diff options
| author | Chad Horohoe <chadh@wikimedia.org> | 2015-12-17 15:09:17 -0800 |
|---|---|---|
| committer | Chad Horohoe <chadh@wikimedia.org> | 2015-12-17 16:36:59 -0800 |
| commit | 905d088b12375958099346a922d4f0ccc1db12ca (patch) | |
| tree | e6d7ff877230bafdbf456a6ab9beaafdc3ae6f3c | |
| parent | 8bb46160c7cbd32231ce1fae5ee1f49a4fc5e123 (diff) | |
1.26.1: Bump version and add release notes1.26.1
Change-Id: I11a677017d5791d389ffe88faf4224570036a86b
| -rw-r--r-- | RELEASE-NOTES-1.26 | 21 | ||||
| -rw-r--r-- | includes/DefaultSettings.php | 2 |
2 files changed, 19 insertions, 4 deletions
diff --git a/RELEASE-NOTES-1.26 b/RELEASE-NOTES-1.26 index 91791c0b3297..379c41b3c7cb 100644 --- a/RELEASE-NOTES-1.26 +++ b/RELEASE-NOTES-1.26 @@ -3,9 +3,24 @@ turn it off. MediaWiki will not work with it enabled. == MediaWiki 1.26.1 == -THIS IS NOT YET A RELEASE! - -=== Changes since 1.26 === +This is a maintenance release of the MediaWiki 1.26 branch. + +=== Changes since 1.26.0 === +* (T117899) SECURITY: $wgArticlePath can no longer be set to relative paths + that do not begin with a slash. This enabled trivial XSS attacks. + Configuration values such as "http://my.wiki.com/wiki/$1" are fine, as are + "/wiki/$1". A value such as "$1" or "wiki/$1" is not and will now throw an + error. +* (T119309) SECURITY: Use hash_compare() for edit token comparison +* (T118032) SECURITY: Don't allow cURL to interpret POST parameters starting + with '@' as file uploads +* (T115522) SECURITY: Passwords generated by User::randomPassword() can no + longer be shorter than $wgMinimalPasswordLength +* (T97897) SECURITY: Improve IP parsing and trimming. Previous behavior could + result in improper blocks being issued +* (T109724) SECURITY: Special:MyPage, Special:MyTalk, Special:MyContributions + and related pages no longer use HTTP redirects and are now redirected by + MediaWiki * Fixed ConfigException in ExpandTemplates due to AlwaysUseTidy. * Fixed stray literal \n in Special:Search. * Fix issue that breaks HHVM Repo Authorative mode. diff --git a/includes/DefaultSettings.php b/includes/DefaultSettings.php index 4b0870a4765a..919d05b8307b 100644 --- a/includes/DefaultSettings.php +++ b/includes/DefaultSettings.php @@ -75,7 +75,7 @@ $wgConfigRegistry = array( * MediaWiki version number * @since 1.2 */ -$wgVersion = '1.26.0'; +$wgVersion = '1.26.1'; /** * Name of the site. It must be changed in LocalSettings.php |