MediaWiki-announce

mediawiki-announce@lists.wikimedia.org

1 participants
334 discussions

Pre-Release Announcement for MediaWiki 1.19.24, 1.23.9, 1.24.2
by Chris Steipp 30 Mar '15

30 Mar '15

This is a notice that on Tuesday, March 31st between 21:00-22:00 UTC (2-3pm PDT) Wikimedia Foundation will release security updates for current and supported branches of the MediaWiki software. Downloads and patches will be available at that time.

1 0

MediaWiki Security and Maintenance Releases: 1.24.1, 1.23.8, 1.22.15 and 1.19.23
by Markus Glaser 17 Dec '14

17 Dec '14

Hello everyone, I would like to announce the release of MediaWiki 1.24.1, 1.23.8, 1.22.15 and 1.19.23. This is a regular security and maintenance release. Download links are given at the end of this email. Please note this release marks the end of lifetime for MediaWiki 1.22 branch. == Security fixes in 1.24.1, 1.23.8, 1.22.15 and 1.19.23 == * (bug T76686) [SECURITY] thumb.php outputs wikitext message as raw HTML, which could lead to xss. Permission to edit MediaWiki namespace is required to exploit this. * (bug T77028) [SECURITY] Malicious site can bypass CORS restrictions in $wgCrossSiteAJAXdomains in API calls if it only included an allowed domain as part of its name. == Bugfixes == * (bug T74222) The original patch for T74222 was reverted as unnecessary. * Fixed a couple of entries in RELEASE-NOTES-1.24. * (bug T76168) OutputPage: Add accessors for some protected properties. * (bug T74834) Make 1.24 branch directly installable under PostgreSQL. * Add missing $ in front of variable in OutputPage.php == Security fixes in extensions == * (bug T77624) [SECURITY] Extension:Listings: missing validation in the 'name' and 'url' parameters. * (bug T73111) [SECURITY] Extension:ExpandTemplates: parses user input as wikitext and shows a preview, yet it fails to add an edit token to the form and check it. This can be exploited as an XSS when $wgRawHtml = true. Note this only affects the 1.19/1.22 branches. * (bug T76195) [SECURITY] Extension:TemplateSandbox: Special:TemplateSandbox needs edit token when raw HTML is allowed * (bug T69180) [SECURITY] Extension:Hovercards: XSS in text extracts. * (bug T73167) [SECURITY] Extension:Scribunto allows cross-origin leakage of data from a wiki through timing * (bug T71209) [SECURITY] Extension:TimedMediaHandler: Patch getid3 library for CVE-2014-2053. Full release notes for 1.24.1: <https://www.mediawiki.org/wiki/Release_notes/1.24> Full release notes for 1.23.8: <https://www.mediawiki.org/wiki/Release_notes/1.23> Full release notes for 1.22.15: <https://www.mediawiki.org/wiki/Release_notes/1.22> Full release notes for 1.19.23: <https://www.mediawiki.org/wiki/Release_notes/1.19> Public keys: <https://www.mediawiki.org/keys/keys.html> ********************************************************************** 1.24.1 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.24/mediawiki-1.24.1.tar.gz Patch to previous version (1.24.0): https://releases.wikimedia.org/mediawiki/1.24/mediawiki-1.24.1.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.24/mediawiki-core-1.24.1.tar.gz.… https://releases.wikimedia.org/mediawiki/1.24/mediawiki-1.24.1.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.24/mediawiki-1.24.1.patch.gz.sig ********************************************************************** 1.23.8 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.8.tar.gz Patch to previous version (1.23.7): https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.8.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.23/mediawiki-core-1.23.8.tar.gz.… https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.8.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.8.patch.gz.sig ********************************************************************** 1.22.15 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.15.tar.gz Patch to previous version (1.22.14): https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.15.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.22/mediawiki-core-1.22.15.tar.gz… https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.15.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.15.patch.gz.sig ********************************************************************** 1.19.23 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.23.tar.gz Patch to previous version (1.19.22): https://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.23.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.19/mediawiki-core-1.19.23.tar.gz… https://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.23.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.23.patch.gz.sig Markus Glaser (Wiki Release Team)

1 0

Pre-release announcement for MediaWiki releases 1.24.1, 1.23.8, 1.22.15 and 1.19.23
by Markus Glaser 17 Dec '14

17 Dec '14

Hello everyone, this is a notice that on Wednesday, December 17th, between 19:00-21:00 UTC we will release security and maintenance updates for current and supported branches of the MediaWiki software. Downloads and patches will be available at that time. Best, Markus Glaser (Wiki Release Team)

1 0

End of lifetime announcement for MediaWiki 1.22
by Markus Glaser 27 Nov '14

27 Nov '14

Hello everyone, with the release of MediaWiki 1.24, the lifetime of MediaWiki version 1.22 ends. There will be a final maintenance release on 17th of December, 2014. The new legacy version is 1.23. Users still using MediaWiki 1.22 are advised to upgrade to version 1.24.0 (latest stable) or 1.23.7 (legacy and LTS version). MediaWiki 1.19 LTS will continue to be supported until May, 2015. Best, Mark Hershberger and Markus Glaser (Wiki Release Team)

1 0

MediaWiki Security and Maintenance Releases: 1.23.7, 1.22.14 and 1.19.22
by Markus Glaser 27 Nov '14

27 Nov '14

Hello everyone, I would like to announce the release of MediaWiki 1.23.7, 1.22.14 and 1.19.22. This is a regular security and maintenance release. Download links are given at the end of this email. == Security fixes == * (bugs 66776, 71478) SECURITY: User PleaseStand reported a way to inject code into API clients that used format=php to process pages that underwent flash policy mangling. This was fixed along with improving how the mangling was done for format=json, and allowing sites to disable the mangling using $wgMangleFlashPolicy. <https://phabricator.wikimedia.org/T68776> <https://phabricator.wikimedia.org/T73478> * (bug 70901) SECURITY: User Jackmcbarn reported that the ability to update the content model for a page could allow an unprivileged attacker to edit another user's common.js under certain circumstances. The user right "editcontentmodel" was added, and is needed to change a revision's content model. <https://phabricator.wikimedia.org/T72901> * (bug 71111) SECURITY: User PleaseStand reported that on wikis that allow raw HTML, it is not safe to preview wikitext coming from an untrusted source such as a cross-site request. Thus add an edit token to the form, and when raw HTML is allowed, ensure the token is provided before showing the preview. This check is not performed on wikis that both allow raw HTML and anonymous editing, since there are easier ways to exploit that scenario. <https://phabricator.wikimedia.org/T73111> * (bug 72222) SECURITY: Do not show log action when the entry is revdeleted with DELETED_ACTION. NOTICE: this may be reverted in a future release pending a public RFC about the desired functionality. This issue was reported by user Bawolff. <https://phabricator.wikimedia.org/T74222> == Bugfixes == * (bug 71621) Make allowing site-wide styles on restricted special pages a config option. <https://phabricator.wikimedia.org/T73621> * (bug 42723) Added updated version history from 1.19.2 to 1.22.13 <https://phabricator.wikimedia.org/T44723> * $wgMangleFlashPolicy was added to make MediaWiki's mangling of anything that might be a flash policy directive configurable. Full release notes for 1.23.7: <https://www.mediawiki.org/wiki/Release_notes/1.23> Full release notes for 1.22.14: <https://www.mediawiki.org/wiki/Release_notes/1.22> Full release notes for 1.19.22: <https://www.mediawiki.org/wiki/Release_notes/1.19> Public keys: <https://www.mediawiki.org/keys/keys.html> ********************************************************************** 1.23.7 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.7.tar.gz https://releases.wikimedia.org/mediawiki/1.23/mediawiki-core-1.23.7.tar.gz Patch to previous version (1.23.6): https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.7.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.23/mediawiki-core-1.23.7.tar.gz.… https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.7.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.7.patch.gz.sig ********************************************************************** 1.22.14 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.14.tar.gz Patch to previous version (1.22.13): https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.14.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.22/mediawiki-core-1.22.14.tar.gz… https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.14.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.14.patch.gz.sig ********************************************************************** 1.19.22 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.22.tar.gz Patch to previous version (1.19.21): https://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.22.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.19/mediawiki-core-1.19.22.tar.gz… https://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.22.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.22.patch.gz.sig Mark Hershberger and Markus Glaser (Wiki Release Team)

1 0

MediaWiki 1.24.0 released
by Markus Glaser 27 Nov '14

27 Nov '14

Hello everyone, I am happy to announce the availability of the first stable release of the new MediaWiki 1.24 release series. MediaWiki 1.24 is a large release that contains many new features and bug fixes. This is a summary of the major changes of interest to users. You can consult the RELEASE-NOTES-1.24 file for the full list of changes in this version. Our thanks to everyone who helped to improve MediaWiki by testing the release candidates and submitting bug reports. == What's new? == MediaWiki 1.24 includes all changes released in the smaller 1.24wmfX software deployments to Wikimedia sites. == Preferences made easier == MediaWiki is known to be extremely flexible and customisable, but few users use its full potential. In 1.24, we aim to make dozens obscure preferences easily discoverable and obvious to use. == New features == * Category pages can now be moved (bug 5451). * MergeHistory for all administrators by default (bug 66155). * Improvements have been made to the password storage system, allowing improved security against offline attacks should a wiki's database be compromised by attackers. Then, the default password storage algorithm was changed to PBKDF2. PBKDF2 and Bcrypt have built-in support in PHP. The new extensible password API makes it trivial to implement scrypt support if we wanted to. == Usability == * The move feature and other actions are now discoverable in Vector, thanks to a label for the dropdown where they're hidden by default (bug 44591). * Specify default language on a per-page basis * Redirect to Special:UserLogin when logging is in required to proceed, instead of showing an error message == Performance == In 2014, MediaWiki development has a new focus on frontend performance. * (bug 39035) Improved Vector skin performance by removing collapsibleNav, which used to collapse some sidebar elements by default. This removes -list id suffixes like p-lang-list: instead of using things like #p-lang-list, you can do #p-lang .body ul. If you would like CollapsibleNav back please use the CollapsibleVector extension. ==Upgrade notices for MediaWiki administrators== === Breaking changes === * Upgrade jQuery to version 1.11.x: [[mailarchive:wikitech-l/2014-June/076842.html]] * Support for register_globals (deprecated 5 years ago) was dropped, MediaWiki will no longer run with it enabled. * {{!}} is now a magic word that results in |, mainly for use in templates and other complex templates. If your wiki has another template at Template:!, you will need to change the name and update any usage of it. If your Template:! is just |, it can be safely deleted. === API changes === Starting with MediaWiki 1.24, we're cleaning up the API, and working towards an API 2.0. See the roadmap for more details. * Rarely used formats deprecated: dbg, dump, txt, wddx, yaml. These may be removed in a future release. * Token handling overhauled: the action=tokens module is now deprecated and replaced by action=query&meta=tokens. Most actions now just take a generic "csrf" token, and the token type is now properly documented in the auto-generated documentation. * And more! See the RELEASE-NOTES-1.24 file for a full list. === Directory changes === * The legacy '''skins/common/''' directory has been emptied and deleted as part of the skin system cleanup. Files that have been present in it have been moved elsewhere or deleted (if they were unused). If you loaded any of these files as part of your custom skin or on-wiki CSS/JS, you should make a copy of the old files in a non-MediaWiki directory. See the RELEASE-NOTES-1.24 file for the full list of moved/deleted files. === Browser support deprecated or removed === * Full support for Internet Explorer 6 and Internet Explorer 7 has been removed: it will browse MediaWiki without JavaScript. JavaScript fixes specific to it have also been removed. Additional IE6 and IE7 fixes that exist in MediaWiki:Common.js and similar can be safely removed. === Skins no longer loaded after upgrade? === MediaWiki 1.24 no longer uses the skin autodiscovery mechanism to load default skins, instead requiring that the skins be manually loaded in LocalSettings.php, much like extensions (see [[Manual:Skin configuration#Installing skins]]). This will require you to update LocalSettings.php after the upgrade - a prominently displayed warning message should guide you through the process, suggesting the exact configuration that you need to add. If you're upgrading via a tarball release, that is all you need to do. If you're upgrading via git or otherwise from source, note that the skins themselves have been each moved to a separate repository and will need to be installed separately (much like extensions, some basic ones are included in the tarball). === Composer === If you are using extensions managed by composer, make sure to backup your existing composer.json file as it will be overwritten on upgrade. Full release notes: https://git.wikimedia.org/blob/mediawiki%2Fcore.git/1.24.0/RELEASE-NOTES-1.… https://www.mediawiki.org/wiki/Release_notes/1.24 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.24/mediawiki-1.24.0.tar.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.24/mediawiki-1.24.0.tar.gz.sig Public keys: https://www.mediawiki.org/keys/keys.html Mark Hershberger and Markus Glaser (Wiki Release Team)

1 0

Pre-release announcement for MediaWiki releases 1.24.0, 1.23.7, 1.22.14 and 1.19.22
by Markus Glaser 26 Nov '14

26 Nov '14

Hello everyone, this is a notice that on Wednesday, November 27th, between 20:00-22:00 UTC we will release security and maintenance updates for current and supported branches of the MediaWiki software. Downloads and patches will be available at that time. Best, Markus Glaser (Wiki Release Team)

1 0

Correction to prior announcement
by mah＠nichework.com 29 Oct '14

29 Oct '14

Hello everyone, The prior maintenance release announcement email titled MediaWiki Security and Maintenance Releases: 1.23.6, 1.22.13 and 1.19.21 included the word "Security" in the subject. This inclusion was a mistake. There are no security fixes included in these releases. Best, Mark A. Hershberger (Wiki Release Team)

1 0

MediaWiki Security and Maintenance Releases: 1.23.6, 1.22.13 and 1.19.21
by mah＠nichework.com 29 Oct '14

29 Oct '14

Hello everyone, I would like to announce the release of MediaWiki 1.23.6, 1.22.13 and 1.19.21. These are regular maintenance releases. Download links are given at the end of this email. == Bugfixes in 1.23.6 == * (Bug 67440) Allow classes to be registered properly from installer * (Bug 72274) Job queue not running (HTTP 411) due to missing Content-Length: header == Bugfixes in 1.22.12 == * (Bug 67440) Allow classes to be registered properly from installer == Bugfixes in 1.19.21 == * (bug 67440) Allow classes to be registered properly from installer. * (bug 47281) Fixed a dumpBackup.php error with --uploads --include-files options: Unable to find the wrapper "mwstore". System administrators are encouraged to upgrade to this release or 1.22+ and produce a full data dump. https://www.mediawiki.org/wiki/Special:MyLanguage/Manual:Backing_up_a_wiki * (bug 63049) Removed anonymous functions from ApiFormatBase, added in 1.19.13 as part of the fix for bug 61362, for PHP 5.2 compatibility. Full release notes for 1.23.6: <https://www.mediawiki.org/wiki/Release_notes/1.23> Full release notes for 1.22.13: <https://www.mediawiki.org/wiki/Release_notes/1.22> Full release notes for 1.19.21: <https://www.mediawiki.org/wiki/Release_notes/1.19> Public keys: <https://www.mediawiki.org/keys/keys.html> ********************************************************************** 1.23.6 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.23/mediawiki-core-1.23.6.tar.gz https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.6.tar.gz Patch to previous version (1.23.5): https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.6.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.23/mediawiki-core-1.23.6.tar.gz.… https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.6.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.6.patch.gz.sig Note: There is no i18n patch as there are no changes in translation. ********************************************************************** 1.22.13 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.22/mediawiki-core-1.22.13.tar.gz https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.13.tar.gz Patch to previous version (1.22.12): https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.13.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.22/mediawiki-core-1.22.13.tar.gz… https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.13.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.13.patch.gz.sig Note: There is no i18n patch as there are no changes in translation. ********************************************************************** 1.19.21 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.19/mediawiki-core-1.19.21.tar.gz https://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.21.tar.gz Patch to previous version (1.19.20): https://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.21.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.19/mediawiki-core-1.19.21.tar.gz… https://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.21.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.21.patch.gz.sig Note: There is no i18n patch as there are no changes in translation. Mark A. Hershberger (Wiki Release Team)

1 0

Pre-release announcement for MediaWiki releases 1.23.6, 1.22.13 and 1.19.21
by mah＠nichework.com 29 Oct '14

29 Oct '14

Hello everyone, This is a notice that on Wednesday, October 28, 2014, between 20:00-22:00 UTC, we will release maintenance updates for current and supported branches of the MediaWiki software. Downloads and patches will be available at that time. Best, Mark. A. Hershberger (Wiki Release Team)

1 0

← Newer
1
...
14
15
16
17
18
19
20
...
34
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

MediaWiki-announce