MediaWiki 1.4.5 is a security update and bugfix release.
Incorrect handling of page template inclusions made it possible to
inject JavaScript code into HTML attributes, which could lead to
cross-site scripting attacks on a publicly editable wiki.
Vulnerable releases and fix:
* 1.5 prerelease: fixed in 1.5alpha2
* 1.4 stable series: fixed in 1.4.5
* 1.3 legacy series: fixed in 1.3.13
* 1.2 series no longer supported; upgrade to 1.4.5 strongly recommended
This release also includes a number of bug fixes (see changelog below)
and merges some large-server load balancing patches from Wikipedia.
An experimental rate limiter for page edits and moves can be enabled
with global, per-IP, per-subnet, or per-user bases. See configuration
options in includes/DefaultSettings.php
=== Changes since 1.4.4 ===
* Fix for reading incorrectly re-gzipped HistoryBlob entries
* Generalize project namespace for Latin localization, update namespaces
* (bug 2075) Corrected namespace definitions in Tamil localization
* (bug 1692) Fix margin on unwatch tab
* Avoid overwriting shared image metadata cache with bogus encoding
conversions
* Fix reporting of minor edits in Special:Export output
* (bug 2150) Fix tab indexes on edit form
* Run ArticleSave hooks on image upload.
* (bug 2239) Fix non-ASCII chars in linktrail for Latin-1 mode
* (bug 1454) Backport edit/move rate limiter from CVS HEAD (experimental)
* (bug 1929) Fix documentation comment for $wgWhitelistRead
* (bug 1975) The name for Limburgish (li) changed from "Lèmburgs" to
"Limburgs"
* (bug 2019) Wrapped the output of Special:Version in <div dir='ltr'> in
order to preserve the correct flow of text on RTL wikis.
* (bug 2084) Fixed a regular expression in includes/Title.php that was
accepting invalid syntax like #REDIRECT [[foo] in redirects
* (bug 2087) Fixed a bug in special page handling which which stopped
"0" from
* (bug 2094) Multiple use of a template produced wrong results in some
cases being passed to all special pages Special:Page/0 syntax.
* Fixed a bug in Special:Allpages, Special:Contributions,
Special:Whatlinkshere, Special:Recentchangeslinked and
Special:Emailuser, they all mishandled being passed "0" with the
Special:Page/0 syntax (unrelated to bug 2087), this either required a
workaround in the form of passing "0" as a GET value or blocked the user
from passing that value at all.
* Fixed a bug in Special:Newimages that made it impossible to search for '0'
* (bug 2217) Negative ISO years were incorrectly converted to BC notation.
* (bug 2267) Don't generate thumbnail at the same size as the source image.
* Disable fulltext image name search in Special:Imagelist during MiserMode.
* Fix sorting of profiling output in debug log: largest last for easy
tailing
* (bug 2281) Fix regression with page moves taking the wrong talk pages
* Regression fix: watchlist day cutoff
* (bug 2173) Fatal error when removing an article with an empty title
from the watchlist
* (bug 2034) Armor HTML attributes against template inclusion and links
munging
Release notes:
http://sourceforge.net/project/shownotes.php?release_id=332231
Download:
http://prdownloads.sf.net/wikipedia/mediawiki-1.4.5.tar.gz?download
Before asking for help, try the FAQ:
http://meta.wikimedia.org/wiki/MediaWiki_FAQ
Low-traffic release announcements mailing list:
http://mail.wikipedia.org/mailman/listinfo/mediawiki-announce
Wiki admin help mailing list:
http://mail.wikipedia.org/mailman/listinfo/mediawiki-l
Bug report system:
http://bugzilla.wikipedia.org/
Play "stump the developers" live on IRC:
#mediawiki on
irc.freenode.net
-- brion vibber (brion @
pobox.com)