Re: [Wikitech-l] SECURITY: Flow security fix to make sure EnableFlow is always attributed

2017-02-17 Thread Matthew Flaschen
On 01/20/2017 05:02 PM, Matthew Flaschen wrote: There is a security fix to ensure that EnableFlow is always properly attributed. Backports have been merged for 1.26, 1.27, and 1.28. However, please note that MW 1.26 is end-of-life, and we are not supporting either MW 1.26 or Flow 1.26.

Re: [Wikitech-l] SECURITY: Flow security fix to make sure EnableFlow is always attributed

2017-01-20 Thread Matthew Flaschen
On 01/20/2017 05:02 PM, Matthew Flaschen wrote: There is a security fix to ensure that EnableFlow is always properly attributed. This may be an issue if you see users maliciously using Special:EnableFlow on pages that already exist. To clarify, the page already existing is fine. It's just

[Wikitech-l] SECURITY: Flow security fix to make sure EnableFlow is always attributed

2017-01-20 Thread Matthew Flaschen
There is a security fix to ensure that EnableFlow is always properly attributed. This may be an issue if you see users maliciously using Special:EnableFlow on pages that already exist. It should be merged shortly, but in the meantime, you can download it from Gerrit