Diffusion MediaWiki (REL1_23) History

History
REL1_23

	Apr 11 2017 57062b01fdea Bumping release version to 1.23.17 Author • demon Browse Repository No Audits
	Apr 7 2017 12a617ea933e Merge "Fix up new-style arrays that snuck into REL1_23" into REL1_23 Author • demon Browse Repository No Audits
	2f317d7d0548 Fix up new-style arrays that snuck into REL1_23 Author • demon Browse Repository No Audits
	5f00b40695b4 Fix short array syntax in REL1_23 branch Author • tstarling Browse Repository No Audits
	Apr 6 2017 07ed5049d938 Bump $wgVersion and finalise RELEASE-NOTES for 1.23.16 Author Reedy Browse Repository No Audits
	c9dccd04e510 SECURITY: Do not allow users to undelete a page they can't edit or create Author Bawolff Browse Repository No Audits
	3b46d6447ca8 SECURITY: Always normalize link url before adding to ParserOutput Author Bawolff Browse Repository No Audits
	6eb6aa314ad2 SECURITY: Whitelist DTD declaration in SVG Author Bawolff Browse Repository No Audits
	4d87e34c2829 SECURITY: Escape wikitext content model/format in message Author Bawolff Browse Repository No Audits
	2de4677d6faa SECURITY: SpecialWatchlist: Check CSRF token when using "Mark all pages visited" Author matmarex Browse Repository No Audits
	c70dd446fe75 SECURITY: API: Don't log "sensitive" parameters Author Anomie Browse Repository No Audits
	6d0149aef4f7 SECURITY: XSS in search if $wgAdvancedSearchHighlighting = true; Author Bawolff Browse Repository No Audits
	fd6a600e18fb SECURITY: Do not directly redirect to interwikis, but use splash page Author Reedy Browse Repository No Audits
	Apr 5 2017 fc8169ff0021 Merge "API: Insist authn parameters be in the POST body" into REL1_23 Author Reedy Browse Repository No Audits
	249612b6439f Fix phpunit test added in 57efcafa8a3a64f Author Bawolff Browse Repository No Audits
	Apr 2 2017 e1de305d3c29 API: Insist authn parameters be in the POST body Author Anomie Browse Repository No Audits
	Apr 1 2017 57efcafa8a3a SECURITY: Disable <html> tag on system messages despite $wgRawHtml = true; Author Bawolff Browse Repository No Audits
	Oct 18 2016 b581c9c3653b Disallow css attr() with url type Author • csteipp Browse Repository No Audits
	Sep 11 2016 53f9838b65d6 Add missing global $wgUseXVO to RawAction.php Author Paladox Browse Repository No Audits
	Sep 1 2016 9e04b7ec180b Merge "Followup af6d9aba: $search is a string, not an object" into REL1_23 Author jenkins-bot Browse Repository No Audits
	Aug 23 2016 49aff6403bb7 1.23.15: Release notes and bump version number Author • demon Browse Repository No Audits
	4a7fbe8fa040 SECURITY: API: Generate head items in the context of the given title Author Anomie Browse Repository No Audits
	5ef1ff9c02f1 SECURITY: XSS in unclosed internal links Author Bawolff Browse Repository No Audits
	e17b66c38a76 SECURITY: Escape '<' and ']]>' in inline <style> blocks Author Bawolff Browse Repository No Audits
	Aug 22 2016 231567f44db0 SECURITY: Require login to preview user CSS pages Author Bawolff Browse Repository No Audits
	07db65433a27 SECURITY: Do not allow undeleting a revdel'd file if its top file Author Bawolff Browse Repository No Audits
	632eaaf77d64 SECURITY: Make $wgBlockDisablesLogin also restrict logged in permissions Author Bawolff Browse Repository No Audits
	8ea19ed4148e SECURITY: Make blocks log users out if $wgBlockDisablesLogin Author Bawolff Browse Repository No Audits
	Aug 19 2016 35d57b535438 SECURITY: Check read permission when loading page content in ApiParse. Author daniel Browse Repository No Audits
	Aug 18 2016 0f8c614f6e77 Followup af6d9aba: $search is a string, not an object Author • demon Browse Repository No Audits
	Aug 11 2016 4f0d99b9db2f Remove support for $wgWellFormedXml=false Author Bawolff Browse Repository No Audits
	9e362aec99a9 Merge "Use ipb_id when updating expiry in Block::updateTimestamp()" into REL1_23 Author jenkins-bot Browse Repository No Audits
	Aug 10 2016 c566b3b99d41 Use ipb_id when updating expiry in Block::updateTimestamp() Author Legoktm Browse Repository No Audits
	f846762f83ed Set the default database schema to "mediawiki" so as not to break the CLI… Author Paladox Browse Repository No Audits
	Jul 19 2016 8a65f1ce374c Remove support for getenv('http_proxy') in MediaWiki Author • demon Browse Repository No Audits
	Jun 30 2016 be253f4b392a Fix parser tests. <nowiki> no longer escapes quotes. Author Bawolff Browse Repository No Audits
	May 20 2016 1b1588f892b8 I iz ugh Author MaxSem Browse Repository No Audits
	dbc2603aea34 Fix fatal with PHP 5.3 Author MaxSem Browse Repository No Audits
	15fb1dcf0d2a Bump to 1.23.14 for tagging Author • demon Browse Repository No Audits
	May 18 2016 7e55dc206991 Add rel="noreferrer noopener" when target attribute would open window Author Bawolff Browse Repository No Audits
	faec88cd95fd SECURITY: Rate limit moves via the API Author Anomie Browse Repository No Audits
	edf7b49d3902 SECURITY: Wrap diff generation in PoolCounter Author MaxSem Browse Repository No Audits
	859fac81fec9 Enforce upper limit on invocations of wfShellExec() Author • dpatrick Browse Repository No Audits
	3c00b14e7df7 Canonicalize usernames before rate limiting logins Author Bawolff Browse Repository No Audits
	d44fb6046e64 Use global cache keys login/create account rate limitting Author • demon Browse Repository No Audits
	2e91629e221a SECURITY: RawAction: Vary on the usual headers Author Anomie Browse Repository No Audits
	3c57b201b471 SECURITY: Improve cross-domain-policy mangling Author Anomie Browse Repository No Audits
	f9eb3e3abaf9 SECURITY: Don't use m modifier when checking link prefix Author • csteipp Browse Repository No Audits
	1ea4ab63f970 SECURITY: Check for mbstring.func_overload at runtime Author Anomie Browse Repository No Audits
	322f570c32cf Reset wsEditToken on login Author Bawolff Browse Repository No Audits
	3490a35540a4 SECURITY: Include quote characters in strip markers so esc in attr Author • csteipp Browse Repository No Audits
	c8d49b1cad61 SECURITY: Add class to <a> for patrol links so it can't be spoofed by user Author Bawolff Browse Repository No Audits
	aa5579efea42 SECURITY: API: Add "standard" header and hook for lacksSameOriginSecurity() Author Anomie Browse Repository No Audits
	Mar 4 2016 51724d585529 Merge "build: Bump various devDependencies" into REL1_23 Author jenkins-bot Browse Repository No Audits
	Mar 3 2016 21d8a0873125 build: Bump various devDependencies Author Jdforrester-WMF Browse Repository No Audits
	87498db4f4d4 sajax: Explicitly specify released under 3-clause BSD license Author Kunal Mehta Browse Repository No Audits
	Dec 21 2015 8a017fe25a3d Prep 1.23.13 Author Reedy Browse Repository No Audits
	f75044e377a6 Fix Fatal on various special pages introduced in 1.23.12 Author Reedy Browse Repository No Audits
	Dec 18 2015 f05a87cc536c 1.23.12: Prep release notes and bump version number Author • demon Browse Repository No Audits
	f30f2e185216 Add $query to JavaScript redirect info Author matmarex Browse Repository No Audits
	e03b223af755 SECURITY: Make Special:MyPage and friends fake redirect to prevent info leak Author • csteipp Browse Repository No Audits
	ea5ed444d86f Fixed some doc errors in tryNormaliseRedirect() Author aaron Browse Repository No Audits
	41f5bc290185 MediaWiki.php: Factor out tryNormaliseRedirect Author Krinkle Browse Repository No Audits
	8cd14f9d352e Really validate that $wgArticlePath starts with a slash Author matmarex Browse Repository No Audits
	970e52659216 Validates wgArticlePath does start with slash (/). Author devunt Browse Repository No Audits
	ac48f275d879 Fix IP::toHex for IPv4 addresses with a double/triple 0 block Author • demon Browse Repository No Audits
	fce061074bd5 [SECURITY] 0-pad to length in random string generation Author Anomie Browse Repository No Audits
	da0cc6ba4c36 SECURITY: Work around CURL insanity breaking POST parameters that start with '@' Author Catrope Browse Repository No Audits
	ad1fdc3b216d Use hash_equals in User::matchEditToken Author Tgr Browse Repository No Audits
	Dec 14 2015 ac9587126d54 Don't install a custom error handler for hooks Author ori Browse Repository No Audits
	Dec 1 2015 aa7717dff6b9 tests: let us select/exclude ParserTests Author hashar Browse Repository No Audits
	Oct 16 2015 fb64dc5803a8 Bump version number and add release notes for security release 1.23.11 Author • demon Browse Repository No Audits
	4990b4068043 Avoid exposure of local path in PNG thumbnails Author • dpatrick Browse Repository No Audits
	00bc60a78e30 SECURITY: API: Improve validation in chunked uploading Author • demon Browse Repository No Audits
	5d9bace38b72 SECURITY: Throttle uploads Author • demon Browse Repository No Audits
	Sep 23 2015 45220df7a453 PostgreSQL: Fix text search on moved pages Author Jjanes Browse Repository No Audits
	Sep 11 2015 fc2a1ed687c5 Log useful error messages on SSL errors in PhpHttpRequest Author Tgr Browse Repository No Audits
	760770bf3942 Log errors in Http::request() Author Tgr Browse Repository No Audits
	aa32d4af7cec Workaround fopen lack of SubjectAltName support for instantCommons Author Bawolff Browse Repository No Audits
	ef5f4febe590 Use system default location for cafile when using php fopen. Author Bawolff Browse Repository No Audits
	Sep 9 2015 4230af59ca82 Avoid bogus IE extension check errors in img_auth.php Author aaron Browse Repository No Audits
	Aug 10 2015 f834e8cab31e Update Releasenotes and version number for 1.23.10 Author • csteipp Browse Repository No Audits
	68d3211f2ce8 SECURITY: Don't disclose if an IP is autoblocked on Special:DeletedContributions Author Legoktm Browse Repository No Audits
	5355958c72a8 thumb.php: Escape $rel404 in error message Author • csteipp Browse Repository No Audits
	8f74aa9ed0d1 SECURITY: API: Use constant-time comparison for watchlist token Author • demon Browse Repository No Audits
	Jul 13 2015 bc01b3a62e7b Merge "Fix InstantCommons - HTTP access to Commons does not work anymore" into… Author jenkins-bot Browse Repository No Audits
	Jul 2 2015 18d1f3191042 Log http error in ForeignAPIRepo::httpGet Author Umherirrender Browse Repository No Audits
	Jun 17 2015 8ce68858061a Fix InstantCommons - HTTP access to Commons does not work anymore Author Tgr Browse Repository No Audits
	Jun 6 2015 410c51ca5a05 Add a hook for reporting exceptions Author Tgr Browse Repository No Audits
	Apr 15 2015 c0cd94c135f5 Minimal PSR-3 compatible logger layer Author bd808 Browse Repository No Audits
	39bf3bda1aed Make AutoLoaderTest handle namespaces Author • demon Browse Repository No Audits
	Mar 31 2015 3168f88114df Updated release notes and version number for MediaWiki 1.23.9 Author • csteipp Browse Repository No Audits
	3ed926d89e77 SECURITY: Don't allow entities in XMP Author • csteipp Browse Repository No Audits
	336bcd330c6e SECURITY: Don't allow directly calling Xml::isWellFormed Author • csteipp Browse Repository No Audits
	02b6f29a69a5 SECURITY: Always expand xml entities when checking SVG's Author • csteipp Browse Repository No Audits
	9004770f60f8 SECURITY: Escape > in Html::expandAttributes Author • csteipp Browse Repository No Audits
	cf580155d82e SECURITY: Don't execute another user's CSS or JS on preview Author • csteipp Browse Repository No Audits
	b30f31ac281a SECURITY: Fix animate blacklist Author • csteipp Browse Repository No Audits
	9a82896842fe SECURITY: Don't allow embedded application/xml in SVG's Author • csteipp Browse Repository No Audits
	7c19043d1dc2 SECURITY: Make SVG @import checking case insensitive Author Parent5446 Browse Repository No Audits

HistoryREL1_23

Apr 11 2017

Apr 7 2017

Apr 6 2017

Apr 5 2017

Apr 2 2017

Apr 1 2017

Oct 18 2016

Sep 11 2016

Sep 1 2016

Aug 23 2016

Aug 22 2016

Aug 19 2016

Aug 18 2016

Aug 11 2016

Aug 10 2016

Jul 19 2016

Jun 30 2016

May 20 2016

May 18 2016

Mar 4 2016

Mar 3 2016

Dec 21 2015

Dec 18 2015

Dec 14 2015

Dec 1 2015

Oct 16 2015

Sep 23 2015

Sep 11 2015

Sep 9 2015

Aug 10 2015

Jul 13 2015

Jul 2 2015

Jun 17 2015

Jun 6 2015

Apr 15 2015

Mar 31 2015

History
REL1_23