MediaWiki 1.16.4

[autoinstallsdev/mediawiki.git] / RELEASE-NOTES

diff --git a/RELEASE-NOTES b/RELEASE-NOTES
index 4afdef4709be61af002343ef05918cdc55f60748..1a863b9fa9b4ecd56fc5dcd93f5b042a7f3d844b 100644 (file)
--- a/RELEASE-NOTES
+++ b/RELEASE-NOTES
@@ -1,8 +1,8 @@
 = MediaWiki release notes =
 
-== MediaWiki 1.16.1 ==
+== MediaWiki 1.16.4 ==
 
-2011-01-04
+2011-04-14
 
 This is a security and maintenance release of the MediaWiki 1.16 branch.
 
@@ -44,6 +44,33 @@ set $wgCacheDirectory to a writable path on the local filesystem. Make sure
 you have the DBA extension for PHP installed, this will improve performance 
 further.
 
+== Changes since 1.16.3 ==
+
+* (bug 28507) The change we made in 1.16.3 to fix bug 28235 (XSS for IE 6 
+  clients) was not actually sufficient to fix that bug. This release contains 
+  a second attempt, hopefully we have fixed it this time.
+
+== Changes since 1.16.2 ==
+
+* (bug 28449) Fixed permissions checks in Special:Import which allowed users 
+  without the 'import' permission to import pages from the configured import 
+  sources.
+* (bug 28235) Fixed XSS affecting IE 6 and earlier clients only, due to those 
+  browsers looking for a file extension in the query string of the URL, and 
+  ignoring the Content-Type header if one is found.
+* (bug 28450) Fixed a CSS validation issue involving escaped comments, which
+  led to XSS for Internet Explorer clients and privacy loss for other clients.
+
+== Changes since 1.16.1 ==
+
+* (bug 26642) Fixed incorrect translated namespace due to a regression in the
+  language converter.
+* The interface translations were updated.
+* (bug 27093, CVE-2011-0047): Fixed CSS injection vulnerability.
+* (bug 27094) Fixed server-side arbitrary script inclusion vulnerability. 
+  Affects Windows servers only. A malicious file with extension ".php" must 
+  exist on the server for the exploit to be effective.
+
 == Changes since 1.16.0 ==
 
 * (bug 24981) Allow extensions to access SpecialUpload variables again