Allow ­ in messages

[lhc/web/wiklou.git] / RELEASE-NOTES-1.27

diff --git a/RELEASE-NOTES-1.27 b/RELEASE-NOTES-1.27
index fbbacab..3a83b36 100644 (file)
--- a/RELEASE-NOTES-1.27
+++ b/RELEASE-NOTES-1.27
@@ -1,6 +1,3 @@
-Security reminder: If you have PHP's register_globals option set, you must
-turn it off. MediaWiki will not work with it enabled.
-

 == MediaWiki 1.27 ==
 
 THIS IS NOT A RELEASE YET
 == MediaWiki 1.27 ==
 
 THIS IS NOT A RELEASE YET


@@ -8,6 +5,10 @@ THIS IS NOT A RELEASE YET
 MediaWiki 1.27 is an alpha-quality branch and is not recommended for use in
 production.
 
 MediaWiki 1.27 is an alpha-quality branch and is not recommended for use in
 production.
 

+=== PHP version requirement ===
+As of 1.27, MediaWiki now requires PHP 5.5.9 or higher. This corresponds with
+HHVM 3.1.
+

 === Configuration changes in 1.27 ===
 * $wgUseLinkNamespaceDBFields was removed.
 * Deprecated $wgResourceLoaderMinifierStatementsOnOwnLine and
 === Configuration changes in 1.27 ===
 * $wgUseLinkNamespaceDBFields was removed.
 * Deprecated $wgResourceLoaderMinifierStatementsOnOwnLine and


@@ -62,8 +63,38 @@ production.
   $wgSharedDB and $wgSharedTables are properly set even on the "central" wiki
   that all others are sharing from and that $wgLocalDatabases is set to the
   full list of sharing wikis on all those wikis.
   $wgSharedDB and $wgSharedTables are properly set even on the "central" wiki
   that all others are sharing from and that $wgLocalDatabases is set to the
   full list of sharing wikis on all those wikis.

+* Massive overhaul to session handling:
+** $wgSessionsInObjectCache is no longer supported and must be true, due to
+   MediaWiki\Session\SessionManager. $wgSessionHandler is similarly no longer
+   used.
+** ObjectCacheSessionHandler is removed, replaced with
+   MediaWiki\Session\PhpSessionHandler.
+** PHP session handling in general ($_SESSION, session_id(), and so on) is
+   deprecated. Use MediaWiki\Session\SessionManager instead. A new config
+   variable, $wgPHPSessionHandling, is available to cause use of $_SESSION to
+   issue a deprecation warning or to cause most PHP session handling to throw
+   exceptions.
+** Deprecated UserSetCookies hook. Session-handling extensions should generally
+   be creating a custom subclass of CookieSessionProvider. Other extensions
+   messing with cookies can no longer count on user data being saved in cookies
+   versus other methods.
+** Deprecated UserLoadFromSession hook, extensions should create a
+   MediaWiki\Session\SessionProvider.
+** The User cannot be loaded from session until after Setup.php completes.
+   Attempts to do so will be ignored and the User will remain unloaded.
+** CSRF tokens may be fetched from the MediaWiki\Session\Session, which uses
+   the MediaWiki\Session\Token class.
+* MediaWiki will now auto-create users as necessary, removing the need for
+  extensions to do so. An 'autocreateaccount' right is added to allow
+  auto-creation when 'createaccount' is not granted to all users.
+* Deprecated AuthPluginAutoCreate hook in favor of LocalUserCreated.
+* Most cookie-handling methods in User are deprecated.

 * $wgAllowAsyncCopyUploads and $CopyUploadAsyncTimeout were removed. This was an
   experimental feature that has never worked.
 * $wgAllowAsyncCopyUploads and $CopyUploadAsyncTimeout were removed. This was an
   experimental feature that has never worked.

+* Login and createaccount tokens now vary by timestamp.
+* LoginForm::getLoginToken() and LoginForm::getCreateaccountToken()
+  return a MediaWiki\Session\Token, and tokens must be checked using that
+  class's methods.

 * $wgEnotifUseJobQ was removed and the job queue is always used.
 * The functionality of the ApiSandbox extension has been merged into core. The
   extension should no longer be used.
 * $wgEnotifUseJobQ was removed and the job queue is always used.
 * The functionality of the ApiSandbox extension has been merged into core. The
   extension should no longer be used.


@@ -110,6 +141,10 @@ production.
 * It is now possible to patrol file uploads (both for new files and new versions
   of existing files). Special:NewFiles has gained an option to filter by patrol
   status. This functionality can be disabled using $wgUseFilePatrol.
 * It is now possible to patrol file uploads (both for new files and new versions
   of existing files). Special:NewFiles has gained an option to filter by patrol
   status. This functionality can be disabled using $wgUseFilePatrol.

+* MediaWiki\Session infrastructure allows for easier use of session mechanisms
+  other than the usual cookies.
+** SessionMetadata and SessionCheckInfo hooks allow for setting and checking
+   custom session metadata.

 * Added MWGrants and associated configuration settings $wgGrantPermissions and
   $wgGrantPermissionGroups to hold configuration for authentication features
   such as OAuth that want to allow restricting the user rights a user may make
 * Added MWGrants and associated configuration settings $wgGrantPermissions and
   $wgGrantPermissionGroups to hold configuration for authentication features
   such as OAuth that want to allow restricting the user rights a user may make


@@ -119,10 +154,18 @@ production.
    $wgMWOAuthGrantPermissionGroups.
 * Added MWRestrictions as a class to check restrictions on a WebRequest, e.g.
   to assert that the request comes from a particular IP range.
    $wgMWOAuthGrantPermissionGroups.
 * Added MWRestrictions as a class to check restrictions on a WebRequest, e.g.
   to assert that the request comes from a particular IP range.

+* Added bot passwords, a rights-restricted login mechanism for API-using bots.

 * Whitelisted the following HTML attributes for all elements in wikitext:
   aria-describedby, aria-flowto, aria-label, aria-labelledby, aria-owns.
 * Removed "presentation" restriction on the HTML role attribute in wikitext.
   All values are now allowed for the role attribute.
 * Whitelisted the following HTML attributes for all elements in wikitext:
   aria-describedby, aria-flowto, aria-label, aria-labelledby, aria-owns.
 * Removed "presentation" restriction on the HTML role attribute in wikitext.
   All values are now allowed for the role attribute.

+* $wgContentHandlers now also supports callbacks to create an instance of the
+  appropriate ContentHandler subclass.
+* Added $wgAuthenticationTokenVersion, which if non-null prevents the
+  user_token database field from being exposed in cookies. Setting this would
+  be a good idea, but will log out all current sessions.
+* $wgEventRelayerConfig was added, for managing PubSub event relay configuration,
+  specifically for reliable CDN url purges.

 
 === External library changes in 1.27 ===
 
 
 === External library changes in 1.27 ===
 


@@ -136,6 +179,7 @@ production.
 * Added wikimedia/cldr-plural-rule-parser v1.0.0.
 * Added wikimedia/relpath v1.0.3.
 * Added wikimedia/running-stat v1.1.0.
 * Added wikimedia/cldr-plural-rule-parser v1.0.0.
 * Added wikimedia/relpath v1.0.3.
 * Added wikimedia/running-stat v1.1.0.

+* Added wikimedia/php-session-serializer v1.0.3.

 
 ==== Removed and replaced external libraries ====
 
 
 ==== Removed and replaced external libraries ====
 


@@ -158,6 +202,9 @@ production.
 * The following response properties from action=login are deprecated, and may
   be removed in the future: lgtoken, cookieprefix, sessionid. Clients should
   handle cookies to properly manage session state.
 * The following response properties from action=login are deprecated, and may
   be removed in the future: lgtoken, cookieprefix, sessionid. Clients should
   handle cookies to properly manage session state.

+* action=login transparently allows login using bot passwords. Clients should
+  merely need to change the username and password used after setting up a bot
+  password.

 * action=upload no longer understands statuskey, asyncdownload or leavemessage.
 
 === Action API internal changes in 1.27 ===
 * action=upload no longer understands statuskey, asyncdownload or leavemessage.
 
 === Action API internal changes in 1.27 ===


@@ -273,7 +320,7 @@ changes to languages because of Phabricator reports.
 
 == Compatibility ==
 
 
 == Compatibility ==
 

-MediaWiki 1.27 requires PHP 5.3.3 or later. There is experimental support for
+MediaWiki 1.27 requires PHP 5.5.9 or later. There is experimental support for

 HHVM 3.6.5 or later.
 
 MySQL is the recommended DBMS. PostgreSQL or SQLite can also be used, but
 HHVM 3.6.5 or later.
 
 MySQL is the recommended DBMS. PostgreSQL or SQLite can also be used, but