Block: Clean up handling of non-User targets

[lhc/web/wiklou.git] / RELEASE-NOTES-1.32

diff --git a/RELEASE-NOTES-1.32 b/RELEASE-NOTES-1.32
index d90cfdf..2cd1222 100644 (file)
--- a/RELEASE-NOTES-1.32
+++ b/RELEASE-NOTES-1.32
@@ -60,6 +60,10 @@ production.
 * $wgPopularPasswordFile — The location of the default popular passwords file
   has been moved to be in line with other non-PHP files used by libraries and
   classes.
+* $wgEnableImageWhitelist is now disabled by default, as it opens up a hole for
+  potential privacy leaks by administrators. You can check
+  "MediaWiki:External image whitelist" on your wiki to see whether the feature
+  was ever used, and whether it needs to be re-enabled.
 
 ==== Removed configuration ====
 * $wgEnableAPI and $wgEnableWriteAPI – These settings, deprecated in 1.31,
@@ -594,6 +598,7 @@ because of Phabricator reports.
   $wgTidyConfig instead.
 * All Tidy configurations other than Remex have been hard deprecated;
   future parsers will not emit compatible output for these configurations.
+  In particular, running MediaWiki with tidy disabled has been deprecated.
 * (T198214) OutputPage::addWikiText(), OutputPage::addWikiTextWithTitle(),
   and OutputPage::addWikiTextTitle() have been deprecated, since they
   can result in untidy output.  In addition OutputPage::addWikiTextTidy()
@@ -655,7 +660,8 @@ because of Phabricator reports.
 == Compatibility ==
 MediaWiki 1.32 requires PHP 7.0.0 or later. Although HHVM 3.18.5 or later is
 supported, it is generally advised to use PHP 7.0.0 or later for long term
-support.
+support. MediaWiki requires that the mbstring, xml, ctype, json, iconv and
+fileinfo PHP extensions are loaded to work.
 
 MySQL/MariaDB is the recommended DBMS. PostgreSQL or SQLite can also be used,
 but support for them is somewhat less mature. There is experimental support for