Mglaser has uploaded a new change for review. https://gerrit.wikimedia.org/r/176212
Change subject: Updated release notes and version number to MediaWiki 1.22.14 ...................................................................... Updated release notes and version number to MediaWiki 1.22.14 This is MediaWiki 1.22.14 security and maintenance release. Change-Id: I7fa4054648478bd08cfeac04870fad4200ded493 --- M RELEASE-NOTES-1.22 M includes/DefaultSettings.php 2 files changed, 18 insertions(+), 1 deletion(-) git pull ssh://gerrit.wikimedia.org:29418/mediawiki/core refs/changes/12/176212/1 diff --git a/RELEASE-NOTES-1.22 b/RELEASE-NOTES-1.22 index ac0d355..20c1947 100644 --- a/RELEASE-NOTES-1.22 +++ b/RELEASE-NOTES-1.22 @@ -8,6 +8,23 @@ This is a security and maintenance release of the MediaWiki 1.22 branch. === Changes since 1.22.13 === + +* (bugs 66776, 71478) SECURITY: User PleaseStand reported a way to inject code + into API clients that used format=php to process pages that underwent flash + policy mangling. This was fixed along with improving how the mangling was done + for format=json, and allowing sites to disable the mangling using + $wgMangleFlashPolicy. +* (bug 70901) SECURITY: User Jackmcbarn reported that the ability to update + the content model for a page could allow an unprivileged attacker to edit + another user's common.js under certain circumstances. The user right + "editcontentmodel" was added, and is needed to change a revision's content + model. +* (bug 72222) SECURITY: Do not show log action when the entry is revdeleted with + DELETED_ACTION. NOTICE: this may be reverted in a future release pending a + public RFC about the desired functionality. This issue was reported by user + Bawolff. +* (bug 71621) Make allowing site-wide styles on restricted special pages a + config option. * $wgMangleFlashPolicy was added to make MediaWiki's mangling of anything that might be a flash policy directive configurable. diff --git a/includes/DefaultSettings.php b/includes/DefaultSettings.php index 9288154..6feac36 100644 --- a/includes/DefaultSettings.php +++ b/includes/DefaultSettings.php @@ -63,7 +63,7 @@ * MediaWiki version number * @since 1.2 */ -$wgVersion = '1.22.13'; +$wgVersion = '1.22.14'; /** * Name of the site. It must be changed in LocalSettings.php -- To view, visit https://gerrit.wikimedia.org/r/176212 To unsubscribe, visit https://gerrit.wikimedia.org/r/settings Gerrit-MessageType: newchange Gerrit-Change-Id: I7fa4054648478bd08cfeac04870fad4200ded493 Gerrit-PatchSet: 1 Gerrit-Project: mediawiki/core Gerrit-Branch: REL1_22 Gerrit-Owner: Mglaser <gla...@hallowelt.biz> _______________________________________________ MediaWiki-commits mailing list MediaWiki-commits@lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
