<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html><head><meta content="text/html; charset=utf-8" http-equiv="Content-Type"></head><br><br><div style='font-size:10.0pt;font-family:"Tahoma","sans-serif";padding:3.0pt 0in 0in 0in'>
<hr style='border:none;border-top:solid #E1E1E1 1.0pt'>
<b>From:</b> Chad <innocentkiller@gmail.com><br>
<b>Sent:</b> December 17, 2015 7:25:59 PM EST<br>
<b>To:</b> "mediawiki-announce@lists.wikimedia.org" <mediawiki-announce@lists.wikimedia.org><br>
<b>Subject:</b> [MediaWiki-announce] Security Release: 1.26.1, 1.25.4, 1.24.5 and 1.23.12<br>
</div>
<br>
<pre class="k9mail">I would like to announce the release of MediaWiki 1.26.1, 1.25.4, 1.24.5,<br />and<br />1.23.12.<br /><br />These releases fix five security issues in core, in addition to other bug<br />fixes. Download links are given at the end of this email<br /><br />== Security fixes ==<br /><br />(T117899) SECURITY: $wgArticlePath can no longer be set to relative paths<br />that<br />do not begin with a slash. This enabled trivial XSS attacks. Configuration<br />values such as "<a href="http://my.wiki.com/wiki">http://my.wiki.com/wiki</a>/$1" are fine, as are "/wiki/$1". A<br />value such as "$1" or "wiki/$1" is not and will now throw an error<br /><br />(T119309) SECURITY: Use hash_compare() for edit token comparison<br /><br />(T118032) SECURITY: Don't allow cURL to interpret POST parameters starting<br />with<br />'@' as file uploads<br /><br />(T115522) SECURITY: Passwords generated by User::randomPassword() can no<br />longer<br />be shorter than
$wgMinimalPasswordLength<br /><br />(T97897) SECURITY: Improve IP parsing and trimming. Previous behavior could<br />result in improper blocks being issued<br /><br />(T109724) SECURITY: Special:MyPage, Special:MyTalk, Special:MyContributions<br />and<br />related pages no longer use HTTP redirects and are now redirected by<br />MediaWiki<br /><br />== Note about EOL of 1.24.x ==<br /><br />Please note that 1.24.5 marks the end of support for the 1.24.x series of<br />releases. Technically this ended a few weeks ago with the release of 1.26.0<br />but<br />we dropped one final release of 1.24.x here to give it a nicer send off for<br />those who have not yet upgraded.<br /><br />== Release notes ==<br /><br />Full release notes for 1.26.1:<br /><<a href="https://www.mediawiki.org/wiki/Release_notes/1.26">https://www.mediawiki.org/wiki/Release_notes/1.26</a>><br /><br />Full release notes for 1.25.4:<br /><<a
href="https://www.mediawiki.org/wiki/Release_notes/1.25">https://www.mediawiki.org/wiki/Release_notes/1.25</a>><br /><br />Full release notes for 1.24.5:<br /><<a href="https://www.mediawiki.org/wiki/Release_notes/1.24">https://www.mediawiki.org/wiki/Release_notes/1.24</a>><br /><br />Full release notes for 1.23.12:<br /><<a href="https://www.mediawiki.org/wiki/Release_notes/1.23">https://www.mediawiki.org/wiki/Release_notes/1.23</a>><br /><br />For information about how to upgrade, see<br /><<a href="https://www.mediawiki.org/wiki/Manual:Upgrading">https://www.mediawiki.org/wiki/Manual:Upgrading</a>><br /><br />**********************************************************************<br /> 1.26.1<br />**********************************************************************<br />Download:<br /><a href="https://releases.wikimedia.org/mediawiki/1.26/mediawiki-1.26.1.tar.gz">https://releases.wikimedia.org/mediawiki/1.26/mediawiki-1.26.1.tar.gz</a><br /><a
href="https://releases.wikimedia.org/mediawiki/1.26/mediawiki-core-1.26.1.tar.gz">https://releases.wikimedia.org/mediawiki/1.26/mediawiki-core-1.26.1.tar.gz</a><br /><br />Patch to previous version:<br /><a href="https://releases.wikimedia.org/mediawiki/1.26/mediawiki-1.26.1.patch.gz">https://releases.wikimedia.org/mediawiki/1.26/mediawiki-1.26.1.patch.gz</a><br /><a href="https://releases.wikimedia.org/mediawiki/1.26/mediawiki-i18n-1.26.1.patch.gz">https://releases.wikimedia.org/mediawiki/1.26/mediawiki-i18n-1.26.1.patch.gz</a><br /><br />GPG signatures:<br /><a href="https://releases.wikimedia.org/mediawiki/1.26/mediawiki-1.26.1.tar.gz.sig">https://releases.wikimedia.org/mediawiki/1.26/mediawiki-1.26.1.tar.gz.sig</a><br /><a href="https://releases.wikimedia.org/mediawiki/1.26/mediawiki-1.26.1.patch.gz.sig">https://releases.wikimedia.org/mediawiki/1.26/mediawiki-1.26.1.patch.gz.sig</a><br /><a
href="https://releases.wikimedia.org/mediawiki/1.26/mediawiki-core-1.26.1.tar.gz.sig">https://releases.wikimedia.org/mediawiki/1.26/mediawiki-core-1.26.1.tar.gz.sig</a><br /><br />Public keys:<br /><a href="https://www.mediawiki.org/keys/keys.html">https://www.mediawiki.org/keys/keys.html</a><br /><br />**********************************************************************<br /> 1.25.4<br />**********************************************************************<br />Download:<br /><a href="https://releases.wikimedia.org/mediawiki/1.25/mediawiki-1.25.4.tar.gz">https://releases.wikimedia.org/mediawiki/1.25/mediawiki-1.25.4.tar.gz</a><br /><a href="https://releases.wikimedia.org/mediawiki/1.25/mediawiki-core-1.25.4.tar.gz">https://releases.wikimedia.org/mediawiki/1.25/mediawiki-core-1.25.4.tar.gz</a><br /><br />Patch to previous version:<br /><a
href="https://releases.wikimedia.org/mediawiki/1.25/mediawiki-1.25.4.patch.gz">https://releases.wikimedia.org/mediawiki/1.25/mediawiki-1.25.4.patch.gz</a><br /><a href="https://releases.wikimedia.org/mediawiki/1.25/mediawiki-i18n-1.25.4.patch.gz">https://releases.wikimedia.org/mediawiki/1.25/mediawiki-i18n-1.25.4.patch.gz</a><br /><br />GPG signatures:<br /><a href="https://releases.wikimedia.org/mediawiki/1.25/mediawiki-1.25.4.tar.gz.sig">https://releases.wikimedia.org/mediawiki/1.25/mediawiki-1.25.4.tar.gz.sig</a><br /><a href="https://releases.wikimedia.org/mediawiki/1.25/mediawiki-1.25.4.patch.gz.sig">https://releases.wikimedia.org/mediawiki/1.25/mediawiki-1.25.4.patch.gz.sig</a><br /><a href="https://releases.wikimedia.org/mediawiki/1.25/mediawiki-core-1.25.4.tar.gz.sig">https://releases.wikimedia.org/mediawiki/1.25/mediawiki-core-1.25.4.tar.gz.sig</a><br /><br />Public keys:<br /><a href="https://www.mediawiki.org/keys/keys.html">https://www.mediawiki.org/keys/keys.html</a><br
/><br />**********************************************************************<br /> 1.24.5<br />**********************************************************************<br />Download:<br /><a href="https://releases.wikimedia.org/mediawiki/1.24/mediawiki-1.24.5.tar.gz">https://releases.wikimedia.org/mediawiki/1.24/mediawiki-1.24.5.tar.gz</a><br /><a href="https://releases.wikimedia.org/mediawiki/1.24/mediawiki-core-1.24.5.tar.gz">https://releases.wikimedia.org/mediawiki/1.24/mediawiki-core-1.24.5.tar.gz</a><br /><br />Patch to previous version:<br /><a href="https://releases.wikimedia.org/mediawiki/1.24/mediawiki-1.24.5.patch.gz">https://releases.wikimedia.org/mediawiki/1.24/mediawiki-1.24.5.patch.gz</a><br /><a href="https://releases.wikimedia.org/mediawiki/1.24/mediawiki-i18n-1.24.5.patch.gz">https://releases.wikimedia.org/mediawiki/1.24/mediawiki-i18n-1.24.5.patch.gz</a><br /><br />GPG signatures:<br /><a
href="https://releases.wikimedia.org/mediawiki/1.24/mediawiki-1.24.5.tar.gz.sig">https://releases.wikimedia.org/mediawiki/1.24/mediawiki-1.24.5.tar.gz.sig</a><br /><a href="https://releases.wikimedia.org/mediawiki/1.24/mediawiki-1.24.5.patch.gz.sig">https://releases.wikimedia.org/mediawiki/1.24/mediawiki-1.24.5.patch.gz.sig</a><br /><a href="https://releases.wikimedia.org/mediawiki/1.24/mediawiki-core-1.24.5.tar.gz.sig">https://releases.wikimedia.org/mediawiki/1.24/mediawiki-core-1.24.5.tar.gz.sig</a><br /><br />Public keys:<br /><a href="https://www.mediawiki.org/keys/keys.html">https://www.mediawiki.org/keys/keys.html</a><br /><br />**********************************************************************<br /> 1.23.12<br />**********************************************************************<br />Download:<br /><a href="https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.12.tar.gz">https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.12.tar.gz</a><br /><a
href="https://releases.wikimedia.org/mediawiki/1.23/mediawiki-core-1.23.12.tar.gz">https://releases.wikimedia.org/mediawiki/1.23/mediawiki-core-1.23.12.tar.gz</a><br /><br />Patch to previous version:<br /><a href="https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.12.patch.gz">https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.12.patch.gz</a><br /><a href="https://releases.wikimedia.org/mediawiki/1.23/mediawiki-i18n-1.23.12.patch.gz">https://releases.wikimedia.org/mediawiki/1.23/mediawiki-i18n-1.23.12.patch.gz</a><br /><br />GPG signatures:<br /><a href="https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.12.tar.gz.sig">https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.12.tar.gz.sig</a><br /><a href="https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.12.patch.gz.sig">https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.12.patch.gz.sig</a><br /><a
href="https://releases.wikimedia.org/mediawiki/1.23/mediawiki-core-1.23.12.tar.gz.sig">https://releases.wikimedia.org/mediawiki/1.23/mediawiki-core-1.23.12.tar.gz.sig</a><br /><br />Public keys:<br /><a href="https://www.mediawiki.org/keys/keys.html">https://www.mediawiki.org/keys/keys.html</a><br /><br />-Chad H. & Chris S.<br /><hr /><br />MediaWiki announcements mailing list<br />To unsubscribe, go to:<br /><a href="https://lists.wikimedia.org/mailman/listinfo/mediawiki-announce">https://lists.wikimedia.org/mailman/listinfo/mediawiki-announce</a><br /></pre><br>
-- <br>
Sent from my Android device with K-9 Mail. Please excuse my brevity.</html>