MediaWiki 1.3.9 is a security and bug fix release.
A flaw in upload handling has been found which may allow upload and execution of arbitrary scripts with the permissions of the web server. Only wikis that have enabled uploads and have a vulnerable Apache configuration will be affected, but to be safe all wikis should upgrade.
Wikis with uploads available should either disable uploads or upgrade to 1.3.9 immediately; if other files are customized and require merging changes, includes/SpecialUpload.php may be replaced individually to add the fix.
(It is also recommended to configure your web server to disable script execution in the 'images' subdirectory where uploads are placed, which prevents most attacks even if the wiki fails.)
Changes from 1.3.8: * Backported "Templates used in this page"-feature of EditPage * Allow "MySkin" as a default skin. * (bug 938) Parse namespaces correctly on self-interwiki links * (bug 1010) fix broken Commons image link on Classic & Cologne Blue * (bug 1004) Norsk language names for interwiki links changed, Nauruan language name changed * Fix upload extension blacklist to protect against vulnerable Apache configurations
Release notes: http://sourceforge.net/project/shownotes.php?release_id=289468
Download: http://prdownloads.sf.net/wikipedia/mediawiki-1.3.9.tar.gz?download
Wiki admin help mailing list: http://mail.wikipedia.org/mailman/listinfo/mediawiki-l
Low-traffic release announcements mailing list: http://mail.wikipedia.org/mailman/listinfo/mediawiki-announce
Bug report system: http://bugzilla.wikipedia.org/
Play "stump the developers" live on IRC: #mediawiki on irc.freenode.net
- -- brion vibber (brion @ pobox.com)
wikitech-l@lists.wikimedia.org