-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
MediaWiki 1.5rc1 is a preview release of the new 1.5 release series. Numerous bug fixes since last beta, plus a security fix; see change log in the release notes for full details.
A flaw in the interaction between extensions and HTML attribute sanitization was discovered which could allow unauthorized use of offsite resources in style sheets, and possible exploitation of a JavaScript injection feature on Microsoft Internet Explorer.
This version expands the returned text and properly checks it before output.
MediaWiki 1.4.8 is a bug fix and security maintenance release. It fixes the above bug, plus an update to skins/MonoBook.php ensures that sites using the default MonoBook skin will display correctly in the Internet Explorer 7 beta. (1.3 and 1.5 are not affected by this display problem.)
MediaWiki 1.3.14 is a security maintenance release.
The 1.3.x series is no longer maintained except for security fixes; new users and those seeking bug fixes should upgrade to 1.4.8 or 1.5rc1. Existing 1.3.x installations not willing to upgrade to the current stable relase should apply the change manually; details are in the release notes.
If you are actively using extensions to generate HTML attribute values, upgrade to 1.4 or 1.5 for a full fix; 1.3.14 simply disables any attempt to use such.
Release notes: 1.5rc1: http://sourceforge.net/project/shownotes.php?release_id=351260 1.4.8: http://sourceforge.net/project/shownotes.php?release_id=351258 1.3.14: http://sourceforge.net/project/shownotes.php?release_id=351257
Download: http://prdownloads.sourceforge.net/wikipedia/mediawiki-1.5rc1.tar.gz?downloa... http://prdownloads.sourceforge.net/wikipedia/mediawiki-1.4.8.tar.gz?download http://prdownloads.sourceforge.net/wikipedia/mediawiki-1.3.14.tar.gz?downloa...
MD5 checksums: mediawiki-1.5rc1.tar.gz f8b61f0cdac4ed8a7ed7aecf02d3bc78 mediawiki-1.4.8.tar.gz 69112673e0599049dc962d4c904feb6b mediawiki-1.3.14.tar.gz 2d65015aff380620434e381a4d60b57a
Before asking for help, try the FAQ: http://meta.wikimedia.org/wiki/MediaWiki_FAQ
Low-traffic release announcements mailing list: http://mail.wikipedia.org/mailman/listinfo/mediawiki-announce
Wiki admin help mailing list: http://mail.wikipedia.org/mailman/listinfo/mediawiki-l
Bug report system: http://bugzilla.wikimedia.org/
Play "stump the developers" live on IRC: #mediawiki on irc.freenode.net
- -- brion vibber (brion @ pobox.com)