Merge "Add HKDF as a fast, random number source"

diff --combined RELEASE-NOTES-1.24
index a85a3a0,eb0d634..b15ef6d
--- 1/RELEASE-NOTES-1.24
--- 2/RELEASE-NOTES-1.24
+++ b/RELEASE-NOTES-1.24
@@@ -35,11 -35,7 +35,11 @@@ production
  * (bug 49156) Added the mediawiki.cookie ResourceLoader module, which wraps
    jQuery.cookie so that getting/setting a cookie is syntactically and functionally
    similar to using the WebRequest#getCookie/WebResponse#setcookie methods.
 -* (bug 44740) jQuery upgraded from 1.8.3 to 1.11.1.
 +* (bug 44740) jQuery upgraded from 1.8.3 to 1.11.1. A new configuration option,
 +  $wgIncludejQueryMigrate, also loads the jQuery Migrate hack to let extensions
 +  and gadgets use the long-deprecated functions that were removed in jQuery 1.9.
 +  This option is turned off by default, and will be removed in MediaWiki 1.25.
 +* (bug 47076) jQuery UI upgraded from 1.8.24 to 1.9.2.
  * Changes to content typography (fonts, etc.). See
    https://www.mediawiki.org/wiki/Typography_refresh for further information.
  * WikitextContent will now render redirects with the expected "redirect"
@@@ -60,6 -56,8 +60,8 @@@
    than in a dedicated pane in the preferences panel.
  * (bug 44591) The dropdown actions menu (little triangle next to page tabs) in
    the Vector skin has gained a label that should make it more discoverable.
+ * MWCryptHKDF added for fast, cryptographically secure random number generation
+   that won't deplete openssl's entropy pool.
  
  === Bug fixes in 1.24 ===
  * (bug 49116) Footer copyright notice is now always displayed in user language
@@@ -97,10 -95,6 +99,10 @@@
    specified.
  * action=logevents has a new parameter, lenamespace, to allow filtering by
    namespace.
 +* action=expandtemplates has a new parameter, prop, and a new output format.
 +  The old format is still used if prop isn't provided, but this is deprecated.
 +* meta=userinfo can now return the count of unread pages on the watchlist.
 +* list=watchlist can now filter by unread status.
  
  === Languages updated in 1.24 ===
  
@@@ -131,8 -125,6 +133,8 @@@ changes to languages because of Bugzill
    like "headlinks", "skinnameclass", etc. to be defined.
  * The deprecated 'SpecialVersionExtensionTypes' hook was removed.
  * (bug 63891) Add 'X-Robots-Tag: noindex' header in action=render pages.
 +* SpecialPage no longer supports the syntax for invoking wfSpecial*() functions.
 +  All special pages should subclass SpecialPage and implement the execute() method.
  
  ==== Renamed classes ====
  * CLDRPluralRuleConverter_Expression to CLDRPluralRuleConverterExpression

diff --combined includes/DefaultSettings.php
index 1727aed,28ae757..f9cafc9
--- 1/includes/DefaultSettings.php
--- 2/includes/DefaultSettings.php
+++ b/includes/DefaultSettings.php
@@@ -3221,15 -3221,6 +3221,15 @@@ $wgResourceLoaderMinifierMaxLineLength 
   */
  $wgIncludeLegacyJavaScript = true;
  
 +/**
 + * Whether to include the jQuery Migrate library, which lets legacy JS that
 + * requires jQuery 1.8.x to work and breaks with 1.9.x+.
 + *
 + * @since 1.24
 + * @deprecated since 1.24, to be removed in 1.25
 + */
 +$wgIncludejQueryMigrate = false;
 +
  /**
   * Whether to preload the mediawiki.util module as blocking module in the top
   * queue.
@@@ -7076,6 -7067,16 +7076,16 @@@ $wgPagePropsHaveSortkey = true
   */
  $wgHttpsPort = 443;
  
+ /**
+  * Secret and algorithm for hmac-based key derivation function (fast,
+  * cryptographically secure random numbers).
+  * This should be set in LocalSettings.php, otherwise wgSecretKey will
+  * be used.
+  * @since 1.24
+  */
+ $wgHKDFSecret = false;
+ $wgHKDFAlgorithm = 'sha256';
+ 
  /**
   * For really cool vim folding this needs to be at the end:
   * vim: foldmarker=@{,@} foldmethod=marker