Mglaser has submitted this change and it was merged. Change subject: Updated release notes and version number for MediaWiki 1.23.7 ......................................................................
Updated release notes and version number for MediaWiki 1.23.7 This is MediaWiki 1.23.7 security and maintenance release. Change-Id: Ib796284fb7be80fee37652bdc9acc4e91f4d0bf9 --- M RELEASE-NOTES-1.23 M includes/DefaultSettings.php 2 files changed, 24 insertions(+), 1 deletion(-) Approvals: Mglaser: Looks good to me, approved MarkAHershberger: Looks good to me, approved jenkins-bot: Verified diff --git a/RELEASE-NOTES-1.23 b/RELEASE-NOTES-1.23 index b0bc091..190fc95 100644 --- a/RELEASE-NOTES-1.23 +++ b/RELEASE-NOTES-1.23 @@ -7,6 +7,29 @@ == Changes since 1.23.6 == +* (bugs 66776, 71478) SECURITY: User PleaseStand reported a way to inject code + into API clients that used format=php to process pages that underwent flash + policy mangling. This was fixed along with improving how the mangling was done + for format=json, and allowing sites to disable the mangling using + $wgMangleFlashPolicy. +* (bug 70901) SECURITY: User Jackmcbarn reported that the ability to update + the content model for a page could allow an unprivileged attacker to edit + another user's common.js under certain circumstances. The user right + "editcontentmodel" was added, and is needed to change a revision's content + model. +* (bug 71111) SECURITY: User PleaseStand reported that on wikis that allow raw + HTML, it is not safe to preview wikitext coming from an untrusted source such + as a cross-site request. Thus add an edit token to the form, and when raw HTML + is allowed, ensure the token is provided before showing the preview. This + check is not performed on wikis that both allow raw HTML and anonymous + editing, since there are easier ways to exploit that scenario. +* (bug 72222) SECURITY: Do not show log action when the entry is revdeleted with + DELETED_ACTION. NOTICE: this may be reverted in a future release pending a + public RFC about the desired functionality. This issue was reported by user + Bawolff. +* (bug 71621) Make allowing site-wide styles on restricted special pages a + config option. +* (bug 42723) Added updated version history from 1.19.2 to 1.22.13 * $wgMangleFlashPolicy was added to make MediaWiki's mangling of anything that might be a flash policy directive configurable. diff --git a/includes/DefaultSettings.php b/includes/DefaultSettings.php index da45394..7e1cb43 100644 --- a/includes/DefaultSettings.php +++ b/includes/DefaultSettings.php @@ -73,7 +73,7 @@ * MediaWiki version number * @since 1.2 */ -$wgVersion = '1.23.6'; +$wgVersion = '1.23.7'; /** * Name of the site. It must be changed in LocalSettings.php -- To view, visit https://gerrit.wikimedia.org/r/176211 To unsubscribe, visit https://gerrit.wikimedia.org/r/settings Gerrit-MessageType: merged Gerrit-Change-Id: Ib796284fb7be80fee37652bdc9acc4e91f4d0bf9 Gerrit-PatchSet: 1 Gerrit-Project: mediawiki/core Gerrit-Branch: REL1_23 Gerrit-Owner: Mglaser <[email protected]> Gerrit-Reviewer: MarkAHershberger <[email protected]> Gerrit-Reviewer: Mglaser <[email protected]> Gerrit-Reviewer: TTO <[email protected]> Gerrit-Reviewer: jenkins-bot <> _______________________________________________ MediaWiki-commits mailing list [email protected] https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
