MediaWiki-announce

mediawiki-announce@lists.wikimedia.org

331 discussions

End of lifetime announcement for MediaWiki 1.22
by Markus Glaser 27 Nov '14

27 Nov '14

Hello everyone, with the release of MediaWiki 1.24, the lifetime of MediaWiki version 1.22 ends. There will be a final maintenance release on 17th of December, 2014. The new legacy version is 1.23. Users still using MediaWiki 1.22 are advised to upgrade to version 1.24.0 (latest stable) or 1.23.7 (legacy and LTS version). MediaWiki 1.19 LTS will continue to be supported until May, 2015. Best, Mark Hershberger and Markus Glaser (Wiki Release Team)

1 0

MediaWiki Security and Maintenance Releases: 1.23.7, 1.22.14 and 1.19.22
by Markus Glaser 27 Nov '14

27 Nov '14

Hello everyone, I would like to announce the release of MediaWiki 1.23.7, 1.22.14 and 1.19.22. This is a regular security and maintenance release. Download links are given at the end of this email. == Security fixes == * (bugs 66776, 71478) SECURITY: User PleaseStand reported a way to inject code into API clients that used format=php to process pages that underwent flash policy mangling. This was fixed along with improving how the mangling was done for format=json, and allowing sites to disable the mangling using $wgMangleFlashPolicy. <https://phabricator.wikimedia.org/T68776> <https://phabricator.wikimedia.org/T73478> * (bug 70901) SECURITY: User Jackmcbarn reported that the ability to update the content model for a page could allow an unprivileged attacker to edit another user's common.js under certain circumstances. The user right "editcontentmodel" was added, and is needed to change a revision's content model. <https://phabricator.wikimedia.org/T72901> * (bug 71111) SECURITY: User PleaseStand reported that on wikis that allow raw HTML, it is not safe to preview wikitext coming from an untrusted source such as a cross-site request. Thus add an edit token to the form, and when raw HTML is allowed, ensure the token is provided before showing the preview. This check is not performed on wikis that both allow raw HTML and anonymous editing, since there are easier ways to exploit that scenario. <https://phabricator.wikimedia.org/T73111> * (bug 72222) SECURITY: Do not show log action when the entry is revdeleted with DELETED_ACTION. NOTICE: this may be reverted in a future release pending a public RFC about the desired functionality. This issue was reported by user Bawolff. <https://phabricator.wikimedia.org/T74222> == Bugfixes == * (bug 71621) Make allowing site-wide styles on restricted special pages a config option. <https://phabricator.wikimedia.org/T73621> * (bug 42723) Added updated version history from 1.19.2 to 1.22.13 <https://phabricator.wikimedia.org/T44723> * $wgMangleFlashPolicy was added to make MediaWiki's mangling of anything that might be a flash policy directive configurable. Full release notes for 1.23.7: <https://www.mediawiki.org/wiki/Release_notes/1.23> Full release notes for 1.22.14: <https://www.mediawiki.org/wiki/Release_notes/1.22> Full release notes for 1.19.22: <https://www.mediawiki.org/wiki/Release_notes/1.19> Public keys: <https://www.mediawiki.org/keys/keys.html> ********************************************************************** 1.23.7 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.7.tar.gz https://releases.wikimedia.org/mediawiki/1.23/mediawiki-core-1.23.7.tar.gz Patch to previous version (1.23.6): https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.7.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.23/mediawiki-core-1.23.7.tar.gz.… https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.7.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.7.patch.gz.sig ********************************************************************** 1.22.14 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.14.tar.gz Patch to previous version (1.22.13): https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.14.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.22/mediawiki-core-1.22.14.tar.gz… https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.14.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.14.patch.gz.sig ********************************************************************** 1.19.22 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.22.tar.gz Patch to previous version (1.19.21): https://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.22.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.19/mediawiki-core-1.19.22.tar.gz… https://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.22.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.22.patch.gz.sig Mark Hershberger and Markus Glaser (Wiki Release Team)

1 0

MediaWiki 1.24.0 released
by Markus Glaser 27 Nov '14

27 Nov '14

Hello everyone, I am happy to announce the availability of the first stable release of the new MediaWiki 1.24 release series. MediaWiki 1.24 is a large release that contains many new features and bug fixes. This is a summary of the major changes of interest to users. You can consult the RELEASE-NOTES-1.24 file for the full list of changes in this version. Our thanks to everyone who helped to improve MediaWiki by testing the release candidates and submitting bug reports. == What's new? == MediaWiki 1.24 includes all changes released in the smaller 1.24wmfX software deployments to Wikimedia sites. == Preferences made easier == MediaWiki is known to be extremely flexible and customisable, but few users use its full potential. In 1.24, we aim to make dozens obscure preferences easily discoverable and obvious to use. == New features == * Category pages can now be moved (bug 5451). * MergeHistory for all administrators by default (bug 66155). * Improvements have been made to the password storage system, allowing improved security against offline attacks should a wiki's database be compromised by attackers. Then, the default password storage algorithm was changed to PBKDF2. PBKDF2 and Bcrypt have built-in support in PHP. The new extensible password API makes it trivial to implement scrypt support if we wanted to. == Usability == * The move feature and other actions are now discoverable in Vector, thanks to a label for the dropdown where they're hidden by default (bug 44591). * Specify default language on a per-page basis * Redirect to Special:UserLogin when logging is in required to proceed, instead of showing an error message == Performance == In 2014, MediaWiki development has a new focus on frontend performance. * (bug 39035) Improved Vector skin performance by removing collapsibleNav, which used to collapse some sidebar elements by default. This removes -list id suffixes like p-lang-list: instead of using things like #p-lang-list, you can do #p-lang .body ul. If you would like CollapsibleNav back please use the CollapsibleVector extension. ==Upgrade notices for MediaWiki administrators== === Breaking changes === * Upgrade jQuery to version 1.11.x: [[mailarchive:wikitech-l/2014-June/076842.html]] * Support for register_globals (deprecated 5 years ago) was dropped, MediaWiki will no longer run with it enabled. * {{!}} is now a magic word that results in |, mainly for use in templates and other complex templates. If your wiki has another template at Template:!, you will need to change the name and update any usage of it. If your Template:! is just |, it can be safely deleted. === API changes === Starting with MediaWiki 1.24, we're cleaning up the API, and working towards an API 2.0. See the roadmap for more details. * Rarely used formats deprecated: dbg, dump, txt, wddx, yaml. These may be removed in a future release. * Token handling overhauled: the action=tokens module is now deprecated and replaced by action=query&meta=tokens. Most actions now just take a generic "csrf" token, and the token type is now properly documented in the auto-generated documentation. * And more! See the RELEASE-NOTES-1.24 file for a full list. === Directory changes === * The legacy '''skins/common/''' directory has been emptied and deleted as part of the skin system cleanup. Files that have been present in it have been moved elsewhere or deleted (if they were unused). If you loaded any of these files as part of your custom skin or on-wiki CSS/JS, you should make a copy of the old files in a non-MediaWiki directory. See the RELEASE-NOTES-1.24 file for the full list of moved/deleted files. === Browser support deprecated or removed === * Full support for Internet Explorer 6 and Internet Explorer 7 has been removed: it will browse MediaWiki without JavaScript. JavaScript fixes specific to it have also been removed. Additional IE6 and IE7 fixes that exist in MediaWiki:Common.js and similar can be safely removed. === Skins no longer loaded after upgrade? === MediaWiki 1.24 no longer uses the skin autodiscovery mechanism to load default skins, instead requiring that the skins be manually loaded in LocalSettings.php, much like extensions (see [[Manual:Skin configuration#Installing skins]]). This will require you to update LocalSettings.php after the upgrade - a prominently displayed warning message should guide you through the process, suggesting the exact configuration that you need to add. If you're upgrading via a tarball release, that is all you need to do. If you're upgrading via git or otherwise from source, note that the skins themselves have been each moved to a separate repository and will need to be installed separately (much like extensions, some basic ones are included in the tarball). === Composer === If you are using extensions managed by composer, make sure to backup your existing composer.json file as it will be overwritten on upgrade. Full release notes: https://git.wikimedia.org/blob/mediawiki%2Fcore.git/1.24.0/RELEASE-NOTES-1.… https://www.mediawiki.org/wiki/Release_notes/1.24 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.24/mediawiki-1.24.0.tar.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.24/mediawiki-1.24.0.tar.gz.sig Public keys: https://www.mediawiki.org/keys/keys.html Mark Hershberger and Markus Glaser (Wiki Release Team)

1 0

Pre-release announcement for MediaWiki releases 1.24.0, 1.23.7, 1.22.14 and 1.19.22
by Markus Glaser 25 Nov '14

25 Nov '14

Hello everyone, this is a notice that on Wednesday, November 27th, between 20:00-22:00 UTC we will release security and maintenance updates for current and supported branches of the MediaWiki software. Downloads and patches will be available at that time. Best, Markus Glaser (Wiki Release Team)

1 0

Correction to prior announcement
by mah＠nichework.com 29 Oct '14

29 Oct '14

Hello everyone, The prior maintenance release announcement email titled MediaWiki Security and Maintenance Releases: 1.23.6, 1.22.13 and 1.19.21 included the word "Security" in the subject. This inclusion was a mistake. There are no security fixes included in these releases. Best, Mark A. Hershberger (Wiki Release Team)

1 0

MediaWiki Security and Maintenance Releases: 1.23.6, 1.22.13 and 1.19.21
by mah＠nichework.com 29 Oct '14

29 Oct '14

Hello everyone, I would like to announce the release of MediaWiki 1.23.6, 1.22.13 and 1.19.21. These are regular maintenance releases. Download links are given at the end of this email. == Bugfixes in 1.23.6 == * (Bug 67440) Allow classes to be registered properly from installer * (Bug 72274) Job queue not running (HTTP 411) due to missing Content-Length: header == Bugfixes in 1.22.12 == * (Bug 67440) Allow classes to be registered properly from installer == Bugfixes in 1.19.21 == * (bug 67440) Allow classes to be registered properly from installer. * (bug 47281) Fixed a dumpBackup.php error with --uploads --include-files options: Unable to find the wrapper "mwstore". System administrators are encouraged to upgrade to this release or 1.22+ and produce a full data dump. https://www.mediawiki.org/wiki/Special:MyLanguage/Manual:Backing_up_a_wiki * (bug 63049) Removed anonymous functions from ApiFormatBase, added in 1.19.13 as part of the fix for bug 61362, for PHP 5.2 compatibility. Full release notes for 1.23.6: <https://www.mediawiki.org/wiki/Release_notes/1.23> Full release notes for 1.22.13: <https://www.mediawiki.org/wiki/Release_notes/1.22> Full release notes for 1.19.21: <https://www.mediawiki.org/wiki/Release_notes/1.19> Public keys: <https://www.mediawiki.org/keys/keys.html> ********************************************************************** 1.23.6 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.23/mediawiki-core-1.23.6.tar.gz https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.6.tar.gz Patch to previous version (1.23.5): https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.6.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.23/mediawiki-core-1.23.6.tar.gz.… https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.6.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.6.patch.gz.sig Note: There is no i18n patch as there are no changes in translation. ********************************************************************** 1.22.13 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.22/mediawiki-core-1.22.13.tar.gz https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.13.tar.gz Patch to previous version (1.22.12): https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.13.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.22/mediawiki-core-1.22.13.tar.gz… https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.13.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.13.patch.gz.sig Note: There is no i18n patch as there are no changes in translation. ********************************************************************** 1.19.21 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.19/mediawiki-core-1.19.21.tar.gz https://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.21.tar.gz Patch to previous version (1.19.20): https://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.21.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.19/mediawiki-core-1.19.21.tar.gz… https://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.21.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.21.patch.gz.sig Note: There is no i18n patch as there are no changes in translation. Mark A. Hershberger (Wiki Release Team)

1 0

Pre-release announcement for MediaWiki releases 1.23.6, 1.22.13 and 1.19.21
by mah＠nichework.com 28 Oct '14

28 Oct '14

Hello everyone, This is a notice that on Wednesday, October 28, 2014, between 20:00-22:00 UTC, we will release maintenance updates for current and supported branches of the MediaWiki software. Downloads and patches will be available at that time. Best, Mark. A. Hershberger (Wiki Release Team)

1 0

Security fixes for CentralAuth and MobileFrontend extensions
by Chris Steipp 08 Oct '14

08 Oct '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 A number of security issues in MediaWiki extensions have been fixed. Users of these extensions should update to the latest version. * CentralAuth: Internal review found multiple issues that have been resolved: ** (bug 70469) Special:MergeAccount failed to validate the anti-csrf token in its forms when performing actions. <https://bugzilla.wikimedia.org/show_bug.cgi?id=70469> ** (bug 70468) The internal function to attach multiple local wiki accounts into a single, global account did not re-check that the requesting user owned the "home wiki" for that username, but assumed that user did own this account. This could allow a user to add their local account edits to a global account that they didn't own. <https://bugzilla.wikimedia.org/show_bug.cgi?id=70468> ** (bug 71749) Incomplete fix for bug 70468. The fix wasn't applied to the new feature where accounts were globalized automatically on login. <https://bugzilla.wikimedia.org/show_bug.cgi?id=71749> ** (bug 70620) When globally renaming a user, the antispoof table, which prevents similar looking names from being created, weren't updated. This potentially allowed another user to register an account with a name that looked identical to the username of a user who had been globally renamed. <https://bugzilla.wikimedia.org/show_bug.cgi?id=70620> * MobileFrontend: (bug 70009) Sherif Mansour discovered that POST parameters were being added to links generated by MobileFrontend, which could reveal the user's password after login. <https://bugzilla.wikimedia.org/show_bug.cgi?id=70009> ********************************************************************** Extension:CentralAuth ********************************************************************** Information and Download: https://www.mediawiki.org/wiki/Extension:CentralAuth ********************************************************************** Extension:MobileFrontend ********************************************************************** Information and Download: https://www.mediawiki.org/wiki/Extension:MobileFrontend -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iF4EAREIAAYFAlQ1lJoACgkQ7h9mNGLYTwGdgAD/X7q6WfaBoE2SdKjZeoLE9yvs wg07Fs4kytmmSQDXa4IBAKBgaYuhuRt5j+G5Q9YNdfCCkvlSqnz7heCIX1Ddn5ma =cOb1 -----END PGP SIGNATURE-----

1 0

MediaWiki Security and Maintenance Releases: 1.19.20, 1.22.12 and 1.23.5
by Markus Glaser 02 Oct '14

02 Oct '14

Hello everyone, I would like to announce the release of MediaWiki 1.19.20, 1.22.12 and 1.23.5. This is a security release. Download links are given at the end of this email. == Security == * (bug 70672) SECURITY: OutputPage: Remove separation of css and js module allowance. Full release notes for 1.23.5: <https://www.mediawiki.org/wiki/Release_notes/1.23> Full release notes for 1.22.12: <https://www.mediawiki.org/wiki/Release_notes/1.22> Full release notes for 1.19.20: <https://www.mediawiki.org/wiki/Release_notes/1.19> Public keys: <https://www.mediawiki.org/keys/keys.html> ********************************************************************** 1.23.5 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.5.tar.gz Patch to previous version (1.23.4): https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.5.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.23/mediawiki-core-1.23.5.tar.gz.… https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.5.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.5.patch.gz.sig Note: There is no i18n patch as there are no changes in translation. ********************************************************************** 1.22.12 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.12.tar.gz Patch to previous version (1.22.11): https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.12.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.22/mediawiki-core-1.22.12.tar.gz… https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.12.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.12.patch.gz.sig Note: There is no i18n patch as there are no changes in translation. ********************************************************************** 1.19.20 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.20.tar.gz Patch to previous version (1.19.19): https://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.20.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.19/mediawiki-core-1.19.20.tar.gz… https://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.20.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.20.patch.gz.sig Note: There is no i18n patch as there are no changes in translation. Markus Glaser (Wiki Release Team)

1 0

Pre-release announcement for MediaWiki releases 1.19.20, 1.22.12 and 1.23.5
by Markus Glaser 01 Oct '14

01 Oct '14

Hello everyone, this is a notice that on Wednesday, 1st October 2014, between 20:00-22:00 UTC we will release security updates for current and supported branches of the MediaWiki software. Downloads and patches will be available at that time. Best, Markus Glaser (Wiki Release Team)

1 0

← Newer
1
...
14
15
16
17
18
19
20
...
34
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

MediaWiki-announce