SECURITY: API: Don't log "sensitive" parameters

[lhc/web/wiklou.git] / RELEASE-NOTES-1.29

diff --git a/RELEASE-NOTES-1.29 b/RELEASE-NOTES-1.29
index 964e0bb..94bdcf7 100644 (file)
--- a/RELEASE-NOTES-1.29
+++ b/RELEASE-NOTES-1.29
@@ -63,17 +63,18 @@ production.
 === External library changes in 1.29 ===
 
 ==== Upgraded external libraries ====
-* Added wikimedia/timestamp v1.0.0.
 * Updated QUnit from v1.22.0 to v1.23.1.
-* Updated cssjanus from v1.1.2 to 1.1.3.
+* Updated cssjanus from v1.1.2 to v1.2.0.
 * Updated psr/log from v1.0.0 to v1.0.2.
 * Update Moment.js from v2.8.4 to v2.15.0.
-* Updated oyejorge/less.php from v1.7.0.10 to v1.7.0.13.
-* Added wikimedia/remex-html v1.0.1.
+* Updated oyejorge/less.php from v1.7.0.10 to v1.7.0.14.
 * Updated monolog from v1.18.2 to 1.22.1.
 * Updated wikimedia/composer-merge-plugin from v1.3.1 to v1.4.0.
+* Updated OOjs from v1.1.10 to v2.0.0.
 
 ==== New external libraries ====
+* Added wikimedia/timestamp v1.0.0.
+* Added wikimedia/remex-html v1.0.1.
 
 ==== Removed and replaced external libraries ====
 
@@ -85,6 +86,12 @@ production.
 * (T157035) "new mw.Uri()" was ignoring options when using default URI.
 * Special:Allpages can no longer be filtered by redirect in miser mode.
 * (T160519) CACHE_ANYTHING will not be CACHE_ACCEL if no accelerator is installed.
+* (T109140) (T122209) SECURITY: Special:UserLogin and Special:Search allow redirect
+  to interwiki links.
+* (T144845) SECURITY: XSS in SearchHighlighter::highlightText() when
+  $wgAdvancedSearchHighlighting is true.
+* (T125177) SECURITY: API parameters may now be marked as "sensitive" to keep
+  their values out of the logs.
 
 === Action API changes in 1.29 ===
 * Submitting sensitive authentication request parameters to action=login,
@@ -145,6 +152,8 @@ production.
   various methods now take a module path rather than a module name.
 * ApiMessageTrait::getApiCode() now strips 'apierror-' and 'apiwarn-' prefixes
   from the message key, and maps some message keys for backwards compatibility.
+* API parameters may now be marked as "sensitive" to keep their values out of
+  the logs.
 
 === Languages updated in 1.29 ===
 
@@ -283,6 +292,8 @@ changes to languages because of Phabricator reports.
   rather than <strong> tags. The old class name, "selflink", was deprecated
   and will be removed in a future release. (T160480)
 * (T156184) $wgRawHtml will no longer apply to internationalization messages.
+* Browser support for non-ES5 JavaScript browsers, including Android 2,
+  Opera <12.10, and Internet Explorer 9, was lowered from Grade A to Grade C.
 
 == Compatibility ==