From: Nikita Rana Date: Tue, 26 Mar 2019 12:54:48 +0000 (+0530) Subject: HISTORY: Add MediaWiki 1.9 post-release change notes X-Git-Tag: 1.34.0-rc.0~2345^2 X-Git-Url: http://git.cyclocoop.org/%24image?a=commitdiff_plain;h=9f6d091d5942ecb129d6841bf647318ce45ce1ca;p=lhc%2Fweb%2Fwiklou.git HISTORY: Add MediaWiki 1.9 post-release change notes Add MediaWiki 1.9 post-release change notes, sourced from https://www.mediawiki.org/wiki/Release_notes/1.9 Bug:T213714 Change-Id: Idbb105e332afeec1daafaf275da6ae432a698371 --- diff --git a/HISTORY b/HISTORY index e8a3692a00..15617ef220 100644 --- a/HISTORY +++ b/HISTORY @@ -13913,10 +13913,159 @@ break. Don't forget to always back up your database before upgrading! See the file UPGRADE for more detailed upgrade instructions. = MediaWiki release notes = - Security reminder: MediaWiki does not require PHP's register_globals setting since version 1.2.0. If you have it on, turn it *off* if you can. += MediaWiki 1.9 = + +== MediaWiki 1.9.6 == + +March 2, 2008 + +* Correction for API path fix, broken in 1.9.5 + +== MediaWiki 1.9.5 == + +January 23, 2008 + +This is a security update to the Winter 2007 quarterly release. A potential XSS +injection vector affecting api.php only for Microsoft Internet Explorer users +has been closed. + + +To work around the vulnerability without upgrading, you may disable the API if +you don't need it: + +:[[Manual:$wgEnableAPI|$wgEnableAPI]] = false; + +Not vulnerable versions: +* 1.12 or later +* 1.11 >= 1.11.1 +* 1.10 >= 1.10.3 +* 1.9 >= 1.9.5 +* 1.8 any version (if $wgEnableAPI has been left off) + +Vulnerable versions: +* 1.11 <= 1.11.0rc1 +* 1.10 <= 1.10.2 +* 1.9 <= 1.9.4 +* 1.8 any version (if $wgEnableAPI has been switched on) + +MediaWiki 1.7 and below are not affected as they do not include the API +functionality, however the BotQuery extension is similarly vulnerable unless +updated to the latest SVN version. + +== MediaWiki 1.9.4 == + +September 10, 2007 + +This is a security and bug fix update to the Winter 2007 quarterly release. +Minor compatibility fixes for IIS 5 are included. + +* (bug [[bugzilla:8847|8847]]) Strip spurious #fragments from request URI to +fix redirect loops on some server configurations +* A possible HTML/XSS injection vector in the API pretty-printing mode has been +found and fixed. + +The vulnerability may be worked around in an unfixed version by simply +disabling the API interface if it is not in use, by adding this to +LocalSettings.php: + +:[[Manual:$wgEnableAPI|$wgEnableAPI]] = false; + +Not vulnerable versions: +* 1.11 >= 1.11.0 +* 1.10 >= 1.10.2 +* 1.9 >= 1.9.4 +* 1.8 >= 1.8.5 + +Vulnerable versions: +* 1.11 <= 1.11.0rc1 +* 1.10 <= 1.10.1 +* 1.9 <= 1.9.3 +* 1.8 <= 1.8.4 (if $wgEnableAPI has been switched on) + +MediaWiki 1.7 and below are not affected as they do not include the faulty +function, however the BotQuery extension is similarly vulnerable unless updated +to the latest SVN version. + +== MediaWiki 1.9.3 == + +February 20, 2007 + +This is a security and bug-fix update to the Winter 2007 quarterly release. +Minor compatibility fixes for IIS and PostgreSQL are included. + +An XSS injection vulnerability based on Microsoft Internet Explorer's UTF-7 +charset autodetection was located in the AJAX support module, affecting MSIE +users on MediaWiki 1.6.x and up when the optional setting $wgUseAjax is enabled. + +If you are using an extension based on the optional Ajax module, either disable +it or upgrade to a version containing the fix: + +* 1.9: fixed in 1.9.3 +* 1.8: fixed in 1.8.4 +* 1.7: fixed in 1.7.3 +* 1.6: fixed in 1.6.10 + +There is no known danger in the default configuration, with ''$wgUseAjax'' off. + +* ([[mediazilla:8992|8992]]) Fix a remaining raw use of REQUEST_URI in history +* ([[mediazilla:8984|8984]]) Fix a database error in +Special:Recentchangeslinked when using the PostgreSQL database. +* Add ''charset'' to Content-Type headers on various HTTP error responses to +forestall additional UTF-7-autodetect XSS issues. PHP sends only ''text/html'' +by default when the script didn't specify more details, which some +inconsiderate browsers consider a license to autodetect the deadly, +hard-to-escape UTF-7. This fixes an issue with the Ajax interface error message +on MSIE when ''$wgUseAjax'' is enabled (not default configuration); this UTF-7 +variant on a previously fixed attack vector was discovered by Moshe BA from +BugSec: [http://www.bugsec.com/articles.php?Security=24 +http://www.bugsec.com/articles.php?Security=24] +* Trackback responses now specify XML content type + +== MediaWiki 1.9.2 == + +February 4, 2007 + +This is a bug-fix update that fixes some installation and other minor issues +with the 1.9.1 release as well as a security issue which was introduced in the +1.9 branch. + +JavaScript code which regenerated the "sortable tables" feature did not +properly sanitize input, leading to an HTML injection vulnerability. + +* ([[mediazilla:8774|8774]]) Fix path for GNU FDL rights icon on new installs +* ([[mediazilla:8819|8819]]) Fix full path disclosure with skins dependencies +* ([[mediazilla:8819|8819]]) Fixed data-loss bug in compressOld batch text +compression affecting pages which had null edits (move, protect, etc) as second +edit in a batch group. Isolated and patched by Travis Derouin. +* Security fix for sortable tables JavaScript + +== MediaWiki 1.9.1 == + +January 24, 2007 + +This is a bug-fix update that fixes some installation and upgrade issues with +the original 1.9.0 release. + +* ([[mediazilla:3000|3000]]) Fall back to SCRIPT_NAME plus QUERY_STRING when +REQUEST_URI is not available, as on IIS with PHP-CGI +* Security fix for DjVu images. (Only affects servers where .djvu file uploads +are enabled and ''$wgDjvuToXML'' is set.) +* ([[mediazilla:8638|8638]]) Fix update from 1.4 and earlier +* ([[mediazilla:8641|8641]]) Fix order of updates to ipblocks table for updates +from <=1.7 +* ([[mediazilla:8673|8673]]) Minor fix for web service API content-type header +* Fix API revision list on PHP 5.2.1; bad reference assignment +* Fixed up the AjaxSearch +* Exclude settings files when generating documentation. That could expose the +database user and password to remote users. +* ar: fix the 'create a new page' on search page when no exact match found +* Correct tooltip accesskey hint for Opera on the Macintosh (uses Shift-Esc-, +not Ctrl-). +* ([[mediazilla:8719|8719]]) Firefox release notes lie! Fix tooltips for +Firefox 2 on x11; accesskeys default settings appear to be same as Windows. == Changes since 1.8 ==