MediaWiki development

MediaWiki 1.4.7 is a bug fix release. Those affected by the following problems in 1.4.6 should upgrade:

• Watchlist breakage on MySQL 3.23.x and with table prefix enabled
• Possible breakage in watchlist, some image resizing modes on PHP 4.1.2

1.4.6 included a fix for a cross-site scripting vulnerability, so anyone running older 1.4 releases is very strongly encouraged to upgrade as well.

Note to upgraders: current versions of MediaWiki are known to produce a large number of notice-level warnings under the newly released PHP 4.4.0. These appear however to be harmless; if you encounter them add this to your LocalSettings.php to suppress the notices:

  error_reporting( E_ALL & ~E_NOTICE );

PHP 5.1.0beta3 is known to be incompatible at this time.

Changes since last release: (full release notes)

• (bug 2755, bug 2747) MySQL 3.23.x and table prefix compatibility fix: restore old watchlist code
• PHP 4.1.2 compatibility fix: define floatval() equivalent if missing

MediaWiki 1.4.6 is a bug fix and security update release.

Incorrect escaping of a parameter in the page move template could be used to inject JavaScript code by getting a victim to visit a maliciously constructed URL. Users of vulnerable releases are recommended to upgrade to this release.

Vulnerable versions:

• 1.5 preview series: n <= 1.5beta2 vulnerable, fixed in 1.5beta3
• 1.4 stable series: 1.4beta6 <= n <= 1.4.5 vulnerable, fixed in 1.4.6
• 1.3 legacy series: not vulnerable

This release also includes fixes for some rare bug annoying HTTP errors, a PHP 4.1.2 breakage bug, and works around some template limitations introduced in 1.4.5.

Changes since last release: (full release notes)

• New covering index was added on cur for query speedups.
• (bug 2228) Updated the Slovak translation
• (bug 1976) fix shared user database with a table prefix set
• (bug 2309) Allow templates and template parameters in HTML attribute zone, with proper validation checks. (regression from fix for 2304)
• (bug 2355) Use content language in image blacklist check
• (bug 2368) Avoid fatally breaking PHP 4.1.2 in a debug line
• (bug 2384) Fix typo in regex for IP address checking
• Enhance cleanupDupes.php to save the pruned revisions to old for safety, and to try to pick the same one that would be read by the wiki
• (bug 2292) Catch 'null' return values for images that can not be thumbnailed.
• (bug 2277) Added Friulian language file
• (bug 2459) Correct escaping in Special:Log prev/next links
• (bug 750) Keep line endings consistent in LocalSettings.php
• (bug 1120) Updated the Czech translation
• (bug 2172) Solved a parsing error that would happen when there was a <nowiki> tag on a page that included a gallery through a template (backported from HEAD)
• (bug 2457) The "Special page" href now links to the current special page rather than to ""
• Latin: auto-grammar for -tio, -tionis endings in meta talk namespace
• Fixed a typo in the Romanian language file (NS_MESIA => NS_MEDIA)
• (bug 2531) Changed the interwiki name for sh (Serbocroatian) to Srpskohrvatski/Српскохрватски (was Српскохрватски (Srbskohrvatski))
• Workaround for mysterious problem with bogus epoch If-Last-Modified reqs
• Remove forced covering index usage to allow stable release upgrade.
• Fix escaping in page move template.
• (bug 1109) Suppress compressed output on 304 responses

MediaWiki 1.4.5 is a security update and bugfix release.

Incorrect handling of page template inclusions made it possible to inject JavaScript code into HTML attributes, which could lead to cross-site scripting attacks on a publicly editable wiki.

Vulnerable releases and fix:

• 1.5 prerelease: fixed in 1.5alpha2
• 1.4 stable series: fixed in 1.4.5
• 1.3 legacy series: fixed in 1.3.13
• 1.2 series no longer supported; upgrade to 1.4.5 strongly recommended

This release also includes a number of bug fixes (see changelog below) and merges some large-server load balancing patches from Wikipedia.

An experimental rate limiter for page edits and moves can be enabled with global, per-IP, per-subnet, or per-user bases. See configuration options in includes/DefaultSettings.php

Changes since last release: (full release notes)

• Fix for reading incorrectly re-gzipped HistoryBlob entries
• Generalize project namespace for Latin localization, update namespaces
• (bug 2075) Corrected namespace definitions in Tamil localization
• (bug 1692) Fix margin on unwatch tab
• Avoid overwriting shared image metadata cache with bogus encoding conversions
• Fix reporting of minor edits in Special:Export output
• (bug 2150) Fix tab indexes on edit form
• Run ArticleSave hooks on image upload.
• (bug 2239) Fix non-ASCII chars in linktrail for Latin-1 mode
• (bug 1454) Backport edit/move rate limiter from CVS HEAD (experimental)
• (bug 1929) Fix documentation comment for
• (bug 1975) The name for Limburgish (li) changed from "Lèmburgs" to "Limburgs"
• (bug 2019) Wrapped the output of Special:Version in <div dir='ltr'> in order to preserve the correct flow of text on RTL wikis.
• (bug 2084) Fixed a regular expression in includes/Title.php that was accepting invalid syntax like #REDIRECT [[foo] in redirects
• (bug 2087) Fixed a bug in special page handling which which stopped "0" from
• (bug 2094) Multiple use of a template produced wrong results in some cases being passed to all special pages Special:Page/0 syntax.
• Fixed a bug in Special:Allpages, Special:Contributions, Special:Whatlinkshere, Special:Recentchangeslinked and Special:Emailuser, they all mishandled being passed "0" with the Special:Page/0 syntax (unrelated to bug 2087), this either required a workaround in the form of passing "0" as a GET value or blocked the user from passing that value at all.
• Fixed a bug in Special:Newimages that made it impossible to search for '0'
• (bug 2217) Negative ISO years were incorrectly converted to BC notation.
• (bug 2267) Don't generate thumbnail at the same size as the source image.
• Disable fulltext image name search in Special:Imagelist during MiserMode.
• Fix sorting of profiling output in debug log: largest last for easy tailing
• (bug 2281) Fix regression with page moves taking the wrong talk pages
• Regression fix: watchlist day cutoff
• (bug 2173) Fatal error when removing an article with an empty title from the watchlist
• (bug 2304) Armor HTML attributes against template inclusion and links munging

MediaWiki 1.3.13 is a security maintenance release.

Incorrect handling of page template inclusions made it possible to inject JavaScript code into HTML attributes, which could lead to cross-site scripting attacks on a publicly editable wiki.

Vulnerable releases and fix:

• 1.5 prerelease: fixed in 1.5alpha2
• 1.4 stable series: fixed in 1.4.5
• 1.3 legacy series: fixed in 1.3.13
• 1.2 series no longer supported; upgrade to 1.4.5 strongly recommended

The 1.3.x series is no longer maintained except for security fixes; new users and those seeking general bug fixes should install 1.4.5. Existing 1.3.x installations not willing or able to upgrade to the current stable relase should update the installation to 1.3.13; only includes/Parser.php has changed from 1.3.12.

Changes since last release: (full release notes)

MediaWiki 1.4.4 is a bugfix release for the 1.4 stable release series.

Some bugs in the installer/updater and refreshLinks maintenance script were introduced in the last release and have been corrected.

Changes since last release: (full release notes)

• (bug 725) Let dir="ltr" attribute work again in MonoBook on RTL languages
• (bug 2024) Skip JavaScript error for custom skins where .js message not set
• (bug 2025) Updated Indonesian localization
• (bug 2039) Updated Lithuanian localization
• Don't die on PHP <4.3.0 when calling mysql_ping()
• Fix refreshLinks cleanup step on MySQL 3.x
• Fix breakage on rerunning the site_stats update
• Localized namespaces for csb

MediaWiki 1.4.3 is a bugfix release for the 1.4 stable release series.

Chiefly, this fixes a compatibility problem with PHP 5 and a minor link table corruption bug on initial page save.

Changes since last release: (full release notes)

• (bug 1636) Refs like &#0355; were misinterpreted as octal in some places
• (bug 1163) Special:Undelete showed oldest revision instead of newest
• (bug 1938) Fix escaping of illegal character references in link text
• (bug 1997) Fix for error on display of renamed items in Recentchanges on PHP5
• (bug 1949) Profiling typo in rare error case
• (bug 1963) Fix deletion log link when is off
• (bug 1970) Don't show move tab for immobile pages
• (bug 1770) Page creation recorded links from the 'newarticletext' message
• Optional change to the site_stats table. When applied, this removes the need for expensive queries in Special:Statistics.

MediaWiki 1.4.2 is a security and bug fix release for the 1.4 stable release series.

A cross-site scripting injection vulnerability was discovered, which affects only MSIE clients and is only open if MediaWiki has been manually configured to run output through HTML Tidy ($wgUseTidy).

(A bugfix release for the old 1.3.x series is available to fix this issue as well.)

Several other bugs are fixed in this release, see the changelog below.

All new installations are highly recommended to use 1.4.2 instead of 1.3.x; 1.3.x users should consider upgrading for bug fixes and new features. Ealier 1.4.x release and beta users should upgrade to this release for relevant bug fixes; see the changelog below.

Changes since last release: (full release notes)

• Fix math options in Finnish localization
• Use in-process Tidy extension if available when $wgUseTidy is on
• (bug 1933) Fix PATH_INFO usage under IIS with PHP ISAPI module
• (bug 1188) <nowiki> in {{subst:}} includes fixed
• (bug 1936) <!-- comments --> in {{subst:}} includes fixed
• Fix a potential MSIE JavaScript injection vector in Tidy mode

MediaWiki 1.4.1 is a bug fix release for the 1.4 stable release series. All new installations are highly recommended to use 1.4.1 instead of 1.3.x; 1.3.x users should consider upgrading for bug fixes and new features.

1.4.0 and 1.4 beta or release candidate users should upgrade to this release for relevant bug fixes; see the changelog later in this file.

If you have trouble, remember to read the whole release notes and the online FAQ page before asking for help.

Changes since last release: (full release notes)

• (bug 1720) fix genitive month names for uk
• (bug 1704) fixed untranslateable string in Special:Log
• (bug 1638) Added Belrusian language file
• (bug 1736) typo in SpecialValidate.php
• (bug 73) Upload doesn't run edit updates on description page (links, search index and categories)
• (bug 646) <math> fails to recognize \ll and \gg
• (bug 926) \div element from TeX not supported in <math> element
• (bug 1147) add \checkmark to whitelist in texutil.ml
• (bug 937) \limits function from LaTeX not supported in <math> element
• Support for manually converting article title to different Chinese variants (for zh)
• (bug 1488, bug 1744) Fix encoding for preferences, dates in Latin-1 mode
• (bug 1042) Fix UTF-8 case conversion for PHP <4.3 with mbstring extension
• Fix code typo that broke article credits display
• Installation fixes for running under IIS
• (bug 1556) login page tab order. "remember" checkbox now come after password.
• SQL debug log fixlets
• (bug 1815) Fix namespace in old revision display with mismatched title
• (bug 1788) Fix link duplication when edit/upload comment includes newlines
• Change default on $wgSysopUserBans and $wgSysopRangeBans to true
• Fix link conversion for URL request
• (bug 1851) Updated download URL for the SCIM packages used by zhtable
• (bug 1853) Try stripping quotes from term for 'go' title match
• Fix missing function in Latin1 mode
• (bug 1860) Anchors of interwiki links did not get normalized
• (bug 1847) accept lowercase x in ISBN, do not accept invalid A-W,Y,Z
• Fix link conversion for URL request, hopefully without breaking the wiki
• (bug 1849) New option allows to consider categorized images as used on Special:Unusedimages
• Localized category namespace for ka (Georgian)
• (bug 1107) Work around includes problem in installer when parent dir is not readable by the web server

MediaWiki 1.3.12 is a security maintenance release.

A cross-site scripting injection vulnerability was discovered, which affects only MSIE clients and is only open if MediaWiki has been manually configured to run output through HTML Tidy ($wgUseTidy).

The 1.3.x series is no longer maintained except for security fixes; new users and those seeking bug fixes should upgrade to 1.4.2. Existing 1.3.x installations using Tidy not willing to upgrade to the current stable relase should either turn off Tidy or update the installation to 1.3.12.

Changes since last release: (full release notes)

• Fix a potential MSIE JavaScript injection vector in Tidy mode