Beta 6 includes a security fix: earlier 1.3.0 beta releases may be vulnerable to a PHP inclusion attack if you have allow_url_fopen and register_globals on (this is the default configuration in PHP 4.1.x, but register_globals is off by default in 4.2.x and later).

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 This should be the final beta release of MediaWiki 1.3.0; the final final version will be released in a few days after some more bug fixing and polishing up of documentation and installation. Beta 6 includes a security fix: earlier 1.3.0 beta releases may be vulnerable to a PHP inclusion attack if you have allow_url_fopen and register_globals on (this is the default configuration in PHP 4.1.x, but register_globals is off by default in 4.2.x and later). Note that while MediaWiki through 1.1 required register_globals to be on, 1.2 and 1.3 *do not*. If you have register_globals on, you should turn it off unless you are absolutely sure you require it for some other package. See http://php.net/register_globals for general information. Release notes: https://sourceforge.net/project/shownotes.php?release_id=258701 Download: http://prdownloads.sourceforge.net/wikipedia/mediawiki -1.3.0beta6.tar.gz?download Wiki admin help mailing list: http://mail.wikipedia.org/mailman/listinfo/mediawiki-l Bug report system: https://sourceforge.net/tracker/?group_id=34373&atid=411192 Play "stump the developers" live on IRC: #mediawiki on irc.freenode.net - -- brion vibber (brion @ pobox.com) _______________________________________________ MediaWiki-l mailing list MediaWiki-l(a)Wikimedia.org http://mail.wikipedia.org/mailman/listinfo/mediawiki-l