X-Git-Url: https://git.heureux-cyclage.org/?a=blobdiff_plain;f=HISTORY;h=e57d346316a4a5437fcaa32a7945ba41189a7c72;hb=058aec4c76129b7ee8541692a8a48f8046e15bb6;hp=7e72fc78e5e9fac8d2cc34d836b9de8f99deaa8a;hpb=ade945b97a51536ccb16291c37af85ac2db87e7f;p=lhc%2Fweb%2Fwiklou.git diff --git a/HISTORY b/HISTORY index 7e72fc78e5..e57d346316 100644 --- a/HISTORY +++ b/HISTORY @@ -1,6 +1,40 @@ Change notes from older releases. For current info see RELEASE-NOTES-1.27. -== MediaWiki 1.26 == += MediaWiki 1.26 = + +== MediaWiki 1.26.2 == + +This is a maintenance release of the MediaWiki 1.26 branch. + +=== Changes since 1.26.1 === +* (T121892) Fix fatal error on some Special pages, introduced in 1.26.1. + +== MediaWiki 1.26.1 == + +This is a maintenance release of the MediaWiki 1.26 branch. + +=== Changes since 1.26.0 === +* (T117899) SECURITY: $wgArticlePath can no longer be set to relative paths + that do not begin with a slash. This enabled trivial XSS attacks. + Configuration values such as "http://my.wiki.com/wiki/$1" are fine, as are + "/wiki/$1". A value such as "$1" or "wiki/$1" is not and will now throw an + error. +* (T119309) SECURITY: Use hash_compare() for edit token comparison +* (T118032) SECURITY: Don't allow cURL to interpret POST parameters starting + with '@' as file uploads +* (T115522) SECURITY: Passwords generated by User::randomPassword() can no + longer be shorter than $wgMinimalPasswordLength +* (T97897) SECURITY: Improve IP parsing and trimming. Previous behavior could + result in improper blocks being issued +* (T109724) SECURITY: Special:MyPage, Special:MyTalk, Special:MyContributions + and related pages no longer use HTTP redirects and are now redirected by + MediaWiki +* Fixed ConfigException in ExpandTemplates due to AlwaysUseTidy. +* Fixed stray literal \n in Special:Search. +* Fix issue that breaks HHVM Repo Authorative mode. +* (T120267) Work around APCu memory corruption bug + +== MediaWiki 1.26.0 == === Configuration changes in 1.26 === * $wgPasswordResetRoutes['email'] = true by default. @@ -91,7 +125,7 @@ Change notes from older releases. For current info see RELEASE-NOTES-1.27. documentation for mw.Upload.Dialog, mw.Upload.BookletLayout and its subclasses for more information. -== extension.json changes in 1.26 == +=== extension.json changes in 1.26 === * (T99344) The extension.json schema is now versioned. All extensions and skins should set a "manifest_version" property corresponding to the schema version they were written for. The only supported version @@ -243,10 +277,95 @@ changes to languages because of Phabricator reports. * DatabaseBase::errorCount() was removed (unused). * $wgDeferredUpdateList was removed. * DeferredUpdates::addHTMLCacheUpdate() was removed. -* Obsolete maintenance scripts clearCacheStats.php and showCacheStats.php - were removed. The underlying data is sent to StatsD (see $wgStatsdServer). -== MediaWiki 1.25 == += MediaWiki 1.25 = + +== MediaWiki 1.25.5 == + +This is a maintenance release of the MediaWiki 1.25 branch. + +=== Changes since 1.25.4 === +* (T121892) Fix fatal error on some Special pages, introduced in 1.25.4. + +== MediaWiki 1.25.4 == + +This is a security and maintenance release of the MediaWiki 1.25 branch. + +=== Changes since 1.25.3 === +* (T117899) SECURITY: $wgArticlePath can no longer be set to relative paths + that do not begin with a slash. This enabled trivial XSS attacks. + Configuration values such as "http://my.wiki.com/wiki/$1" are fine, as are + "/wiki/$1". A value such as "$1" or "wiki/$1" is not and will now throw an + error. +* (T119309) SECURITY: Use hash_compare() for edit token comparison +* (T118032) SECURITY: Don't allow cURL to interpret POST parameters starting + with '@' as file uploads +* (T115522) SECURITY: Passwords generated by User::randomPassword() can no + longer be shorter than $wgMinimalPasswordLength +* (T97897) SECURITY: Improve IP parsing and trimming. Previous behavior could + result in improper blocks being issued +* (T109724) SECURITY: Special:MyPage, Special:MyTalk, Special:MyContributions + and related pages no longer use HTTP redirects and are now redirected by + MediaWiki +* (T103237) $wgUseGzip had no effect when using file cache. +* (T114606) mw.notify was not correctly fixed to the page if + initialized while not at the top of the page. +* Fix issue that breaks HHVM Repo Authorative mode. + +== MediaWiki 1.25.3 == + +This is a security and maintenance release of the MediaWiki 1.25 branch. + +=== Changes since 1.25.2 === + +* (T98975) Fix having multiple callbacks for a single hook. +* (T107632) maintenance/refreshLinks.php did not always remove all links + pointing to nonexistent pages. +* (T104142) $wgEmergencyContact and $wgPasswordSender now use their default + value if set to an empty string. +* (T62174) Provide fallbacks for use of mb_convert_encoding() in + HtmlFormatter. It was causing an error when accessing the api help page + if the mbstring PHP extension was not installed. +* (T105896) Confirmation emails would sometimes contain invalid codes. +* (T105597) Fixed edit stash inclusion queries. +* (T91850) SECURITY: Add throttle check in ApiUpload and SpecialUpload +* (T91203, T91205) SECURITY: API: Improve validation in chunked uploading +* (T95589) SECURITY: RevDel: Check all revisions for suppression, not just the + first +* (T108616) SECURITY: Avoid exposure of local path in PNG thumbnails + +== MediaWiki 1.25.2 == + +This is a security and maintenance release of the MediaWiki 1.25 branch. + +=== Changes since 1.25.1 === + +* (T94116) SECURITY: Compare API watchlist token in constant time +* (T97391) SECURITY: Escape error message strings in thumb.php +* (T106893) SECURITY: Don't leak autoblocked IP addresses on + Special:DeletedContributions +* (T102562) Fix InstantCommons parameters to handle the new HTTPS-only + policy of Wikimedia Commons. +* (T100767) Setting a configuration setting for skin or extension to + false in LocalSettings.php was not working. +* (T100635) API action=opensearch json output no longer breaks when + $wgDebugToolbar is enabled. +* (T102522) Using an extension.json or skin.json file which has + a "manifest_version" property for 1.26 compatability will no longer + trigger warnings. +* (T86156) Running updateSearchIndex.php will not throw an error as + page_restrictions has been added to the locked table list. +* Special:Version would throw notices if using SVN due to an incorrectly + named variable. Add an additional check that an index is defined. + +== MediaWiki 1.25.1 == + +This is a bug fix release of the MediaWiki 1.25 branch. + +=== Changes since 1.25 === +* (T100351) Fix syntax errors in extension.json of ConfirmEdit extension + +== MediaWiki 1.25.0 == === Configuration changes in 1.25 === * $wgPageShowWatchingUsers was removed. @@ -750,49 +869,108 @@ changes to languages because of Bugzilla reports. loadedScripts object, from wikibits.js (deprecated since 1.17) now emit warnings through mw.log.warn when accessed. += MediaWiki 1.24 = -== Compatibility == +== MediaWiki 1.24.6 == -MediaWiki 1.25 requires PHP 5.3.3 or later. There is experimental support for -HHVM 3.3.0. +This is a maintenance release of the MediaWiki 1.24 branch. -MySQL is the recommended DBMS. PostgreSQL or SQLite can also be used, but -support for them is somewhat less mature. There is experimental support for -Oracle and Microsoft SQL Server. +=== Changes since 1.24.5 === +* (T121892) Fix fatal error on some Special pages, introduced in 1.24.5. -The supported versions are: +== MediaWiki 1.24.5 == -* MySQL 5.0.3 or later -* PostgreSQL 8.3 or later -* SQLite 3.3.7 or later -* Oracle 9.0.1 or later -* Microsoft SQL Server 2005 (9.00.1399) +This is a security and maintenance release of the MediaWiki 1.23 branch. -== Upgrading == +=== Changes since 1.24.4 === +* (T117899) SECURITY: $wgArticlePath can no longer be set to relative paths + that do not begin with a slash. This enabled trivial XSS attacks. + Configuration values such as "http://my.wiki.com/wiki/$1" are fine, as are + "/wiki/$1". A value such as "$1" or "wiki/$1" is not and will now throw an + error. +* (T119309) SECURITY: Use hash_compare() for edit token comparison +* (T118032) SECURITY: Don't allow cURL to interpret POST parameters starting + with '@' as file uploads +* (T115522) SECURITY: Passwords generated by User::randomPassword() can no + longer be shorter than $wgMinimalPasswordLength +* (T97897) SECURITY: Improve IP parsing and trimming. Previous behavior could + result in improper blocks being issued +* (T109724) SECURITY: Special:MyPage, Special:MyTalk, Special:MyContributions + and related pages no longer use HTTP redirects and are now redirected by + MediaWiki +* (T103237) $wgUseGzip had no effect when using file cache. -1.25 has several database changes since 1.24, and will not work without schema -updates. Note that due to changes to some very large tables like the revision -table, the schema update may take quite long (minutes on a medium sized site, -many hours on a large site). +== MediaWiki 1.24.4 == -If upgrading from before 1.11, and you are using a wiki as a commons -repository, make sure that it is updated as well. Otherwise, errors may arise -due to database schema changes. +This is a security and maintenance release of the MediaWiki 1.24 branch. -If upgrading from before 1.7, you may want to run refreshLinks.php to ensure -new database fields are filled with data. +=== Changes since 1.24.3 === -If you are upgrading from MediaWiki 1.4.x or earlier, you should upgrade to -1.5 first. The upgrade script maintenance/upgrade1_5.php has been removed -with MediaWiki 1.21. +* (T91653) Minimal PSR-3 debug logger to support backports from 1.25+. +* (T68650) Fix indexing of moved pages with PostgreSQL. Requires running + update.php to fix. +* (T91850) SECURITY: Add throttle check in ApiUpload and SpecialUpload +* (T91203, T91205) SECURITY: API: Improve validation in chunked uploading +* (T95589) SECURITY: RevDel: Check all revisions for suppression, not just the + first +* (T108616) SECURITY: Avoid exposure of local path in PNG thumbnails -Don't forget to always back up your database before upgrading! +== MediaWiki 1.24.3 == -See the file UPGRADE for more detailed upgrade instructions. +This is a security and maintenance release of the MediaWiki 1.24 branch. -For notes on 1.24.x and older releases, see HISTORY. +=== Changes since 1.24.2 === -== MediaWiki 1.24 == +* (T94116) SECURITY: Compare API watchlist token in constant time +* (T97391) SECURITY: Escape error message strings in thumb.php +* (T106893) SECURITY: Don't leak autoblocked IP addresses on + Special:DeletedContributions +* Update jQuery from v1.11.2 to v1.11.3. +* (T102562) Fix InstantCommons parameters to handle the new HTTPS-only + policy of Wikimedia Commons. + +== MediaWiki 1.24.2 == + +This is a security and maintenance release of the MediaWiki 1.24 branch. + +=== Changes since 1.24.1 === + +* (T85848, T71210) SECURITY: Don't parse XMP blocks that contain XML entities, + to prevent various DoS attacks. +* (T85848) SECURITY: Don't allow directly calling Xml::isWellFormed, to reduce + likelihood of DoS. +* (T88310) SECURITY: Always expand xml entities when checking SVG's. +* (T73394) SECURITY: Escape > in Html::expandAttributes to prevent XSS. +* (T85855) SECURITY: Don't execute another user's CSS or JS on preview. +* (T64685) SECURITY: Allow setting maximal password length to prevent DoS when + using PBKDF2. +* (T85349, T85850, T86711) SECURITY: Multiple issues fixed in SVG filtering to + prevent XSS and protect viewer's privacy. +* Fix case of SpecialAllPages/SpecialAllMessages in SpecialPageFactory to fix + loading these special pages when $wgAutoloadAttemptLowercase is false. +* (bug T70087) Fix Special:ActiveUsers page for installations using + PostgreSQL. +* (bug T76254) Fix deleting of pages with PostgreSQL. Requires a schema change + and running update.php to fix. + +== MediaWiki 1.24.1 == + +This is a security and maintenance release of the MediaWiki 1.24 branch. + +=== Changes since 1.24.0 === + +* (bug T76686) [SECURITY] thumb.php outputs wikitext message as raw HTML, which + could lead to xss. Permission to edit MediaWiki namespace is required to + exploit this. +* (bug T77028) [SECURITY] Malicious site can bypass CORS restrictions in + $wgCrossSiteAJAXdomains in API calls if it only included an allowed domain as + part of its name. +* (bug T74222) The original patch for T74222 was reverted as unnecessary. +* Fixed a couple of entries in RELEASE-NOTES-1.24. +* (bug T76168) OutputPage: Add accessors for some protected properties. +* (bug T74834) Make 1.24 branch directly installable under PostgreSQL. + +== MediaWiki 1.24.0 == === Configuration changes in 1.24 === * MediaWiki will no longer run if register_globals is enabled. It has been @@ -1486,8 +1664,204 @@ of files that are no longer available follows. * skins/common/images/icons/fileicon.png * skins/common/images/ksh/button_S_italic.png += MediaWiki 1.23 = + +== MediaWiki 1.23.13 == + +This is a maintenance release of the MediaWiki 1.23 branch. + +=== Changes since 1.23.12 === +* (T121892) Fix fatal errors on some Special pages, introduced in 1.23.12. + +== MediaWiki 1.23.12 == + +This is a security and maintenance release of the MediaWiki 1.23 branch. + +=== Changes since 1.23.11 === +* (T117899) SECURITY: $wgArticlePath can no longer be set to relative paths + that do not begin with a slash. This enabled trivial XSS attacks. + Configuration values such as "http://my.wiki.com/wiki/$1" are fine, as are + "/wiki/$1". A value such as "$1" or "wiki/$1" is not and will now throw an + error. +* (T119309) SECURITY: Use hash_compare() for edit token comparison +* (T118032) SECURITY: Don't allow cURL to interpret POST parameters starting + with '@' as file uploads +* (T115522) SECURITY: Passwords generated by User::randomPassword() can no + longer be shorter than $wgMinimalPasswordLength +* (T97897) SECURITY: Improve IP parsing and trimming. Previous behavior could + result in improper blocks being issued +* (T109724) SECURITY: Special:MyPage, Special:MyTalk, Special:MyContributions + and related pages no longer use HTTP redirects and are now redirected by + MediaWiki + +== MediaWiki 1.23.11 == + +This is a security and maintenance release of the MediaWiki 1.23 branch. + +=== Changes since 1.23.10 === + +* (T91850) SECURITY: Add throttle check in ApiUpload and SpecialUpload +* (T91203, T91205) SECURITY: API: Improve validation in chunked uploading +* (T108616) SECURITY: Avoid exposure of local path in PNG thumbnails + +== MediaWiki 1.23.10 == + +This is a security and maintenance release of the MediaWiki 1.23 branch. + +=== Changes since 1.23.9 === + +* (T94116) SECURITY: Compare API watchlist token in constant time +* (T97391) SECURITY: Escape error message strings in thumb.php +* (T106893) SECURITY: Don't leak autoblocked IP addresses on + Special:DeletedContributions +* (bug 67644) Make AutoLoaderTest handle namespaces +* (T91653) Minimal PSR-3 debug logger to support backports from 1.25+. +* (T102562) Fix InstantCommons parameters to handle the new HTTPS-only + policy of Wikimedia Commons. + +== MediaWiki 1.23.9 == + +This is a security and maintenance release of the MediaWiki 1.23 branch. + +=== Changes since 1.23.8 === + +* (T85848, T71210) SECURITY: Don't parse XMP blocks that contain XML entities, + to prevent various DoS attacks. +* (T85848) SECURITY: Don't allow directly calling Xml::isWellFormed, to reduce + likelihood of DoS. +* (T88310) SECURITY: Always expand xml entities when checking SVG's. +* (T73394) SECURITY: Escape > in Html::expandAttributes to prevent XSS. +* (T85855) SECURITY: Don't execute another user's CSS or JS on preview. +* (T85349, T85850, T86711) SECURITY: Multiple issues fixed in SVG filtering to + prevent XSS and protect viewer's privacy. +* (bug T68650) Fix indexing of moved pages with PostgreSQL. Requires running + update.php to fix. +* (bug T70087) Fix Special:ActiveUsers page for installations using + PostgreSQL. + +== MediaWiki 1.23.8 == + +This is a security and maintenance release of the MediaWiki 1.23 branch. + +=== Changes since 1.23.7 === + +* (bug T76686) [SECURITY] thumb.php outputs wikitext message as raw HTML, which + could lead to xss. Permission to edit MediaWiki namespace is required to + exploit this. +* (bug T77028) [SECURITY] Malicious site can bypass CORS restrictions in + $wgCrossSiteAJAXdomains in API calls if it only included an allowed domain as + part of its name. +* (bug T74222) The original patch for T74222 was reverted as unnecessary. + +== MediaWiki 1.23.7 == + +This is a security and maintenance release of the MediaWiki 1.23 branch. + +=== Changes since 1.23.6 === + +* (bugs 66776, 71478) SECURITY: User PleaseStand reported a way to inject code + into API clients that used format=php to process pages that underwent flash + policy mangling. This was fixed along with improving how the mangling was done + for format=json, and allowing sites to disable the mangling using + $wgMangleFlashPolicy. +* (bug 70901) SECURITY: User Jackmcbarn reported that the ability to update + the content model for a page could allow an unprivileged attacker to edit + another user's common.js under certain circumstances. The user right + "editcontentmodel" was added, and is needed to change a revision's content + model. +* (bug 71111) SECURITY: User PleaseStand reported that on wikis that allow raw + HTML, it is not safe to preview wikitext coming from an untrusted source such + as a cross-site request. Thus add an edit token to the form, and when raw HTML + is allowed, ensure the token is provided before showing the preview. This + check is not performed on wikis that both allow raw HTML and anonymous + editing, since there are easier ways to exploit that scenario. +* (bug 72222) SECURITY: Do not show log action when the entry is revdeleted with + DELETED_ACTION. NOTICE: this may be reverted in a future release pending a + public RFC about the desired functionality. This issue was reported by user + Bawolff. +* (bug 71621) Make allowing site-wide styles on restricted special pages a + config option. +* (bug 42723) Added updated version history from 1.19.2 to 1.22.13 +* $wgMangleFlashPolicy was added to make MediaWiki's mangling of anything that + might be a flash policy directive configurable. + +== MediaWiki 1.23.6 == -== MediaWiki 1.23 == +This is a maintenance release of the MediaWiki 1.23 branch. + +=== Changes since 1.23.5 === +* (Bug 72274) Job queue not running (HTTP 411) due to missing + Content-Length: header +* (Bug 67440) Allow classes to be registered properly from installer + +== MediaWiki 1.23.5 == + +This is a security release of the MediaWiki 1.23 branch. + +=== Changes since 1.23.4 === +* (bug 70672) SECURITY: OutputPage: Remove separation of css and js module + allowance. + +== MediaWiki 1.23.4 == + +This is a security and maintenance release of the MediaWiki 1.23 branch. + +=== Changes since 1.23.3 === + +* (bug 69008) SECURITY: Enhance CSS filtering in SVG files. Filter