MediaWiki 1.15.4

[autoinstallsdev/mediawiki.git] / RELEASE-NOTES

diff --git a/RELEASE-NOTES b/RELEASE-NOTES
index 553c1fdbf21d5b1b26d22b58245d311b60e823f1..8a7cfc8beb7f0f1554487e5ee72db09cf48568cd 100644 (file)
--- a/RELEASE-NOTES
+++ b/RELEASE-NOTES
@@ -3,9 +3,9 @@
 Security reminder: MediaWiki does not require PHP's register_globals
 setting since version 1.2.0. If you have it on, turn it *off* if you can.
 
-== MediaWiki 1.15.3 ==
+== MediaWiki 1.15.4 ==
 
-April 7, 2010
+2010-05-28
 
 This is a security and maintenance release.
 
@@ -20,6 +20,14 @@ will be made on the development trunk and appear in the next quarterly release.
 Those wishing to use the latest code instead of a branch release can obtain
 it from source control: http://www.mediawiki.org/wiki/Download_from_SVN
 
+== Changes since 1.15.3 ==
+
+* (bug 23534) Fixed SQL query error in API list=allusers.
+* (bug 23371) Fixed CSRF vulnerability in "e-mail me my password", "create 
+  account" and "create by e-mail" features of [[Special:Userlogin]]
+* (bug 23687) Fixed XSS vulnerability affecting IE clients only, due to a CSS 
+  validation issue.
+
 === Changes since 1.15.2 ===
 
 * (bug 22828) Fixed deletion on SQLite.