MediaWiki-announce

mediawiki-announce@lists.wikimedia.org

1 participants
334 discussions

Security fixes for CentralAuth and MobileFrontend extensions
by Chris Steipp 08 Oct '14

08 Oct '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 A number of security issues in MediaWiki extensions have been fixed. Users of these extensions should update to the latest version. * CentralAuth: Internal review found multiple issues that have been resolved: ** (bug 70469) Special:MergeAccount failed to validate the anti-csrf token in its forms when performing actions. <https://bugzilla.wikimedia.org/show_bug.cgi?id=70469> ** (bug 70468) The internal function to attach multiple local wiki accounts into a single, global account did not re-check that the requesting user owned the "home wiki" for that username, but assumed that user did own this account. This could allow a user to add their local account edits to a global account that they didn't own. <https://bugzilla.wikimedia.org/show_bug.cgi?id=70468> ** (bug 71749) Incomplete fix for bug 70468. The fix wasn't applied to the new feature where accounts were globalized automatically on login. <https://bugzilla.wikimedia.org/show_bug.cgi?id=71749> ** (bug 70620) When globally renaming a user, the antispoof table, which prevents similar looking names from being created, weren't updated. This potentially allowed another user to register an account with a name that looked identical to the username of a user who had been globally renamed. <https://bugzilla.wikimedia.org/show_bug.cgi?id=70620> * MobileFrontend: (bug 70009) Sherif Mansour discovered that POST parameters were being added to links generated by MobileFrontend, which could reveal the user's password after login. <https://bugzilla.wikimedia.org/show_bug.cgi?id=70009> ********************************************************************** Extension:CentralAuth ********************************************************************** Information and Download: https://www.mediawiki.org/wiki/Extension:CentralAuth ********************************************************************** Extension:MobileFrontend ********************************************************************** Information and Download: https://www.mediawiki.org/wiki/Extension:MobileFrontend -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iF4EAREIAAYFAlQ1lJoACgkQ7h9mNGLYTwGdgAD/X7q6WfaBoE2SdKjZeoLE9yvs wg07Fs4kytmmSQDXa4IBAKBgaYuhuRt5j+G5Q9YNdfCCkvlSqnz7heCIX1Ddn5ma =cOb1 -----END PGP SIGNATURE-----

1 0

MediaWiki Security and Maintenance Releases: 1.19.20, 1.22.12 and 1.23.5
by Markus Glaser 02 Oct '14

02 Oct '14

Hello everyone, I would like to announce the release of MediaWiki 1.19.20, 1.22.12 and 1.23.5. This is a security release. Download links are given at the end of this email. == Security == * (bug 70672) SECURITY: OutputPage: Remove separation of css and js module allowance. Full release notes for 1.23.5: <https://www.mediawiki.org/wiki/Release_notes/1.23> Full release notes for 1.22.12: <https://www.mediawiki.org/wiki/Release_notes/1.22> Full release notes for 1.19.20: <https://www.mediawiki.org/wiki/Release_notes/1.19> Public keys: <https://www.mediawiki.org/keys/keys.html> ********************************************************************** 1.23.5 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.5.tar.gz Patch to previous version (1.23.4): https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.5.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.23/mediawiki-core-1.23.5.tar.gz.… https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.5.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.5.patch.gz.sig Note: There is no i18n patch as there are no changes in translation. ********************************************************************** 1.22.12 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.12.tar.gz Patch to previous version (1.22.11): https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.12.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.22/mediawiki-core-1.22.12.tar.gz… https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.12.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.12.patch.gz.sig Note: There is no i18n patch as there are no changes in translation. ********************************************************************** 1.19.20 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.20.tar.gz Patch to previous version (1.19.19): https://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.20.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.19/mediawiki-core-1.19.20.tar.gz… https://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.20.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.20.patch.gz.sig Note: There is no i18n patch as there are no changes in translation. Markus Glaser (Wiki Release Team)

1 0

Pre-release announcement for MediaWiki releases 1.19.20, 1.22.12 and 1.23.5
by Markus Glaser 01 Oct '14

01 Oct '14

Hello everyone, this is a notice that on Wednesday, 1st October 2014, between 20:00-22:00 UTC we will release security updates for current and supported branches of the MediaWiki software. Downloads and patches will be available at that time. Best, Markus Glaser (Wiki Release Team)

1 0

MediaWiki Security and Maintenance Releases: 1.19.19, 1.22.11 and 1.23.4
by Markus Glaser 24 Sep '14

24 Sep '14

Hello everyone, I would like to announce the release of MediaWiki 1.19.19, 1.22.11 and 1.23.4. This is a regular security and maintenance release. Download links are given at the end of this email. == Security == * (bug 69008) SECURITY: Enhance CSS filtering in SVG files. Filter <style> elements; normalize style elements and attributes before filtering; add checks for attributes that contain css; add unit tests for html5sec and reported bugs. == Bugfixes in 1.23.4 == * (bug 65998) Make MySQLi work with non-standard socket. * (bug 66986) GlobalVarConfig shouldn't throw exceptions for null-valued config settings. Full release notes for 1.23.4: <https://www.mediawiki.org/wiki/Release_notes/1.23> Full release notes for 1.22.11: <https://www.mediawiki.org/wiki/Release_notes/1.22> Full release notes for 1.19.19: <https://www.mediawiki.org/wiki/Release_notes/1.19> Public keys: <https://www.mediawiki.org/keys/keys.html> ********************************************************************** 1.23.4 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.4.tar.gz Patch to previous version (1.23.3): https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.4.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.23/mediawiki-core-1.23.4.tar.gz.… https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.4.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.4.patch.gz.sig Note: There is no i18n patch as there are no changes in translation. ********************************************************************** 1.22.11 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.11.tar.gz Patch to previous version (1.22.10): https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.11.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.22/mediawiki-core-1.22.11.tar.gz… https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.11.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.11.patch.gz.sig Note: There is no i18n patch as there are no changes in translation. ********************************************************************** 1.19.19 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.19.tar.gz Patch to previous version (1.19.18): https://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.19.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.19/mediawiki-core-1.19.19.tar.gz… https://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.19.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.19.patch.gz.sig Note: There is no i18n patch as there are no changes in translation. Markus Glaser (Wiki Release Team)

1 0

Pre-release announcement for MediaWiki releases 1.19.19, 1.22.11 and 1.23.4
by Markus Glaser 23 Sep '14

23 Sep '14

Hello everyone, this is a notice that on Wednesday, September 24th between 20:00-23:00 UTC we will release security and maintenance updates for current and supported branches of the MediaWiki software. Downloads and patches will be available at that time. Best, Markus Glaser (WikiReleaseTeam)

1 0

MediaWiki Security and Maintenance Releases: 1.22.10 and 1.23.3
by Markus Glaser 27 Aug '14

27 Aug '14

Hello everyone, I would like to announce the release of MediaWiki 1.22.10 and 1.23.3. This is a regular maintenance release. Download links are given at the end of this email. == Bugfixes in 1.23.3 == * (bug 68501) Correctly handle incorrect namespace in cleanupTitles.php. * (bug 64970) Fix support for blobs on DatabaseOracle::update. * (bug 66574) Display MediaWiki:Loginprompt on the login page. * (bug 67870) wfShellExec() cuts off stdout at multiples of 8192 bytes. * (bug 60629) Handle invalid language code gracefully in Language::fetchLanguageNames. * (bug 62017) Restore the number of rows shown on Special:Watchlist. * Check for boolean false result from database query in SqlBagOStuff. == Bugfixes in 1.22.10 == * (bug 64970) Fix support for blobs on DatabaseOracle::update Full release notes for 1.23.3: <https://www.mediawiki.org/wiki/Release_notes/1.23> Full release notes for 1.22.10: <https://www.mediawiki.org/wiki/Release_notes/1.22> Public keys: <https://www.mediawiki.org/keys/keys.html> ********************************************************************** 1.23.3 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.3.tar.gz Patch to previous version (1.23.2): https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.3.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.23/mediawiki-core-1.23.3.tar.gz.… https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.3.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.3.patch.gz.sig Note: There is no i18n patch as there are no changes in translation. ********************************************************************** 1.22.10 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.10.tar.gz Patch to previous version (1.22.9): https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.10.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.22/mediawiki-core-1.22.10.tar.gz… https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.10.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.10.patch.gz.sig Note: There is no i18n patch as there are no changes in translation. Markus Glaser (Wiki Release Team)

1 0

Pre-release announcement for MediaWiki releases 1.22.10 and 1.23.3
by Markus Glaser 27 Aug '14

27 Aug '14

Hello everyone, this is a notice that on 27th August between 20:00-22:00 UTC we will release maintenance updates for current and legacy branches of the MediaWiki software. Downloads and patches will be available at that time. Best, Markus Wiki Release Team

1 0

MediaWiki Security and Maintenance Releases: 1.19.18, 1.22.9 and 1.23.2
by Markus Glaser 30 Jul '14

30 Jul '14

Hello everyone, I would like to announce the release of MediaWiki 1.23.2, 1.22.9 and 1.19.18. This is a regular security and maintenance release. Download links are given at the end of this email. == Security == * (bug 68187) SECURITY: Prepend jsonp callback with comment. * (bug 66608) SECURITY: Fix for XSS issue in bug 66608: Generate the URL used for loading a new page in Javascript,instead of relying on the URL in the link that has been clicked. * (bug 65778) SECURITY: Copy prevent-clickjacking between OutputPage and ParserOutput. == Bugfixes in 1.23.2 == * (bug 68313) Preferences: Turn stubthreshold back into a combo box. * (bug 65214) Fix initSiteStats.php maintenance script. * (bug 67594) Special:ActiveUsers: Fix to work with PostgreSQL. == Bugfixes in 1.22.9 == * (bug 59147) The img_metadata field was not being decoded from bytea into text. Full release notes for 1.23.2: <https://www.mediawiki.org/wiki/Release_notes/1.23> Full release notes for 1.22.9: <https://www.mediawiki.org/wiki/Release_notes/1.22> Full release notes for 1.19.18: <https://www.mediawiki.org/wiki/Release_notes/1.19> Public keys: <https://www.mediawiki.org/keys/keys.html> ********************************************************************** 1.23.2 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.2.tar.gz Patch to previous version (1.23.1): https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.2.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.23/mediawiki-core-1.23.2.tar.gz.… https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.2.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.2.patch.gz.sig Note: There is no i18n patch as there are no changes in translation. ********************************************************************** 1.22.9 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.9.tar.gz Patch to previous version (1.22.8): https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.9.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.22/mediawiki-core-1.22.9.tar.gz.… https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.9.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.9.patch.gz.sig Note: There is no i18n patch as there are no changes in translation. ********************************************************************** 1.19.18 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.18.tar.gz Patch to previous version (1.19.17): https://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.18.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.19/mediawiki-core-1.19.18.tar.gz… https://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.18.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.18.patch.gz.sig Note: There is no i18n patch as there are no changes in translation. Markus Glaser (Release Management Team) P.S.: If you are interested in shaping the future of MediaWiki, come join our session about a MediaWiki user group at Wikimania: http://wikimania2014.wikimedia.org/wiki/Submissions/How_about_a_MediaWiki_C… . Email us at glaser(a)hallowelt.biz or mah(a)nichework.com if you would like to participate remotely.

1 0

Pre-release announcement for MediaWiki releases 1.19.18, 1.22.9 and 1.23.2
by Markus Glaser 29 Jul '14

29 Jul '14

Hello everyone, this is a notice that on Wednesday, July 30th, between 20:00-22:00 UTC we will release security and maintenance updates for current and supported branches of the MediaWiki software. Downloads and patches will be available at that time. Best, Markus (mglaser), Release Team

1 0

MediaWiki Security and Maintenance Releases: 1.19.17, 1.21.11, 1.22.8 and 1.23.1
by Markus Glaser 25 Jun '14

25 Jun '14

Hello everyone, I would like to announce the release of MediaWiki 1.19.17, 1.21.11, 1.22.8 and 1.23.1. This is a regular security and maintenance release. Download links are given at the end of this email. == Security == * (bug 65839) SECURITY: Prevent external resources in SVG files. == Bugfixes in 1.23.1 == * (bug 67025) Special:Watchlist: Don't try to render empty row * (bug 66922) Don't allow some E_NOTICE messages to end up in the LocalSettings.php. * (bug 66467) Filebackend: Avoid using popen() when "parallelize" is disabled * (bug 66428) MimeMagic: Don't seek before BOF. This has weird side effects like only extracting the tail of the file partially or not at all. * (bug 66182) Removed -x flag on some php files. == Bugfixes in 1.22.8 == * (bug 66428) MimeMagic: Don't seek before BOF. This has weird side effects like only extracting the tail of the file partially or not at all. == Bugfixes in 1.21.11 == * (bug 66428) MimeMagic: Don't seek before BOF. This has weird side effects like only extracting the tail of the file partially or not at all. == Bugfixes in 1.19.17 == * (bug 66428) MimeMagic: Don't seek before BOF. This has weird side effects like only extracting the tail of the file partially or not at all. Full release notes for 1.23.1: <https://www.mediawiki.org/wiki/Release_notes/1.23> Full release notes for 1.22.8: <https://www.mediawiki.org/wiki/Release_notes/1.22> Full release notes for 1.21.11: <https://www.mediawiki.org/wiki/Release_notes/1.21> Full release notes for 1.19.17: <https://www.mediawiki.org/wiki/Release_notes/1.19> Public keys: <https://www.mediawiki.org/keys/keys.html> ********************************************************************** 1.23.1 ********************************************************************** Download: http://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.1.tar.gz Patch to previous version (1.23.0): http://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.1.patch.gz GPG signatures: http://releases.wikimedia.org/mediawiki/1.23/mediawiki-core-1.23.1.tar.gz.s… http://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.1.tar.gz.sig http://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.1.patch.gz.sig Note: There is no i18n patch as there are no changes in translation. ********************************************************************** 1.22.8 ********************************************************************** Download: http://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.8.tar.gz Patch to previous version (1.22.7): http://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.8.patch.gz GPG signatures: http://releases.wikimedia.org/mediawiki/1.22/mediawiki-core-1.22.8.tar.gz.s… http://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.8.tar.gz.sig http://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.8.patch.gz.sig Note: There is no i18n patch as there are no changes in translation. ********************************************************************** 1.21.11 ********************************************************************** Download: http://releases.wikimedia.org/mediawiki/1.21/mediawiki-1.21.11.tar.gz Patch to previous version (1.21.10): http://releases.wikimedia.org/mediawiki/1.21/mediawiki-1.21.11.patch.gz GPG signatures: http://releases.wikimedia.org/mediawiki/1.21/mediawiki-core-1.21.11.tar.gz.… http://releases.wikimedia.org/mediawiki/1.21/mediawiki-1.21.11.tar.gz.sig http://releases.wikimedia.org/mediawiki/1.21/mediawiki-1.21.11.patch.gz.sig Note: There is no i18n patch as there are no changes in translation. ********************************************************************** 1.19.17 ********************************************************************** Download: http://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.17.tar.gz Patch to previous version (1.19.16): http://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.17.patch.gz GPG signatures: http://releases.wikimedia.org/mediawiki/1.19/mediawiki-core-1.19.17.tar.gz.… http://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.17.tar.gz.sig http://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.17.patch.gz.sig Note: There is no i18n patch as there are no changes in translation. Markus Glaser (Release Team)

1 0

← Newer
1
...
15
16
17
18
19
20
21
...
34
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

MediaWiki-announce