Reedy has submitted this change and it was merged. Change subject: 1.25.4: Prep release notes and bump version number ......................................................................
1.25.4: Prep release notes and bump version number Change-Id: I26182a13c3cf11d5f6317ea134c1d56383e0d35f --- M RELEASE-NOTES-1.25 M includes/DefaultSettings.php 2 files changed, 18 insertions(+), 3 deletions(-) Approvals: Reedy: Verified; Looks good to me, approved Legoktm: Looks good to me, approved diff --git a/RELEASE-NOTES-1.25 b/RELEASE-NOTES-1.25 index 362414f..284c38c 100644 --- a/RELEASE-NOTES-1.25 +++ b/RELEASE-NOTES-1.25 @@ -3,13 +3,28 @@ == MediaWiki 1.25.4 == -THIS IS NOT YET A RELEASE! +This is a security and maintenance release of the MediaWiki 1.25 branch. === Changes since 1.25.3 === +* (T117899) SECURITY: $wgArticlePath can no longer be set to relative paths + that do not begin with a slash. This enabled trivial XSS attacks. + Configuration values such as "http://my.wiki.com/wiki/$1"; are fine, as are + "/wiki/$1". A value such as "$1" or "wiki/$1" is not and will now throw an + error. +* (T119309) SECURITY: Use hash_compare() for edit token comparison +* (T118032) SECURITY: Don't allow cURL to interpret POST parameters starting + with '@' as file uploads +* (T115522) SECURITY: Passwords generated by User::randomPassword() can no + longer be shorter than $wgMinimalPasswordLength +* (T97897) SECURITY: Improve IP parsing and trimming. Previous behavior could + result in improper blocks being issued +* (T109724) SECURITY: Special:MyPage, Special:MyTalk, Special:MyContributions + and related pages no longer use HTTP redirects and are now redirected by + MediaWiki * (T103237) $wgUseGzip had no effect when using file cache. * (T114606) mw.notify was not correctly fixed to the page if initialized while not at the top of the page. -* * Fix issue that breaks HHVM Repo Authorative mode. +* Fix issue that breaks HHVM Repo Authorative mode. == MediaWiki 1.25.3 == diff --git a/includes/DefaultSettings.php b/includes/DefaultSettings.php index 1e697d1..9267d3a 100644 --- a/includes/DefaultSettings.php +++ b/includes/DefaultSettings.php @@ -75,7 +75,7 @@ * MediaWiki version number * @since 1.2 */ -$wgVersion = '1.25.3'; +$wgVersion = '1.25.4'; /** * Name of the site. It must be changed in LocalSettings.php -- To view, visit https://gerrit.wikimedia.org/r/259935 To unsubscribe, visit https://gerrit.wikimedia.org/r/settings Gerrit-MessageType: merged Gerrit-Change-Id: I26182a13c3cf11d5f6317ea134c1d56383e0d35f Gerrit-PatchSet: 1 Gerrit-Project: mediawiki/core Gerrit-Branch: REL1_25 Gerrit-Owner: Chad <[email protected]> Gerrit-Reviewer: Legoktm <[email protected]> Gerrit-Reviewer: Reedy <[email protected]> Gerrit-Reviewer: jenkins-bot <> _______________________________________________ MediaWiki-commits mailing list [email protected] https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
