From 11dd10c5be890e4effe60d8432e7c41cda43f41e Mon Sep 17 00:00:00 2001 From: Reedy Date: Wed, 29 May 2019 00:38:44 +0100 Subject: [PATCH] Add RELEASE-NOTES for security patches Change-Id: I9032e202505fb77a7d4abea6662ef4f8fa49e0dd --- RELEASE-NOTES-1.31 | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/RELEASE-NOTES-1.31 b/RELEASE-NOTES-1.31 index 54672be5e3..e09851d85d 100644 --- a/RELEASE-NOTES-1.31 +++ b/RELEASE-NOTES-1.31 @@ -83,6 +83,14 @@ Required PHP version has been increased from 7.0.0 to 7.0.13. reauthenticating. * FormSpecialPage::execute() will now call checkLoginSecurityLevel() if getLoginSecurityLevel() returns non-false. +* (T197279) SECURITY: Fix reauth in Special:ChangeEmail. +* (T208881) SECURITY: blacklist CSS var(). +* (T209794) SECURITY: rate-limit and prevent blocked users from changing email. +* (T199540) SECURITY: API: Respect $wgBlockCIDRLimit in action=block. +* (T212118) SECURITY: Fix cache mode for (un)patrolled recent changes query. +* (T222036, T222038) SECURITY: Add permission check for user is permitted to + view the log type. +* (T221739) SECURITY: resources: Patch jQuery 3.2.1 for CVE-2019-11358. == MediaWiki 1.31.1 == -- 2.20.1