From 812733910641618f06ed87a2f098739f4bb32d95 Mon Sep 17 00:00:00 2001 From: Nikita Rana Date: Sat, 23 Mar 2019 10:42:20 +0530 Subject: [PATCH] HISTORY: Add MediaWiki 1.19 post-release change notes Add MediaWiki 1.19 post-release change notes, sourced from https://www.mediawiki.org/wiki/Release_notes/1.19 Bug:T213714 Change-Id: Ia3295c12938750337cfd42371a0ae72abfceff2c --- HISTORY | 46 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 46 insertions(+) diff --git a/HISTORY b/HISTORY index a9260699fb..45ed5bd55e 100644 --- a/HISTORY +++ b/HISTORY @@ -7044,6 +7044,52 @@ changes to languages because of Bugzilla reports. == MediaWiki 1.19 == +== MediaWiki 1.19.24 == + +This is a security and maintenance release of the MediaWiki 1.19 branch. + +=== Changes since 1.19.23 === + +* ({{bug|T85848}}, {{bug|T71210}}) SECURITY: Don't parse XMP blocks that +contain XML entities, to prevent various DoS attacks. +* ({{bug|T88310}}) SECURITY: Always expand xml entities when checking SVG's. +* ({{bug|T73394}}) SECURITY: Escape > in Html::expandAttributes to prevent XSS. +* ({{bug|T85855}}) SECURITY: Don't execute another user's CSS or JS on preview. +* ({{bug|T85349}}, {{bug|T85850}}, {{bug|T86711}}) SECURITY: Multiple issues +fixed in SVG filtering to prevent XSS and protect viewer's privacy. + +== MediaWiki 1.19.23 == + +This is a security and maintenance release of the MediaWiki 1.19 branch. + +=== Changes since 1.19.22 === + +* (bug T76686) [SECURITY] thumb.php outputs wikitext message as raw HTML, which +could lead to xss. Permission to edit MediaWiki namespace is required to +exploit this. +* (bug T74222) The original patch for T74222 was reverted as unnecessary. +* Add missing $ in front of variable in OutputPage.php + +== MediaWiki 1.19.22 == + +This is a security and maintenance release of the MediaWiki 1.19 branch. + +=== Changes since 1.19.21 === + +* ({{bug|66776}}, {{bug|71478}}) SECURITY: User PleaseStand reported a way to +inject code into API clients that used format=php to process pages that +underwent flash policy mangling. This was fixed along with improving how the +mangling was done for format=json, and allowing sites to disable the mangling +using $wgMangleFlashPolicy. +* ({{bug|72222}}) SECURITY: Do not show log action when the entry is revdeleted +with DELETED_ACTION. NOTICE: this may be reverted in a future release pending a +public RFC about the desired functionality. This issue was reported by user +Bawolff. +* ({{bug|71621}}) Make allowing site-wide styles on restricted special pages a +config option. +* $wgMangleFlashPolicy was added to make MediaWiki's mangling of anything that +might be a flash policy directive configurable. + == MediaWiki 1.19.21 == This is a maintenance release of the MediaWiki 1.19 branch. -- 2.20.1