BITNAMI MEDIAWIKI STACK 1.23 CODE
BITNAMI MEDIAWIKI STACK 1.23 PASSWORD

BITNAMI MEDIAWIKI STACK 1.23 CODE

( bug 66776, bug 71478) SECURITY: User PleaseStand reported a way to inject code into API clients that used format=php to process pages that underwent flash policy mangling.

BITNAMI MEDIAWIKI STACK 1.23 PASSWORD

( T126685) Globally throttle password attempts.( T110143) strip markers can be used to get around html attribute escaping in (many?) parser tags.( T132874) API action=move is not rate limited.( T133507) Careless use of $wgExternalLinkTarget is insecure.( T130947) Diff generation should use PoolCounter.( T98313) Graphs can leak tokens, leading to CSRF.( T122807) Check php crypto primatives.( T103239) Patrol allows click catching and patrolling of any page.( T125283) SECURITY: Users occasionally logged in as different users after SessionManager deployment.( T129506) MediaWiki:Gadget-popups.js isn't renderable.( T123071) Incorrectly identifying http link in a's href attributes, due to m modifier in regex.( T123653) Cross-domain policy regexp is too narrow.( T127114) Login throttle can be tricked using non-canonicalized usernames.( T122056) Old tokens are remaining valid within a new session.This is a security release of the MediaWiki 1.23 branch. ( T108138) SECURITY: Sysops can undelete pages, although the page is protected against it.( T48143) SECURITY: Spam blacklist ineffective on encoded URLs inside file inclusion syntax's link parameter.( T151735) SECURITY: SVG filter evasion using default attribute values in DTD declaration.( T156184) SECURITY: Escape content model/format url parameter in message.( T150044) SECURITY: 'Mark all pages visited' on the watchlist now requires a CSRF token.( T125177) SECURITY: API parameters may now be marked as 'sensitive' to keep their values out of the logs.( T144845) SECURITY: XSS in SearchHighlighter::highlightText() when $wgAdvancedSearchHighlighting is true.( T109140) ( T122209) SECURITY: Special:UserLogin and Special:Search allow redirect to interwiki links.They should be submitted in the POST body instead. Submitting the lgtoken and lgpassword parameters in the query string to action=login is now deprecated and outputs a warning.( T156184) $wgRawHtml will no longer apply to internationalization messages.( T68404) CSS3 attr() function with url type is no longer allowed in inline styles.This is a security and maintenance release of the MediaWiki 1.23 branch.

Bitnami mediawiki stack 1.23