Mediawiki-enterprise November 2014

mediawiki-enterprise@lists.wikimedia.org

3 participants
5 discussions

End of lifetime announcement for MediaWiki 1.22
by Markus Glaser 26 Nov '14

26 Nov '14

Hello everyone, with the release of MediaWiki 1.24, the lifetime of MediaWiki version 1.22 ends. There will be a final maintenance release on 17th of December, 2014. The new legacy version is 1.23. Users still using MediaWiki 1.22 are advised to upgrade to version 1.24.0 (latest stable) or 1.23.7 (legacy and LTS version). MediaWiki 1.19 LTS will continue to be supported until May, 2015. Best, Mark Hershberger and Markus Glaser (Wiki Release Team)

1 0

MediaWiki Security and Maintenance Releases: 1.23.7, 1.22.14 and 1.19.22
by Markus Glaser 26 Nov '14

26 Nov '14

Hello everyone, I would like to announce the release of MediaWiki 1.23.7, 1.22.14 and 1.19.22. This is a regular security and maintenance release. Download links are given at the end of this email. == Security fixes == * (bugs 66776, 71478) SECURITY: User PleaseStand reported a way to inject code into API clients that used format=php to process pages that underwent flash policy mangling. This was fixed along with improving how the mangling was done for format=json, and allowing sites to disable the mangling using $wgMangleFlashPolicy. <https://phabricator.wikimedia.org/T68776> <https://phabricator.wikimedia.org/T73478> * (bug 70901) SECURITY: User Jackmcbarn reported that the ability to update the content model for a page could allow an unprivileged attacker to edit another user's common.js under certain circumstances. The user right "editcontentmodel" was added, and is needed to change a revision's content model. <https://phabricator.wikimedia.org/T72901> * (bug 71111) SECURITY: User PleaseStand reported that on wikis that allow raw HTML, it is not safe to preview wikitext coming from an untrusted source such as a cross-site request. Thus add an edit token to the form, and when raw HTML is allowed, ensure the token is provided before showing the preview. This check is not performed on wikis that both allow raw HTML and anonymous editing, since there are easier ways to exploit that scenario. <https://phabricator.wikimedia.org/T73111> * (bug 72222) SECURITY: Do not show log action when the entry is revdeleted with DELETED_ACTION. NOTICE: this may be reverted in a future release pending a public RFC about the desired functionality. This issue was reported by user Bawolff. <https://phabricator.wikimedia.org/T74222> == Bugfixes == * (bug 71621) Make allowing site-wide styles on restricted special pages a config option. <https://phabricator.wikimedia.org/T73621> * (bug 42723) Added updated version history from 1.19.2 to 1.22.13 <https://phabricator.wikimedia.org/T44723> * $wgMangleFlashPolicy was added to make MediaWiki's mangling of anything that might be a flash policy directive configurable. Full release notes for 1.23.7: <https://www.mediawiki.org/wiki/Release_notes/1.23> Full release notes for 1.22.14: <https://www.mediawiki.org/wiki/Release_notes/1.22> Full release notes for 1.19.22: <https://www.mediawiki.org/wiki/Release_notes/1.19> Public keys: <https://www.mediawiki.org/keys/keys.html> ********************************************************************** 1.23.7 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.7.tar.gz https://releases.wikimedia.org/mediawiki/1.23/mediawiki-core-1.23.7.tar.gz Patch to previous version (1.23.6): https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.7.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.23/mediawiki-core-1.23.7.tar.gz.… https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.7.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.7.patch.gz.sig ********************************************************************** 1.22.14 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.14.tar.gz Patch to previous version (1.22.13): https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.14.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.22/mediawiki-core-1.22.14.tar.gz… https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.14.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.14.patch.gz.sig ********************************************************************** 1.19.22 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.22.tar.gz Patch to previous version (1.19.21): https://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.22.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.19/mediawiki-core-1.19.22.tar.gz… https://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.22.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.22.patch.gz.sig Mark Hershberger and Markus Glaser (Wiki Release Team)

1 0

MediaWiki 1.24.0 released
by Markus Glaser 26 Nov '14

26 Nov '14

Hello everyone, I am happy to announce the availability of the first stable release of the new MediaWiki 1.24 release series. MediaWiki 1.24 is a large release that contains many new features and bug fixes. This is a summary of the major changes of interest to users. You can consult the RELEASE-NOTES-1.24 file for the full list of changes in this version. Our thanks to everyone who helped to improve MediaWiki by testing the release candidates and submitting bug reports. == What's new? == MediaWiki 1.24 includes all changes released in the smaller 1.24wmfX software deployments to Wikimedia sites. == Preferences made easier == MediaWiki is known to be extremely flexible and customisable, but few users use its full potential. In 1.24, we aim to make dozens obscure preferences easily discoverable and obvious to use. == New features == * Category pages can now be moved (bug 5451). * MergeHistory for all administrators by default (bug 66155). * Improvements have been made to the password storage system, allowing improved security against offline attacks should a wiki's database be compromised by attackers. Then, the default password storage algorithm was changed to PBKDF2. PBKDF2 and Bcrypt have built-in support in PHP. The new extensible password API makes it trivial to implement scrypt support if we wanted to. == Usability == * The move feature and other actions are now discoverable in Vector, thanks to a label for the dropdown where they're hidden by default (bug 44591). * Specify default language on a per-page basis * Redirect to Special:UserLogin when logging is in required to proceed, instead of showing an error message == Performance == In 2014, MediaWiki development has a new focus on frontend performance. * (bug 39035) Improved Vector skin performance by removing collapsibleNav, which used to collapse some sidebar elements by default. This removes -list id suffixes like p-lang-list: instead of using things like #p-lang-list, you can do #p-lang .body ul. If you would like CollapsibleNav back please use the CollapsibleVector extension. ==Upgrade notices for MediaWiki administrators== === Breaking changes === * Upgrade jQuery to version 1.11.x: [[mailarchive:wikitech-l/2014-June/076842.html]] * Support for register_globals (deprecated 5 years ago) was dropped, MediaWiki will no longer run with it enabled. * {{!}} is now a magic word that results in |, mainly for use in templates and other complex templates. If your wiki has another template at Template:!, you will need to change the name and update any usage of it. If your Template:! is just |, it can be safely deleted. === API changes === Starting with MediaWiki 1.24, we're cleaning up the API, and working towards an API 2.0. See the roadmap for more details. * Rarely used formats deprecated: dbg, dump, txt, wddx, yaml. These may be removed in a future release. * Token handling overhauled: the action=tokens module is now deprecated and replaced by action=query&meta=tokens. Most actions now just take a generic "csrf" token, and the token type is now properly documented in the auto-generated documentation. * And more! See the RELEASE-NOTES-1.24 file for a full list. === Directory changes === * The legacy '''skins/common/''' directory has been emptied and deleted as part of the skin system cleanup. Files that have been present in it have been moved elsewhere or deleted (if they were unused). If you loaded any of these files as part of your custom skin or on-wiki CSS/JS, you should make a copy of the old files in a non-MediaWiki directory. See the RELEASE-NOTES-1.24 file for the full list of moved/deleted files. === Browser support deprecated or removed === * Full support for Internet Explorer 6 and Internet Explorer 7 has been removed: it will browse MediaWiki without JavaScript. JavaScript fixes specific to it have also been removed. Additional IE6 and IE7 fixes that exist in MediaWiki:Common.js and similar can be safely removed. === Skins no longer loaded after upgrade? === MediaWiki 1.24 no longer uses the skin autodiscovery mechanism to load default skins, instead requiring that the skins be manually loaded in LocalSettings.php, much like extensions (see [[Manual:Skin configuration#Installing skins]]). This will require you to update LocalSettings.php after the upgrade - a prominently displayed warning message should guide you through the process, suggesting the exact configuration that you need to add. If you're upgrading via a tarball release, that is all you need to do. If you're upgrading via git or otherwise from source, note that the skins themselves have been each moved to a separate repository and will need to be installed separately (much like extensions, some basic ones are included in the tarball). === Composer === If you are using extensions managed by composer, make sure to backup your existing composer.json file as it will be overwritten on upgrade. Full release notes: https://git.wikimedia.org/blob/mediawiki%2Fcore.git/1.24.0/RELEASE-NOTES-1.… https://www.mediawiki.org/wiki/Release_notes/1.24 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.24/mediawiki-1.24.0.tar.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.24/mediawiki-1.24.0.tar.gz.sig Public keys: https://www.mediawiki.org/keys/keys.html Mark Hershberger and Markus Glaser (Wiki Release Team)

1 0

FW: [Wikitech-l] Recognition of the MediaWiki Stakeholder's Group
by Derric Atzrott 12 Nov '14

12 Nov '14

Thought this might be of interest to the folks on this list as well. Thank you, Derric Atzrott -----Original Message----- From: wikitech-l-bounces(a)lists.wikimedia.org [mailto:wikitech-l-bounces@lists.wikimedia.org] On Behalf Of Gregory Varnum Sent: 09 November 2014 22:34 To: Wikimedia Mailing List; Wikimedia developers Subject: [Wikitech-l] Recognition of the MediaWiki Stakeholder's Group Greetings, The Affiliations Committee is pleased to announce the recognition [1] of the MediaWiki Stakeholder's Group - a user group for "MediaWiki developers, admins, users, consultants, and hosting providers who cooperate in order to improve the software and advocate the needs of MediaWiki users outside the Wikimedia Foundation (WMF) and its projects." This group shows great promise and potential for helping organize folks who are interested in making MediaWiki even better and give a voice to the many non-WMF users of the software. So, now we have them joining the family of affiliates. Please, let's give them a warm welcome! More info about the group: https://www.mediawiki.org/wiki/MediaWiki_Stakeholder%27s_Group Congratulations! -greg aka varnent Vice-Chair, Affiliations Committee 1: https://meta.wikimedia.org/wiki/Affiliations_Committee/Resolutions/MediaWik… _______________________________________________ Wikitech-l mailing list Wikitech-l(a)lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/wikitech-l

1 0

MediaWiki:Common.js and MediaWiki:Common.css blocked on Special:Login and Special:Preferences
by mah＠nichework.com 06 Nov '14

06 Nov '14

TL;DR: Should we merge https://gerrit.wikimedia.org/r/#/c/165979/ and release it with MediaWiki 1.24? A lot of sites have used MediaWiki:Common.js and MediaWiki:Common.css to customize the appearance of their site. In a recent security release[1], support for JS and CSS with on-wiki origins was removed from being displayed on the Special:Login and Special:Preferences page. Because of how the on-wiki MediaWiki:Common.* pages are used and the access restrictions on them, I think it is reasonable to allow JS and CSS from them while continuing to disallow individual's JS and CSS on the Special:Preferences and Special:Login page. Alexia filed a bug[2] and Kunal (Legoktm) has provided a patch[3] to allow site-wide styling back on those pages. I'd like to merge this, but I want some input from the community and security people before I do that. Thanks, Mark. (Reply-to set to mediawiki-l.) Footnotes: [1] https://bugzilla.wikimedia.org/70672 [2] https://bugzilla.wikimedia.org/71621 [3] https://gerrit.wikimedia.org/r/#/c/165979/ -- Mark A. Hershberger NicheWork LLC 717-271-1084

1 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

Mediawiki-enterprise November 2014