RELEASE-NOTES

   1 = MediaWiki release notes =
   2
   3 Stable branch snapshot, release 2003-11-18. This is the version of MediaWiki
   4 that we're running on Wikipedia as of this date.
   5
   6 == Overview of changes from mediawiki-20031117 release: ==
   7
   8 * Image deletion fixed.
   9 * Deletion of image old revisions now restricted to sysops
  10   (this is an irreversible action and not well logged)
  11 * Fixed maintenance scripts broken by last release's security fix
  12 * Many errors in rebuildlinks script fixed.
  13
  14 == Overview of changes from mediawiki-20031107 release: ==
  15
  16 * SECURITY FIX: stricter checking of include path
  17 * Fixed user contributions next/prev bug
  18 * Login cookies now have the database name prefixed to allow wikis
  19   to coexist in the same domain. This will invalidate any old saved
  20   password cookies.
  21 * Update cache timestamp when talk pages are created
  22 * Saving the login form in Mozilla no longer blanks password in prefs.
  23 * Check existence of source page before performing a move.
  24 * Detect invalid titles in Special:Allpages
  25 * Q-encode headers on outgoing inter-user e-mail
  26 * Updates to some translations.
  27 * Added table of contents border/bg to Cologne Blue, Nostalgia skins
  28 * Protected pages no longer appear unprotected when visited via redirect
  29 * Swapped old Wikipedia logo for the MediaWiki sunflower logo
  30 * install.php, update.php print warning on old PHP versions,
  31   added compatibility functions that might or might not help
  32
  33 No database changes since 20031107; upgrading should be clean.
  34
  35
  36 == Overview of changes from mediawiki-20030829 release: ==
  37
  38 * Fixed various bugs!
  39 * Some speed improvements from tweaks to the table indexes
  40 * Limited support for memcached (see below)
  41 * New translations (see below)
  42 * Interwiki link data now kept in database for flexibility
  43 * Friendlier read-only source view if asked to edit a page when
  44   the db is locked or the page is protected.
  45 * Normal IP blocks auto-expire after 24 hours
  46 * Optional support for blocking usernames
  47 * Uploads disabled by default (see below)
  48
  49
  50 == Security note ==
  51
  52 Uploads are now disabled by default. If you've set up a secure configuration
  53 you can reenable uploads by putting:
  54
  55   $wgDisableUploads = false;
  56
  57 into LocalSettings.php.
  58
  59 Earlier versions of MediaWiki included a bug that potentially allows logged-
  60 in users to delete arbitrary files in directories writable by the web server
  61 user by manually feeding false form data; this is now fixed.
  62
  63 As a reminder, disable PHP script execution in the upload directory!
  64 You may also wish to serve HTML pages as plaintext to prevent cookie-
  65 stealing JavaScript attacks. Example Apache config fragment:
  66
  67   <Directory "/Library/MediaWiki/web/upload">
  68      # Ignore .htaccess files
  69      AllowOverride None
  70
  71      # Serve HTML as plaintext
  72      AddType text/plain .html .htm .shtml
  73
  74      # Don't run arbitrary PHP code.
  75      php_admin_flag engine off
  76
  77      # If you've other scripting languages, disable them too.
  78   </Directory>
  79
  80
  81 == Database updates ==
  82
  83 If you're using update.php, the necessary database changes should
  84 be made automatically.
  85
  86 To manually upgrade your database from the 2003-08-29 release, run the
  87 following SQL scripts from the maintenance subdirectory:
  88
  89   archives/patch-ipblocks.sql
  90   archives/patch-interwiki.sql
  91   archives/patch-indexes.sql
  92   interwiki.sql
  93
  94 To copy in the Wikipedia language-prefix interwikis as well, add:
  95
  96   wikipedia-interwiki.sql
  97
  98
  99 == Translations ==
 100
 101 New interface localization files are included for:
 102   fy Frisian
 103   ro Romanian
 104   sl Slovene
 105   sq Albanian
 106   sr Serbian
 107
 108
 109 == Memcached ==
 110
 111 Memcached is a distributed cache system. See http://www.danga.com/memcached/
 112 MediaWiki can optionally use memcached to store some data between calls
 113 to reduce load on the database. Currently this is limited to user and
 114 talk page notification data, interwiki prefix/URL matches, and the
 115 UTF-8 conversion tables.
 116
 117 MediaWiki includes version 1.0.10 of the (GPL'd) PHP memcached client by
 118 Ryan Gilfether; if memcached is disabled it acts as a dummy object with
 119 minimal overhead.
 120
 121 To use memcached you'll need PHP installed with sockets support (this is not
 122 in the default configure options). See docs/memcached for some more details.
 123
 124 Additionally, you can store login session data in memcached instead of the
 125 local filesystem, which can help to enable load-balancing by letting login
 126 sessions transparently work on multiple front-end web servers. (The primary
 127 other issue is with uploads, which requires some care in handling.)
 128
 129 To enable this, set $wgSessionsInMemcached = true; and set $wgCookieDomain
 130 appropriately if exposing multiple hostnames. This system is new and may be
 131 volatile; login sessions will fail dramatically if memcached is unavailable
 132 when this option is turned on.
 133
 134
 135 == Online documentation ==
 136
 137 Documentation for both end-users and site administrators is currently being
 138 built up on Meta-Wikipedia, and is covered under the GNU Free Documentation
 139 License:
 140
 141   http://meta.wikipedia.org/wiki/MediaWiki_User%27s_Guide
 142
 143
 144 == Mailing list ==
 145
 146 A MediaWiki-l mailing list has been set up distinct from the Wikipedia
 147 wikitech-l list:
 148
 149   http://mail.wikipedia.org/mailman/listinfo/mediawiki-l
 150
 151
 152 == UseModWiki import script ==
 153
 154 A stripped-down UseModWiki import script is available in the maintenance
 155 subdirectory. It is incomplete and requires a lot of manual clean-up, but
 156 does function for the brave and pure of heart.
 157
 158
 159 == Test suite removed ==
 160
 161 The unmaintained Java-based test suite has been removed from the tarball
 162 release. If you really want it you can check it out from CVS.
 163