Merge "RCFilters UI: Adjust styles to OOUI's newest release"

[lhc/web/wiklou.git] / RELEASE-NOTES-1.29

diff --git a/RELEASE-NOTES-1.29 b/RELEASE-NOTES-1.29
index 3d3f9ca..38072dc 100644 (file)
--- a/RELEASE-NOTES-1.29
+++ b/RELEASE-NOTES-1.29
@@ -35,6 +35,8 @@ production.
 * (T156983) $wgRateLimitsExcludedIPs now accepts CIDR ranges as well as single IPs.
 * $wgDummyLanguageCodes is deprecated. Additional language code mappings may be
   added to $wgExtraLanguageCodes instead.
+* (T161453) LocalisationCache will no longer use the temporary directory in it's
+  fallback chain when trying to work out where to write the cache.
 
 === New features in 1.29 ===
 * (T5233) A cookie can now be set when a user is autoblocked, to track that user
@@ -86,6 +88,23 @@ production.
 * (T157035) "new mw.Uri()" was ignoring options when using default URI.
 * Special:Allpages can no longer be filtered by redirect in miser mode.
 * (T160519) CACHE_ANYTHING will not be CACHE_ACCEL if no accelerator is installed.
+* (T109140) (T122209) SECURITY: Special:UserLogin and Special:Search allow redirect
+  to interwiki links.
+* (T144845) SECURITY: XSS in SearchHighlighter::highlightText() when
+  $wgAdvancedSearchHighlighting is true.
+* (T125177) SECURITY: API parameters may now be marked as "sensitive" to keep
+  their values out of the logs.
+* (T150044) SECURITY: "Mark all pages visited" on the watchlist now requires a CSRF
+  token.
+* (T156184) SECURITY: Escape content model/format url parameter in message.
+* (T151735) SECURITY: SVG filter evasion using default attribute values in DTD
+  declaration.
+* (T161453) SECURITY: LocalisationCache will no longer use the temporary directory
+  in it's fallback chain when trying to work out where to write the cache.
+* (T48143) SECURITY: Spam blacklist ineffective on encoded URLs inside file inclusion
+  syntax's link parameter.
+* (T108138) SECURITY: Sysops can undelete pages, although the page is protected against
+  it.
 
 === Action API changes in 1.29 ===
 * Submitting sensitive authentication request parameters to action=login,
@@ -146,6 +165,8 @@ production.
   various methods now take a module path rather than a module name.
 * ApiMessageTrait::getApiCode() now strips 'apierror-' and 'apiwarn-' prefixes
   from the message key, and maps some message keys for backwards compatibility.
+* API parameters may now be marked as "sensitive" to keep their values out of
+  the logs.
 
 === Languages updated in 1.29 ===
 
@@ -286,6 +307,16 @@ changes to languages because of Phabricator reports.
 * (T156184) $wgRawHtml will no longer apply to internationalization messages.
 * Browser support for non-ES5 JavaScript browsers, including Android 2,
   Opera <12.10, and Internet Explorer 9, was lowered from Grade A to Grade C.
+* Removed wikibits global methods deprecated since MediaWiki 1.17 (T122755):
+  is_gecko, is_chrome_mac, is_chrome, webkit_version, is_safari_win, is_safari,
+  webkit_match, is_ff2, ff2_bugs, is_ff2_win, is_ff2_x11, opera95_bugs,
+  opera7_bugs, opera6_bugs, is_opera_95, is_opera_preseven, is_opera,
+  ie6_bugs, clientPC, changeText, killEvt, addHandler, hookEvent,
+  addClickHandler, removeHandler, getElementsByClassName, getInnerText,
+  setupCheckboxShiftClick, addCheckboxClickHandlers, mwEditButtons,
+  mwCustomEditButtons, injectSpinner, removeSpinner, escapeQuotes,
+  escapeQuotesHTML, jsMsg, addPortletLink, appendCSS, tooltipAccessKeyPrefix,
+  tooltipAccessKeyRegexp, updateTooltipAccessKeys.
 
 == Compatibility ==