Merge "Use setMwGlobals in UserTest::testPasswordExpire"

[lhc/web/wiklou.git] / RELEASE-NOTES-1.25

diff --git a/RELEASE-NOTES-1.25 b/RELEASE-NOTES-1.25
index cd99d2e..029b36b 100644 (file)
--- a/RELEASE-NOTES-1.25
+++ b/RELEASE-NOTES-1.25
@@ -12,12 +12,19 @@ production.
 * $wgPageShowWatchingUsers was removed.
 * $wgLocalVirtualHosts has been added to replace $wgConf->localVHosts.
 * $wgAntiLockFlags was removed.
+* Edit tokens returned from User::getEditToken may change on every call. Token
+  validity must be checked by passing the user-supplied token to
+  User::matchEditToken rather than by testing for equality with a
+  newly-generated token.
 
 === New features in 1.25 ===
 * (bug 58139) ResourceLoaderFileModule now supports language fallback
   for 'languageScripts'.
 * Added a new hook, "ContentAlterParserOutput", to allow extensions to modify the
   parser output for a content object before links update.
+* (bug 35785) Enhanced recent changes and extended watchlist are now default.
+  Documentation: https://meta.wikimedia.org/wiki/Help:Enhanced_recent_changes
+  and https://www.mediawiki.org/wiki/Manual:$wgDefaultUserOptions.
 * (bug 67341) SVG images will no longer be base64-encoded when being embedded
   in CSS. This results in slight size increase before gzip compression (due to
   percent-encoding), but up to 20% decrease after it.
@@ -30,6 +37,8 @@ production.
   - Usage instructions: https://www.mediawiki.org/wiki/Help:Page_status_indicators
   - Adjusting custom skins to support indicators:
     https://www.mediawiki.org/wiki/Manual:Skinning#Page_status_indicators
+* Edit tokens may now be time-limited: passing a maximum age to
+  User::matchEditToken will reject any older tokens.
 
 === Bug fixes in 1.25 ===
 * (bug 71003) No additional code will be generated to try to load CSS-embedded
@@ -129,6 +138,9 @@ changes to languages because of Bugzilla reports.
   Also, the former will now throw an MWException if called with one or more
   arguments.
 * Removed hitcounters and associated code.
+* The "temp" zone of the upload respository is now considered private. If it
+  already exists (such as under the images/ directory), please make sure that
+  the directory is not web readable (e.g. via a .htaccess file).
 
 == Compatibility ==