MediaWiki 1.15.5

[autoinstallsdev/mediawiki.git] / RELEASE-NOTES

diff --git a/RELEASE-NOTES b/RELEASE-NOTES
index f6d2523e396fb7945b245311679fe68dfcaf8962..4e5effb20cf2d1b297cb5ef82790e98f12fcf512 100644 (file)
--- a/RELEASE-NOTES
+++ b/RELEASE-NOTES
@@ -3,11 +3,11 @@
 Security reminder: MediaWiki does not require PHP's register_globals
 setting since version 1.2.0. If you have it on, turn it *off* if you can.
 
-== MediaWiki 1.15.0 ==
+== MediaWiki 1.15.5 ==
 
-2009-06-10
+2010-07-28
 
-This is a stable release of the the 2009 Q2 branch of MediaWiki. 
+This is a security and maintenance release.
 
 MediaWiki is now using a "continuous integration" development model with
 quarterly snapshot releases. The latest development code is always kept
@@ -20,6 +20,59 @@ will be made on the development trunk and appear in the next quarterly release.
 Those wishing to use the latest code instead of a branch release can obtain
 it from source control: http://www.mediawiki.org/wiki/Download_from_SVN
 
+== Changes since 1.15.4 ==
+
+* (bug 24565) Fixed Cache-Control headers sent from API modules, to protect
+  user privacy in the case where an attacker can access the wiki through the
+  same HTTP proxy as a logged-in user.
+* Fixed a minor cookie header parsing issue causing incorrect Cache-Control 
+  headers to be sent.
+* Fixed an XSS vulnerability in profileinfo.php for installations with 
+  $wgEnableProfileInfo = true (false by default)
+* For backwards compatibility with extensions from 1.14.x or before, restored 
+  the original function ApiMain::requestWriteMode(). 
+* In API login "need token" responses, added the cookieprefix and sessionid 
+  fields, as in MediaWiki 1.16.x. This is an improvement to the CSRF fix 
+  introduced in 1.15.3.
+
+== Changes since 1.15.3 ==
+
+* (bug 23534) Fixed SQL query error in API list=allusers.
+* (bug 23371) Fixed CSRF vulnerability in "e-mail me my password", "create 
+  account" and "create by e-mail" features of [[Special:Userlogin]]
+* (bug 23687) Fixed XSS vulnerability affecting IE clients only, due to a CSS 
+  validation issue.
+
+=== Changes since 1.15.2 ===
+
+* (bug 22828) Fixed deletion on SQLite.
+* (bug 23076) Fixed login CSRF vulnerability. Logins now require a token to 
+  be submitted along with the user name and password.
+
+=== Changes since 1.15.1 ===
+
+* The installer now includes a check for a data corruption issue with certain
+  versions of libxml2 2.7 and PHP earlier than 5.2.9, and also for a PHP bug 
+  present in the official release of PHP 5.3.1.
+* (bug 20239) MediaWiki:Imagemaxsize does not contain anymore a <br /> tag which
+  was displayed to the user
+* (bug 21150) SQLite no longer raise an error when deleting files
+* (bug 20880) Fixed updater failure on SQLite backend
+* upgrade1_5.php now requires to be run --update option to prevent confusion
+* Fixed a CSS validation issue which allowed external images to be included 
+  into wikis where that is disallowed by configuration.
+* Fixed a data leakage vulnerability for private wikis using img_auth.php or 
+  similar image access authentication schemes. Check user permissions before 
+  streaming out scaled images from thumb.php.
+
+=== Changes since 1.15.0 ===
+
+* Fixed fatal errors for unusual file repository configurations, such as 
+  ForeignAPIRepo.
+* Fixed the "change password" link on Special:Preferences to have the correct
+  returnto parameter.
+* (bug 19693) Fixed cross-site scripting vulnerability in Special:Block
+
 === Changes since 1.15.0rc1 ===
 
 * Removed category redirect feature, implementation was incomplete.