SECURITY: XSS in search if $wgAdvancedSearchHighlighting = true;

[lhc/web/wiklou.git] / RELEASE-NOTES-1.29

diff --git a/RELEASE-NOTES-1.29 b/RELEASE-NOTES-1.29
index b1157fe..a2dbcd5 100644 (file)
--- a/RELEASE-NOTES-1.29
+++ b/RELEASE-NOTES-1.29
@@ -86,6 +86,10 @@ production.
 * (T157035) "new mw.Uri()" was ignoring options when using default URI.
 * Special:Allpages can no longer be filtered by redirect in miser mode.
 * (T160519) CACHE_ANYTHING will not be CACHE_ACCEL if no accelerator is installed.
+* (T109140) (T122209) SECURITY: Special:UserLogin and Special:Search allow redirect
+  to interwiki links.
+* (T144845) SECURITY: XSS in SearchHighlighter::highlightText() when
+  $wgAdvancedSearchHighlighting is true.
 
 === Action API changes in 1.29 ===
 * Submitting sensitive authentication request parameters to action=login,
@@ -284,8 +288,8 @@ changes to languages because of Phabricator reports.
   rather than <strong> tags. The old class name, "selflink", was deprecated
   and will be removed in a future release. (T160480)
 * (T156184) $wgRawHtml will no longer apply to internationalization messages.
-* Browser support for non-ES5 JavaScript browsers, including Android 2, Opera 12,
-  and Internet Explorer 9, was lowered from Grade A to Grade C.
+* Browser support for non-ES5 JavaScript browsers, including Android 2,
+  Opera <12.10, and Internet Explorer 9, was lowered from Grade A to Grade C.
 
 == Compatibility ==