From 8f93926e1bc6e96fc11b4d0d201025022d471de7 Mon Sep 17 00:00:00 2001 From: Pierre Schmitz Date: Tue, 4 Jan 2011 12:24:29 +0100 Subject: update to MediaWiki 1.16.1 --- CREDITS | 1 + RELEASE-NOTES | 27 ++++++++++++++--- config/Installer.php | 9 ++++-- includes/Article.php | 5 ++++ includes/DefaultSettings.php | 32 ++++++++++++++++++-- includes/HTMLForm.php | 3 ++ includes/HistoryPage.php | 19 ++++++++++++ includes/ImagePage.php | 26 +++++++++++++++++ includes/OutputPage.php | 43 +++++++++++++++++++++++++++ includes/Skin.php | 2 +- includes/Title.php | 5 ++-- includes/api/ApiBase.php | 12 ++++++-- includes/api/ApiBlock.php | 6 +++- includes/api/ApiDelete.php | 6 +++- includes/api/ApiEditPage.php | 6 +++- includes/api/ApiEmailUser.php | 6 +++- includes/api/ApiImport.php | 6 +++- includes/api/ApiMove.php | 6 +++- includes/api/ApiPatrol.php | 6 +++- includes/api/ApiProtect.php | 8 +++-- includes/api/ApiQueryAllUsers.php | 11 +++++-- includes/api/ApiQueryRevisions.php | 7 +++-- includes/api/ApiUnblock.php | 6 +++- includes/api/ApiUndelete.php | 6 +++- includes/api/ApiUpload.php | 4 +++ includes/api/ApiUserrights.php | 6 +++- includes/diff/DifferenceInterface.php | 3 ++ includes/json/Services_JSON.php | 2 +- includes/specials/SpecialAllpages.php | 1 + includes/specials/SpecialCategories.php | 1 + includes/specials/SpecialContributions.php | 10 +++++++ includes/specials/SpecialLinkSearch.php | 4 ++- includes/specials/SpecialSearch.php | 1 + includes/specials/SpecialSpecialpages.php | 1 + includes/specials/SpecialUpload.php | 38 ++++++++++++------------ includes/specials/SpecialVersion.php | 1 + languages/LanguageConverter.php | 28 ++++++++++++------ languages/classes/LanguageGan.php | 41 -------------------------- languages/classes/LanguageZh.php | 47 ------------------------------ languages/messages/MessagesFr.php | 2 +- maintenance/Maintenance.php | 10 ++++++- maintenance/generateSitemap.php | 3 -- maintenance/parserTests.txt | 14 +++++++++ skins/common/wikibits.js | 2 +- 44 files changed, 327 insertions(+), 156 deletions(-) diff --git a/CREDITS b/CREDITS index 2205032b..7abe12f0 100644 --- a/CREDITS +++ b/CREDITS @@ -62,6 +62,7 @@ following names for their contribution to the product. * Tim Starling * Tom Gries * Victor Vasiliev +* Yuri Astrakhan == Patch Contributors == * Agbad diff --git a/RELEASE-NOTES b/RELEASE-NOTES index d3983380..4afdef47 100644 --- a/RELEASE-NOTES +++ b/RELEASE-NOTES @@ -1,15 +1,17 @@ = MediaWiki release notes = -== MediaWiki 1.16.0 == +== MediaWiki 1.16.1 == -2010-07-28 +2011-01-04 -This is a stable release of the MediaWiki 1.16 branch. +This is a security and maintenance release of the MediaWiki 1.16 branch. === Summary of selected changes in 1.16 === Selected changes since MediaWiki 1.15 that may be of interest: +* A new skin called Vector was added + * Watchlists now have RSS/Atom feeds. RSS feeds generally are now hidden, since Atom is a better protocol and is supported by virtually all clients. @@ -42,6 +44,23 @@ set $wgCacheDirectory to a writable path on the local filesystem. Make sure you have the DBA extension for PHP installed, this will improve performance further. +== Changes since 1.16.0 == + +* (bug 24981) Allow extensions to access SpecialUpload variables again +* (bug 24724) list=allusers was out by 1 (shows total users - 1) +* (bug 24166) Fixed API error when using rvprop=tags +* For wikis using French as a content language, Special:Téléchargement works + again as an alias for Special:Upload. +* (bug 25167) Correctly load JS fixes for IE6 (fixing a regression in 1.16.0) +* (bug 25248) Fixed paraminfo errors in certain API modules. +* The installer now has improved handling for situations where safe_mode is + active or exec() and similar functions are disabled. +* (bug 19593) Specifying --server in now works for all maintenance scripts. +* Fixed $wgLicenseTerms register globals. +* (bug 26561) Fixed clickjacking vulnerabilities by introducing support for + X-Frame-Options. The header value can be configured using $wgBreakFrames and + $wgEditPageFrameOptions. + == Changes since 1.16 beta 3 == * (bug 23769) Disabled HTML 5 client-side form validation. Was introduced in @@ -206,6 +225,7 @@ further. === New features in 1.16 === +* A new skin called Vector was added * Add CSS defintion of the 'wikitable' class to shared.css * (bug 17163) Added MediaWiki:Talkpageheader which will be displayed when viewing talk pages @@ -856,7 +876,6 @@ comment from another wiki. * (bug 17790) Users instantly logged off on HughesNet == API changes in 1.16 == - * Added uiprop=changeablegroups to meta=userinfo * Added usprop=gender to list=users * (bug 18311) action=purge now works for images too diff --git a/config/Installer.php b/config/Installer.php index 293a1a6c..f00a850d 100644 --- a/config/Installer.php +++ b/config/Installer.php @@ -25,6 +25,7 @@ if( !defined( 'MEDIAWIKI_INSTALL' ) ) { error_reporting( E_ALL | E_STRICT ); header( "Content-type: text/html; charset=utf-8" ); +header( 'X-Frame-Options: DENY' ); @ini_set( "display_errors", true ); # In case of errors, let output be clean. @@ -47,6 +48,8 @@ require_once( "$IP/includes/Exception.php" ); require_once( "$IP/includes/json/Services_JSON.php" ); require_once( "$IP/includes/json/FormatJson.php" ); +$wgMaxShellMemory = 0; + # If we get an exception, the user needs to know # all the details $wgShowExceptionDetails = true; @@ -2148,7 +2151,7 @@ function locate_executable($loc, $names, $versioninfo = false) { return $command; $file = str_replace('$1', $command, $versioninfo[0]); - if (strstr(`$file`, $versioninfo[1]) !== false) + if ( strstr( wfShellExec( $file ), $versioninfo[1]) !== false ) return $command; } } @@ -2239,12 +2242,12 @@ function getShellLocale( $wikiLang ) { # Get a list of available locales $lines = $ret = false; - exec( '/usr/bin/locale -a', $lines, $ret ); + $lines = wfShellExec( '/usr/bin/locale -a', $ret, true ); if ( $ret ) { return false; } - $lines = wfArrayMap( 'trim', $lines ); + $lines = wfArrayMap( 'trim', explode( "\n", $lines ) ); $candidatesByLocale = array(); $candidatesByLang = array(); foreach ( $lines as $line ) { diff --git a/includes/Article.php b/includes/Article.php index d3863c77..5edfc10d 100644 --- a/includes/Article.php +++ b/includes/Article.php @@ -792,6 +792,9 @@ class Article { return; } + # Allow frames by default + $wgOut->allowClickjacking(); + # Should the parser cache be used? $useParserCache = $this->useParserCache( $oldid ); wfDebug( 'Article::view using parser cache: ' . ( $useParserCache ? 'yes' : 'no' ) . "\n" ); @@ -1452,6 +1455,8 @@ class Article { ); if ( !$dbr->numRows( $tbs ) ) return; + $wgOut->preventClickjacking(); + $tbtext = ""; while ( $o = $dbr->fetchObject( $tbs ) ) { $rmvtxt = ""; diff --git a/includes/DefaultSettings.php b/includes/DefaultSettings.php index a369fccd..c118075e 100644 --- a/includes/DefaultSettings.php +++ b/includes/DefaultSettings.php @@ -33,7 +33,7 @@ if ( !defined( 'MW_PHP4' ) ) { } /** MediaWiki version number */ -$wgVersion = '1.16.0'; +$wgVersion = '1.16.1'; /** Name of the site. It must be changed in LocalSettings.php */ $wgSitename = 'MediaWiki'; @@ -2502,6 +2502,11 @@ $wgRightsUrl = null; $wgRightsText = null; $wgRightsIcon = null; +/** + * Set to an array of metadata terms. Else they will be loaded based on $wgRightsUrl + */ +$wgLicenseTerms = false; + /** Set this to some HTML to override the rights icon with an arbitrary logo */ $wgCopyrightIcon = null; @@ -3981,11 +3986,32 @@ $wgParserTestFiles = array( $wgParserTestRemote = false; /** - * Break out of framesets. This can be used to prevent external sites from - * framing your site with ads. + * Break out of framesets. This can be used to prevent clickjacking attacks, + * or to prevent external sites from framing your site with ads. */ $wgBreakFrames = false; +/** + * The X-Frame-Options header to send on pages sensitive to clickjacking + * attacks, such as edit pages. This prevents those pages from being displayed + * in a frame or iframe. The options are: + * + * - 'DENY': Do not allow framing. This is recommended for most wikis. + * + * - 'SAMEORIGIN': Allow framing by pages on the same domain. This can be used + * to allow framing within a trusted domain. This is insecure if there + * is a page on the same domain which allows framing of arbitrary URLs. + * + * - false: Allow all framing. This opens up the wiki to XSS attacks and thus + * full compromise of local user accounts. Private wikis behind a + * corporate firewall are especially vulnerable. This is not + * recommended. + * + * For extra safety, set $wgBreakFrames = true, to prevent framing on all pages, + * not just edit pages. + */ +$wgEditPageFrameOptions = 'DENY'; + /** * Set this to an array of special page names to prevent * maintenance/updateSpecialPages.php from updating those pages. diff --git a/includes/HTMLForm.php b/includes/HTMLForm.php index fddc887b..12687dc4 100644 --- a/includes/HTMLForm.php +++ b/includes/HTMLForm.php @@ -311,6 +311,9 @@ class HTMLForm { $this->displayErrors( $submitResult ); } + # For good measure (it is the default) + $wgOut->preventClickjacking(); + $html = '' . $this->mHeader . $this->getBody() diff --git a/includes/HistoryPage.php b/includes/HistoryPage.php index e515d3dd..8f5c2dda 100644 --- a/includes/HistoryPage.php +++ b/includes/HistoryPage.php @@ -166,6 +166,7 @@ class HistoryPage { $pager->getBody() . $pager->getNavigationBar() ); + $wgOut->preventClickjacking( $pager->getPreventClickjacking() ); wfProfileOut( __METHOD__ ); } @@ -301,6 +302,7 @@ class HistoryPage { class HistoryPager extends ReverseChronologicalPager { public $lastRow = false, $counter, $historyPage, $title, $buttons, $conds; protected $oldIdChecked; + protected $preventClickjacking = false; function __construct( $historyPage, $year='', $month='', $tagFilter = '', $conds = array() ) { parent::__construct(); @@ -382,6 +384,7 @@ class HistoryPager extends ReverseChronologicalPager { $this->buttons = '
'; if( $wgUser->isAllowed('deleterevision') ) { + $this->preventClickjacking(); $float = $wgContLang->alignEnd(); # Note bug #20966,