyContact and $wgPasswordSender now use their default value if set to an empty string. <https://phabricator.wikimedia.org/T104142> * Provide fallbacks for use of mb_convert_encoding() in HtmlFormatter. It was causing an error when accessing the api help page if the mbstring PHP extension was not installed. <https://phabricator.wikimedia.org/T62174> * Confirmation emails would sometimes contain invalid codes. <https://phabricator.wikimedia.org/T105896> * Fixed edit stash inclusion queries. <https://phabricator.wikimedia.org/T105597> == Bug Fixes in 1.24.4 == * Minimal PSR-3 debug logger to support backports from 1.25+. <https://phabricator.wikimedia.org/T91653> * Fix indexing of moved pages with PostgreSQL. Requires running update.php to fix. <https://phabricator.wikimedia.org/T68650> == Release notes == Full release notes for 1.25.3: <https://www.mediawiki.org/wiki/Release_notes/1.25> Full release notes for 1.24.4: <https://www.mediawiki.org/wiki/Release_notes/1.24> Full release notes for 1.23.11: <https://www.mediawiki.org/wiki/Release_notes/1.23> For information about how to upgrade, see <https://www.mediawiki.org/wiki/Manual:Upgrading> ********************************************************************** 1.25.3 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.25/mediawiki-1.25.3.tar.gz https://releases.wikimedia.org/mediawiki/1.25/mediawiki-core-1.25.3.tar.gz Patch to previous version: https://releases.wikimedia.org/mediawiki/1.25/mediawiki-1.25.3.patch.gz https://releases.wikimedia.org/mediawiki/1.25/mediawiki-i18n-1.25.3.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.25/mediawiki-1.25.3.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.25/mediawiki-1.25.3.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.25/mediawiki-core-1.25.3.tar.gz.… https://releases.wikimedia.org/mediawiki/1.25/mediawiki-i18n-1.25.3.patch.g… Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** 1.24.4 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.24/mediawiki-1.24.4.tar.gz https://releases.wikimedia.org/mediawiki/1.24/mediawiki-core-1.24.4.tar.gz Patch to previous version: https://releases.wikimedia.org/mediawiki/1.24/mediawiki-1.24.4.patch.gz https://releases.wikimedia.org/mediawiki/1.24/mediawiki-i18n-1.24.4.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.24/mediawiki-1.24.4.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.24/mediawiki-1.24.4.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.24/mediawiki-core-1.24.4.tar.gz.… https://releases.wikimedia.org/mediawiki/1.24/mediawiki-i18n-1.24.4.patch.g… Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** 1.23.11 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.11.tar.gz https://releases.wikimedia.org/mediawiki/1.23/mediawiki-core-1.23.11.tar.gz Patch to previous version: https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.11.patch.gz https://releases.wikimedia.org/mediawiki/1.23/mediawiki-i18n-1.23.11.patch.… GPG signatures: https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.11.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.11.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.23/mediawiki-core-1.23.11.tar.gz… https://releases.wikimedia.org/mediawiki/1.23/mediawiki-i18n-1.23.11.patch.… Public keys: https://www.mediawiki.org/keys/keys.html -Chad

1 0

Announcement: Security Release Tomorrow
by Chad 15 Oct '15

15 Oct '15

Hi all, Tomorrow we will be issuing a security release to all supported branches of MediaWiki. The new releases will be: 1.25.3 1.24.4 1.23.11 Fixes will be available in these respective release branches, the unreleased 1.26.x branch, and master. Tarballs will be available for the above mentioned point releases as well. This security release will encompass core only, no bundled extensions are affected. -Chad

1 0

MediaWiki Security and Maintenance Releases: 1.25.2, 1.24.3, 1.23.10
by Chad 10 Aug '15

10 Aug '15

I would like to announce the release of MediaWiki 1.25.2, 1.24.3, and 1.23.10. These releases fix three security issues in core, in addition to other bug fixes. Several extensions have also had security issues fixed. Download links are given at the end of this email == Security fixes == * Internal review discovered that Special:DeletedContributions did not properly protect the IP of autoblocked users. This fix makes the functionality of Special:DeletedContributions consistent with Special:Contributions and Special:BlockList. <https://phabricator.wikimedia.org/T106893> * Internal review discovered that watchlist anti-csrf tokens were not being compared in constant time, which could allow various timing attacks. This could allow an attacker to modify a user's watchlist via csrf. <https://phabricator.wikimedia.org/T94116> * John Menerick reported that MediaWiki's thumb.php failed to sanitize various error messages, resulting in xss. <https://phabricator.wikimedia.org/T97391> Additionally, the following extensions have been updated to fix security issues: * Extension:SemanticForms - MediaWiki user Grunny discovered multiple reflected xss vectors in SemanticForms. Further internal review discovered and fixed other reflected and stored xss vectors. <https://phabricator.wikimedia.org/T103391> <https://phabricator.wikimedia.org/T103765> <https://phabricator.wikimedia.org/T103761> * Extension:SyntaxHighlight_GeSHi - xss and potential DoS vectors. Internal review discovered that the contib directory for GeSHi was re-included in MediaWiki 1.25. Some scripts could be potentially be used for DoS, and DAU Huy Ngoc discovered an xss vector. All contrib scripts have been removed. <https://phabricator.wikimedia.org/T108198> * Extension:TimedMediaHandler - User:McZusatz reported that resetting transcodes deleted the transcode without creating a new one, which could be used for vandalism or potentially DoS. <https://phabricator.wikimedia.org/T100211> * Extension:Quiz - Internal review discovered that Quiz did not properly escape regex metacharacters in a user controlled regular expression, enabling a DoS vector. <https://phabricator.wikimedia.org/T97083> * Extension:Widgets - MediaWiki developer Majr reported a potential HTML injection (xss) vector. <https://phabricator.wikimedia.org/T88964> == Bug Fixes in 1.25.2 == * (T102562) Fix InstantCommons parameters to handle the new HTTPS-only policy of Wikimedia Commons. * (T100767) Setting a configuration setting for skin or extension to false in LocalSettings.php was not working. * (T100635) API action=opensearch json output no longer breaks when $wgDebugToolbar is enabled. * (T102522) Using an extension.json or skin.json file which has a "manifest_version" property for 1.26 compatability will no longer trigger warnings. * (T86156) Running updateSearchIndex.php will not throw an error as page_restrictions has been added to the locked table list. * Special:Version would throw notices if using SVN due to an incorrectly named variable. Add an additional check that an index is defined. == Bug Fixes in 1.24.3 == * Update jQuery from v1.11.2 to v1.11.3. * (T102562) Fix InstantCommons parameters to handle the new HTTPS-only policy of Wikimedia Commons. == Bug Fixes in 1.23.10 == * (bug 67644) Make AutoLoaderTest handle namespaces * (T91653) Minimal PSR-3 debug logger to support backports from 1.25+. * (T102562) Fix InstantCommons parameters to handle the new HTTPS-only policy of Wikimedia Commons. Full release notes for 1.25.2: <https://www.mediawiki.org/wiki/Release_notes/1.25> Full release notes for 1.24.3: <https://www.mediawiki.org/wiki/Release_notes/1.24> Full release notes for 1.23.10: <https://www.mediawiki.org/wiki/Release_notes/1.23> For information about how to upgrade, see <https://www.mediawiki.org/wiki/Manual:Upgrading> ********************************************************************** Mediawiki downloads and patches ********************************************************************** Full release notes: https://www.mediawiki.org/wiki/Release_notes/1.25 https://www.mediawiki.org/wiki/Release_notes/1.24 https://www.mediawiki.org/wiki/Release_notes/1.23 Download: http://download.wikimedia.org/mediawiki/1.25/mediawiki-1.25.2.tar.gz http://download.wikimedia.org/mediawiki/1.24/mediawiki-1.24.3.tar.gz http://download.wikimedia.org/mediawiki/1.23/mediawiki-1.23.10.tar.gz Download (no bundled extensions): http://download.wikimedia.org/mediawiki/1.25/mediawiki-core-1.25.2.patch.gz http://download.wikimedia.org/mediawiki/1.24/mediawiki-core-1.24.3.patch.gz http://download.wikimedia.org/mediawiki/1.23/mediawiki-core-1.23.10.patch.gz Patch to previous version: http://download.wikimedia.org/mediawiki/1.25/mediawiki-1.25.2.patch.gz http://download.wikimedia.org/mediawiki/1.24/mediawiki-1.24.3.patch.gz http://download.wikimedia.org/mediawiki/1.23/mediawiki-1.23.10.patch.gz Localization patch to previous version: http://download.wikimedia.org/mediawiki/1.25/mediawiki-i18n-1.25.2.patch.gz http://download.wikimedia.org/mediawiki/1.24/mediawiki-i18n-1.24.3.patch.gz http://download.wikimedia.org/mediawiki/1.23/mediawiki-i18n-1.23.10.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.25/mediawiki-1.25.2.tar.gz.sig http://download.wikimedia.org/mediawiki/1.24/mediawiki-1.24.3.tar.gz.sig http://download.wikimedia.org/mediawiki/1.23/mediawiki-1.23.10.tar.gz.sig http://download.wikimedia.org/mediawiki/1.25/mediawiki-core-1.25.2.patch.gz… http://download.wikimedia.org/mediawiki/1.24/mediawiki-core-1.24.3.patch.gz… http://download.wikimedia.org/mediawiki/1.23/mediawiki-core-1.23.10.patch.g… http://download.wikimedia.org/mediawiki/1.25/mediawiki-1.25.2.patch.gz.sig http://download.wikimedia.org/mediawiki/1.24/mediawiki-1.24.3.patch.gz.sig http://download.wikimedia.org/mediawiki/1.23/mediawiki-1.23.10.patch.gz.sig http://download.wikimedia.org/mediawiki/1.25/mediawiki-i18n-1.25.2.patch.gz… http://download.wikimedia.org/mediawiki/1.24/mediawiki-i18n-1.24.3.patch.gz… http://download.wikimedia.org/mediawiki/1.23/mediawiki-i18n-1.23.10.patch.g… Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** Extension:Semantic Forms ********************************************************************** Information and Download: https://www.mediawiki.org/wiki/Extension:Semantic_Forms ********************************************************************** Extension:SyntaxHighlight_GeSHi ********************************************************************** Information and Download: https://www.mediawiki.org/wiki/Extension:SyntaxHighlight_GeSHi ********************************************************************** Extension:TimedMediaHandler ********************************************************************** Information and Download: https://www.mediawiki.org/wiki/Extension:TimedMediaHandler ********************************************************************** Extension:Quiz ********************************************************************** Information and Download: https://www.mediawiki.org/wiki/Extension:Quiz ********************************************************************** Extension:Widgets ********************************************************************** Information and Download: https://www.mediawiki.org/wiki/Extension:Widgets -Chad

1 0

MediaWiki bug fix release 1.25.1
by Chris Steipp 25 May '15

25 May '15

Hello everyone, The ConfirmEdit extension in the 1.25.0 tarball contained a syntax error in two JSON files. We deeply apologize for this error, and thanks to Paul Villiger for reporting the issue. A new 1.25.1 tarball has been released which fixes the issue. Users using git can update to the latest REL1_25 branch. Full release notes: https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_25/RELEASE-NOTES… https://www.mediawiki.org/wiki/Release_notes/1.25 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.25/mediawiki-1.25.1.tar.gz http://download.wikimedia.org/mediawiki/1.25/mediawiki-core-1.25.1.tar.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.25/mediawiki-core-1.25.1.tar.gz.s… http://download.wikimedia.org/mediawiki/1.25/mediawiki-1.25.1.tar.gz.sig Public keys: https://www.mediawiki.org/keys/keys.html

1 0

End of life announcement - 1.19.x LTS
by Chad 25 May '15

25 May '15

Hi, With the release of MediaWiki 1.25, the lifetime of MediaWiki version 1.19.x LTS ends. Users still using MediaWiki 1.19.x are advised to upgrade to version 1.25.0 (latest stable) or 1.23.x (legacy and LTS version). -Chad Horohoe, MW Release Manager

1 0

MediaWiki 1.25 Now Available
by Chad 25 May '15

25 May '15

Hello everyone, I am happy to announce the availability of the first stable release of the new MediaWiki 1.25 series. MediaWiki 1.25 is a large release that contains many new features and bug fixes. This is a summary of the major changes of interest to users. You can consult the RELEASE-NOTES-1.25 file for the full list of changes in this version. Our thanks to everyone who helped to improve MediaWiki by testing the release candidates and submitting bug reports. == What's new for users? == MediaWiki 1.25 includes all changes released in the smaller 1.25wmf* software deployments to Wikimedia sites over six months, totaling approximately 2200 changes. * Indicators – Templates that add icons to the top right corner of the page (and more) can be updated to use the new page status indicators feature. * Enhanced recent changes – MediaWiki now uses by default the extended watchlist and so called enhanced recent changes (preference "Group changes by page in recent changes and watchlist"), which also received several improvements in MediaWiki 1.24 and 1.25 (task 37785). This means that Special:RecentChanges and Special:Watchlist show all the changes to each page in a given day, sorted by page rather than chronologically. Changes to each page are collapsed by default and a compact overview is shown, with links to collated diffs and counts of each user's actions. Full activity for an individual page can then be shown with a single click. Users will no longer need to know in detail how a single change was chosen for display in order to figure out what else may have happened to the page that day, nor to scan a long list of non-contiguous lines on the screen in order to get a complete picture. The change is part of MediaWiki's evolution towards an interface which is more discoverable and less cluttered by default, while equally easy to quickly access in full, with the help of JavaScript. However, the (grouped) layout is an improvement for non-JavaScript users as well. * Live preview – While editing, you're not sure what a wikitext syntax will produce? That's no longer a problem, now that live preview is no longer experimental. By enabling the feature in your preferences, MediaWiki will display the effect of your edits without fully reloading the page, so that you can quickly correct any mistake. * Import – The import tool is now much easier to use on content from a wiki which has different namespaces than yours (e.g. because it's in another language). * Internationalization – In logging and gender support, continuing the work in MediaWiki 1.18 and 1.19, multiple log types of Special:Log have been migrated to the new logging system, which allows full internationalization including word order and grammatical gender. The migration continues. See task T26620 for a list. Locales – The following locales have been added: अवधी, بلوچی رخشانی and Koyraboro Senni. * API documentation is localized and easier to access through Special:ApiHelp. == What's new for system administrators? == * PHP 5.3.3 is now required (from 5.3.2) * Extensions and skins are now loaded through a new registration system * Profiling was completely overhauled to use the xhprof module. Full release notes: https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_25/RELEASE-NOTES… https://www.mediawiki.org/wiki/Release_notes/1.25 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.25/mediawiki-1.25.0.tar.gz http://download.wikimedia.org/mediawiki/1.25/mediawiki-core-1.25.0.tar.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.25/mediawiki-core-1.25.0.tar.gz.s… http://download.wikimedia.org/mediawiki/1.25/mediawiki-1.25.0.tar.gz.sig Public keys: https://www.mediawiki.org/keys/keys.html -Chad Horohoe, MW Release Manager

1 0

MediaWiki Security and Maintenance Releases: 1.19.24, 1.23.9, and 1.24.2
by Chris Steipp 31 Mar '15

31 Mar '15

I would like to announce the release of MediaWiki 1.24.2, 1.23.9 and 1.19.24. These releases fix 10 security issues, in addition to other bug fixes. Download links are given at the end of this email. == Security fixes == * iSEC Partners discovered a way to circumvent the SVG MIME blacklist for embedded resources (iSEC-WMF1214-11). This allowed an attacker to embed JavaScript in the SVG. The issue was additionally identified by Mario Heiderich / Cure53. MIME types are now whitelisted. <https://phabricator.wikimedia.org/T85850> * MediaWiki user Bawolff pointed out that the SVG filter to prevent injecting JavaScript using animate elements was incorrect. <https://phabricator.wikimedia.org/T86711> * MediaWiki user Bawolff reported a stored XSS vulnerability due to the way attributes were expanded in MediaWiki's Html class, in combination with LanguageConverter substitutions. <https://phabricator.wikimedia.org/T73394> * Internal review discovered that MediaWiki's SVG filtering could be bypassed with entity encoding under the Zend interpreter. This could be used to inject JavaScript. This issue was also discovered by Mario Gomes from Beyond Security. <https://phabricator.wikimedia.org/T88310> * iSEC Partners discovered a XSS vulnerability in the way api errors were reflected when running under HHVM versions before 3.6.1 (iSEC-WMF1214-8). MediaWiki now detects and mitigates this issue on older versions of HHVM. <https://phabricator.wikimedia.org/T85851> * Internal review and iSEC Partners discovered (iSEC-WMF1214-1) that MediaWiki versions using PBKDF2 for password hashing (the default since 1.24) are vulnerable to DoS attacks using extremely long passwords. <https://phabricator.wikimedia.org/T64685> * iSEC Partners discovered that MediaWiki's SVG and XMP parsing, running under HHVM, was susceptible to "Billion Laughs" DoS attacks (iSEC-WMF1214-13). <https://phabricator.wikimedia.org/T85848> * Internal review found that MediaWiki is vulnerable to "Quadratic Blowup" DoS attacks, under both HHVM and Zend PHP. <https://phabricator.wikimedia.org/T71210> * iSEC Partners discovered a way to bypass the style filtering for SVG files (iSEC-WMF1214-3). This could violate the anonymity of users viewing the SVG. <https://phabricator.wikimedia.org/T85349> * iSEC Partners reported that the MediaWiki feature allowing a user to preview another user's custom JavaScript could be abused for privilege escalation (iSEC-WMF1214-10). This feature has been removed. <https://phabricator.wikimedia.org/T85855> Additionally, the following extensions have been updated to fix security issues: * Extension:Scribunto - MediaWiki user Jackmcbarn discovered that function names were not sanitized in Lua error backtraces, which could lead to XSS. <https://phabricator.wikimedia.org/T85113> * Extension:CheckUser - iSEC Partners discovered that the CheckUser extension did not prevent CSRF attacks on the form allowing checkusers to look up sensitive information about other users (iSEC-WMF1214-6). Since the use of CheckUser is logged, the CSRF could be abused to defame a trusted user or flood the logs with noise. <https://phabricator.wikimedia.org/T85858> == Bug fixes == === 1.24 === * Fix case of SpecialAllPages/SpecialAllMessages in SpecialPageFactory to fix loading these special pages when $wgAutoloadAttemptLowercase is false. * (bug T76254) Fix deleting of pages with PostgreSQL. Requires a schema change and running update.php to fix. == 1.23 & 1.24 == * (bug T70087) Fix Special:ActiveUsers page for installations using PostgreSQL. ********************************************************************** Full release notes: https://www.mediawiki.org/wiki/Release_notes/1.24 https://www.mediawiki.org/wiki/Release_notes/1.23 https://www.mediawiki.org/wiki/Release_notes/1.19 Download: http://download.wikimedia.org/mediawiki/1.24/mediawiki-1.24.2.tar.gz http://download.wikimedia.org/mediawiki/1.23/mediawiki-1.23.9.tar.gz http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.24.tar.gz Patch to previous version: http://download.wikimedia.org/mediawiki/1.24/mediawiki-1.24.2.patch.gz http://download.wikimedia.org/mediawiki/1.23/mediawiki-1.23.9.patch.gz http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.24.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.24/mediawiki-1.24.2.tar.gz.sig http://download.wikimedia.org/mediawiki/1.24/mediawiki-1.24.2.patch.gz.sig http://download.wikimedia.org/mediawiki/1.23/mediawiki-1.23.9.tar.gz.sig http://download.wikimedia.org/mediawiki/1.23/mediawiki-1.23.9.patch.gz.sig http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.24.tar.gz.sig http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.24.patch.gz.sig Extensions: http://www.mediawiki.org/wiki/Extension:Scribunto http://www.mediawiki.org/wiki/Extension:CheckUser Public keys: https://www.mediawiki.org/keys/keys.html

1 0

← Newer
1
...
13
14
15
16
17
18
19
...
34
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

MediaWiki-announce