1Change notes from older releases. For current info, see RELEASE-NOTES-1.36.
2
3= MediaWiki 1.35 =
4
5== MediaWiki 1.35.1 ==
6
7This is a maintenance release of the MediaWiki 1.35 branch.
8
9While normally running update.php isn't required for point releases,
10it is recommended to run it for 1.35.1 so that sites.site_language is
11updated to take 35 characters.
12
13Watchlist Expiry is no longer considered experimental, but is off by default.
14To enable it, set $wgWatchlistExpiry = true; in your LocalSettings.php.
15
16=== Changes since MediaWiki 1.35.0 ===
17* (T263929) purgeList.php Fix all-namespaces option to match one used in code.
18* (T248719) ParserCache::get - fix wfDeprecated call.
19* (T261430) WatchlistExpiryWidget: Move focus to expiry dropdown after hitting
20  Tab.
21* Preload mediawiki.watchstar.widgets before api request.
22* (T261030) ApiEditPage: Show existing watchlist expiry if status is not being
23  changed.
24* (T264502) Fix PHP 8 compat with strcspn() $length parameter exceeding string.
25* (T248925) Remove final modifier on private function.
26* (T264683) Remove ipb_anon_only from ipb_address_unique index addition.
27* (T261415) Add days left messages to changes-lists' clock icons.
28* Fix order of wfDeprecated parameters in ExternalStoreDB::getSlave.
29* (T261260) Preload class used in HeaderCallback.
30* (T260868, T260009) Normalize WatchedItem expiry field.
31* (T264683) Remove doTable check from (Mysql|Sqlite)Updater::indexHasFields.
32* (T264534) ApiPageSet: Avoid infinite loop when merging redirects.
33* (T196906) Empty Monolog loggers are now real blackholes.
34* (T258649) WatchAction: avoid UPDATE when old and new watch period is
35  indefinite.
36* Parser: Adjust typehint to show that getTitle can return null.
37* (T263592) media: Fix case of FlashPixVersion in
38  FormatMetadata::makeFormattedData().
39* (T265223) BaseTemplate: Guard against passing zero arg to array_merge().
40* (T264965) Fix base path handling for MessagePosterModule registration.
41* (T252183) Fix Database::getTempTableWrites for multi table DDLs.
42* (T182546) Fix switch/case indentation per mediawiki coding conventions.
43* Flip Yoda conditionals.
44* (T263213) Move SkinTemplate::getFooterLinks() to Skin.
45* build: Updating mediawiki/mediawiki-codesniffer to 33.0.0.
46* (T267105) Make ImageBuilder::checkMissingImage public.
47* Updating guzzlehttp/guzzle (6.5.4 => 6.5.5).
48* (T266681) Support new style hook registration on install and update.
49* (T266980) Fix unsetting of copyright icon in FooterIcons.
50* upload.js: Don't assume that warnings array will include 'code' key.
51* upload.js:  Fix typo in upload API.
52* (T264333, T190988, T266903) Pass along ignorewarnings param to all
53  individual chunks being uploaded.
54* (T267558) importTextFiles.php: Replace deprecated WikiRevision:setText().
55* (T266418) composer.json: add requirement for composer-plugin-api ^1.1.
56* (T261431) Add ARIA attributes to watchlink and its notification.
57* (T258877) Change invalid 'Content-Encoding: none' header.
58* Fix trailing ; in patch-sites-site_language-35.sql.
59* (T248852) wfAssembleUrl: Handle empty query field in URL bits.
60* (T268846) Updating wikimedia/testing-access-wrapper (1.0.0 => 2.0.0).
61* (T268887) migrateComments: Cast array keys back to string before passing
62  to the DB.
63* (T266619) Introduce new $wgThumbPath config.
64* (T269178) MemcachedClient: Cast Resource to integer.
65* (T263925) Use the old HookContainer to set up the post-reset services.
66* Change "site cache" to just "cache" in the right-purge message.
67* [UploadedFileStreamTest] Skip test with chmod.
68* (T269710) Updating composer/semver (1.5.1 => 1.7.2).
69* (T269710) Updating mediawiki/mediawiki-codesniffer (33.0.0 => 34.0.0).
70* (T260631, T260633), BotPassword::save() now returns a Status object for the
71  result rather than a bool. The length of the bot password grants and
72  restriction fields are now validated, and an error will be thrown if it
73  would be truncated by the database.
74* (T265778) Fix English/*nix specific error messages in FSFileBackend.
75* (T267543) Split dropping of image.img_user_timestamp.
76* [FileTest] Do not assume /tmp exists on windows.
77* Clean up temp files correctly after unit tests.
78* Skip undo related phpunit tests when diff3 is missing.
79* (T269964) rdbms: Remove outer parentheses in insert query for Postgres.
80* (T263911) In MWExceptionHandler::report(), catch all throwables.
81* (T268894, CVE-2020-35474) SECURITY: Use Html::element in
82  ChangeListSpecialPage for sanity.
83* (T268917) Use Xml::element in SpecialUserrights for sanity.
84* (T268938, CVE-2020-35478, CVE-2020-35479) SECURITY: Pass escaped html
85  to LogFormatter::makePageLink for sanity.
86* (T268938) Fixed mixed escaping in Language::translateBlockExpiry.
87* (T263911) UserOptionsManager: don't differentiate anons caches.
88* (T261260) HeaderCallback: pre-cache request ID.
89* Parsoid updated to v0.12.1.
90* (T205908, CVE-2020-35477) SECURITY: Unable to change visibility of log
91  entries when MediaWiki:Mainpage uses Special:MyLanguage.
92* (T120883, CVE-2020-35480) SECURITY: Divergent behavior for contributions
93  and user pages of hidden users and missing users.
94* (T270145) Fix condition that can lead to using APCOND_BLOCKED in
95  $wgAutopromote to cause an OOM in PHP.
96
97== MediaWiki 1.35.0 ==
98
99=== Changes since MediaWiki 1.35.0-rc.3 ===
100* (T261258) Remove checks for ancient ImageMagick versions in BitmapHandler.
101* (T260232) Don't include null page ids in query list for category dumps.
102* (T260009) Check existing watchitem when saving action=watch.
103* (T259055) Correct success messages for action=watch.
104* mediawiki.page.ready: Simpler tablesorter/makeCollapsible call.
105* mediawiki.page.ready: Fix skin override config flags, wrong way round.
106* (T262175, T248512) Remove requirement for ApiWatchlistTrait to be in ApiBase.
107* (T259053, T260434) Watchlist: Fix updateWatchLink removing css class when
108  action=watch.
109* (T261901, T261476) mediawiki.notification: Don't close notif when clicking
110  <select> element.
111* (T251506) Sanitizer: Truncate IDs to a reasonable length.
112* (T259452) Parsoid updated to v0.12.0.
113* (T261970) watch.ajax: Add expiry support to watchpage.mw event.
114* (T262900) Fix failure of rebuildLocalisationCache.php due to ResourceLoader
115  hook.
116* (T263014) Hard deprecate File::userCan() with $user=null.
117* (T262547) Use localized success message after watching via action=watch.
118* (T201491) Fix typo 'Watchlst' in `apihelp-edit-param-watchlistexpiry`.
119* (T261081) Installer: consistently reset Language objects.
120* (T250449, T250450) Installer: consistently reset Language objects.
121* Explicitly wrap some XML calls in libxml_disable_entity_loader().
122* (T262934) Ensure dropdown label is always on its own line.
123* (T246855) resourceloader: Use a local HookRunner.
124* (T263604) Have findBadBlobs.php require Maintenance.php rather than
125  cleanupTable.inc.
126* (T263606) Set fake time, to avoid flaky tests.
127* (T261325) Add FindMissingActors script.
128* (T262364) shell: Don't blacklist /run/firejail.
129* (T263655) NewPagesPager: Ignore nonexistent namespaces.
130* Update specialPageAliases and magicWords for Egyptian Arabic (arz).
131* (T261347) ParserOutput: don't throw on bad editsection.
132* (T232568, CVE-2020-25813) SpecialUserrights: If a viewer lacks `hideuser`,
133  ignore hidden users.
134* (T255918, CVE-2020-25812) SECURITY: Unescaped message used in HTML on
135  Special:Contributions.
136* (T256171, CVE-2020-25815) SECURITY: Unescaped message used in HTML within
137  LogEventsList.
138* (T258763, CVE-2020-17367, CVE-2020-17368) SECURITY: Prevent invoking
139  firejail's --output functionality.
140* (T86738, CVE-2020-25814) SECURITY: mediawiki.jqueryMsg: Sanitize URLs and
141  'style' attribute.
142* (T115888, CVE-2020-25828) SECURITY: mediawiki.js: Escape HTML in
143  mw.message( ... ).parse().
144* (T260485, CVE-2020-25869) SECURITY: ActorMigration: Load user from the correct
145  database.
146* (T260485, CVE-2020-25869) SECURITY: ensure actor ID from correct wiki is used.
147* Add Finnish special page aliases.
148* Fix GuzzleHttpRequest request headers.
149* Fix description for pruneFileCache.php.
150* emptyUserGroup.php: handle more than 5000 users.
151* Make ApiSandbox copyable URL absolute.
152* (T261087) Add a link from a deleted page to that page's logs.
153
154== MediaWiki 1.35.0-rc.3 ==
155
156=== Changes since MediaWiki 1.35.0-rc.2 ===
157* (T258662) mediawiki.visibleTimeout: Update the nextVisibleTimeoutId value.
158* Ensure Parsoid doesn't throw when <ref> is used w/o Cite installed.
159* Remove maintenance/createCommonPasswordCdb.php.
160* (T260468) Increase "sites.site_global_key" to varbinary(64).
161* (T183759) Fix shell edge-cases in Windows.
162* (T257879) Drop PHP 7.2 support; require 7.3.19.
163* (T251661, CVE-2020-25827) SECURITY: User::pingLimiter: add user-global
164  rate limit type.
165* (T246991) User: enforce pingLimiter() expiry time.
166* (T256831) Rest: Handle Uri constructor exception.
167* (T259094) Fix RequestFromGlobalsTest failing in Travis CI.
168* (T256831, T261344) Rest: Use try/catch to handle URIs with embedded colon.
169
170== MediaWiki 1.35.0-rc.2 ==
171
172=== Changes since MediaWiki 1.35.0-rc.1 ===
173* (T259693) uuid: Fix filenames on Windows.
174* Remove Gruntfile.js and package-lock.json from the tarball.
175* firejail: Strengthen by copying from Wikimedia's profile.
176* (T260059) ResourceLoaderOOUIImageModule: loadOOUIDefinition() may return
177  false.
178* (T30162, T245387) The installer supports using a Postgres server running
179  on a custom port other than 5432.
180* (T260201) Support private wikis in Parsoid zero configuration mode.
181* Fix bad use of `|=` PHP bit operation where `= … ||` bool is intended.
182* (T259212) SpecialBlock: Show error if a block could not be inserted or found.
183* (T255842) UserOptionsManager: fix options reset.
184* (T258649) WatchAction: avoid unnecessary UPDATEs when expiry is unchanged.
185* (T250851) Allow skins to override mediawiki.page.ready initialisation.
186* (T250851) mediawiki.page.ready: Allow skins to disable search lazy load.
187* (T253135, T255632) Update language in watchlist expiry.
188* Use IPset in MWRestrictions::checkIP.
189* (T259564) Fix race condition on edit page.
190* (T260759) Hide watchlist expiry label in edit form.
191* mime: Fix docs of MIME_EXTENSIONS, they're arrays, not space-seperated.
192* (T260031) Add application/font-sfnt to MimeMap for ttf files.
193* (T259379) WatchedItemStore: Cache single WatchedItems with preexisting expiry.
194* Add a maintenance script to create bot passwords.
195* (T201269) Add Traditional Chinese zh-hant as fallback for Amis (ami).
196* Improve wfParseUrl docs.
197* (T251038) Add multi index fields in ImageListPager for unique paginate.
198* (T259916) Guard against 'Widget not found' error.
199
200== MediaWiki 1.35.0-rc.1 ==
201
202=== Changes since MediaWiki 1.35.0-rc.0 ===
203* (T252136) Fix RecentChanges watchlist filters when WatchlistExpiry is off.
204* (T258662) Update time period for watchlist expiry pop-up.
205* (T258443) Fix expiry dropdown not getting disabled on edit page.
206* (T259398) Add license information for promise-polyfill.
207* Remove executable bit from scripts without shebang.
208* (T256526) Fix bold of watched items on Special:RecentChangesLinked.
209* (T259060) Edit page expiry dropdown should keep state after
210  disabling/enabling.
211* (T259009) Translate expiry period in pop-up message for watchlist expiry.
212* (T258310) Add watchlist clock icon to RecentChanges.
213* (T259362) Permit temporary table writes on replica DB connections.
214* (T250214) Add UI support in Special:EditWatchlist for watchlist expiry.
215* (T72470) Disable wgLegacyJavaScriptGlobals by default.
216* (T130906) Add Edge to MediaWiki:Clearyourcache.
217* (T257279) Add mediawiki.ui Less variable deprecation note.
218* (T249521) Fixed reassignEdits.php to work with anonymous users.
219* (T259448) Fix Circular dependency when creating service in
220  DBLoadBalancerFactory.
221* (T257259) Default to using watchlist expiry of old page when moving pages.
222
223== MediaWiki 1.35.0-rc.0 ==
224
225== Upgrading notes for 1.35 ==
2261.35 requires PHP 7.3.19 or above (up from 7.2.9). (T257879)
227
2281.35 has several database changes since 1.34, and will not work without schema
229updates. Note that due to changes to some very large tables like the revision
230table, the schema update may take quite long (minutes on a medium sized site,
231many hours on a large site).
232
233Don't forget to always back up your database before upgrading!
234
235MediaWiki 1.35 is the next LTS after 1.31, and will be supported for around 3
236years.
237
238MediaWiki has a lot of both soft and hard deprecations, and code removed. As
239always, make sure your versions of extensions match the MediaWiki version,
240and updates may be required to any custom extensions.
241
242See the file UPGRADE for more detailed upgrade instructions, including
243important information when upgrading from versions prior to 1.11.
244
245Some specific notes for MediaWiki 1.35 upgrades are below:
246* (T259685) Zeroconf (zero-configuration) VisualEditor/Parsoid doesn't work
247  using SQLite as the database backend for MediaWiki. This is due to the lack
248  of write concurrency in SQLite. If you wish to use this feature, it is
249  recommended to use MySQL/MariaDB rather than SQLite.
250
251For notes on 1.34.x and older releases, see HISTORY.
252
253=== Configuration changes for system administrators in 1.35 ===
254
255* (T72470) $wgLegacyJavaScriptGlobals is now false by default. This feature
256  will be completely removed in a later MediaWiki release.
257
258==== New configuration ====
259* $wgDiffEngine — This can be used to specify the difference engine to use,
260  rather than MediaWiki choosing the first of $wgExternalDiffEngine, wikidiff2,
261  or php that is usable.
262* $wgSearchMatchRedirectPreference — This configuration setting controls whether
263  users can set a new preference, search-match-redirect, which decides if search
264  should redirect them to exact matches is available. By default, this is set to
265  false, which maintains the previous behaviour without preference bloat. Change
266  your site's default by setting $wgDefaultUserOptions['search-match-redirect'].
267* $wgPoolCounterConf['SpecialContributions'] — Per-user concurrency in the use
268  of SpecialContributions can now be limited by setting this appropriately.
269* $wgPasswordPolicy — PasswordCannotBeSubstringInUsername is a new password
270  policy check. Similar to the existing PasswordCannotMatchUsername check, this
271  check ensures that a user's (case-insensitive) password cannot be a part of
272  their username. e.g. password = MyPass, username = ThisUsersPasswordIsMyPass.
273* $wgLogos — This new configuration setting combines the now-deprecated $wgLogo
274  and $wgLogoHD settings into a single, associative array. It provides support
275  for a new key, 'wordmark', for setting a horizontal wordmark to show next to
276  the graphical logo. To do this, set 'wordmark' to an array with 'src' set to
277  the path of the wordmark image, and 'width' and 'height' for its dimensions
278  in pixels. $wgLogos inherits the existing support provided by its predecessor
279  settings: '1x' mapping to the path of the logo as a 135x135px raster image
280  (equivalent to $wgLogo), and '1.5x', '2x', and 'svg' operating as before for
281  $wgLogoHD. If $wgLogos is unset, $wgLogo and $wgLogoHD values are read for
282  temporary backwards compatibility. (T232140)
283* $wgWatchlistExpiry — (EXPERIMENTAL) This enables the new watchlist expiry
284  feature. The database table (watchlist_expiry) for this is created regardless
285  of this setting, but all other aspects of the expiry feature are controlled
286  by it. Enabling in production is discouraged for the time being. A future
287  MediaWiki 1.35 release will advertise this feature once it is stable.
288* $wgWatchlistPurgeRate — This sets the chance of expired watchlist items being
289  purged on each page edit. Only has effect if $wgWatchlistExpiry is true.
290* $wgWatchlistExpiryMaxDuration — This is the maximum definite relative duration
291  for watchlist expiries. Only has effect if $wgWatchlistExpiry is true.
292* $wgImgAuthPath – This can be used to override the path prefix used when
293  handling img_auth.php requests. (T235357)
294* $wgAllowedCorsHeaders — This is a list of headers which can be used in a
295  cross-site API request.
296* $wgHTTPMaxTimeout and $wgHTTPMaxConnectTimeout — These allow site
297  administrators to limit the timeouts used by the HTTP client libraries.
298  This only affects callers using HttpRequestFactory and the deprecated
299  wrappers in the Http class.
300* $wgCdnMaxageStale — This controls the Cache-Control s-maxage header for page
301  views when PoolCounter lock contention indicates that a stale cache entry
302  should be sent.
303* $wgForceHTTPS — This makes the HTTP to HTTPS redirect be unconditional and
304  suppresses various hacks needed to support mixed HTTP/HTTPS wikis. We
305  recommend this be set to true on pure HTTPS wikis.
306* $wgCookieSameSite — This setting allows login cookies to be sent with
307  SameSite=None. This is required for cross-site CentralAuth auto-login after
308  Chrome 84.
309* $wgUseSameSiteLegacyCookies — This adds a compatibility hack to
310  SameSite=None cookies for browsers which implemented an incompatible draft
311  version of the specification.
312
313==== Changed configuration ====
314* $wgResourceLoaderMaxage (T235314) — This configuration array controls the
315  max-age for HTTP caching through the Cache-Control header. It has uses the
316  "versioned" key for urls that do have a version parameter, and the
317  "unversioned" key for urls without a version parameter. The sub keys for
318  "client" and "server" are no longer supported in MediaWiki 1.35.
319* $wgEnableOpenSearchSuggest — This boolean variable is deprecated and no longer
320  used. The OpenSearch API is now always enabled.
321* $wgAuthManagerConfig and $wgAuthManagerAutoConfig — These can now use the
322  'services' option in provider specifications.
323* $wgVirtualRestConfig['modules']['parsoid'] —
324  - The defaults have been updated. If you were relying on the default values,
325    you may need to update your configuration.
326  - The 'URL' parameter, previously allowed for backwards-compatibility, has
327    been deprecated. Use 'url' instead.
328* $wgXmlDumpSchemaVersion — Default is now set to XML_DUMP_SCHEMA_VERSION_11, so
329  dumps use the new dump format per default. Consumers of XML dumps should not
330  be affected if they ignore any unknown tags they encounter. Also, the format
331  is effectively unchanged for revisions that only contain the main slot. The
332  --schema-version option can be used with the dumpBackup.php script to set the
333  dump format. (T238921)
334* $wgParserConf — This configuration is now deprecated. It has been
335  effectively constant since 2008, and is ignored by core code.
336  Configure the ParserFactory service in order to customize the Parser used.
337* $wgAutoloadAttemptLowercase — This has been deprecated, and the default value
338  changed to false.
339* $wgAllowImageMoving — This configuration setting is now deprecated. Instead,
340  use $wgGroupPermissions; e.g., to revoke sysops' ability to move images use
341  $wgGroupPermissions['sysop']['movefile'] = false.
342* $wgAllowImageTag — This configuration is now deprecated; future parsers will
343  not support direct use of the HTML <img> tag in wikitext.
344* $wgUseTwoButtonsSearchForm — This has been deprecated. If you maintain a skin
345  that relies on this and wishes to let system administrators change it, you
346  should convert it to a config variable specific to your skin. If you're using
347  it to configure your wiki, you should check individual skins to see whether
348  they have local skin config for the feature and use that.
349* $wgPasswordPolicy — The deprecated policy 'PasswordCannotBePopular' has been
350  removed. Use PasswordNotInCommonList instead which covers many more passwords.
351* Backwards compatibility for using an associative array
352  (e.g. [ '127.0.0.1' => 'bad-ip' ]) for $wgProxyList has been removed. This
353  was deprecated since 1.30. Please convert these arrays to indexed/sequential
354  ones (e.g. [ '127.0.0.1' ]).
355* $wgShellRestrictionMethod — This now defaults to 'autodetect', which will
356  enable sandboxing for shell commands using firejail, if it's installed. To
357  disable restrictions, set it to false.
358* $wgLegacyJavaScriptGlobals – This deprecated setting now default to false,
359  instead of true, ahead of its planned removal.
360
361==== Removed configuration ====
362* $wgSysopEmailBans — This setting, deprecated in 1.34, was removed. To let
363  sysops block email access, use $wgGroupPermissions['sysop']['blockemail'].
364* $wgDBWindowsAuthentication — This setting had no effect anymore after support
365  for SQL Server was removed in 1.34. (T230418)
366* $wgProfileOnly — This setting, deprecated in 1.23, was removed. The profiler
367  output should instead be configured via $wgProfiler['output'].
368* $wgProfileLimit — This setting, deprecated in 1.25, was removed.
369  Set $wgProfiler['threshold'] instead.
370* $wgDebugTimestamps — This setting was removed. It affected the text output
371  produced via $wgDebugComments, if enabled.
372* $wgSkipSkin — This setting, deprecated in 1.23, was removed. To disable a
373  skin from being shown, use $wgSkipSkins.
374* $wgUseSquid, $wgSquidServers, $wgSquidServersNoPurge, and $wgSquidMaxage —
375  These, deprecated in 1.34, have been removed. Use $wgUseCdn, $wgCdnServers,
376  $wgCdnServersNoPurge, or $wgCdnMaxAge instead.
377* $wgDisableCounters — This, deprecated in 1.25, was removed. The feature that
378  it controlled was already removed in 1.26, but the variable remained existent
379  with a value of `false` for backward-compatibility.
380* $wgMaxGeneratedPPNodeCount — This setting was removed. It only affected
381  Preprocessor_DOM, which was deprecated in 1.34 and removed in this release.
382* $wgFixArabicUnicode and $wgFixMalayalamUnicode — These, deprecated in 1.33,
383  were removed. The fixes are now always enabled for their respective languages.
384* $wgAllowTitlesInSVG — This, unused and deprecated since 1.34, was removed.
385* $wgEnablePartialBlocks — This setting, deprecated when it was added in 1.33,
386  was removed. Partial blocks are now always enabled.
387* $wgLocalInterwiki — This setting, deprecated in 1.23, has been removed.
388* $wgContentHandlerUseDB — This setting, deprecated in 1.34, has been removed.
389* $wgMultiContentRevisionSchemaMigrationStage — This setting must no longer
390  be set locally. If the migration stage was set to anything other than
391  SCHEMA_COMPAT_NEW locally, update.php must be run after removing the setting.
392  Usage of the setting in code is deprecated. The setting will be removed
393  completely in 1.36.
394* $wgEnableRestAPI — This setting is no longer obeyed by MediaWiki core, and
395  should not be set set locally. Usage of the setting in code is deprecated; it
396  is now set true by default. The setting will be removed completely in 1.36.
397* $wgObjectCaches — The 'slaveOnly' option for SqlBagOStuff, deprecated in 1.34,
398  was removed. Use 'replicaOnly' instead.
399
400=== New user-facing features in 1.35 ===
401* (T204618) Whitelisted the aria-hidden HTML attribute for all elements in
402  wikitext.
403* (T13456) Special:EditPage, Special:PageHistory, Special:PageInfo, and
404  Special:Purge have been created as shortcuts for each action.
405  Special:EditPage/Foo redirects to title=foo&action=edit, with PageHistory,
406  PageInfo, and Purge corresponding to action= history, info, and purge
407  respectively. When linked to, its subpage is used as the target. Otherwise,
408  it displays a basic interface to allow the end user to specify the target
409  manually.
410* (T139221) The generated table of contents is now a navigation landmark role
411  for assistive technologies.
412* (T245931) interwiki map API doesn't report foreign language if
413  $wgInterwikiMagic=false
414* The form at ?action=watch has a new dropdown list to support expiry dates for
415  watchlist items (if $wgWatchlistExpiry is true).
416
417=== New developer features in 1.35 ===
418* A Docker based local development develpoment environment configuration is
419  included (T238224) and DEVELOPERS.md has been added with usage documentation
420  and links to further help.
421* If CSP is enabled, extensions can now add additional sources using the
422  ContentSecurityPolicy::addDefaultSource, ::addStyleSrc and ::addScriptSrc
423  methods (e.g. $context->getOutput()->getCSP()->addDefaultSrc( 'example.com' ))
424* Extensions can now specify classes and namespaces to be autoloaded by the
425  test autoloader, by setting the "TestAutoloadNamespaces" and
426  "TestAutoloadClasses" properties in extension.json. (T196090)
427* (T250977) extension.json now allows "SearchMappings" which maps the canonical
428  name of the search engine (used in wgSearchType and wgSearchTypeAlternatives)
429  to a specification using the ObjectFactory specification. This allows
430  extensions to register Search Engines using namespaced classes.
431* Added getters for OutputPage's robot, index and follow policies;
432  getRobotPolicy() returns the entire policy as a string in the form
433  <index policy>,<follow policy> while getIndexPolicy() and getFollowPolicy()
434  return their respective policies as a string.
435* The ResourceLoaderSiteModulePages and ResourceLoaderSiteStylesModulePages
436  hooks were added to allow changing which wiki pages these modules contain.
437* The SkinFactory now allows skins to be specified as an ObjectFactory spec,
438  allowing the construction of skins with services injected.
439* ContentHandlerFactory for most ContentHandler static methods. It has been
440  added to the constructors for many classes to improve SOLID / GRASP.
441* FileDeleteForm's constructor now accepts a user as the second parameter.
442  Support for not passing a user has also been hard-deprecated and will be
443  removed in 1.36.
444* The ParserPreSaveTransformComplete hook was added.
445* The ParserBeforePreprocess hook was added.
446* The ResourceLoaderSkinModule class now has a "legacy" feature that loads
447  the stylesheets previously part of the "mediawiki.legacy.shared" and
448  "mediawiki.legacy.commonPrint" module.
449  Those modules are now deprecated and no longer loaded by skins.
450  For skins needing to retain these styles, you will need to load these
451  styles via a module using the ResourceLoaderSkinModule class.
452  See Vector and Monobook for examples.
453* ParserOutput now has methods addExtraCSPStyleSrc, addExtraCSPDefaultSrc
454  addExtraCSPScriptSrc for parser tags/functions to be able to add sources
455  to the Content Security Policy.
456* The HtmlCacheUpdater service was added to unify the logic of purging CDN cache
457  and HTML file cache to simplify callers and make them more consistent.
458* The MultiHttpClient code will fallover to non-curl if curl_multi* is blocked.
459* Preferences which use HTMLTitlesMultiselectField can make use of
460  MultiTitleFilter class for saving title text to/from article IDs in user
461  preferences.
462* OutputPage::addHtmlClasses() was added to allow injecting CSS classes on
463  to the <html> element on page load.
464* The SkinAddFooterLinks hook is added to allow extensions to add items to skin
465  footers. Previously this had to be done via SkinTemplateOutputPageBeforeExec.
466  Doing so using that hook is now hard deprecated.
467* A new BlockPermissionChecker service was introduced for checking
468  block-related permissions.
469* The support of 'database' type of extensions has been added to allow 3d party
470  databases like Percona be used as storage. See T226857, T253248.
471* Three new return parameters have been added to the
472  EditPageGetCheckboxesDefinition hook. Handlers of this hook are no longer
473  restricted to defining checkboxes. See the documentation of
474  EditPage::getCheckboxesDefinition() for more details.
475* New flag File::RENDER_TMP was added in order to allow
476  File::generateAndSaveThumb and File::trasform to render a thumbnail without
477  saving it to the storage.
478
479=== External library changes in 1.35 ===
480
481==== New external libraries ====
482* Added wikimedia/ip-utils 1.0.0.
483* Added wikimedia/parsoid 0.12.0.
484* Added wikimedia/services 2.0.1.
485* Added taylorhakes/promise-polyfill v8.1.3.
486* Added vuejs v2.6.11.
487* Added vuex v3.1.3.
488
489===== New development-only external libraries =====
490* Added doctrine/dbal 2.10.2.
491* Added doctrine/sql-formatter 1.1.0.
492* Added pimple/pimple 3.3.0.
493
494==== Changed external libraries ====
495* pear/mail_mime was upgraded from 1.10.2 to 1.10.8.
496* wikimedia/less.php was upgraded from 1.8.0 to 3.0.0.
497* Updated oojs from 3.0.0 to 5.0.0.
498* Updated OOUI from 0.35.1 to 0.39.3.
499* zordius/lightncandy was upgraded from 0.23.0 to 1.2.5.
500* Updated jQuery from v3.3.1 to v3.4.1.
501* Updated jQuery Migrate from v3.0.1 to v3.1.0.
502* Updated wikimedia/assert from 0.2.2 to 0.5.0.
503* Updated pear/net_smtp from 1.8.1 from to 1.9.1.
504* Updated psr/log from 1.0.2 to 1.1.3.
505* Updated jquery.i18n from 1.0.5 to 1.0.7.
506* Updated guzzlehttp/guzzle from 6.3.3 to 6.5.4.
507* Updated wikimedia/xmp-reader from 0.6.3 to 0.7.0.
508  Fixes error log spam with too-large XMP data, and adds support for GPano tags.
509* Updated wikimedia/base-convert from v2.0.0 to v2.0.1.
510* Updated composer/semver from 1.5.0 to 1.5.1.
511* Updated wikimedia/remex-html from 2.1.0 to 2.2.0.
512* Replaced wikimedia/password-blacklist 0.1.4 with wikimedia/common-passwords
513  0.2.0.
514
515===== Changed development-only external libraries =====
516* Updated symfony/yaml from 3.4.28 to 5.0.5.
517* Updated nikic/php-parser from 3.1.5 to 4.4.0.
518* Updated php-parallel-lint/php-console-highlighter from v0.3.2 to v0.5.
519* Updated php-parallel-lint/php-parallel-lint from v0.9.2 to v1.2.0.
520* Updated psy/psysh from 0.9.9 to 0.10.4.
521* Updated monolog/monolog from 1.24.0 to 1.25.2.
522* Upgrade mediawiki-codesniffer from 28.0.0 to 30.0.0.
523* Updated composer/spdx-licenses from 1.5.1 to 1.5.3.
524* Updated monolog/monolog from 1.25.2 to 1.25.3.
525* Updated qunit from 2.9.1 to 2.10.0.
526
527==== Removed external libraries ====
528* phpunit/php-invoker (dev-only).
529  Removing this unbreaks development on Windows systems, in exchange for losing
530  time limits in running unit tests.
531* The jquery.getAttrs module was removed.
532
533=== Action API changes in 1.35 ===
534* The 'suggest' parameter of action=opensearch has been deprecated.
535  The API behaves the same with and without this parameter.
536  It was previously used by $wgEnableOpenSearchSuggest to partially
537  disable the API if set to false. Specifically, it would deny internal
538  frontend requests carrying this parameter, whilst accepting other requests.
539* Integer-type parameters are now validated for syntax rather than being
540  interpreted in surprising ways. For example, the following will now return a
541  badinteger error:
542  - "1.9" (formerly interpreted as "1")
543  - " 1" (formerly interpreted as "1")
544  - "1e1" (formerly interpreted as "1" or "10", depending on the PHP version)
545  - "1foobar" (formerly interpreted as "1")
546  - "foobar" (formerly intepreted as "0")
547  parameters. Ranges should be assumed to be enforced.
548* Many user-type parameters now accept a user ID, formatted like "#12345".
549* The 'assert' parameter used by all API modules now supports the value 'anon'.
550  When specified, the API will return the 'assertanonfailed' error if the user
551  is logged in.
552* action=edit now supports  the 'baserevid' parameter for edit conflict
553  detection, as an alternative to 'basetimestamp'. Note that self-conflicts
554  will continue to be ignored if 'basetimestamp' is set, but not if only
555  'baserevid' is set.
556* A new module was added to change the content model of existing pages.
557  Use action=changecontentmodel. Unlike Special:ChangeContentModel, the api
558  module does not work for pages that do not already exist.
559* If $wgWatchlistExpiry is true, the following API changes are made:
560  - action=watch accepts a new 'expiry' parameter analagous to the expiry
561    accepted by action=userrights, action=block, etc., except it must be no
562    greater than $wgWatchlistExpiryMaxDuration, or an infinity value.
563  - action=query&list=watchlistraw returns pages' watchlist expiry dates.
564* (T249526) action=login will now return Failed rather than NeedToken on
565  session loss.
566
567=== Action API internal changes in 1.35 ===
568* The Action API now uses the Wikimedia\ParamValidator library for parameter
569  validation, which brings some new features and changes. For the most part
570  existing module code should work as it did before, but see subsequent notes
571  for changes.
572  - The values for all ApiBase PARAM_* constants have changed. Code should have
573    been using the constants rather than hard-coding the values.
574  - Several ApiBase PARAM_* constants have been deprecated, see the in-class
575    documentation for details. Use the equivalent ParamValidator constants
576    instead.
577  - The value returned for 'upload'-type parameters has changed from
578    WebRequestUpload to Psr\Http\Message\UploadedFileInterface.
579* Validation of 'user'-type parameters is more flexible. PARAM constants exist
580  to specify the type of "user" allowed and to request UserIdentity objects
581  rather than name strings. The default is to accept all types (name, IP,
582  range, and interwiki) that were formerly accepted.
583* Maximum limits are no longer ignored in "internal mode".
584* The $paramName to ApiBase::handleParamNormalization() should now include the
585  prefix.
586* (T245931) meta=siteinfo&siprop=interwikimap no longer reports language or
587  extralanglink when $wgInterwikiMagic is false.
588
589=== Languages updated in 1.35 ===
590MediaWiki supports over 350 languages. Many localisations are updated regularly.
591Below only new and removed languages are listed, as well as changes to languages
592because of Phabricator reports.
593
594* The default targets for the ISBN search from Special:BookSources in English
595  have been updated for better international suppport. They will now be
596  BetterWorldBooks.com, OpenLibrary.org and Worldcat.org.
597* (T237672) Changed the Moroccan Arabic language (ary) to the Arabic script.
598* (T201269) Added language support for Amis (ami).
599* (T248299) Added language support for Inari Sami (smn).
600* (T251369) Added language support for Ladin (lld).
601* (T251369) Added language support for Seediq (trv), also known as Taroko.
602
603=== Breaking changes in 1.35 ===
604* MediaWiki no longer supports PHP 7.2; use PHP 7.3.19+ (T228346, T257879).
605* ResourceLoader::getLessVars(), deprecated in 1.32, was removed.
606  Use ResourceLoaderModule::getLessVars() instead.
607* The jquery.tabIndex module, deprecated in 1.34, has been removed.
608* The mediawiki.RegExp module alias, deprecated in 1.34, was removed.
609  Use the mediawiki.util module instead.
610* The easy-deflate.inflate module, unused since 1.32, was removed.
611* The easy-deflate.deflate module was removed. Use the mediawiki.deflate
612  module instead.
613* The mediawiki.notify module was removed. The mw.notify() shortcut is now
614  available by default, without any dependency.
615* (T219604) The "jquery.ui.*" and "jquery.effects.*" module aliases,
616  deprecated in 1.34, have been removed. Use "jquery.ui" instead.
617* (T235457) The "user.tokens" module has been removed.
618  Use "user.options" instead.
619* (T251855) The mw.Map#exists method in JavaScript no longer supports checking
620  multiple keys. This affects mw.config.exists() and mw.user.tokens.exists().
621* The internal variable $constructorOptions for the Parser & SpecialPageFactory,
622  exposed only for integration purposes, are now each replaced by a const called
623  CONSTRUCTOR_OPTIONS. This was a breaking change made without deprecation.
624* ObjectCache::getWANInstance, deprecated in 1.34, was removed.
625  Use MediaWikiServices::getMainWANObjectCache instead.
626* ObjectCache::newWANCacheFromParams, deprecated in 1.34, was removed.
627  Construct WANObjectCache directly instead, or use MediaWikiServices.
628* (T231366) The ProfilerOutputDb class and profileinfo.php entry point,
629  deprecated in 1.34, was removed.
630* SiteConfiguration->localVHosts, deprecated in 1.25, was removed.
631  Use $wgLocalVirtualHosts instead.
632* The $wgContLanguageCode read-only variable was removed.
633  It has been a non-configurable copy of $wgLanguageCode since MW 1.8 (2006).
634  Use $wgLanguageCode directly instead.
635* ApiQueryUserInfo::getBlockInfo, deprecated in 1.34, was removed. Use
636  ApiBlockInfoTrait::getBlockDetails instead.
637* Password::equals(), deprecated in 1.33, was removed. Use Password::verify().
638* QuickTemplate::setRef(), deprecated in 1.31, was removed. Use set().
639* The mediawiki.ui.text module, deprecated in 1.28 and unused, was removed.
640* AbstractBlock::mReason, deprecated in 1.34, is no longer public.
641* The GetBlockedStatus and UserIsHidden, deprecated in 1.34, has been removed.
642  Instead, use the GetUserBlock hook.
643* As part of work to replace the Parser, a large number of breaking changes have
644  been made, principally in related methods and properties being removed or made
645  private:
646  - disableCache(), deprecated in 1.28.
647  - serializeHalfParsedText() and the helpers unserializeHalfParsedText(),
648    isValidHalfParsedText(), and StripState::getSubState() and
649    StripState::merge(), all deprecated in 1.31. The helper functions
650    LinkHolderArray::mergeForeign() and LinkHolderArray::getSubArray()
651    were also removed.
652  - getConverterLanguage(), deprecated in 1.32. Use getTargetLanguage() instead.
653  - A large set of methods exposed only for historical reasons, deprecated in
654    1.34, have now been removed or made private:
655    - areSubpagesAllowed()
656    - armorLinks()
657    - createAssocArgs()
658    - doAllQuotes()
659    - doDoubleUnderscore()
660    - doHeadings()
661    - doMagicLinks()
662    - formatHeadings()
663    - getImageParams()
664    - getVariableValue()
665    - initialiseVariables()
666    - makeKnownLinkHolder()
667    - maybeDoSubpageLink()
668    - parseLinkParameter()
669    - replaceExternalLinks()
670    - replaceInternalLinks()
671    - replaceInternalLinks2()
672    - replaceLinkHoldersText().
673    - splitWhitespace()
674    - stripAltText()
675    - testPreprocess()
676    - testPst()
677    - testSrvus()
678  - incrementIncludeSize(), setTransparentTagHook(), replaceTransparentTags(),
679    and $mTransparentTagHooks have been removed without deprecation.
680  - The following constants have been made private without deprecation:
681    - ::EXT_LINK_ADDR
682    - ::EXT_IMAGE_REGEX
683    - ::SPACE_NOT_NL
684  - The following properties have been removed without deprecation:
685    - ::$mDefaultStripList
686    - ::$mIncludeCount
687    - ::$mRevIdForTs
688  - The following properties have been made private without deprecation:
689    - ::$mFunctionSynonyms
690    - ::$mFunctionTagHooks
691    - ::$mStripList
692    - ::$mVarCache
693    - ::$mImageParams
694    - ::$mImageParamsMagicArray
695    - ::$mSubstWords
696    - ::$mVariables
697    - ::$mConf (deprecated in 1.34)
698    - ::$mExtLinkBracketedRegex
699    - ::$mUrlProtocols
700    - ::$mAutonumber
701    - ::$mLinkHolders
702    - ::$mDefaultSort
703    - ::$mTplRedirCache
704    - ::$mForceTocPosition
705    - ::$mTplDomCache
706    - ::$mOutputType
707    - ::$mLangLinkLanguages
708    - ::$currentRevisionCache
709    - ::$mProfiler
710    - ::$mLinkRenderer
711  - Parser::getTitle() will now throw a TypeError if $mTitle is uninitialized.
712    This use pattern was deprecated in 1.34.
713  - ContentHandler::makeParserOptions(), deprecated in 1.32, was removed. Use
714    WikiPage::makeParserOptions() or ParserOptions::newCanonical() instead.
715  - The ParserAfterUnstrip hook, believed to be unused, was removed without
716    deprecation.
717  - Preprocessor_DOM and related classes, deprecated in 1.34, have been removed.
718    Consequently, the related ParserOptions::getMaxGeneratedPPNodeCount() and
719    ::setMaxGeneratedPPNodeCount() have been removed without deprecation.
720  - The support for the old signature for ParserFactory::__construct, which was
721    deprecated in 1.34, has been removed.
722  - Parser::getDefaultPreprocessorClass(), deprecated in 1.34, has been removed.
723* MediaWikiTestCase::prepareServices(), deprecated in 1.32, has been removed
724* The method ContentHandler::getSlotDiffRendererInternal is replaced with
725  ContentHandler::getSlotDiffRendererWithOptions. This breaks consumers which
726  call parent::getSlotDiffRendererInternal (no instances of which are known).
727* TextContent::getHighlightHtml, deprecated since 1.24, has been removed. Use
728  TextContent::getHtml instead.
729* ExtensionRegistry::load(), deprecated in 1.34, was removed. Instead, use
730  ExtensionRegistry::queue().
731* MWMessagePack class, deprecated in 1.34, was removed.
732* The cdb.php maintenance script was removed. Use the 'cdb' command from the
733  wikimedia/cdb library instead.
734* User::addNewUserLogEntryAutoCreate, deprecated in 1.27, was removed.
735* FileBasedSiteLookup class, deprecated in 1.33, was removed.
736* The wfGlobalCacheKey global function, deprecated in 1.30, was removed.
737* The APCBagOStuff class was removed. MediaWiki requires PHP 7.2+ (support
738  for HHVM was dropped) and these versions of PHP only support apcu. The default
739  "apc" entry in $wgObjectCaches now refers to APCUBagOStuff.
740* Database::bufferResults(), deprecated in 1.34, has been removed.
741* CannotReplaceActiveServiceException, ContainerDisabledException,
742  DestructibleService, NoSuchServiceException, SalvageableService,
743  ServiceAlreadyDefinedException, ServiceContainer and ServiceDisabledException
744  in the global namespace, deprecated in 1.33, were removed. Use the classes in
745  the MediaWiki\\Services namespace instead.
746* The following methods in the Interwiki class were removed: ::fetch(),
747  ::isValidInterwiki(), ::invalidateCache(), and ::getAllPrefixes().
748* The UsersMultiselectWidget config 'allowArbitrary' is now false by default. To
749  accept arbitrary entries, pass in true for this config.
750* OutputPage::parse() and OutputPage::parseInline(), deprecated in 1.32, have
751  been removed. Use ::parseAsContent() or ::parseAsInterface(), as
752  appropriate.
753* WikiPage::selectFields, deprecated in 1.31, was removed. Use ::getQueryInfo.
754* The remaining static methods for MagicWord, deprecated in 1.32, were removed.
755  These were MagicWord::get(), ::getSubstIDs(), ::getDoubleUnderscoreArray(),
756  ::getVariableIDs(), and ::getCacheTTL(). Instead, use MagicWordFactory (via
757  MediaWikiServices).
758* ApiBase::checkTitleUserPermissions no longer accepts a User as the third
759  parameter. Passing a user was deprecated in 1.33.
760* Sanitizer::setupAttributeWhitelist() and Sanitizer::attributeWhitelist(),
761  deprecated in 1.34, have been removed. They should not have been public.
762* Passing a sequential array as the second parameter to
763  Sanitizer::validateAttributes() has been deprecated; use an associative
764  array where keys are the allowed attributes.
765* The $warnCallback parameter to Sanitizer::removeHTMLtags, deprecated since
766  its introduction in 1.28, has been removed.
767* SpecialRecentChanges::filterByCategories(), deprecated in 1.31, was removed.
768* The `ArticleContentViewCustom` hook, deprecated in 1.32, was removed.
769* AuthManager::callLegacyAuthPlugin, deprecated in 1.33, was removed.
770* wfGetMessageCacheStorage was removed without deprecation.
771* Title::moveSubpages, deprecated in 1.34, was removed. Use the MovePage class
772  and MovePage::moveSubpages instead.
773* Article::doEditContent, deprecated in 1.29, was removed. Instead, use
774  WikiPage::doEditContent.
775* CommentStore::newKey, deprecated in 1.31, was removed.
776* EditPage::$hookError was changed from public to private.
777* Title::isValidMoveOperation, ::moveTo, and ::isValidMoveTarget, deprecated
778  in 1.25, were removed. Use the MovePage class and its methods instead.
779* Title::getUserCaseDBKey(), deprecated in 1.33, was removed. Use ::getDBkey().
780* StringUtils::explodeMarkup() was removed without deprecation.
781* AjaxResponse methods that were unused have been removed without deprecation:
782  - checkLastModified
783  - loadFromMemcached
784  - storeInMemcached
785  - setCacheDuration
786  - setVary
787* ApiDelete::delete and ::deleteFile, both of which were protected methods,
788  have been made private to allow a signature change.
789* HistoryPager::revLink, ::curLink, ::lastLink, and ::diffButtons, which had
790  no visibilities defined, have been made private to allow signature changes.
791* SpecialNewpages::revisionFromRcResult, which previously was protected, has
792  been made private to allow a signature change.
793* DifferenceEngine::$mOldRev and $mNewRev, deprecated for public access in
794  1.32, have been removed.
795* DifferenceEngine::revisionDeleteLink, which was previosuly protected, has
796  been made private to allow a signature change.
797* DifferenceEngine::getParserOutput, which is protected, has had a breaking
798  signature change: the second parameter must be a RevisionRecord object,
799  rather than a Revision object.
800* WikiPage::setLastEdit, which was previously protected, has been made
801  private to allow a signature change.
802* Skin::getSkinNameMessages() deprecated in 1.34, has been removed.
803* Skin::escapeSearchLink() deprecated in 1.34, has been removed, use
804  Skin::getSearchLink() instead.
805* Skin::shouldPreloadLogo() deprecated in  1.32, has been removed.
806* Revision::loadFromId and RevisionStore::loadRevisionFromId have been
807  removed.
808* OutputPage::parserOptions doesn't accept an $options parameter anymore.
809* MessageCache::getParserOptions previously did not have a visibility set.
810  It has been made private.
811* SpecialUndelete::showDiff previously did not have a visibilty set. It
812  hav been made private to allow a signature change.
813* The Skin no longer loads the "mediawiki.legacy.shared" or
814  "mediawiki.legacy.commonPrint" modules. The legacy shared styles must now
815  be loaded by the skin explicitly, either inherited via the
816  "mediawiki.skinning.*" modules, or by making your skin's main styles
817  module use the ResourceLoaderSkinModule class with the "legacy" attribute.
818  See Vector and Monobook for examples.
819* Passing an ApiMain to the constructor of ApiResult is no longer supported.
820  This was deprecated in 1.25.
821* ResourceLoaderWikiModule::invalidateModuleCache has been declared to
822  be @internal as part of a signature change. No known uses exist outside
823  of MediaWiki core.
824* The ArticleAfterFetchContentObject hook, deprecated in 1.32, was removed.
825  Use ArticleRevisionViewCustom to control output.
826* DatabaseBlock::isValid, deprecated in 1.33, was removed.
827* HTMLUserTextField and HTMLUsersMultiselectField previously implied
828  required=true when exists=true. Form fields that use exists=true should also
829  set required=true if they are required.
830* In DatabaseUpdater, the following methods are no longer public: dropTable(),
831  modifyTable(), modifyField(), runMaintenance(), copyFile(), appendLine().
832  In PostgresUpdater, the following methods are no longer public:
833  addPgEnumValue(), addPgIndex(), addPgExtIndex(). This change was made without
834  deprecation due to immediate danger of data corruption and loss, see T157651.
835  Extensions should instead use dropExtensionTable(),
836  modifyExtensionExtensionTable(), modifyExtensionField(), addExtensionUpdate().
837  The addExtensionUpdate() method can still be used to access any of the
838  protected methods on DatabaseUpdater.
839* ResourceLoader no longer provides the (always-true) variables for wgEnableAPI
840  and wgEnableWriteAPI; they were deprecated in MediaWiki 1.31 and removed from
841  the PHP environment in MediaWiki 1.32.
842* The wfSetupSession global function, deprecated in 1.27, was removed. Use the
843  persist() method of the right MediaWiki\Session\SessionManager object instead.
844* The wfIsHHVM global function, deprecated in 1.34, was removed.
845* GenderCache::doTitlesArray no longer accepts string values in its $titles
846  array parameter. Use Title objects (or other LinkTarget) instead.
847* Unused CommentStore::MAX_COMMENT_LENGTH has been removed.
848* User::checkTemporaryPassword() and User::checkPassword(), deprecated in 1.27,
849  were removed. Use AuthManager instead.
850* All constants and class functions now have explicit visibility modifiers. This
851  means, per [[mw:Stable interface policy]], that these should now be considered
852  stable. This also helps MW align with PSR 2 and PSR 12. This was done based on
853  audits of the corpus of skins and extensions hosted in Gerrit. If you find any
854  that you need to be less restrictive (i.e. public or protected), please report
855  these so that we can re-evaluate or suggest workarounds.
856* BaseTemplate::msgWiki(), deprecated in 1.33, was removed. Use ->msg() or
857  ->getMsg() instead.
858* QuickTemplate::msgWiki(), deprecated in 1.33, was removed. Use ->msg()
859  instead.
860* WebInstaller::getErrorBox() and ::getWarningBox(), deprecated in 1.34,
861  were removed. Use Html::errorBox() or ::warningBox() instead.
862* SpecialVersion::getExtensionCredits() and SpecialVersion::getSkinCredits()
863  have become private without deprecation.
864* As part of the migration to a new hook system (T240307), the following classes
865  now require an additional HookContainer constructor parameter:
866    - AuthManager
867    - BadFileLookup
868    - BlockManager
869    - ClassicInterwikiLookup
870    - ContentHandlerFactory
871    - ContentSecurityPolicy
872    - DefaultOptionsManager
873    - DerivedPageDataUpdater
874    - FullSearchResultWidget
875    - HtmlCacheUpdater
876    - LanguageFactory
877    - LanguageNameUtils
878    - LinkRenderer
879    - LinkRendererFactory
880    - LocalisationCache
881    - MagicWordFactory
882    - MessageCache
883    - NamespaceInfo
884    - PageEditStash
885    - PageHandlerFactory
886    - PageUpdater
887    - ParserFactory
888    - PermissionManager
889    - RevisionStore
890    - RevisionStoreFactory
891    - Router
892    - SearchEngineConfig
893    - SearchEngineFactory
894    - SearchFormWidget
895    - SearchNearMatcher
896    - SessionBackend
897    - SpecialPageFactory
898    - UserNameUtils
899    - UserOptionsManager
900    - WatchedItemQueryService
901    - WatchedItemStore
902* The following classes now require setHookContainer() to be called after
903  construction:
904    - AuthenticationProvider
905    - ResourceLoaderModule
906    - SearchEngine
907* The parameters to ChronologyProtector::getTouched() and
908  ILBFactory::getChronologyProtectorTouched() were changed without backwards
909  compatibility.
910* The deprecated $blacklist parameter to wfIsBadImage() has been removed.
911* SpecialBlock::checkUnblockSelf no longer accepts an integer representing
912  an user ID as part of ongoing refactoring of SpecialBlock class.
913* User::setInternalPassword() and User::setPassword(), deprecated in 1.27, have
914  been removed. Use User::changeAuthenticationData() instead.
915* User::selectFields(), deprecated in 1.31, has been removed. Use
916  User::getQueryInfo() instead.
917* The "legacy" serialization type in RESTBagOStuff, deprecated in 1.34,
918  has been removed.
919* The populateContentModel.php maintenance script was removed. It has
920  been replaced by the populateContentTables.php script.
921* The findHooks.php maintenance script, for the old hooks system, was removed.
922* (T257278) Calling MediaWiki\Shell\Command::restrict() will now overwrite
923  any previous restrictions rather than adding to them, making it possible to
924  disable the default restrictions.
925
926=== Deprecations in 1.35 ===
927* The PHPUnit4And6Compat class, used to provide compatibility with PHPUnit 4, is
928  now deprecated. MediaWiki support for PHPUnit 4 ended with the removal of HHVM
929  support.
930* LockManagerGroup::getDefault() and LockManagerGroup::getAny() are deprecated.
931  They seem to be unused. Just use get() directly, and catch any exception.
932* AbstractBlock::getPermissionsError and AbstractBlock::getBlockErrorParams are
933  deprecated. Use BlockErrorFormatter::getMessage instead.
934* The IP class is deprecated. Please instead use the Wikimedia\IPUtils class
935  from the new wikimedia/ip-utils library instead. Additionally, the RE_IP_*
936  constants are also deprecated. RE_IP_BYTE can be replaced with a class
937  constant on the IPUtils class, while the others will eventually be made
938  private.
939* The following Language methods are deprecated: getFallbackFor,
940  getFallbacksFor, getFallbacksIncludingSiteLanguage. Use the corresponding new
941  methods on the LanguageFallback class: getFirst, getAll, and
942  getAllIncludingSiteLanguage.
943* FileJournal::factory is deprecated. Use the constructor directly instead.
944* AbstractBlock methods setBlocker(), getBlocker() are deprecated and will
945  become internal implementation of DatabaseBlock.
946* Title::countRevisionsBetween has been deprecated and moved into RevisionStore.
947* FileBackendGroup::singleton() is deprecated. Use MediaWikiServices instead.
948* FileBackendGroup::destroySingleton() is deprecated. Test frameworks should
949  instead reset MediaWikiServices between test runs.
950  (MediaWikiIntegrationTestCase does this automatically.)
951* GenderCache::singleton(), deprecated in 1.28, is hard deprecated. Use
952  MediaWikiServices::getGenderCache() instead.
953* MediaWikiIntegrationTest::setContentLang() has been deprecated. Use
954  setMwGlobals( 'wgLanguageCode', 'xxx' ) to set a different site language
955  code, or setService( 'ContentLanguage', $myObj ) to set a specific Language
956  object. Service resets and $wgContLang will be handled automatically.
957* MediaWikiIntegrationTest::assertType() has been deprecated, as part of the
958  work to move to PHPUnit 8; PHPUnit's assertInternalType() was deprecated, and
959  will be removed in PHPUnit 9. MediaWikiIntegrationTest::assertTypeOrValue(),
960  a wrapper for assertType(), has been removed immediately, without deprecation.
961* AbstractBlock::getReason is deprecated, since reasons are actually stored as
962  CommentStoreComments, and getReason returns a string with no caller control
963  over language or formatting. Instead use AbstractBlock::getReasonComment,
964  which returns the CommentStoreComment.
965* The global function wfGetRusage() is deprecated and will now always call the
966  getrusage() function without checking for its existence.
967* The properties User::mBlock, User::mBlockedby and User::mHideName are
968  deprecated. Instead, use User::getBlock to get the block, then use
969  AbstractBlock::getByName or AbstractBlock::getHideName.Use the GetUserBlock
970  hook to set, unset or modify a block, including hiding or unhiding a user.
971* Directly calling the MergeHistory constructor is deprecated. Instead, use the
972  new MergeHistoryFactory class.
973* Language::factory() and Language::getParentLanguage() are deprecated, and so
974  is directly calling the Language constructor. Use the new LanguageFactory
975  class instead.
976* Language::classFromCode() is deprecated. There is no reason it should be used
977  outside the Language class itself.
978* Language::clearCaches() is deprecated. Instead, reset all services and set
979  Language::$mLangObjCache = [].
980* The following functions from Language class are deprecated in favour of
981  respective functions in LanguageConverter:
982  - autoConvert
983  - autoConvertToAllVariants
984  - convert
985  - convertTitle
986  - convertNamespace
987  - hasVariants
988  - hasVariant
989  - convertHtml
990  - convertCategoryKey
991  - getVariants
992  - getPreferredVariant
993  - getURLVariant
994  - findVariantLink
995  - getExtraHashOptions
996  - updateConversionTable
997* Language::classFromCode() is hard deprecated and should be removed in 1.36
998* Language::getConverter() is deprecated and should be removed in 1.36
999* Language::MESSAGES_FALLBACKS, Language::STRICT_FALLBACKS were deprecated.
1000  Use LanguageFallback::MESSAGES and LanguageFallback::STRICT respectively
1001* Language::$mLangObjCache is deprecated and should be removed in 1.36. Use
1002  MediaWikiServices instead to get a LanguageFactory.
1003* Language::getMessagesFor(), getMessageFor(), and getMessageKeysFor() are
1004  deprecated. Use LocalisationCache's getItem(), getSubitem(), and
1005  getSubitemList() methods directly.
1006* OutputPage::getCSPNonce() is deprecated, use OutputPage::getCSP()->getNonce()
1007  instead.
1008* DerivedPageDataUpdater::prepareUpdate accepted as its second parameter an
1009  optional array of options. Specifying the value of the `oldrevision` key of
1010  the array to be a Revision object, rather than a RevisionRecord object, is
1011  hard deprecated. The same applies to the options parameter in
1012  WikiPage::doEditUpdates.
1013* Skin::makeI18nUrl() and makeNSUrl() have been deprecated, no longer used.
1014* Title::countAuthorsBetween and Title::getAuthorsBetween were hard deprecated.
1015  Use respective methods in RevisionStore instead.
1016* Remove deprecated SkinCopyrightFooter &$forContent parameter
1017* The following Language class static variables have been replaced with
1018  constants and deprecated: $mWeekdayMsgs, $mWeekdayAbbrevMsgs, $mMonthMsgs,
1019  $mMonthGenMsgs, $mMonthAbbrevMsgs, $mIranianCalendarMonthMsgs,
1020  $mHebrewCalendarMonthMsgs, $mHebrewCalendarMonthGenMsgs,
1021  $mHijriCalendarMonthMsgs and $durationIntervals.
1022* As part of dropping security support for IE 6 and IE 7,
1023  WebRequest::checkUrlExtension() has been deprecated, and now always returns
1024  true.
1025* The following ApiBase::PARAM_* constants have been deprecated in favor of
1026  equivalent ParamValidator constants: PARAM_DFLT, PARAM_ISMULTI, PARAM_TYPE,
1027  PARAM_MAX, PARAM_MAX2, PARAM_MIN, PARAM_ALLOW_DUPLICATES, PARAM_DEPRECATED,
1028  PARAM_REQUIRED, PARAM_SUBMODULE_MAP, PARAM_SUBMODULE_PARAM_PREFIX, PARAM_ALL,
1029  PARAM_EXTRA_NAMESPACES, PARAM_SENSITIVE, PARAM_DEPRECATED_VALUES,
1030  PARAM_ISMULTI_LIMIT1, PARAM_ISMULTI_LIMIT2, PARAM_MAX_BYTES, PARAM_MAX_CHARS.
1031* ApiBase::explodeMultiValue() is deprecated. Use
1032  ParamValidator::explodeMultiValue() instead.
1033* ApiBase::parseMultiValue() is deprecated. No replacement is provided;
1034  generally this sort of thing should be handled by fully validating the
1035  parameter.
1036* ApiBase::validateLimit() and ApiBase::validateTimestamp() are deprecated.
1037  Use ApiParamValidator::validateValue() with an appropriate settings array
1038  instead.
1039* ContentHandler (use ContentHandlerFactory):
1040  - getForTitle
1041  - getForContent
1042  - getForModelID
1043  - getContentModels
1044  - getAllContentFormats
1045  - protected $handler (not need anymore)
1046  - cleanupHandlersCache (not need anymore)
1047* (T212738) The $wgVersion global is deprecated; instead, use MW_VERSION.
1048* $wgMemc is deprecated, use MediaWikiServices::getLocalServerObjectCache()
1049  instead.
1050* ObjectCache::detectLocalServerCache() is deprecated, instead use
1051  MediaWikiServices::getLocalServerObjectCache() or
1052  ObjectCache::makeLocalServerCache().
1053* ImagePage::getImageLimitsFromOptions() is deprecated. Use static function
1054  MediaFileTrait::getImageLimitsFromOptions() instead.
1055* As part of work to replace the Parser, alongside the breaking changes listed
1056  above, a large number of deprecations changes been made, to simplify the API
1057  or because they will not be supported in replacement:
1058  - Parser::doBlockLevels() (and BlockLevelPass class has been marked @internal)
1059  - Parser::setFunctionTagHook()
1060  - Parser::attributeStripCallback()
1061  - Parser::fetchTemplate() - use Parser::fetchTemplateAndTitle() instead.
1062  - Parser::enableOOUI() - use $parser->getOutput()->enableOOUI() instead.
1063  - LinkHolderArray has been deprecated for public usage and will be
1064    internal part of parser.
1065  - The following parser-related hooks have been deprecated:
1066    - InternalParseBeforeSanitize
1067        Use an alternative hook which doesn't expose internal half-parsed state,
1068        like ParserBeforeInternalParse or ParserAfterTidy
1069    - ParserFetchTemplate
1070        Use BeforeParserFetchTemplateAndTitle
1071    - ParserSectionCreate
1072        No replacement; <section> tag wrapping will be done by core in future.
1073    - BeforeParserrenderImageGallery
1074        No replacement; MediaHandler provides for customizable media rendering
1075    - ParserBeforeTidy
1076        Use ParserAfterTidy instead to avoid exposing internal half-parsed state
1077    - ParserBeforeStrip
1078        No replacement; stripping is no longer supported.
1079    - ParserAfterStrip
1080        No replacement; stripping is no longer supported.
1081  - The accessor/mutator methods Parser::Options(), Parser::OutputType(), and
1082    Parser::Title() have been deprecated; use the appropriate Parser::get* or
1083    Parser::set* methods instead.
1084  - Parser::firstCallInit() has been deprecated. The parser is initialized
1085    fully on construction and so ::firstCallInit() no longer has any effect
1086    when manually invoked.
1087  - ParserOptions::setAllowExternalImages(), ::setAllowExternalImagesFrom(),
1088    and ::setEnableImageWhitelist() have been deprecated.  Future parsers
1089    will not allow per-parser configuration of image filtering; use
1090    site configuration instead.
1091  - ParserOptions::getTidy() and ParserOptions::setTidy() have been deprecated.
1092    These options no longer have any effect.
1093  - Most methods of MWTidy, except for MWTidy::tidy(), have been deprecated;
1094    tidiness is always enabled and not configurable.
1095  - Version 1 of the parserTests file format has been deprecated. You'll need to
1096    update your parser tests to version 2, which uses Remex tidy on all test
1097    output by default. Support for parser tests with Remex tidy off will later
1098    be removed entirely.
1099  - $wgParser — This global variable, soft deprecated in 1.32, has now been hard
1100    deprecated. Use MediaWikiServices::getInstance()->getParser() instead.
1101    (T160811)
1102* The signature of DefaultPreferencesFactory::__construct has been changed:
1103  - LanguageConverter $languageConverter has been added.
1104  and its usage with old arguments is hard deprecated.
1105* The public usage of the following properties of LanguageConverter have been
1106  deprecated as there is no reason they should be used outside the
1107  LanguageConverter class and will be changed from public to private:
1108  - mLangObj
1109  - mUcfirst
1110  - mConvRuleTitle
1111  - mURLVariant
1112  - mUserVariant
1113  - mHeaderVariant
1114  - mMaxDepth
1115  - mVarSeparatorPattern
1116  changed from public to protected:
1117  - mTables
1118* The ArticleEditUpdatesDeleteFromRecentchanges hook has been deprecated. Please
1119  use the RecentChange_save hook or similar instead.
1120* The ArticleEditUpdates hook has been deprecated. Please
1121  use the RevisionDataUpdates hook or similar instead.
1122* The SkinTemplatePreventOtherActiveTabs and SkinTemplateTabAction hooks have
1123  been hard deprecated. Please use the SkinTemplateNavigation__Universal hook
1124  instead.
1125* ResourceLoaderFileModule::compileLessFile() has been deprecated, use
1126  ResourceLoaderFileModule::compileLessString() instead
1127* The SquidPurgeClient and SquidPurgeClientPool classes have been deprecated.
1128  Use MultiHttpClient or HtmlCacheUpdater instead.
1129* MimeAnalyzer::getExtensionsForType() and ::getTypesForExtensions() were
1130  deprecated in favor of MimeAnalyzer::getExtensionsFromMimeType() and
1131  ::getMimeTypesFromExtension(), respectively. The new methods return arrays
1132  rather than strings.
1133* Calling Action::factory and Action constructor with WikiPage has been
1134  hard deprecated. Caller must provide an Article instance.
1135* ApiTestCase::doLogin, soft deprecated in 1.31, was hard deprecated.
1136* WebRequest::getLimitOffset is hard deprecated. Instead, use
1137  ::getLimitOffsetForUser and pass a User object.
1138* PageArchive::getPreviousRevision is hard deprecated. Instead, use the new
1139  ::getPreviousRevisionRecord method.
1140* PageArchive::getArchivedRevision is hard deprecated. Instead, use the new
1141  ::getArchivedRevisionRecord method.
1142* PageArchive::undelete is hard deprecated. Instead, use ::undeleteAsUser
1143  and pass a User object.
1144* PageArchive::getRevision is hard deprecated.
1145* EditPage::getBaseRevision was hard deprecated. Instead, use the new
1146  ::getExpectedParentRevision method.
1147* The public variable EditPage::$mBaseRevision was hard deprecated.
1148* FileDeleteForm previously did not accept a user parameter in its constructor,
1149  instead relying on the global $wgUser. A user parameter has been added,
1150  and //not// providing a user is deprecated. There are no known callers
1151  outside of mediawiki core.
1152* AuthManager::singleton() has been deprecated. Use
1153  MediaWikiServices::getInstance()->getAuthManager() instead.
1154* ContribsPager::tryToCreateValidRevision is hard deprecated. Instead, use
1155  ContribsPager::tryCreatingRevisionRecord.
1156* The following functions all accept an optional user parameter. Not passing a
1157  user is hard deprecated, and support for calling them without passing a user
1158  will be removed in 1.36:
1159  - Title::getNotificationTimestamp (note however that the method is deprecated
1160      in its entirely in favor of the new WatchlistNotificationManager service)
1161  - PatrolLog::record
1162  - LogEventsList::userCan
1163  - LogEventsList::userCanBitfield
1164  - LogEventsList::userCanViewLogType
1165  - LogPage::addEntry
1166  - FileDeleteForm::doDelete
1167  - OldLocalFile::userCan
1168  - ArchivedFile::userCan
1169  - File::userCan
1170* The following functions all accept an optional audience parameter and
1171  an optional user parameter. If the audience is FOR_THIS_USER and no
1172  user is passed, they fallback to $wgUser. Not passing a user when
1173  one is needed is deprecated
1174  - LogEventsList::getExcludeClause
1175  - WikiPage::getComment
1176  - WikiPage::getCreator
1177  - WikiPage::getUser
1178  - WikiPage::getUserText
1179* UploadBase::checkWarnings now accepts a User parameter; not providing a
1180  user is soft deprecated.
1181* Article::insertProtectNullRevision and WikiPage::insertProtectNullRevision
1182  were hard deprecated. Instead, use WikiPage::insertNullProtectionRevision.
1183* Article::doDeleteArticle, Article::doDeleteArticleReal, and
1184  WikiPage::doDeleteArticle are all deprecated. Instead, use
1185  WikiPage::doDeleteArticleReal.
1186* Article::getComment is deprecated. Instead, use WikiPage::getComment.
1187* Article::getCreator is deprecated. Instead, use WikiPage::getCreator.
1188* Article::updateRevisionOn() and ::updateIfNewerOn(), and
1189  WikiPage::updateIfNewerOn() are deprecated. Instead, use
1190  WikiPage::updateRevisionOn().
1191* Article::getUser is deprecated. Instead, use WikiPage::getUser.
1192* Article::getUserText is deprecated. Instead, use WikiPage::getUserText.
1193* Article::prepareContentForEdit is hard deprecated. Instead, use
1194  WikiPage::prepareContentForEdit.
1195* WikiPage::prepareContentForEdit previously accepted either a Revision or a
1196  RevisionRecord object as its optional second parameter. Passing a Revision
1197  is now hard deprecated.
1198* Article::getUndoContent and WikiPage::getUndoContent are hard deprecated.
1199  Instead, use ContentHandler::getUndoContent.
1200* Passing Revision objects to ContentHandler::getUndoContent is hard deprecated.
1201  Instead, pass the associated Content objects, as well as whether the undo is
1202  from the current revision.
1203* Article::doDeleteUpdates and ::doEditUpdates are deprecated. Instead,
1204  use WikiPage::doDeleteUpdates and ::doEditUpdates.
1205* WikiPage::doEditUpdates previously accepted a Revision object as its first
1206  parameter. It now accepts RevisionRecord objects, and passing Revision
1207  objects is deprecated.
1208* Article::getRevisionFetched is deprecated. Instead, use the
1209  fetchRevisionRecord method, which has been converted from protected to
1210  public.
1211* LocalFileDeleteBatch was migrated to a new constructor signature with the
1212  user as the second parameter. Support for the old signature is hard
1213  deprecated, and once removed the user parameter will be required. At the
1214  same time, a number of file-deletion related methods were updated
1215  - File::delete is hard deprecated in favor of the new ::deleteFile
1216  - LocalFile::delete is hard deprecated in favor of the new ::deleteFile
1217  - LocalFile::deleteOld is hard deprecated in favor of the new ::deleteOldFile
1218  - ForeignDBFile::delete is hard deprecated in favor of the new ::deleteFile
1219* File::recordUpload (along with the respective methods in the LocalFile and
1220  ForeignDBFile classes) is hard deprecated, and LocalFile::recordUpload2 is
1221  soft deprecated. Use the new LocalFile::recordUpload3, which has a different
1222  signature and requires that a User parameter is passed.
1223* The SpecialPageFactory class was moved from the MediaWiki\Special namespace
1224  to the MediaWiki\SpecialPage namespace. The old location remains as a
1225  deprecated alias.
1226* Title::userCan, ::quickUserCan, and ::getUserPermissionsErrors, which
1227  were deprecated in 1.33, were hard deprecated. Instead, use
1228  PermissionManager::userCan, ::quickUserCan, and ::getPermissionErrors.
1229* All methods of the old SpecialPageFactory, deprecated in 1.32, were hard
1230  deprecated. Instead, get a SpecialPageFactory from MediaWikiServices and
1231  use its methods.
1232* User::updateNewtalk now accepts as its optional third parameter a
1233  RevisionRecord object; passing a Revision is hard deprecated.
1234* User::getNewMessageRevisionId and ::getNewMessageLinks were hard deprecated.
1235* DifferenceEngine::getRevisionHeader now accepts a RevisionRecord as its
1236  first parameter; passing a Revision is hard deprecated.
1237* WikiPage::doDeleteUpdates now accepts as its optional third parameter
1238  a RevisionRecord object; passing a Revision is hard deprecated.
1239* WikiPage::onArticleEdit now accepts as its optional second parameter
1240  a RevisionRecord object; passing a Revision is hard deprecated.
1241* Global $wgUser variable was soft deprecated.
1242* The Revision class was soft deprecated entirely in 1.31. All methods
1243  have now been individually hard deprecated:
1244  - ::__construct - create MutableRevisionRecord objects instead
1245  - ::newFromId - use RevisionLookup::getRevisionById instead
1246  - ::newFromTitle - use RevisionLookup::getRevisionByTitle instead
1247  - ::newFromPageId - use RevisionStore::getRevisionByPageId instead
1248  - ::newFromArchiveRow - use RevisionFactory::newRevisionFromArchiveRow
1249  - ::newFromRow - use RevisionStore::newRevisionFromRow instead
1250  - ::loadFromPageId - use RevisionStore::getRevisionByPageId instead
1251  - ::loadFromTitle - use RevisionStore::getRevisionByTitle instead
1252  - ::loadFromTimestamp - use RevisionStore::getRevisionByTimestamp instead
1253  - ::getQueryInfo - use RevisionStore::getQueryInfo instead
1254  - ::getArchiveQueryInfo - use RevisionStore::getArchiveQueryInfo instead
1255  - ::getParentLengths - use RevisionStore::getRevisionSizes instead
1256  - ::getRevisionRecord - no replacement
1257  - ::getId - use RevisionRecord::getId instead
1258  - ::setId - use MutableRevisionRecord::setId instead
1259  - ::setUserIdAndName - use MutableRevisionRecord::setUser instead
1260  - ::getTextId - use SlotRecord::getContentAddress for retrieving an actual
1261      content address, or RevisionRecord::hasSameContent to compare content
1262  - ::getParentId - use RevisionRecord::getParentId instead
1263  - ::getSize - use RevisionRecord::getSize instead
1264  - ::getSha1 - use RevisionRecord::getSha1 instead
1265  - ::getTitle - use RevisionRecord::getPageAsLinkTarget instead
1266  - ::setTitle - the method was previously a no-op
1267  - ::getPage - use RevisionRecord::getPageId instead
1268  - ::getUser - use RevisionRecord::getUser and then User::getId instead
1269  - ::getUserText - use RevisionRecord::getUser and then User::getName instead
1270  - ::getComment - use RevisionRecord::getComment instead
1271  - ::isMinor - use RevisionRecord::isMinor instead
1272  - ::isUnpatrolled - use RevisionStore::getRcIdIfUnpatrolled instead
1273  - ::getRecentChange - use RevisionStore::getRecentChange instead
1274  - ::isDeleted - use RevisionRecord::isDeleted instead
1275  - ::getVisibility - use RevisionRecord::getVisibility instead
1276  - ::getContent - use RevisionRecord::getContent instead
1277  - ::getSerializedData - use SlotRecord::getContent for retrieving a
1278      content object, and Content::serialize for the serialized form
1279  - ::getContentModel - use SlotRecord::getModel instead
1280  - ::getContentFormat - use SlotRecord::getFormat instead, with a fallback
1281       to ContentHandler::getDefaultFormat
1282  - ::getContentHandler - use ContentHandlerFactory::getContentHandler instead
1283  - ::getTimestamp - use RevisionRecord::getTimestamp instead
1284  - ::isCurrent - use RevisionRecord::isCurrent instead
1285  - ::getPrevious - use RevisionLookup::getPreviousRevision instead
1286  - ::getNext - use RevisionLookup::getNextRevision instead
1287  - ::getRevisionText - use RevisionRecord::getContent instead
1288  - ::compressRevisionText - use SqlBlobStore::compressData instead
1289  - ::decompressRevisionText - use SqlBlobStore::decompressData instead
1290  - ::insertOn - use RevisionStore::insertRevisionOn instead
1291  - ::base36Sha1 - use SlotRecord::base36Sha1 instead
1292  - ::newNullRevision - use RevisionStore::newNullRevision
1293  - ::userCan - use RevisionRecord::userCanBitfield instead
1294  - ::userCanBitfield - use RevisionRecord::userCanBitfield instead
1295  - ::getTimestampFromId - use RevisionStore::getTimestampFromId instead
1296  - ::countByPageId - use RevisionStore::countRevisionsByPageId instead
1297  - ::countByTitle - use RevisionStore::countRevisionsByTitle instead
1298  - ::userWasLastToEdit - use RevisionStore::userWasLastToEdit instead
1299  - ::newKnownCurrent - use RevisionStore::getKnownCurrentRevision instead
1300* The Revision method had a few methods that were previously protected and
1301  have been made private. They were:
1302  - ::getRevisionStore
1303  - ::getRevisionLookup
1304  - ::getRevisionFactory
1305  - ::getBlobStore
1306  The $mRecord variable was also changed from protected to private.
1307* Multiple hooks that include Revision objects were deprecated. The hooks, as
1308  well as suitable replacements, are noted below:
1309  - ArticleRevisionUndeleted (hard deprecated, use the RevisionUndeleted hook)
1310  - ArticleRollbackComplete (hard deprecated, use the RollbackComplete hook)
1311  - DiffRevisionTools (hard deprecated, use the DiffTools hook)
1312  - DiffViewHeader (hard deprecated, use the DifferenceEngineViewHeader hook)
1313  - HistoryRevisionTools (hard deprecated, use the HistoryTools hook)
1314  - NewRevisionFromEditComplete (hard deprecated, use the
1315      RevisionFromEditComplete hook).
1316  - PageContentInsertComplete (hard deprecated, use the PageSaveComplete hook)
1317  - PageContentSaveComplete (hard deprecated, use the PageSaveComplete hook)
1318  - RevisionInsertComplete (soft deprecated in 1.31, now hard deprecated)
1319  - TitleMoveCompleting (hard deprecated, use the PageMoveCompleting hook)
1320  - TitleMoveComplete (hard deprecated, use the PageMoveComplete hook)
1321  - UndeleteShowRevision (hard deprecated)
1322* The following RevisionStore methods were deprecated:
1323  - ::loadRevisionFromTitle
1324  - ::loadRevisionFromTimestamp
1325  - ::loadRevisionFromPageId
1326  - ::listRevisionSizes
1327* WikiPage::$mLastRevision was changed from protected to private.
1328* RecentChange::markPatrolled was deprecated. Use ::doMarkPatrolled instead.
1329* The JobRunner class has been converted to a service class.
1330  Direct construction is deprecated, use MediaWikiServices::getJobRunner.
1331* JobRunner::setLogger has been deprecated, thus using JobRunner as a
1332  LoggerAwareInterface is deprecated as well. Rely on the logger passed in the
1333  constructor instead.
1334* LogEventsList::typeAction accepts an optional right to check against as
1335  the fourth parameter. Specifying such a right is deprecated.
1336* SkinTemplate::makeArticleUrlDetails has been deprecated, no longer used.
1337* Passing a Revision object into CategoryMembershipChange constructor is
1338  deprecated. Pass a RevisionRecord instead.
1339* The "mediawiki.legacy.oldshared" module has been deprecated.
1340  Skins and extensions that are using this should copy its necessary CSS rules
1341  to their own styles module. CologneBlue and Nostalgia skins serve as examples.
1342* The "mediawiki.legacy.shared" module has been deprecated.
1343  Use the "mediawiki.skinning.*" modules, or ResourceLoaderSkinModule instead.
1344* The following hooks, soft deprecated in 1.24, have been hard deprecated:
1345  - APIQueryInfoTokens
1346  - APIQueryRecentChangesTokens
1347  - APIQueryRevisionsTokens
1348  - APIQueryUsersTokens
1349  - ApiTokensGetTokenTypes
1350* Calling Action::factory and Action constructor with any Page implementations
1351  other than Article is deprecated.
1352* Action::page property is deprecated for direct access.
1353  Use Action::getArticle or Action::getWikiPage instead.
1354* LESS `.background-image-svg()` mixin from 'mediawiki.mixins.less' is
1355  deprecated and should be removed in 1.36.
1356* LESS `.background-image-svg-quick()` mixin from 'mediawiki.mixins.less' is
1357  deprecated and should be removed in 1.36.
1358* The following methods were deprecated:
1359  - Title::getFirstRevision (hard deprecated)
1360  - Title::getEarliestRevTime
1361  - WikiPage::getOldestRevision (hard deprecated)
1362  - Article::getOldestRevision (hard deprecated)
1363  Use RevisionStore::getFirstRevision instead.
1364* WikiPage::commitRollback and ::doRollback are declared to be internal
1365  in preparation for breaking changes. Neither method has any known
1366  callers outside of MediaWiki core. Both methods modify an array passed
1367  by reference ($resultDetails) - accessing the Revision objects added to
1368  that array (using the keys `current` and `target`) is also deprecated.
1369* The following Linker methods previously accepted Revision objects as
1370  parameters. They now accept either Revision or RevisionRecord objects.
1371  Passing a Revision object is hard deprecated.
1372  - ::revUserLink
1373  - ::revUserTools
1374  - ::revComment
1375  - ::generateRollback
1376  - ::getRollbackEditCount
1377  - ::buildRollbackLink
1378  - ::getRevDeleteLink
1379* WikiPage::hasDifferencesOutsideMainSlot previously accepted Revision
1380  objects for its two parameters. It now accepts RevisionRecord objects,
1381  and passing Revision objects is hard deprecated.
1382* WikiPage::updateRevisionOn previously accepted Revision objects for its
1383  second parameter. It now accepts RevisionRecord objects, and passing
1384  Revision objects is hard deprecated.
1385* The ParserGetVariableValueVarCache hook has been deprecated.
1386* When using the ParserGetVariableValueSwitch hook, the following unusual
1387  uses have been deprecated: modifying the passed $magicWordId or failing to
1388  cache the returned value in $variableCache.  The related
1389  MagicWordwgVariableIDs hook has been deprecated and renamed; use
1390  the GetMagicVariableIDs hook instead.
1391* The following Parser properties have been deprecated:
1392  - ::$mTagHooks
1393  - ::$mFunctionHooks
1394  - ::$mMarkerIndex
1395  - ::$mFirstCall
1396  - ::$mPreprocessor
1397  - ::$mOutput
1398  - ::$mStripState
1399  - ::$mLinkID
1400  - ::$mIncludeSizes
1401  - ::$mPPNodeCount
1402  - ::$mGeneratedPPNodeCount
1403  - ::$mHighestExpansionDepth
1404  - ::$mDoubleUnderscores
1405  - ::$mExpensiveFunctionCount
1406  - ::$mShowToc
1407  - ::$mUser
1408  - ::$mOptions
1409  - ::$mTitle
1410  - ::$ot
1411  - ::$mRevisionObject
1412  - ::$mRevisionId
1413  - ::$mRevisionTimestamp
1414  - ::$mRevisionUser
1415  - ::$mRevisionSize
1416  - ::$mInputSize
1417  - ::$mInParse
1418* LinksUpdate::getRevision and ::setRevision are hard deprecated in favor
1419  of the new ::getRevisionRecord and ::setRevisionRecord methods.
1420* A large number of exposed variables and methods of Article were deprecated as
1421  part of its planned removal:
1422  - Article::$mContext is deprecated; use getContext()/setContext() instead.
1423  - Article::__get(), ::__set() are hard deprecated, use the WikiPage properties
1424    instead.
1425  - These Article methods were hard deprecated; use their WikiPage equivalents:
1426    - ::checkFlags,
1427    - ::checkTouched,
1428    - ::clearPreparedEdit,
1429    - ::commitRollback,
1430    - ::doDeleteArticleReal,
1431    - ::doEditContent,
1432    - ::doPurge,
1433    - ::doRollback,
1434    - ::doUpdateRestrictions,
1435    - ::doViewUpdates,
1436    - ::exists,
1437    - ::followRedirect,
1438    - ::getContentHandler,
1439    - ::getContentModel,
1440    - ::getContributors,
1441    - ::getDeletionUpdates,
1442    - ::getHiddenCategories,
1443    - ::getId,
1444    - ::getLatest,
1445    - ::getLinksTimestamp,
1446    - ::getMinorEdit,
1447    - ::getRedirectTarget,
1448    - ::getRedirectURL,
1449    - ::getTimestamp,
1450    - ::getTouched,
1451    - ::hasViewableContent,
1452    - ::insertOn,
1453    - ::insertRedirect,
1454    - ::insertRedirectEntry,
1455    - ::isCountable,
1456    - ::isRedirect,
1457    - ::loadFromRow,
1458    - ::loadPageData,
1459    - ::lockAndGetLatest,
1460    - ::makeParserOptions,
1461    - ::pageDataFromId,
1462    - ::pageDataFromTitle,
1463    - ::prepareContentForEdit,
1464    - ::protectDescription,
1465    - ::protectDescriptionLog,
1466    - ::replaceSectionAtRev,
1467    - ::setTimestamp,
1468    - ::shouldCheckParserCache,
1469    - ::supportsSections,
1470    - ::triggerOpportunisticLinksUpdate,
1471    - ::updateCategoryCounts, and
1472    - ::updateRedirectOn.
1473  - Article::generateReason() was hard deprecated; instead, please use
1474    WikiPage::getAutoDeleteReason().
1475  - Article::replaceSectionContent() was hard deprecated, use
1476    Article::replaceSectionAtRev() instead.
1477  - Article::getRevision and WikiPage::getRevision were hard deprecated in favor
1478    of the new WikiPage::getRevisionRecord method.
1479* A new UserNameUtils service was introduced. The following User methods
1480  were deprecated in favor of using the new service:
1481  - isIP
1482  - isIPRange
1483  - isValidUserName
1484  - isUsableName
1485  - isCreatableName
1486  - getCanonicalName
1487* The signature of WikiPage::doDeleteArticleReal was changed to make the user
1488  the second parameter, and the suppression option the third parameter.
1489  Previously, the third parameter was unused. Using the old signature is
1490  hard deprecated.
1491* ApiQueryRevisions::getRollbackToken, which has been soft deprecated since
1492  1.24, accepted as its third parameter a Revision object. It now accepts
1493  a RevisionRecord, and passing a Revision is hard deprecated.
1494* Passing Article to ParserCache::get() was deprecated
1495* ParserOptions::newCanonical() with no first parameter, or null as the first
1496  parameter, which falls back to using global $wgUser, is hard deprecated.
1497* Parser::fetchCurrentRevisionOfTitle, ::statelessFetchRevision, and
1498  ::getRevisionObject were hard deprecated in favor of the new
1499  ::fetchCurrentRevisionRecordOfTitle, ::statelessFetchRevisionRecord,
1500  and ::getRevisionRecordObject methods respectively.
1501* ParserOptions::getCurrentRevisionCallback and ::setCurrentRevisionCallback
1502  were hard deprecated in favor of the new ::getCurrentRevisionRecordCallback
1503  and ::setCurrentRevisionRecordCallback methods respectively.
1504* Parser::statelessFetchTemplate returns an array; accessing the Revision
1505  object returned (via the `revision` key to the array) is deprecated. Instead,
1506  use `revision-record` to retrieve the equivalent RevisionRecord.
1507* WikiPage::doEditContent returns an array, and PageUpdater::getStatus returns
1508  a Status object with an array value. For both of those arrays, accessing the
1509  Revision object returned (via the `revision` key to the array) is deprecated.
1510  Instead, use `revision-record` to retrieve the equivalent RevisionRecord.
1511* Page interface was deprecated. Use Article or WikiPage instead.
1512* The following DatabaseBlock methods are deprecated because they are no longer
1513  needed in core: chooseBlock, fromMaster, deleteIfExpired.
1514* wfGetScriptUrl() was deprecated. The script URL should be configured rather
1515  than detected. wfScript() can be used to get a configured script URL.
1516* Action::factory() with null $action argument is hard deprecated
1517* The following methods of the User class were deprecated: getDefaultOptions,
1518  getDefaultOption, getOptions, getOption, getBoolOption, getIntOption,
1519  setOption, listOptionKinds, getOptionKinds, resetOptions. Use corresponding
1520  methods in UserOptionsLookup or UserOptionsManager service classes instead.
1521* UserRetrieveNewTalks hook was deprecated without replacement.
1522* User::getNewtalk and ::setNewtalk were hard deprecated. Use service
1523  TalkPageNotificationManager instead.
1524* EditPage::matchSpamRegex and ::matchSummarySpamRegex were hard deprecated in
1525  favor of the new SpamChecker service.
1526* Title::getNotificationTimestamp, User::clearNotification, and
1527  User::clearAllNotifications were deprecated in favor of the new
1528  WatchlistNotificationManager service.
1529* SpecialPage::setListed() and SpecialPage::listed() were deprecated. Subclass
1530  UnlistedSpecialPage to set listed as false, and use SpecialPage::isListed()
1531  to get the value.
1532* CategoryPage::getCategoryViewerClass() and ::setCategoryViewerClass() were
1533  deprecated.
1534* MWHttpRequest and its subclasses PhpHttpRequest, CurlHttpRequest and
1535  GuzzleHttpRequest now require the timeout and connectTimeout options to
1536  always be specified, otherwise a deprecation warning will be raised. Most
1537  callers should use HttpRequestFactory which always sets these options.
1538* Linker::normaliseSpecialPage() has been deprecated, instead make use of
1539  LinkRenderer::normalizeTarget().
1540* SkinTemplate::getPersonalToolsList() was soft deprecated.
1541* ChangeTags::truncateTagDescription() has been deprecated.
1542* The following methods of the User class are deprecated: getGroups,
1543  getGroupMemberships, getEffectiveGroups, getAutomaticGroups,
1544  addGroup, removeGroup, getFormerGroups, getAllGroups, getImplicitGroups,
1545  addAutopromoteOnceGroups. Use the new UserGroupManager service instead.
1546* The following methods of the UserGroupMembership class were deprecated:
1547  selectFields, getMembershipsForUser, getMembership, insert, delete,
1548  newFromRow, initFromRow, purgeExpired.
1549  Use the new UserGroupManager service instead.
1550* wfWaitForSlaves() has been hard deprecated. Use LBFactory::waitForReplication
1551  instead. It was soft deprecated in 1.27.
1552* BaseTemplate::getAfterPortlet and ::renderAfterPortlet have been deprecated in
1553  favor of the Skin::getAfterPortlet method. Skin::getAfterPortlet does not wrap
1554  the result in a div, callers are responsible for that.
1555  The hook BaseTemplateAfterPortlet, called by both methods has been deprecated
1556  as well and is replaced by SkinAfterPortlet.
1557* Autopromote class has been soft deprecated and it's methods moved into
1558  UserGroupManager.
1559* SkinTemplateBuildNavUrlsNav_urlsAfterPermalink hook has been deprecated.
1560  Use SidebarBeforeOutput hook and get the revision id from the OutputPage
1561  object.
1562* BaseTemplate::getToolbox() method has been soft deprecated. The toolbox data
1563  is now available in a sidebar data array which you can get from any class
1564  that's extending QuickTemplate class. The hook associated with this method,
1565  BaseTemplateToolbox, has been hard deprecated. To add items to the toolbox,
1566  use SidebarBeforeOutput hook instead.
1567* The SkinTemplateOutputPageBeforeExec hook is deprecated.
1568  The page [[mw:Manual:Hooks/SkinTemplateOutputPageBeforeExec]] and T60137
1569  for recommendations for alternative approaches based on how developers
1570  previously used this hook.
1571* SkinTemplateToolboxEnd hook has been deprecated. Use SidebarBeforeOutput hook
1572  instead.
1573* Using Skin::addToBodyAttributes() method to add body attributes has been
1574  deprecated. Use OutputPageBodyAttributes hook instead.
1575* Installer::getDBTypes has been hard deprecated in favor of
1576  InstallerDBSupport::getDatabases
1577* The hooks BeforeHttpsRedirect, CanIPUseHTTPS and UserRequiresHTTPS were
1578  deprecated, as part of a long-term plan to remove support for mixed
1579  HTTP/HTTPS wikis.
1580* Skin::generateDebugHTML() has been hard deprecated. Call
1581  MWDebug::getHTMLDebugLog() directly.
1582* ExternalStoreDB::getSlave(), soft deprecated in 1.34, was hard deprecated.
1583  Use ExternalStoreDB::getReplica() instead.
1584* Less variables in mediawiki.ui/variables.less file that don't follow the
1585  standard variable naming scheme (compare WikimediaUI Base) including
1586  `@colorGray* variables have been deprecated. New variables are in place and
1587  aliases have been set. Replace occurrences and use the new variables instead.
1588
1589=== Other changes in 1.35 ===
1590* A new maintenance script is added (purgeExpiredWatchlistItems.php) with which
1591  to delete expired watchlist items. These items will also be deleted during
1592  wiki editing if $wgWatchlistPurgeRate is > 0. This maintenance script only
1593  has effect if $wgWatchlistExpiry is true. It is recommended that a cronjob or
1594  similar be set up to run it at least daily.
1595* Title::purgeSquid is deprecated. Use MediaWikiServices::getHtmlCacheUpdater.
1596* SpecialVersion::getExtLicenseFileName() has been deprecated, use
1597  MediaWiki\ExtensionInfo::getLicenseFileNames() instead.
1598* SpecialVersion::getExtAuthorsFileName() has been deprecated, use
1599  MediaWiki\ExtensionInfo::getAuthorsFileName() instead.
1600* Migration to the new content storage schema is complete, all backwards
1601  compatibility code and duplication in the database have been removed.
1602  The old schema was a 1:1 relationship modeled by
1603  revision.text_id -> text.old_id. The new schema is a n:m relationship,
1604  revision.rev_id <- slots.slot_revision_id|slots.slot_content_id ->
1605  content.content_id|content.content_address -> text.old_id. The same applies
1606  to the archive table.
1607  The following fields were removed:
1608  - revision.rev_text_id, replaced by content.content_address
1609  - revision.rev_content_model, replaced by content.content_model,
1610    referencing content_models.model_id
1611  - revision.rev_content_format, replaced by automatic detecting in
1612    ContentHandler
1613  - archive.ar_text_id, replaced by content.content_address
1614  - archive.ar_content_model, replaced by content.content_model,
1615    referencing content_models.model_id
1616  - archive.ar_content_format, replaced by automatic detecting in
1617    ContentHandler
1618* Migration to normalized storage of edit comments and user names is
1619  progressing. The following fields were unused and have been removed:
1620  - revision.rev_comment,
1621    replaced by rev_comment_id referencing comment.comment_id.
1622  - revision.rev_user and rev_user_text,
1623    replaced by rev_actor referencing actor.actor_id.
1624  Note that archive.ar_user, archive.ar_user_text, and archive.ar_comment
1625  had already been removed in previous releases.
1626* The printableversion has been marked as deprecated per T167956.
1627* (T30162, T245387) The installer supports using a Postgres server running
1628  on a custom port other than 5432.
1629
1630= MediaWiki 1.34 =
1631
1632== MediaWiki 1.34.4 ==
1633
1634This is a maintenance release of the Mediawiki 1.34 branch.
1635
1636=== Changes since MediaWiki 1.34.3 ===
1637* Fixed issue relating to backporting of changes for T260485.
1638
1639== MediaWiki 1.34.3 ==
1640
1641This is a security and maintenance release of the MediaWiki 1.34 branch.
1642
1643=== Changes since MediaWiki 1.34.2 ===
1644* In the web installer, use secure session cookies.
1645* Make UsersPager::requestedGroup public.
1646* (T257407) Split patch-drop-user-fields.sql into patch per table.
1647* (T257356) Split patch-drop-comment-fields.sql into patch per table.
1648* (T257997) Undeprecate WebInstaller::getInfoBox().
1649* Added $wgForceHTTPS, which makes the HTTP to HTTPS redirect be unconditional
1650  and suppresses various hacks needed to support mixed HTTP/HTTPS wikis. We
1651  recommend this be set to true on pure HTTPS wikis.
1652* Added $wgCookieSameSite, which allows login cookies to be sent with
1653  SameSite=None. This is required for cross-site CentralAuth autologin after
1654  Chrome 84.
1655* Added $wgUseSameSiteLegacyCookies, which adds a compatibility hack to
1656  SameSite=None cookies for browsers which implemented an incompatible draft
1657  version of the specification.
1658* (T257207) shell: Expand documentation in firejail.profile.
1659* (T246135) Give the "remember me" checkbox a specific CSS class so skins
1660  like Minerva can only hide that checkbox.
1661* (T256287) rdbms: improve DBConnRef domain selection exception message.
1662* (T248191, T259123) phpunit: Acknowledge known dberror from
1663  SpecialPageFatalTest.
1664* (T256394, T259123) Cleanup up excess commit() call in LocalRepoTest.
1665* Fix runBatchedQuery.php for no result from select.
1666* (T130906) Add Edge to MediaWiki:Clearyourcache.
1667* (T249521) reassignEdits: Update script to use User::newFromName for anon
1668  users.
1669* (T172060) GlobalFunctions: Use php_uname instead of posix_uname.
1670* Use IPset in MWRestrictions::checkIP.
1671* (T260031) Add application/font-sfnt to MimeMap for ttf files.
1672* shell: Make ->restrict( RESTRICT_NONE ) actually work.
1673* (T183759) Fixes shell edge-cases in Windows.
1674* (T258390) Add CentralIdLookup::factoryNonLocal().
1675* (T246991) User: Fix pingLimiter() to use makeGlobalKey() for global rate
1676  limits.
1677* (T232568, CVE-2020-25813) SECURITY: Special:UserRights exposes the existence
1678  of hidden users.
1679* (T251661, CVE-2020-25827) SECURITY: User::pingLimiter: add user-global rate
1680  limit type.
1681* (T246991) User: enforce pingLimiter() expiry time.
1682* (T260232) don't include null page ids in query list for category dumps.
1683* (T251506) Sanitizer: Truncate IDs to a reasonable length.
1684* (T262900) Fix failure of rebuildLocalisationCache.php due to RL hook.
1685* Explicitly wrap some XML calls in libxml_disable_entity_loader().
1686* (T263455 T247285) Set EnableJavaScriptTest to true in
1687  includes/DevelopmentSettings.php.
1688* (T232568, CVE-2020-25813) SECURITY: SpecialUserrights: If a viewer lacks
1689  `hideuser`, ignore hidden users.
1690* (T255918, CVE-2020-25812) SECURITY: Unescaped message used in HTML on
1691  Special:Contributions.
1692* (T256171, CVE-2020-25815) SECURITY: Unescaped message used in HTML within
1693  LogEventsList.
1694* (T258763, CVE-2020-17367, CVE-2020-17368) SECURITY: Prevent invoking
1695  firejail's --output functionality.
1696* (T86738, CVE-2020-25814) SECURITY: mediawiki.jqueryMsg: Sanitize URLs and
1697  'style' attribute.
1698* (T115888, CVE-2020-25828) SECURITY: mediawiki.js: Escape HTML in
1699  mw.message( ... ).parse().
1700* (T260485, CVE-2020-25869) SECURITY: ActorMigration: Load user from the correct
1701  database.
1702* (T260485, CVE-2020-25869) SECURITY: ensure actor ID from correct wiki is used.
1703
1704== MediaWiki 1.34.2 ==
1705
1706This is a security and maintenance release of the MediaWiki 1.34 branch.
1707
1708=== Changes since MediaWiki 1.34.1 ===
1709* (T247017) PasswordReset performance improvements.
1710* The MultiHttpClient code will fallover to non-curl if curl_multi* is blocked.
1711* (T250568) Work around change in SimpleXMLElement behavior introduced in PHP
1712  7.3.17.
1713* (T251789) Let $wgResourceLoaderMaxQueryLength=-1 fallback to default.
1714* Remove some rotten and out of date documentation.
1715* (T252311) Improvements to some older SQLite update patches.
1716* (T240307) Minor fixes to extension.schema.v2.json and
1717  extension.schema.v1.json.
1718* (T238043) cleanupUsersWithNoId.php: Handle missing fields.
1719* (T199474) Set rc_patrolled to 2 for autopatrolled changes in
1720  rebuildrecentchanges.php.
1721* (T229461) Update the change_tag table in rebuildrecentchanges.php.
1722* (T249730) Password Reset Updates.
1723* (T234450) Per-user concurrency in SpecialContributions can now be limited by
1724  setting $wgPoolCounterConf['SpecialContributions'] appropriately.
1725* (T248947) SECURITY: img_auth.php may leak private extension images into the
1726  public cache.
1727
1728== MediaWiki 1.34.1 ==
1729
1730This is a security and maintenance release of the MediaWiki 1.34 branch.
1731
1732=== Changes since MediaWiki 1.34.0 ===
1733* (T211450) User: better error message when getActorId fails.
1734* (T241340) Don't redefine MW_ENTRY_POINT in thumb.php if already defined.
1735* (T236444) User: Allow newSystemUser() to create over anonymous actors.
1736* (T238483) Fix NewPagesPager "hide registered users" option.
1737* (T245072) mediawiki.language: Rename languageData back to languageNames.
1738* Use proper SemVer comparison in CheckComposerLockUpToDate.
1739* (T212738) Add the MW_VERSION constant, global $wgVersion is soft deprecated.
1740* (T246127) Fix error when initialising updateCollation.php.
1741* Update comment about PHP versions supported by The PHP Group.
1742* (T247215) Fix output of RecountCategories::doWork().
1743* Add check for page existence to view.php maintenance script.
1744* (T245149) Fix fetching login token from action=query&meta=tokens on private
1745  wikis.
1746* (T236509) SECURITY: Fix HTML escaping in UserGroupMembership::getLink().
1747* (T232932) SECURITY: User content can redirect the logout button to different
1748  URL.
1749* (T246602) SECURITY: jquery.makeCollapsible allows applying event handler to
1750  any CSS selector.
1751
1752== MediaWiki 1.34.0 ==
1753
1754=== Changes since MediaWiki 1.34.0-rc.1 ===
1755* $wgDiffEngine (T237049) – This configuration can be used to specify which
1756  difference engine to use. MediaWiki continues to default to automatically
1757  choosing the first of $wgExternalDiffEngine, wikidiff2, or php that is
1758  usable.
1759* (T231866) SqlBlobStore no longer needs Language object.
1760* (T236735) WikiExporter: Remove unnecessary check for SCHEMA_COMPAT_WRITE_OLD
1761  flag.
1762* (T231673) Set MCR migration stage to SCHEMA_COMPAT_NEW.
1763* (T229601) Make sure DBLoadBalancerFactory service is not disabled.
1764* (T232866) Fix support for HTTP/2 in MultiHttpClient.
1765* (T231866) LocalisationCache: Don't instantiate ResourceLoader.
1766* (T227461) Stop calling deprecated Redis delete functions.
1767* (T239561) Mark options as requiring parameters in addSite.php.
1768* (T232866) Mimic CURLOPT_POST in GuzzleHttpRequest.
1769* (T239734) Replace deprecated lSize with lLen in Redis code.
1770* (T192134) SECURITY: Do not allow user scripts on Special:PasswordReset.
1771* (T239428) ApiEditPage: Test for bad redirect targets.
1772* (T233342) rdbms: Log debug message traces as 'exception.trace' instead of
1773  'trace'.
1774* (T226751) media: Log and fail gracefully on invalid EXIF coordinates.
1775* (T240924) NewPagesPager: Fix namespace query conditions.
1776* (T212067) Tests for an old PHP bug in parse_url.
1777
1778== MediaWiki 1.34.0-rc.1 ==
1779
1780=== Changes since MediaWiki 1.34.0-rc.0 ===
1781* (T231742) rdbms: Restore debug toolbar "Queries" feature.
1782* (T231366) The ProfilerOutputDb class, 'profiling' table, and profileinfo.php
1783  entry point had been deprecated.
1784* (T234361) localisation: Add debug message for backend of MessageCache.
1785* (T234361) session: Add debug message for the used store class.
1786* (T235559) Fix example Kask configuration in RESTBagOStuff class comment.
1787* (T235137) Don't apply styling for Special:Contributions on other pages.
1788* Upgrade mediawiki-codesniffer from 26.0.0 to 28.0.0 (dev-only).
1789* (T219604) The "jquery.ui.*" and "jquery.effects.*" modules are now
1790  deprecated as aliases for the "jquery.ui" module.
1791* (T235392) Deprecate setting Parser::mTitle to null.
1792* Supporting commits for T235392 were also backported to prevent divergence
1793  from master (MediaWiki 1.35).
1794* (T234581) The 'jquery.tabIndex' module is deprecated.
1795* Fix docs for GetUserBlock hooks.
1796* Parser: Hard deprecate getConverterLanguage.
1797* (T236810) A number of public methods of Parser were exposed only for
1798  historical reasons and have been deprecated: doMagicLinks,
1799  doDoubleUnderscore, doHeadings, doAllQuotes, replaceExternalLinks,
1800  replaceInternalLinks, replaceInternalLinks2, getVariableValue,
1801  initialiseVariables, formatHeadings, testPst, testPreprocess, testSrvus,
1802  areSubpagesAllowed, maybeDoSubpageLink, splitWhitespace, createAssocArgs,
1803  armorLinks, makeKnownLinkHolder, getImageParams, parseLinkParameter,
1804  stripAltText, replaceLinkHolders, replaceLinkHoldersText, armorLinks,
1805  makeKnownLinkHolder, getImageParams, parseLinkParameter, stripAltText.
1806* (T30798) $wgServer must now always be set in LocalSettings.php. This is most
1807  likely the case already for any wiki installed after 1.18. The autodetection
1808  system was informally deprecated since 1.18 and vulnerable to cache poisoning
1809  attacks. Older wikis may need to update their LocalSettings.php file.
1810* (T232169) Hard deprecate $wgSysopEmailBans.
1811* (T236628) Fix for ArticleRevisionViewCustom hook in DifferenceEngine.php.
1812* (T181658) Do not insert page titles into querycache.qc_value.
1813* ParamValidator has been flagged as unstable.
1814* Hard deprecate Parser::disableCache().
1815
1816== MediaWiki 1.34.0-rc.0 ==
1817
1818== Upgrading notes for 1.34 ==
18191.34 has several database changes since 1.33, and will not work without schema
1820updates. Note that due to changes to some very large tables like the revision
1821table, the schema update may take quite long (minutes on a medium sized site,
1822many hours on a large site).
1823
1824Don't forget to always back up your database before upgrading!
1825
1826See the file UPGRADE for more detailed upgrade instructions, including
1827important information when upgrading from versions prior to 1.11.
1828
1829Some specific notes for MediaWiki 1.34 upgrades are below:
1830
1831* MediaWiki now requires PHP 7.2.9 or above.
1832* MediaWiki no longer supports HHVM.
1833
1834For notes on 1.33.x and older releases, see HISTORY.
1835
1836=== Configuration changes for system administrators in 1.34 ===
1837
1838In an effort to enforce best practices for passwords, MediaWiki will now warn
1839users, and suggest that they change their password, if it is in the list of
1840100,000 commonly used passwords that are considered bad passwords. If you want
1841to disable this for your users, please add the following to your local settings:
1842
1843$wgPasswordPolicy['policies']['default']['PasswordNotInLargeBlacklist'] = false;
1844
1845==== New configuration ====
1846* $wgAllowExternalReqID (T201409) - This configuration setting controls whether
1847  Mediawiki accepts the request ID set by the incoming request via the
1848  `X-Request-Id` header. If set to `true`, that value will be used throughout
1849  the code as the request identificator. Otherwise, the sent header will be
1850  ignored and the request ID will either be taken from Apache's mod_unique
1851  module or will be generated by Mediawiki itself (depending on the set-up).
1852* $wgEnableSpecialMute (T218265) - This configuration controls whether
1853  Special:Mute is available and whether to include a link to it on emails
1854  originating from Special:Email.
1855* editmyuserjsredirect user right – users without this right now cannot edit JS
1856  redirects in their userspace unless the target of the redirect is also in
1857  their userspace. By default, this right is given to everyone.
1858* (T226733) Add rate limiter to Special:ConfirmEmail.
1859* $wgDiffEngine (T237049) – This configuration can be used to specify which
1860  difference engine to use. MediaWiki continues to default to automatically
1861  choosing the first of $wgExternalDiffEngine, wikidiff2, or php that is
1862  usable.
1863
1864==== Changed configuration ====
1865* $wgUseCdn, $wgCdnServers, $wgCdnServersNoPurge, and $wgCdnMaxAge – These four
1866  CDN-related config variables have been renamed from being specific to Squid –
1867  they were previously $wgUseSquid, $wgSquidServers, $wgSquidServersNoPurge, and
1868  $wgSquidMaxage respectively. This aligns them with the related existing
1869  variable $wgCdnMaxageLagged. The previous configuration variable names are
1870  deprecated, but will be used as the fall back if they are still set.
1871  Note that wgSquidPurgeUseHostHeader has not been renamed, as it is deprecated.
1872* (T27707) File type checks for image uploads have been relaxed to allow files
1873  containing some HTML markup in metadata. As a result, the $wgAllowTitlesInSVG
1874  setting is no longer applied and is now always true. Note that MSIE 7 may
1875  still be able to misinterpret certain malformed PNG files as HTML.
1876* (T30798) $wgServer must now always be set in LocalSettings.php. This is most
1877  likely the case already for any wiki installed after 1.18. The autodetection
1878  system was informally deprecated since 1.18 and vulnerable to cache poisoning
1879  attacks. Older wikis may need to update their LocalSettings.php file.
1880* Introduced $wgVerifyMimeTypeIE to allow disabling the MSIE 6/7 file type
1881  detection heuristic on upload, which is more conservative than the checks
1882  that were changed above.
1883* $wgExternalDiffEngine — Setting this to a string value of 'wikidiff',
1884  'wikidiff2', or 'wikidiff3' will no longer work. This legacy behaviour was
1885  deprecated in MediaWiki 1.27, 1.32, and 1.27, respectively.
1886* $wgSkipSkin — Setting this instead of $wgSkipSkins, deprecated in 1.23, is now
1887  hard-deprecated.
1888* $wgLocalInterwiki — Setting this instead of $wgLocalInterwikis, deprecated in
1889  1.23, is now hard-deprecated.
1890* $wgProfileOnly — Setting this, deprecated in 1.23, is now hard-deprecated.
1891  Instead, set the log file in $wgDebugLogGroups['profileoutput'].
1892* $wgProxyList — Setting this to an array with IP addresses in the array keys,
1893  which was deprecated in 1.30, no longer works. Instead, $wgProxyList should be
1894  an array with IP addresses as the values, or a string path to a file
1895  containing one IP address per line.
1896* $wgCookieSetOnAutoblock and $wgCookieSetOnIpBlock are now enabled by default.
1897
1898==== Removed configuration ====
1899* $wgWikiDiff2MovedParagraphDetectionCutoff — If you still want a custom change
1900  size threshold, please specify in php.ini, using the configuration variable
1901  wikidiff2.moved_paragraph_detection_cutoff.
1902* $wgUseESI - This experimental setting, deprecated in 1.33, is now removed.
1903* $wgDebugPrintHttpHeaders - The default of including HTTP headers in the
1904  debug log channel is no longer configurable. The debug log itself remains
1905  configurable via $wgDebugLogFile.
1906* $wgMsgCacheExpiry - The MessageCache uses 24 hours as the expiry for values
1907  stored in WANObjectCache. This is no longer configurable.
1908* $wgPasswordSalt – This setting, used for migrating exceptionally old, insecure
1909  password setups and deprecated since 1.24, is now removed.
1910* $wgDBOracleDRCP - If you must use persistent connections, set DBO_PERSISTENT
1911  in the 'flags' field for servers in $wgDBServers (or $wgLBFactoryConf).
1912* $wgMemCachedDebug - Set the cache "debug" field in $wgObjectCaches instead.
1913* $wgActorTableSchemaMigrationStage has been removed. Extension code for
1914  MediaWiki 1.31+ finding it unset should treat it as being SCHEMA_COMPAT_NEW.
1915
1916=== New user-facing features in 1.34 ===
1917* Special:Mute has been added as a quick way for users to block unwanted emails
1918  from other users originating from Special:EmailUser.
1919* (T207577) Special:NewSection has been created as a shortcut to creating a new
1920  section on a page. When linked to, its subpage is used as the target
1921  ([[Special:NewSection/Test]] redirects to creating a new section in "Test").
1922  Otherwise, it displays a basic interface to allow the end user to specify
1923  the target manually.
1924* (T220447) Special:Contributions/newbies has been removed for performance and
1925  usefulness reasons. Use Special:RecentChanges?userExpLevel=newcomer instead.
1926* Special:NewFiles/newbies has been removed for performance and usefulness
1927  reasons. Use Special:RecentChanges?userExpLevel=newcomer&namespace=6 instead.
1928
1929=== New developer features in 1.34 ===
1930* The ImgAuthModifyHeaders hook was added to img_auth.php to allow modification
1931  of headers in private wikis.
1932* Language::formatTimePeriod now supports the new 'avoidhours' option to output
1933  strings like "5 days ago" instead of "5 days 13 hours ago".
1934* (T220163) Added SpecialMuteModifyFormFields hook to allow extensions
1935  to add fields to Special:Mute.
1936* (T100896) Skin authors can define custom OOUI themes using OOUIThemePaths.
1937  See <https://www.mediawiki.org/wiki/OOUI/Themes> for details.
1938* (T229035) The GetUserBlock hook was added. Use this instead of
1939  GetBlockedStatus.
1940* ObjectFactory is available as a service. When used as a service, the object
1941  specs can now specify needed DI services.
1942* (T222388) Special pages can now be specified as an ObjectFactory spec,
1943  allowing the construction of special pages that require services to be
1944  injected in their constructor.
1945* (T222388) API modules can now be specified as an ObjectFactory spec,
1946  allowing the construction of modules that require services to be injected
1947  in their constructor.
1948* (T117736) The function signature of SpecialContributions::getForm::filters
1949  has changed. It now expects definitions of additional filter fields as array
1950  rather than string.
1951
1952=== External library changes in 1.34 ===
1953
1954==== Changed external libraries ====
1955* Updated Mustache from 1.0.0 to v3.0.1.
1956* Updated OOUI from v0.31.3 to v0.34.0.
1957* Updated OOjs from v2.2.2 to v3.0.0.
1958* Updated composer/semver from 1.4.2 to 1.5.0.
1959* Updated composer/spdx-licenses from 1.4.0 to 1.5.1 (dev-only).
1960* Updated mediawiki/codesniffer from 25.0.0 to 28.0.0 (dev-only).
1961* Updated cssjanus/cssjanus from 1.2.1 to 1.3.0.
1962* Updated wikimedia/at-ease from 1.2.0 to 2.0.0.
1963* Updated wikimedia/remex-html from 2.0.1 to 2.1.0.
1964* Updated monolog/monolog from 1.22.1 to 1.24.0 (dev-only).
1965* Updated wikimedia/object-factory from 1.0.0 to 2.1.0.
1966* Updated wikimedia/timestamp from 2.2.0 to 3.0.0.
1967* Updated wikimedia/xmp-reader from 0.6.2 to 0.6.3.
1968* Updated mediawiki/mediawiki-phan-config from 0.6.0 to 0.6.1 (dev-only).
1969* Updated wikimedia/avro from 1.8.0 to 1.9.0 (dev-only).
1970
1971==== Removed external libraries ====
1972* The jquery.async module, deprecated in 1.33, was removed.
1973
1974=== Bug fixes in 1.34 ===
1975* (T222529) If a log entry or page revision is recorded in the database with an
1976  empty username, attempting to display it will log an error and return a "no
1977  username available" to the user instead of silently displaying nothing or
1978  invalid links.
1979
1980=== Action API changes in 1.34 ===
1981* The 'recenteditcount' response property from action=query list=allusers,
1982  deprecated in 1.25, has been removed.
1983* (T60993) action=query list=filearchive, list=alldeletedrevisions and
1984  prop=deletedrevisions no longer require the 'deletedhistory' user right.
1985* In the response to queries that use 'prop=imageinfo', entries for
1986  non-existing files (indicated by the 'filemissing' field) now omit the
1987  following fields, since they are meaningless in this context:
1988  'timestamp', 'userhidden', 'user', 'userid', 'anon', 'size', 'width',
1989  'height', 'pagecount', 'duration', 'commenthidden', 'parsedcomment',
1990  'comment', 'thumburl', 'thumbwidth', 'thumbheight', 'thumbmime',
1991  'thumberror', 'url', 'sha1', 'metadata', 'extmetadata', 'commonmetadata',
1992  'mime', 'mediadtype', 'bitdepth'.
1993  Clients that process these fields should first check if 'filemissing' is
1994  set. Fields that are supported even if the file is missing include:
1995  'canonicaltitle', 'archivename' (deleted files only), 'descriptionurl',
1996  'descriptionshorturl'.
1997* The 'blockexpiry' result property in list=users and list=allusers will now be
1998  returned in the same format used by the rest of the API: ISO 8601 for
1999  expiring blocks, and "infinite" for non-expiring blocks.
2000
2001=== Action API internal changes in 1.34 ===
2002* The exception thrown in ApiModuleManager::getModule has been changed
2003  from an MWException to an UnexpectedValueException, thrown by ObjectFactory.
2004  ApiModuleManager::getModule now also throws InvalidArgumentExceptions when
2005  ObjectFactory is presented with an invalid spec or incorrectly constructed
2006  objects.
2007* Added ApiQueryBlockInfoTrait.
2008
2009=== Languages updated in 1.34 ===
2010MediaWiki supports over 350 languages. Many localisations are updated regularly.
2011Below only new and removed languages are listed, as well as changes to languages
2012because of Phabricator reports.
2013
2014* (T152908) Added language support for N'Ko (nqo).
2015
2016=== Breaking changes in 1.34 ===
2017* The global functions wfSuppressWarnings and wfRestoreWarnings, deprecated in
2018  1.26, have been removed. Use Wikimedia\AtEase\AtEase::suppressWarnings() and
2019  Wikimedia\AtEase\AtEase::restoreWarnings() directly.
2020* Preferences class, deprecated in 1.31, has been removed.
2021* The following parts of code, deprecated in 1.32, were removed in favor of
2022  built-in PHP functions:
2023  * CryptRand class
2024  * CryptRand service
2025  * Functions of the MWCryptRand class: singleton(), wasStrong() and generate().
2026* Various Special Page PHP Classes were renamed (mostly casing changes):
2027  * SpecialAncientpages => SpecialAncientPages
2028  * SpecialConfirmemail => SpecialConfirmEmail
2029  * SpecialDeadendpages => SpecialDeadendPages
2030  * SpecialFewestrevisions => SpecialFewestRevisions
2031  * SpecialListredirects => SpecialListRedirects
2032  * SpecialLonelypages => SpecialLonelyPages
2033  * SpecialLongpages => SpecialLongPages
2034  * SpecialMIMEsearch => SpecialMIMESearch
2035  * SpecialMostcategories => SpecialMostCategories
2036  * SpecialMostinterwikis => SpecialMostInterwikis
2037  * SpecialMostlinked => SpecialMostLinked
2038  * SpecialMostlinkedcategories => SpecialMostLinkedCategories
2039  * SpecialMostlinkedtemplates => SpecialMostLinkedTemplates
2040  * SpecialMostrevisions => SpecialMostRevisions
2041  * SpecialNewimages => SpecialNewFiles
2042  * SpecialShortpages => SpecialShortPages
2043  * SpecialUncategorizedcategories => SpecialUncategorizedCategories
2044  * SpecialUncategorizedimages => SpecialUncategorizedImages
2045  * SpecialUncategorizedpages => SpecialUncategorizedPages
2046  * SpecialUncategorizedtemplates => SpecialUncategorizedTemplates
2047  * SpecialUnusedcategories => SpecialUnusedCategories
2048  * SpecialUnusedimages => SpecialUnusedImages
2049  * SpecialUnusedtemplates => SpecialUnusedTemplates
2050  * SpecialUnwatchedpages => SpecialUnwatchedPages
2051  * SpecialWantedcategories => SpecialWantedCategories
2052  * SpecialWantedtemplates => SpecialWantedTemplates
2053  * SpecialWithoutinterwiki => SpecialWithoutInterwiki
2054* Language::setCode, deprecated in 1.32, was removed. Use Language::factory to
2055  create a new Language object with a different language code.
2056* MWNamespace::clearCaches() has been removed.  So has the $rebuild parameter
2057  to MWNamespace::getCanonicalNamespaces(), which was deprecated since 1.31.
2058  Instead, reset services, such as by calling $this->overrideMwServices() (if
2059  your test extends MediaWikiTestCase). Services will generally not pick up
2060  configuration changes from after they were created, so you must reset
2061  services after any configuration change. Even if your code works now, it is
2062  likely to break in future versions as more code is moved to services.
2063* The ill-defined "DatabaseOraclePostInit" hook has been removed.
2064* PreferencesFormLegacy and PreferencesForm classes, deprecated in 1.32, have
2065  been removed.
2066* ObjectFactory class, deprecated in 1.31, has been removed.
2067* HWLDFWordAccumudlator class, deprecated in 1.28, has been removed.
2068* XMPInfo, XMPReader and XMPValidate, deprecated in 1.32, have been removed.
2069* The RedirectSpecialPage::execute method could sometimes return a Title object.
2070  This behavior was removed, and the method now matches the parent signature
2071  (SpecialPage::execute) which is to return HTML string or void.
2072  To obtain the destination title, use RedirectSpecialPage::getRedirect.
2073* The 'recenteditcount' response property from action API action=query
2074  list=allusers, deprecated in 1.25, has been removed.
2075* SearchEngine::userNamespaces(), SearchEngine::namespacesAsText(),
2076  SearchEngine::create(), SearchEngine::getSearchTypes() and
2077  SearchEngine::getNearMatch(), methods deprecated in 1.27, have been removed.
2078* FileRepo::streamFile(), deprecated in 1.26, has been removed.
2079* User::randomPassword() method, deprecated in 1.27, have been removed.
2080* MWNamespace::canTalk(), deprecated in 1.30, have been removed.
2081* Parser class property $mUniqPrefix, deprecated in 1.26, has been removed.
2082* wfArrayFilter() and wfArrayFilterByKey(), deprecated in 1.32, have been
2083  removed.
2084* wfMakeUrlIndexes() function, deprecated in 1.33, have been removed.
2085* Method signatures in WatchedItemQueryServiceExtension have changed from taking
2086  User objects to taking UserIdentity objects. Extensions implementing this
2087  interface need to be changed accordingly.
2088* User::getGroupPage() and ::makeGroupLinkHTML(), deprecated in 1.29, have been
2089  removed. Use UserGroupMembership::getGroupPage and ::getLink instead.
2090* User::makeGroupLinkWiki(), deprecated in 1.29, has been removed. Use
2091  UserGroupMembership::getLink() instead.
2092* SavepointPostgres, deprecated in 1.31, has been removed.
2093* OutputPage::enableSectionEditLinks(), OutputPage::sectionEditLinksEnabled(),
2094  ParserOptions::getEditSection(), ParserOptions::setEditSection(), and
2095  ParserOutput::getEditSectionTokens, ::getTOCEnabled, ::setEditSectionTokens,
2096  and ::setTOCEnabled, deprecated in 1.31, have been removed.
2097* EditPage::safeUnicodeInput() and ::safeUnicodeOutput(), deprecated in 1.30,
2098  have been removed.
2099* Four methods in OutputPage, deprecated in 1.32, have been removed. You should
2100  use OutputPage::showFatalError or throw a FatalError instead. The methods are
2101  ::showFileCopyError(), ::showFileRenameError(), ::showFileDeleteError(), and
2102  ::showFileNotFoundError().
2103* ApiBase::truncateArray(), deprecated in 1.32, has been removed.
2104* IcuCollation::getICUVersion(), deprecated in 1.32, has been removed. Use PHP's
2105  INTL_ICU_VERSION constant directly.
2106* HTMLForm::setSubmitProgressive(), deprecated in 1.32, has been removed.
2107* ResourceLoaderStartUpModules::getStartupModules() and ::getLegacyModules(),
2108  both deprecated in 1.32, have been removed.
2109* BaseTemplate::msgHtml() and QuickTemplate::msgHtml(), deprecated in 1.32, have
2110  been removed. Use ->msg() or ->getMsg() instead.
2111* WatchAction::getUnwatchToken(), deprecated in 1.32, has been removed. Instead,
2112  use WatchAction::getWatchToken() with action 'unwatch' directly.
2113* Language::initEncoding(), ::recodeForEdit(), and recodeInput(), deprecated in
2114  1.28, have been removed.
2115* PageArchive::getTextFromRow(), ::listAllPages(), and ::getLastRevisionText(),
2116  deprecated in 1.32, have been removed.
2117* OutputPage::getModuleScripts(), ParserOutput::getModuleScripts(), deprecated
2118  in 1.33, have been removed.
2119* User::getPasswordValidity(), deprecated in 1.33, has been removed.
2120* ApiQueryBase::prepareUrlQuerySearchString(), deprecated in 1.33, has been
2121  removed.
2122* ChangeTags::purgeTagUsageCache(), deprecated in 1.33, has been removed.
2123* JobQueueGroup::pushLazyJobs(), deprecated in 1.33, has been removed.
2124* MediaWikiTestCase::stashMwGlobals(), deprecated in 1.32, has been removed.
2125* SearchEngine::transformSearchTerm(), deprecated in 1.32, has been removed.
2126* The Block typehint only refers to blocks stored in the database. It should be
2127  updated to AbstractBlock in cases where any type of block could be expected.
2128* FileRepoStatus, deprecated in 1.25, has been removed.
2129* The LegacyHookPreAuthenticationProvider class, deprecated since its creation
2130  in 1.27, has been removed.
2131* IP::isValidBlock(), deprecated in 1.30, has been removed.
2132* WikiPage::prepareContentForEdit now doesn't accept an integer for $revision,
2133  was deprecated in 1.25.
2134* The jquery.byteLength module, deprecated in 1.31, was removed.
2135  Use the mediawiki.String module instead.
2136* mw.language.specialCharacters, deprecated in 1.33, has been removed.
2137  Use require( 'mediawiki.language.specialCharacters' ) instead.
2138* The jquery.colorUtil module was removed. Use jquery.color instead.
2139* The jquery.checkboxShiftClick module was removed. The functionality
2140  is provided by mediawiki.page.ready instead (T232688).
2141* The 'jquery.accessKeyLabel' module has been removed. This jQuery
2142  plugin now ships as part of the 'mediawiki.util' module bundle.
2143* EditPage::submit(), deprecated in 1.29, has been removed. Use $this->edit()
2144  directly.
2145* HTMLForm::getErrors(), deprecated in 1.28, has been removed. Use
2146  getErrorsOrWarnings() instead.
2147* SpecialPage::getTitle(), deprecated in 1.23, has been removed. Use
2148  SpecialPage::getPageTitle() instead.
2149* jquery.ui.effect-bounce, jquery.ui.effect-explode, jquery.ui.effect-fold
2150  jquery.ui.effect-pulsate, jquery.ui.effect-slide, jquery.ui.effect-transfer,
2151  which are no longer used, have now been removed.
2152* SpecialEmailUser::validateTarget(), ::getTarget() without a sender/user
2153  specified, deprecated in 1.30, have been removed.
2154* BufferingStatsdDataFactory::getBuffer(), deprecated in 1.30, has been removed.
2155* The constant DB_SLAVE, deprecated in 1.28, has been removed. Use DB_REPLICA.
2156* The constants NS_IMAGE and NS_IMAGE_TALK, deprecated in 1.14, have been
2157  removed. Use NS_FILE and NS_FILE_TALK respectively.
2158* Replacer, DoubleReplacer, HashtableReplacer and RegexlikeReplacer
2159  (deprecated in 1.32) have been removed. Closures should be used instead.
2160* OutputPage::addWikiText(), ::addWikiTextWithTitle(), ::addWikiTextTitleTidy(),
2161  ::addWikiTextTidy(), ::addWikiTextTitle(), deprecated in 1.32, have been
2162  removed.
2163* The $wgUseKeyHeader configuration option and the OutputPage::getKeyHeader()
2164  method, deprecated in 1.32, have been removed.
2165* WebInstallerOutput::addWikiText(), deprecated in 1.32, has been removed.
2166* Parser::fetchFile(), deprecated in 1.32, has been removed. Use the method
2167  Parser::fetchFileAndTitle() instead.
2168* The global function wfBCP47, deprecated in 1.31, has been removed.
2169* wfCountDown() function, deprecated in 1.31, has been removed. Use
2170  \Maintenance::countDown() method instead.
2171* OutputPage::wrapWikiMsg() no longer accepts an options parameter. This was
2172  deprecated since 1.20.
2173* Skin::outputPage() no longer accepts a context. This was deprecated in 1.20.
2174* Linker::link() no longer accepts a string for the query array, as was
2175  deprecated in 1.20.
2176* PrefixSearch::titleSearch(), deprecated in 1.23, has been removed. Use the
2177  SearchEngine::defaultPrefixSearch or ::completionSearch() methods instead.
2178* The UserRights hook, deprecated in 1.26, has been removed. Instead, use the
2179  UserGroupsChanged hook.
2180* Skin::getDefaultInstance(), deprecated in 1.27, has been removed. Get the
2181  instance from MediaWikiServices instead.
2182* The UserLoadFromSession hook, deprecated in 1.27, has been removed.
2183* The wfResetSessionID global function, deprecated in 1.27, has been removed.
2184  Use MediaWiki\Session\SessionManager instead.
2185* The wfGetLBFactory global function, deprecated in 1.27, has been removed.
2186  Use MediaWikiServices::getInstance()->getDBLoadBalancerFactory().
2187* The internal method OutputPage->addScriptFile() will no longer silently drop
2188  calls that use an invalid path (i.e., something other than an absolute path,
2189  protocol-relative URL, or full scheme URL), and will instead pass them to the
2190  client where they will likely 404. This usage was deprecated in 1.24.
2191* Database::reportConnectionError, deprecated in 1.32, has been removed.
2192* APIEditBeforeSave hook, deprecated in 1.28, has been removed. Please see
2193  EditFilterMergedContent hook for an alternative way to use this feature.
2194* API module methods getDescription(), getParamDescription(), & getExamples(),
2195  all deprecated in 1.25 and ignored, have been removed.
2196* The API module method getDescriptionMessage(), deprecated in 1.30, has been
2197  removed.
2198* The JavaScript global variable wgLoadScript has been removed. Use
2199  mw.util.wikiScript( 'load' ) instead.
2200* ResourceLoader no longer creates the 'mw.legacy' placeholder object. It has
2201  been unused since 1.16 and was deprecated in 1.22. To deprecate a property
2202  in JavaScript, use mw.log.deprecate() instead.
2203* The 'user.groups' module, deprecated in 1.28, was removed.
2204  Use the 'user' module instead.
2205* The ResourceLoaderContext::expandModuleNames method, deprecated in 1.33, was
2206  removed. Use ResourceLoader::expandModuleNames instead.
2207* The ability to override User::$mRights has been removed. Use
2208  PermissionManager::addTemporaryUserRights() instead.
2209* Previously, when iterating ResultWrapper with foreach() or a similar
2210  construct, the range of the index was 1..numRows. This has been fixed to be
2211  0..(numRows-1).
2212* The ChangePasswordForm hook, deprecated in 1.27, has been removed. Use the
2213  AuthChangeFormFields hook or security levels instead.
2214* WikiMap::getWikiIdFromDomain(), deprecated in 1.33, has been removed.
2215  Use WikiMap::getWikiIdFromDbDomain() instead.
2216* The config variables $wgHtml5, $wgJsMimeType, and $wgXhtmlDefaultNamespace,
2217  which were deprecated and ignored by core since 1.22, are no longer set to any
2218  value, and SkinTemplate no longer emits a 'jsmimetype' key. Any extensions not
2219  updated since 2013 to cope with this deprecation may now break.
2220* (T222637) Passing ResourceLoaderModule objects to ResourceLoader::register()
2221  or $wgResourceModules is no longer supported.
2222  Use the 'class' or 'factory' option of the array format instead.
2223* The parameter $lang of the functions generateTOC and tocList in Linker and
2224  DummyLinker must be in type Language when present. Other types are
2225  deprecated since 1.33.
2226* The static properties mw.Api.errors and mw.Api.warnings, deprecated in 1.29,
2227  have been removed.
2228* ParserOption::getSpeculativeRevIdCallback(), deprecated in 1.28, has been
2229  removed.
2230* The UploadVerification hook, deprecated in 1.28, has been removed. Instead,
2231  use the UploadVerifyFile hook.
2232* UploadBase:: and UploadFromChunks::stashFileGetKey() and stashSession(),
2233  deprecated in 1.28, have been removed. Instead, please use the getFileKey()
2234  method on the response from doStashFile().
2235* LBFactory::setDomainPrefix() and LoadBalancer::setDomainPrefix(), deprecated
2236  in 1.33, have been removed. Use setLocalDomainPrefix() instead.
2237* IDatabase::implicitGroupby(), deprecated in 1.30, has been removed.
2238* IDatabase::doneWrites(), deprecated in 1.31, has been removed.
2239  Use IDatabase::lastDoneWrites() instead.
2240* Database::reportConnectionError(), deprecated in 1.32, has been removed.
2241* LoadBalancer::laggedSlaveUsed(), deprecated in 1.28, has been removed.
2242  Use LoadBalancer::laggedReplicaUsed() instead.
2243* Database::getProperty(), deprecated in 1.28, has been removed.
2244* IDatabase::getWikiId(), deprecated in 1.30, has been removed.
2245  Use IDatabase::getDomainID() instead.
2246* (T191231) Support for using Oracle or MSSQL as database backends has been
2247  dropped.
2248* MessageCache::destroyInstance() has been removed. Instead, call
2249  MediaWikiTestCase::resetServices().
2250* SearchResult protected field $searchEngine is removed and no longer
2251  initialized after calling SearchResult::initFromTitle().
2252* The UserIsBlockedFrom hook is only called if a block is found first, and
2253  should only be used to unblock a blocked user.
2254* Parameters for index.php from PATH_INFO, such as the title, are no longer
2255  written to $_GET.
2256* The selectFields() methods on classes LocalFile, ArchivedFile, OldLocalFile,
2257  DatabaseBlock, and RecentChange, deprecated in 1.31, have been removed. Use
2258  the corresponding getQueryInfo() methods instead.
2259* The following methods on Revision, deprecated since 1.31, have been removed.
2260  Use RevisionStore::getQueryInfo() or RevisionStore::getArchiveQueryInfo()
2261  instead.
2262  * Revision::userJoinCond()
2263  * Revision::pageJoinCond()
2264  * Revision::selectFields()
2265  * Revision::selectArchiveFields()
2266  * Revision::selectTextFields()
2267  * Revision::selectPageFields()
2268  * Revision::selectUserFields()
2269* User::setNewpassword(), deprecated in 1.27 has been removed.
2270* The ObjectCache::getMainWANInstance and ObjectCache::getMainStashInstance
2271  functions, deprecated since 1.28, have been removed.
2272* Language::$dataCache has been removed (without prior deprecation, for
2273  practical reasons). Use MediaWikiServices instead to get a LocalisationCache.
2274
2275=== Deprecations in 1.34 ===
2276* The MWNamespace class is deprecated. Use NamespaceInfo.
2277* ExtensionRegistry->load() is deprecated, as it breaks dependency checking.
2278  Instead, use ->queue().
2279* User::isBlocked() is deprecated since it does not tell you if the user is
2280  blocked from editing a particular page. Use User::getBlock() or
2281  PermissionManager::isBlockedFrom() or PermissionManager::userCan() instead.
2282* User::isLocallyBlockedProxy and User::inDnsBlacklist are deprecated and moved
2283  to the BlockManager as private helper methods.
2284* User::isDnsBlacklisted is deprecated. Use BlockManager::isDnsBlacklisted
2285  instead.
2286* The Config argument to ChangesListSpecialPage::checkStructuredFilterUiEnabled
2287  is deprecated. Pass only the User argument.
2288* WatchedItem::getUser is deprecated. Use getUserIdentity.
2289* Passing a Title as the first parameter to the getTimestampById method of
2290  RevisionStore is deprecated. Omit it, passing only the remaining parameters.
2291* Title::getPreviousRevisionId and Title::getNextRevisionId are deprecated. Use
2292  RevisionLookup::getPreviousRevision and RevisionLookup::getNextRevision.
2293* The Title parameter to RevisionLookup::getPreviousRevision and
2294  RevisionLookup::getNextRevision is deprecated and should be omitted.
2295* MWHttpRequest::factory is deprecated. Use HttpRequestFactory.
2296* The Http class is deprecated. For the request, get, and post methods, use
2297  HttpRequestFactory. For isValidURI, use MWHttpRequest::isValidURI.  For
2298  getProxy, use (string)$wgHTTPProxy. For createMultiClient, construct a
2299  MultiHttpClient directly.
2300* Http::$httpEngine is deprecated and has no replacement. The default 'guzzle'
2301  engine will eventually be made the only engine for HTTP requests.
2302* RepoGroup::singleton(), RepoGroup::destroySingleton(),
2303  RepoGroup::setSingleton(), wfFindFile(), and wfLocalFile() are all
2304  deprecated. Use MediaWikiServices instead.
2305* The getSubjectPage, getTalkPage, and getOtherPage of Title are deprecated.
2306  Use NamespaceInfo's getSubjectPage, getTalkPage, and getAssociatedPage.
2307* MWMessagePack class, no longer used, has been deprecated in 1.34.
2308* The Block class is separated into DatabaseBlock (for blocks stored in the
2309  database), and SystemBlock (for temporary blocks created by the system).
2310  SystemBlock should be used when creating any temporary blocks. Block is
2311  a deprecated alias for DatabaseBlock.
2312* Parser::$mConf is deprecated. It will be removed entirely in a later version.
2313  Some context can be found at T224165.
2314* Constructing Parser directly is deprecated. Obtain one from ParserFactory.
2315* Title::moveSubpages is deprecated. Use MovePage::moveSubpages or
2316  MovePage::moveSubpagesIfAllowed.
2317* The MWNamespace class is deprecated. Use MediaWikiServices::getNamespaceInfo.
2318* (T62260) Hard deprecate Language::getExtraUserToggles() method.
2319* Language::viewPrevNext function is deprecated, use
2320  PrevNextNavigationRenderer::buildPrevNextNavigation instead
2321* User::trackBlockWithCookie and DatabaseBlock::clearCookie are deprecated. Use
2322  BlockManager::trackBlockWithCookie and BlockManager::clearCookie instead.
2323* DatabaseBlock::setCookie, DatabaseBlock::getCookieValue,
2324  DatabaseBlock::getIdFromCookieValue and AbstractBlock::shouldTrackWithCookie
2325  are moved to internal helper methods for BlockManager::trackBlockWithCookie.
2326* ResourceLoaderContext::getConfig and ResourceLoaderContext::getLogger have
2327  been deprecated. Inside ResourceLoaderModule subclasses, use the local methods
2328  instead. Elsewhere, use the methods from the ResourceLoader class.
2329* The Profiler::setTemplated and Profiler::getTemplated methods have been
2330  deprecated. Use Profiler::setAllowOutput and Profiler::getAllowOutput
2331  instead.
2332* The ProfilerOutputDb class, 'profiling' table, and profileinfo.php entry
2333  point had been deprecated (T231366).
2334* The Preprocessor_DOM implementation has been deprecated.  It will be
2335  removed in a future release.  Use the Preprocessor_Hash implementation
2336  instead.
2337* Sanitizer::attributeWhitelist() and Sanitizer::setupAttributeWhitelist()
2338  have been deprecated; they will be made private in the future.
2339* SearchResult::termMatches() method is deprecated. It was unreliable because
2340  only populated by few search engine implementations. Use
2341  SqlSearchResult::getTermMatches() if really needed.
2342* SearchResult::getTextSnippet( $terms ) the $terms param is being deprecated
2343  and should no longer be passed. Search engine implemenations should be
2344  responsible for carrying relevant information needed for highlighting with
2345  their own SearchResultSet/SearchResult sub-classes.
2346* SearchResultSet::free() method is deprecated.
2347* SearchEngine::$searchTerms protected field is deprecated. Moved to
2348  SearchDatabase.
2349* The use of the $terms param in the ShowSearchHit and ShowSearchHitTitle
2350  hooks is highly discouraged as it's only populated by SearchDatabase search
2351  engines.
2352* Skin::escapeSearchLink() is deprecated. Use Skin::getSearchLink() or the skin
2353  template option 'searchaction' instead.
2354* Skin::getRevisionId() and Skin::isRevisionCurrent() have been deprecated.
2355  Use OutputPage::getRevisionId() and OutputPage::isRevisionCurrent() instead.
2356* LoadBalancer::haveIndex() and LoadBalancer::isNonZeroLoad() have
2357  been deprecated.
2358* FileBackend::getWikiId() has been deprecated.
2359  Use FileBackend::getDomainId() instead.
2360* User::getRights() and User::$mRights have been deprecated. Use
2361  PermissionManager::getUserPermissions() instead.
2362* The LocalisationCacheRecache hook no longer allows purging of message blobs
2363  to be prevented. Modifying the $purgeBlobs parameter now has no effect.
2364* SVGMetadataExtractor::getMetadata has been deprecated. Instead, you should
2365  use SVGReader->getMetadata() directly.
2366* The following public properties on AbstractBlock are deprecated: $mReason,
2367  $mTimestamp, $mExpiry, $mHideName. Use the getters/setters instead.
2368* The following public properties on DatabaseBlock are deprecated: $mAuto,
2369  $mParentBlockId. To check for an autoblock use DatabaseBlock::getType; to
2370  check for the parent ID, use DatabaseBlock::getParentBlockId.
2371* SearchEngine::userHighlightPrefs() is deprecated, simply stop passing
2372  $contextlines and $contextchars to the SearchHighlighter methods, they will
2373  use proper defaults defined in SearchHighlighter::DEFAULT_CONTEXT_LINES and
2374  DEFAULT_CONTEXT_CHARS.
2375* SearchUpdate constructor: passing a string as the title param and or a boolean
2376  or a string as the content will produce a deprecation warning.
2377* SearchEngine::getTextFromContent() is deprecated, use getTextForSearchIndex()
2378  directly from the Content object.
2379* SearchEngine::textAlreadyUpdatedForIndex() is deprecated, given the
2380  deprecation above this method is no longer needed/called and should not be
2381  implemented by SearchEngine implementation.
2382* IDatabase::bufferResults() has been deprecated. Use query batching instead.
2383* MessageCache::singleton() is deprecated. Use
2384  MediaWikiServices::getMessageCache().
2385* ObjectCache::getWANInstance() is deprecated. Use
2386  MediaWikiServices::getMainWANObjectCache() instead.
2387* ObjectCache::newWANCacheFromParams() is deprecated. Use
2388  MediaWikiServices::getMainWANObjectCache() instead.
2389* Constructing MovePage directly is deprecated. Use MovePageFactory.
2390* TempFSFile::factory() has been deprecated. Use TempFSFileFactory instead.
2391* wfIsBadImage() is deprecated. Use the BadFileLookup service instead.
2392* Building a new SearchResult is hard-deprecated, always call
2393  SearchResult::newFromTitle(). This class is being refactored into an abstract
2394  class. If you extend this class please be sure to override all its methods
2395  or extend RevisionSearchResult.
2396* Skin::getSkinNameMessages() is deprecated and no longer used.
2397* The mediawiki.RegExp module is deprecated; use mw.util.escapeRegExp() instead.
2398* Specifying a SpecialPage object for the list of special pages (either through
2399  the SpecialPage_initList hook or by adding to $wgSpecialPages) is now
2400  deprecated.
2401* The 'jquery.tabIndex' module is deprecated.
2402* WebInstaller::getWarningBox() and getErrorBox() are deprecated.
2403  Use Html::errorBox() or Html::warningBox() instead.
2404* Use of ActorMigration with 'ar_user', 'img_user', 'oi_user', 'fa_user',
2405  'rc_user', 'log_user', and 'ipb_by' is deprecated. Queries should be adjusted
2406  to use the corresponding actor fields directly. Note that use with
2407  'rev_user' is *not* deprecated at this time.
2408* Specifying both the class and factory parameters for
2409  ApiModuleManager::addModule is now deprecated. The ObjectFactory spec should
2410  be used instead.
2411* The UserIsHidden hook is deprecated. Use GetUserBlock instead, and add a
2412  system block that hides the user.
2413* The GetBlockedStatus hook is deprecated. Use GetUserBlock instead, to add or
2414  remove a block.
2415* $wgContentHandlerUseDB is deprecated and should always be true.
2416* StreamFile::send404Message() and StreamFile::parseRange() are now deprecated.
2417  Use HTTPFileStreamer::send404Message() and HTTPFileStreamer::parseRange()
2418  respectively instead.
2419* Global variable $wgSysopEmailBans is deprecated; to allow sysops to ban
2420  users from sending emails, use
2421  $wgGroupPermissions['sysop']['blockemail'] = true;
2422* ApiQueryBase::showHiddenUsersAddBlockInfo() is deprecated. Use
2423  ApiQueryBlockInfoTrait instead.
2424* PasswordReset is now a service, its direct instantiation is deprecated.
2425* RESTBagOStuff users should specify either "JSON" or "PHP" serialization type.
2426* The global function wfIsHHVM() is deprecated and will now always return false
2427  regardless of the runtime environment. This is part of the continuing work to
2428  remove HHVM support from MediaWiki, which started in MediaWiki 1.31.
2429* Language::getLocalisationCache() is deprecated. Use MediaWikiServices
2430  instead.
2431* The following Language methods are deprecated: isSupportedLanguage,
2432  isValidCode, isValidBuiltInCode, isKnownLanguageTag, fetchLanguageNames,
2433  fetchLanguageName, getFileName, getMessagesFileName, getJsonMessagesFileName.
2434  Use the new LanguageNameUtils class instead. (Note that fetchLanguageName(s)
2435  are called getLanguageName(s) in the new class.)
2436* Using the Parser without initializing its $mTitle property to non-null has
2437  been deprecated.  In a future release Parser::getTitle() will throw a
2438  TypeError if $mTitle is uninitialized.
2439* A number of public methods of Parser were exposed only for historical
2440  reasons and have been deprecated: doMagicLinks, doDoubleUnderscore,
2441  doHeadings, doAllQuotes, replaceExternalLinks, replaceInternalLinks,
2442  replaceInternalLinks2, getVariableValue, initialiseVariables, formatHeadings,
2443  testPst, testPreprocess, testSrvus, areSubpagesAllowed, maybeDoSubpageLink,
2444  splitWhitespace, createAssocArgs, armorLinks, makeKnownLinkHolder,
2445  getImageParams, parseLinkParameter, stripAltText, replaceLinkHolders,
2446  replaceLinkHoldersText, armorLinks, makeKnownLinkHolder, getImageParams,
2447  parseLinkParameter, stripAltText.
2448
2449=== Other changes in 1.34 ===
2450* Added option to specify "Various authors" as author in extension credits using
2451  "..." as the only author name. If the "author" array contains more than one
2452  entry and "..." is one of the entries in the array, "..." will be parsed as
2453  "others" (version-poweredby-others i18n message) like previously.
2454* (T232563) Browser support ("Grade C") for Internet Explorer 6 and 7
2455  was discontinued. Basic content and security features may no longer
2456  work correctly in these browsers.
2457
2458= MediaWiki 1.33 =
2459
2460== MediaWiki 1.33.4 ==
2461
2462This is a security and maintenance release of the MediaWiki 1.33 branch.
2463
2464=== Changes since MediaWiki 1.33.3 ===
2465* (T247017) PasswordReset performance improvements.
2466* The MultiHttpClient code will fallover to non-curl if curl_multi* is blocked.
2467* (T250568) Work around change in SimpleXMLElement behavior introduced in PHP
2468  7.3.17.
2469* Remove some rotten and out of date documentation.
2470* (T252311) Improvements to some older SQLite update patches.
2471* (T240307) Minor fixes to extension.schema.v2.json and
2472  extension.schema.v1.json.
2473* rdbms: Add callback for atomic section cancellation.
2474* (T191668) NameTableStoreTest::getCallCheckingDb simplification.
2475* Make NameTableStore use LoadBalancer::getConnectionRef().
2476* (T224949) NameTableStore: ensure consistency upon rollback.
2477* (T199474) Set rc_patrolled to 2 for autopatrolled changes in
2478  rebuildrecentchanges.php.
2479* (T229461) Update the change_tag table in rebuildrecentchanges.php.
2480* (T234450) Per-user concurrency in SpecialContributions can now be limited by
2481  setting $wgPoolCounterConf['SpecialContributions'] appropriately.
2482* (T248947) SECURITY: img_auth.php may leak private extension images into the
2483  public cache.
2484
2485== MediaWiki 1.33.3 ==
2486
2487This is a security and maintenance release of the MediaWiki 1.33 branch.
2488
2489=== Changes since MediaWiki 1.33.2 ===
2490* (T245072) mediawiki.language: Rename languageData back to languageNames.
2491* Use proper SemVer comparison in CheckComposerLockUpToDate.
2492* (T212738) Add the MW_VERSION constant, global $wgVersion is soft deprecated.
2493* Update comment about PHP versions supported by The PHP Group.
2494* (T247215) Fix output of RecountCategories::doWork().
2495* Add check for page existence to view.php maintenance script.
2496* (T236509) SECURITY: Fix HTML escaping in UserGroupMembership::getLink().
2497* (T246602) SECURITY: jquery.makeCollapsible allows applying event handler to
2498  any CSS selector.
2499
2500== MediaWiki 1.33.2 ==
2501
2502This is a security and maintenance release of the MediaWiki 1.33 branch.
2503
2504=== Changes since MediaWiki 1.33.1 ===
2505* (T217831) (T200653) PopulateContentTables: compute sha1 and length if needed.
2506* Fix extra newlines in the installer.
2507* (T236628) Fix for ArticleRevisionViewCustom hook in DifferenceEngine.php.
2508* (T181658) Do not insert page titles into querycache.qc_value.
2509* (T206013) Suppress errors when reading invalid XML file properties.
2510* (T237931) Remove references to pg_attrdef.adsrc in Postgres code.
2511* Use correct value for 'sslmode' in DatabasePostgres.
2512* (T232866) Fix support for HTTP/2 in MultiHttpClient.
2513* (T227461) Stop calling deprecated Redis delete functions.
2514* (T239561) Mark options as requiring parameters in addSite.php.
2515* (T219440) Skip flaky rollback test.
2516* (T232866) Mimic CURLOPT_POST in GuzzleHttpRequest.
2517* (T239734) Replace deprecated lSize with lLen in Redis code.
2518* (T192134) SECURITY: Do not allow user scripts on Special:PasswordReset.
2519* (T239428) ApiEditPage: Test for bad redirect targets.
2520* (T233342) rdbms: Log debug message traces as 'exception.trace' instead of
2521  'trace'.
2522* (T226751) media: Log and fail gracefully on invalid EXIF coordinates.
2523* (T212067) SECURITY: Work around PHP bug in parse_url.
2524
2525== MediaWiki 1.33.1 ==
2526
2527This is a security and maintenance release of the MediaWiki 1.33 branch.
2528
2529=== Changes since MediaWiki 1.33.0 ===
2530* A change that kept people with a database table prefix that didn't
2531  end with an underscore from updating was reverted.
2532* (T207100) Updated LanguageTr for dotted and dotless I in PHP 7.3.
2533* The ImgAuthModifyHeaders hook was added to img_auth.php to allow modification
2534  of headers in private wikis.
2535* (T230317) Allow upgrading from MediaWiki before 1.15 where the valid_tag table
2536  doesn't yet exist.
2537* (T208897) MessageCache: Restore 'loadedLanguages' tracking for load().
2538* (T228555) MessageCache: Fix isMainCacheable() logic for non-content languages.
2539* (T200088) Remove title protection correctly for undeletions and imports.
2540* (T230402) SECURITY: Add permission check for suppressed account to
2541  Special:Redirect.
2542* Add helper for HTTPFileStreamer header syntax.
2543* (T227461) ObjectCache: avoid using deprecated phpredis::delete() alias.
2544* (T231386) SpecialRedirect::dispatchUser() should use a 302 http status code.
2545* (T118799) Fix XMP parser errors due to trailing nullchar.
2546* (T230618) Fix GROUP BY in ActiveUsersPager and RecentChangesUpdateJob for
2547  PostgreSQL.
2548* (T230487) Handle changed defaults in Argon2PasswordTest::testPartialConfig().
2549* (T233119) Improve documentation for the MinimumPasswordLengthToLogin policy.
2550* (T227662) Split down patch-comment-table.sql and patch-actor-table.sql into
2551  separate files to help allieviate potential migration problems.
2552
2553=== Upgrading notes for 1.33 ===
25541.33 has several database changes since 1.32, and will not work without schema
2555updates. Note that due to changes to some very large tables like the revision
2556table, the schema update may take quite long (minutes on a medium sized site,
2557many hours on a large site).
2558
2559Don't forget to always back up your database before upgrading!
2560
2561See the file UPGRADE for more detailed upgrade instructions, including
2562important information when upgrading from versions prior to 1.11.
2563
2564Some specific notes for MediaWiki 1.33 upgrades are below:
2565
2566* Some external link searches will not work correctly until update.php (or
2567  refreshExternallinksIndex.php) is run. These include searches for links using
2568  IP addresses, internationalized domain names, and possibly mailto links.
2569* If you ran migrateActors.php using an older version of MediaWiki and want to
2570  run your wiki with $wgActorTableSchemaMigrationStage SCHEMA_COMPAT_READ_OLD,
2571  note that log_search rows needed to find revision deletions by target user
2572  were incorrectly deleted. See T215464 for details.
2573* If revision deletions were performed when the wiki was configured with
2574  $wgActorTableSchemaMigrationStage SCHEMA_COMPAT_WRITE_BOTH and without
2575  migrateActors.php having been run, the log_search table may contain rows with
2576  empty values for "target_author_actor" which will prevent log searches for
2577  revision deletions by target user from finding those log entries. These rows
2578  may be corrected by (re-)running migrateActors.php.
2579
2580For notes on 1.32.x and older releases, see HISTORY.
2581
2582== MediaWiki 1.33.0 ==
2583
2584=== Changes since MediaWiki 1.33.0-rc.0 ===
2585* (T225558) Update installer link to PHP intl.
2586* (T225901) Only attempt to deduplicate if there is data in archive and revision
2587  tables.
2588* (T225564) Fetch tag ID before calling undefineTag().
2589* (T225496) Detect APC for MainCacheType in CLI installer.
2590* Call unpack() with correct parameters in MimeAnalyzer.php for PHP 7.0 support.
2591* (T212613) Style change tags correctly on Special:Newpages.
2592* (T202211) Fix SQLite patch-(page|template)links-fix-pk.sql column order.
2593
2594== MediaWiki 1.33.0-rc.0 ==
2595
2596=== Configuration changes for system administrators in 1.33 ===
2597==== New configuration ====
2598* $wgEnablePartialBlocks – This enables the Partial Blocks feature, which gives
2599  accounts with block permissions the ability to block users, IPs, and IP ranges
2600  from editing specific pages, while allowing them to edit the rest of the wiki.
2601  It is a temporary setting for gradual enablement, current default to `false`,
2602  and will be set to `true` and then removed once initial development completes.
2603
2604==== Changed configuration ====
2605* $wgChangeTagsSchemaMigrationStage (T193868) — This temporary setting, added in
2606  MediaWiki 1.32, now defaults to MIGRATION_NEW instead of MIGRATION_WRITE_BOTH.
2607* $wgPasswordPolicy – There is a new password policy to check that the account's
2608  password is not in the large blacklist. This is enabled by default for the
2609  built-in user groups bureaucrat, sysop, interface-admin, and bot. To configure
2610  this for other user groups, set the `PasswordNotInLargeBlacklist` flag `true`.
2611* $wgPasswordDefault – There is a new password type configuration using Argon2
2612  password hashing (which requires PHP 7.2 and above). It's designed to resist
2613  timing attacks, and (on systems with PHP 7.3+) GPU hacking; if you configure
2614  argon2 to be used, by default, it will automatically choose the best available
2615  algorithm depending on which version of PHP you have available. To use this,
2616  you can set `$wgPasswordDefault = 'argon2';`.
2617* $wgActorTableSchemaMigrationStage now defaults to reading the new schema.
2618  update.php will back-populate the new database fields due to the changed
2619  setting, which may take some time on large wikis. You can avoid downtime by
2620  following a process like that described in T188327.
2621
2622==== Removed configuration ====
2623* $wgTagStatisticsNewTable (T199334) — This temporary setting, added in
2624  MediaWiki 1.32, has now been removed. When loading Special:Tags, MediaWiki
2625  will now always use the `change_tag_def` instead of the `change_tag` table.
2626* $wgUseTidy, $wgTidyBin, $wgTidyConf, $wgTidyOpts, $wgTidyInternal, and
2627  $wgDebugTidy – These options, all deprecated since 1.26, have now all been
2628  removed, as MediaWiki now always tidies user output. The $wgTidyConfig setting
2629  remains only for experimental features and debugging, and should not be used.
2630* $wgEnableParserCache – This setting has been deprecated since 1.26, has now
2631  been removed. If you still desire to disable the parser cache, instead you can
2632  set `$wgParserCacheType = CACHE_NONE;`.
2633* $wgCommentTableSchemaMigrationStage – This temporary migration setting has now
2634  been removed. Code finding it unset should treat it as being MIGRATION_NEW.
2635* $wgAuth – This old setting, deprecated in 1.27, has been removed as part of
2636  the removal of AuthPlugin.
2637* $wgSitesCacheFile – This configuration was introduced in 1.25 with the intent
2638  to allow sites to configure a file in which to cache the SiteStore database
2639  table, but it was never used. SiteStore already caches its information by
2640  default using BagOStuff (e.g. Memcached or APC).
2641* $wgClockSkewFudge – This setting was used by User.php to let sites adjust by
2642  how much MediaWiki would fudge when trying to minimize the chances of a
2643  user.user_touched database update to the "current" timestamp being before the
2644  value already there (e.g. due to clock skew between different servers). This
2645  is no longer a problem, because the code now ensures the timestamp is always
2646  higher than the previous one. The writes are guarded with CAS logic (check
2647  and set), which prevents updates that would overlap.
2648* $wgDBmysql5 (T196185) - This experimental setting, deprecated in 1.31, has
2649  been removed.
2650
2651=== New user-facing features in 1.33 ===
2652* (T96041) __EXPECTUNUSEDCATEGORY__ on a category page causes the category
2653  to be hidden on Special:UnusedCategories.
2654* (T210814) SVGs are now by default displayed in wiki language on image
2655  pages.
2656* Special:CreateAccount now warns the user if their chosen username has to be
2657  normalized.
2658* (T205040) Multilingual images are now be displayed in the current parse
2659  language where available.
2660* Special:ActiveUsers will no longer filter out users who became inactive since
2661  the last time the active users query cache was updated.
2662* (T215675) RecentChange and ManualLogEntry implement new Taggable interface.
2663* (T215675) Added a hook, ManualLogEntryBeforePublish, to allow extensions
2664  to modify (example: add tags) log entries.
2665
2666=== New developer features in 1.33 ===
2667* The AuthManagerLoginAuthenticateAudit hook has a new parameter for
2668  additional information about the authentication event.
2669* TextContent::getText() was introduced as a replacement for
2670  Content::getNativeData() for text-based content models.
2671* (T214706) LinksUpdate::getAddedExternalLinks() and
2672  LinksUpdate::getRemovedExternalLinks() were introduced.
2673* (T213893) Added 'MaintenanceUpdateAddParams' hook
2674* (T219655) The MarkPatrolled hook has a new parameter for the tags
2675  associated with this entry in the patrol log.
2676* (T212472) Extensions can now specify platform abilities they require to work,
2677  limited to shell access for now.
2678
2679
2680=== External library changes in 1.33 ===
2681==== New external libraries ====
2682* Added wikimedia/password-blacklist 0.1.4.
2683* Added guzzlehttp/guzzle 6.3.3.
2684
2685==== Changed external libraries ====
2686* Updated OOUI from v0.29.2 to v0.31.3.
2687* Updated OOjs Router from pre-release to v0.2.0.
2688* Updated moment from v2.19.3 to v2.24.0.
2689* Updated wikimedia/xmp-reader from 0.6.0 to 0.6.2.
2690* Updated wikimedia/scoped-callback from 2.0.0 to 3.0.0.
2691* Updated jquery-client from 2.0.1 to 2.0.2.
2692* Updated pear/net_smtp from 1.8.0 to 1.8.1.
2693* Updated cssjanus/cssjanus from 1.2.0 to 1.3.0.
2694* Updated wikimedia/php-session-serializer from 1.0.6 to 1.0.7.
2695
2696==== Removed external libraries ====
2697* (T219403) jquery.ui.spinner, deprecated since 1.31, was removed.
2698
2699
2700=== Developer library changes in 1.33 ===
2701==== New developer libraries ====
2702* Added jakub-onderka/php-console-highlighter 0.3.2 explicitly (dev-only).
2703* Added mediawiki/mediawiki-phan-config 0.5.0 (dev-only).
2704
2705==== Changed developer libraries ====
2706* Updated wikimedia/ip-set from 1.3.0 to 2.0.1.
2707  * The deprecated IPSet\IPSet alias was removed, Wikimedia\IPSet must be
2708    used instead.
2709* Updated psy/psysh from 0.9.6 to 0.9.9 (dev-only).
2710* Updated nikic/php-parser from 3.1.3 to 3.1.5 (dev-only).
2711* Updated mediawiki/mediawiki-codesniffer from 22.0.0 to 25.0.0 (dev-only).
2712* Updated qunitjs from 2.6.2 to 2.9.1.
2713
2714==== Removed developer libraries ====
2715* The jetbrains/phpstorm-stubs repository was removed in favour of the minimal
2716  stubs we need, which are kept in the new `.phan/internal_stubs` directory
2717  (dev-only).
2718
2719
2720=== Bug fixes in 1.33 ===
2721* (T164211) Special:UserRights could sometimes fail with a
2722  "conflict detected" error when there weren't any conflicts.
2723* (T216029) Chrome redirects to Special:BadTitle after editing a section with
2724  a non-Latin name on a page with non-Latin characters in title.
2725* (T222385) resourceloader: Use AND instead of OR for upsert conds in
2726  saveFileDependencies().
2727
2728=== Action API changes in 1.33 ===
2729* (T198913) Added 'ApiOptions' hook.
2730* The JSON formatversion=2 is no longer experimental.
2731* Internal API errors (those with code beginning "internal_api_error") will
2732  include the exception class name in a data field named "errorclass".
2733  * Class names are not guaranteed to remain stable, and in particular database
2734    exceptions will now include the "Wikimedia\Rdbms\" prefix in the class name.
2735  * The code including an exception class name is deprecated. In the future,
2736    all internal errors will use code "internal_api_error".
2737* (T212356) When using action=delete on pages with many revisions, the module
2738  may return a boolean-true 'scheduled' and no 'logid'. This signifies that the
2739  deletion will be processed via the job queue.
2740* action=setnotificationtimestamp will now update the watchlist asynchronously
2741  if entirewatchlist is set, so updates may not be visible immediately
2742* Block info will be added to "blocked" errors from more modules.
2743* (T216245) Autoblocks will now be spread by action=edit and action=move.
2744* action=query&meta=userinfo has a new uiprop, 'latestcontrib', that returns
2745  the date of user's latest contribution.
2746* (T25227) action=logout now requires to be posted and have a csrf token.
2747
2748=== Action API internal changes in 1.33 ===
2749* A number of deprecated methods for API documentation, intended for overriding
2750  by extensions, are no longer called by MediaWiki, and will emit deprecation
2751  notices if your extension attempts to use them:
2752  * ApiBase::getDescription() (deprecated in 1.25)
2753  * ApiBase::getParamDescription() (deprecated in 1.25)
2754  * ApiBase::getExamples() (deprecated in 1.25)
2755  * ApiBase::getDescriptionMessage() (deprecated in 1.30)
2756  Additionally, the  'APIGetDescription' and 'APIGetParamDescription' hooks have
2757  been removed, as their only use was to let extensions override values returned
2758  by getDescription() and getParamDescription(), respectively.
2759* API error codes may only contain ASCII letters, numbers, underscore, and
2760  hyphen. Methods such as ApiBase::dieWithError() and
2761  ApiMessageTrait::setApiCode() will throw an InvalidArgumentException if
2762  passed a bad code.
2763* ApiBase::checkTitleUserPermissions() now takes an options array as its third
2764  parameter. Passing a User object or null is deprecated.
2765* The api-feature-usage log channel now has log context. The text message is
2766  deprecated and will be removed in the future.
2767
2768=== Languages updated in 1.33 ===
2769MediaWiki supports over 350 languages. Many localisations are updated regularly.
2770Below only new and removed languages are listed, as well as changes to languages
2771because of Phabricator reports.
2772
2773* (T203908) Added language support for Eastern Pwo (kjp).
2774* (T213717) Fixed a translation error on Goan Konkani (gom-deva) translations
2775  for NS_TEMPLATE.
2776* (T212221) Added $digitTransformTable for Santali (sat).
2777* (T216479) Added language support for Saisiyat (xsy).
2778* (T219728) Added support for new Japanese era name "Reiwa"
2779
2780=== Breaking changes in 1.33 ===
2781* The parameteter $lang in DifferenceEngine::setTextLanguage must be of type
2782  Language. Other types are deprecated since 1.32.
2783* Skin::doEditSectionLink requires type Language for the parameter $lang.
2784  The parameters $tooltip and $lang are mandatory. Omitting the parameters is
2785  deprecated since 1.32.
2786* Language::truncate(), deprecated in 1.31, has been removed.
2787* UtfNormal, deprecated in 1.25, was removed. Use UtfNormal\Validator directly
2788  instead.
2789* (T197179) In OOUI HTMLForm fields, the parameters 'notice', 'notice-messages',
2790  and 'notice-message', which were deprecated in 1.32, were removed. Instead,
2791  use 'help', 'help-message', and 'help-messages'.
2792* (T197179) HTMLFormField::getNotices(), deprecated in 1.32, was removed.
2793* The "Parsoid v1" compatibility mappings in ParsoidVirtualRESTService and
2794  RestbaseVirtualRESTService, deprecated since 1.26, have been removed.
2795  Use the RESTBase v1 or Parsoid v3 API instead.
2796* ParserOptions defaults 'tidy' to true now, since the untidy modes of the
2797  parser are being deprecated and ParserOptions::getCanonicalOverrides()
2798  has always been true at any rate.
2799* Support for disabling tidy and external tidy implementations has been removed.
2800  This was deprecated in 1.32. The pure PHP Remex tidy implementation is now
2801  used and no configuration is necessary.
2802* A number of deprecated methods for API documentation, intended for overriding
2803  by extensions, are no longer called by MediaWiki, and will emit deprecation
2804  notices if your extension attempts to use them:
2805  * ApiBase::getDescription() (deprecated in 1.25)
2806  * ApiBase::getParamDescription() (deprecated in 1.25)
2807  * ApiBase::getExamples() (deprecated in 1.25)
2808  * ApiBase::getDescriptionMessage() (deprecated in 1.30)
2809  Additionally, the  'APIGetDescription' and 'APIGetParamDescription' hooks have
2810  been removed, as their only use was to let extensions override values returned
2811  by getDescription() and getParamDescription(), respectively.
2812* The authentication hooks 'AbortAutoAccount' 'AbortNewAccount', 'AbortLogin',
2813  'LoginUserMigrated', 'UserCreateForm', and 'UserLoginForm', all deprecated by
2814  the creation of AuthManager in 1.27, have been removed. This also means that
2815  the FakeAuthTemplate and LoginForm classes are removed, that FakeAuthTemplate
2816  is no longer passed into LoginSignupSpecialPage->getFieldDefinitions(), and
2817  that LoginSignupSpecialPage->getBCFieldDefinitions() is removed.
2818* The 'jquery.localize' module, deprecated in 1.32, has been removed. Instead,
2819  use 'jquery.i18n'.
2820* The hooks LanguageGetSpecialPageAliases and LanguageGetMagic, deprecated since
2821  1.16, have now been removed. Instead, use $specialPageAliases or $magicWords
2822  respectively in a $wgExtensionMessagesFiles file.
2823* The following methods of the Preferences class, deprecated in 1.31, have been
2824  removed:
2825  * getSaveBlacklist()
2826  * loadPreferenceValues()
2827  * getOptionFromUser()
2828  * profilePreferences()
2829  * skinPreferences()
2830  * filesPreferences()
2831  * datetimePreferences()
2832  * renderingPreferences()
2833  * editingPreferences()
2834  * rcPreferences()
2835  * watchlistPreferences()
2836  * searchPreferences()
2837  * miscPreferences()
2838  * generateSkinOptions()
2839  * getDateOptions()
2840  * getImageSizes()
2841  * getThumbSizes()
2842  * validateSignature()
2843  * cleanSignature()
2844  * getTimezoneOptions()
2845  * filterIntval()
2846  * filterTimezoneInput()
2847  * getTimeZoneList()
2848* mw.util.jsMessage(), deprecated in 1.20, was removed. Use mw.notify instead.
2849* (T61113) User::EDIT_TOKEN_SUFFIX was removed. It was deprecated since 1.27.
2850* The 'mediawiki.api' module aliases, deprecated in 1.32, have been removed.
2851  Specifically: mediawiki.api.category, mediawiki.api.edit,
2852  mediawiki.api.login, mediawiki.api.options, mediawiki.api.parse,
2853  mediawiki.api.upload, mediawiki.api.user, mediawiki.api.watch,
2854  mediawiki.api.messages, and mediawiki.api.rollback.
2855* The 'jquery.byteLimit' module alias for 'jquery.lengthLimit',
2856  deprecated in 1.31, was removed.
2857* Revision::fetchRevision(), deprecated in 1.28, was removed.
2858* Class SquidUpdate, deprecated in 1.27, was removed.
2859* Title->getSquidURLs(), deprecated in 1.27, was removed. Instead, use
2860  Title->getCdnUrls().
2861* Title::escapeFragmentForURL(), deprecated in 1.30, was removed. Use
2862  Sanitizer::escapeIdForLink() or escapeIdForExternalInterwiki() instead.
2863* Title->canTalk(), deprecated in 1.30, was removed. Instead, use
2864  Title->canHaveTalkPage().
2865* Title's methods for site and user page related to CSS and JS, deprecated in
2866  1.31, were removed:
2867  * Title->isCssOrJsPage() — Use Title->isSiteConfigPage()
2868  * Title->isCssJsSubpage() – Use Title->isUserConfigPage()
2869  * Title->getSkinFromCssJsSubpage() – Use Title->getSkinFromConfigSubpage()
2870  * Title->isCssSubpage() – Use Title->isUserCssConfigPage()
2871  * Title->isJsSubpage() – Use Title->isUserJsConfigPage()
2872* SiteSQLStore, deprecated in 1.27 and whose only method, ::newInstance(),
2873  would return the global SiteStore instance, has been removed. You can get to
2874  this via MediaWiki\MediaWikiServices::getInstance()->getSiteStore() directly.
2875* Linker::formatSize, deprecated in 1.28, has been removed (with DummyLinker's).
2876  Instead, use Language->formatSize() with the relevant Language object.
2877* Linker::formatTemplates, deprecated in 1.28, has been removed (along with the
2878  version in DummyLinker). You can use TemplatesOnThisPageFormatter directly.
2879* EventRelayerGroup::singleton(), deprecated in 1.27, has been removed. You can
2880  use MediaWikiServices::getInstance()->getEventRelayerGroup() directly.
2881* LinkCache->addLink(), deprecated in 1.27, has been removed. It is thought to
2882  be unused, and is distinct from OutputPage->addLink(), which remains.
2883* JsonContent->getJsonData(), deprecated in 1.25, has been removed. Instead, use
2884  JsonContent->getData().
2885* MWExceptionHandler::getLogId(), deprecated in 1.27, has been removed, as the
2886  exception ID is the same as the request ID, from WebRequest::getRequestId().
2887* SearchEngine::getNearMatchResultSet(), deprecated in 1.27, has been removed.
2888  You can use SearchEngine::getNearMatcher() instead.
2889* EmailNotification::updateWatchlistTimestamp, deprecated in 1.27, has been
2890  removed. Instead, use WatchedItemStore::updateNotificationTimestamp directly.
2891* User::getGroupName() and ::getGroupMember(), both deprecated in 1.29, have
2892  been removed. Instead, please use UserGroupMembership::getGroupName() and
2893  UserGroupMembership::getGroupMemberName().
2894* Backwards compatibility for setting wgSessionsInObjectCache to false or using
2895  wgSessionHandler, both of which were deprecated in 1.27 with the introduction
2896  of SessionManager, has been removed.
2897* SessionManager::autoCreateUser, deprecated in 1.27, has been removed. Use
2898  MediaWiki\Auth\AuthManager::autoCreateUser instead.
2899* The mw.libs.jpegmeta property, deprecated in 1.31, was removed.
2900  Use require( 'mediawiki.libs.jpegmeta' ) instead.
2901* The mw.user.stickyRandomId() method, deprecated in 1.32, was removed.
2902  Use mw.user.getPageviewToken() instead.
2903* Removed deprecated class property WikiRevision::$importer.
2904* ResourceLoaderFileModule::readStyleFiles() now requires its $context
2905  parameter.
2906* The ChangeList::insertArticleLink() method, that was deprecated in 1.27, has
2907  been removed.
2908* MessageBlobStore::__construct() now requires its $rl parameter.
2909* Second parameter to Sanitizer::escapeIdReferenceList() (deprecated in 1.31)
2910  has been removed.
2911* The 'jquery.xmldom' module has been removed.
2912* The 'jquery.mockjax' module has been removed.
2913* The 'jquery.hidpi' module, deprecated in 1.32, has been removed.
2914* AuthPlugin and related code, deprecated in 1.27, has been removed. Extensions
2915  should instead use AuthManager. The following no longer exist:
2916  * The AuthPlugin class itself and the related AuthPluginUser class and i18n
2917  * The AuthPluginSetup and AuthPluginAutoCreate hooks
2918  * The transitional wrapper classes AuthPluginPrimaryAuthenticationProvider,
2919    AuthManagerAuthPlugin, and AuthManagerAuthPluginUser.
2920  * The $wgAuth configuration setting and its use in Setup.php and unit tests
2921* (T217772) The 'wgAvailableSkins' mw.config key in JavaScript, was removed.
2922* Language::markNoConversion, deprecated in 1.32, has been removed. Use
2923  LanguageConverter::markNoConversion instead.
2924* BagOStuff::modifySimpleRelayEvent() method has been removed.
2925* ParserOutput::getLegacyOptions, deprecated in 1.30, has been removed.
2926  Use ParserOutput::allCacheVaryingOptions instead.
2927* CdnCacheUpdate::newSimplePurge, deprecated in 1.27, has been removed.
2928  Use CdnCacheUpdate::newFromTitles() instead.
2929* Handling of multiple arguments by the Block constructor, deprecated in 1.26,
2930  has been removed.
2931* The translation of main page in Sardinian (sc) was changed from "Pàgina Base"
2932  to "Pàgina printzipale". Existing wikis using this content language need to
2933  move the main page or change the name through MediaWiki:Mainpage page.
2934* wfSplitWikiID(), deprecated in 1.32, has been removed.
2935* MessageBlobStore::getBlob(), deprecated in 1.27, has been removed.
2936  Use ::getBlobs() instead.
2937* The .background-size() LESS mixin, deprecated in 1.27, has been removed.
2938* ReadOnlyMode::clearCache() and ConfiguredReadOnlyMode::clearCache() have been
2939  removed. Use MediaWikiTestCase::overrideMwServices() instead.
2940* Support for the 'aggregator' option of JobQueue (and thus $wgJobTypeConf) was
2941  removed. The JobQueueAggregator interface and JobQueueAggregatorRedis class
2942  have also been removed. They were experimentally developed for use by the
2943  Wikimedia Foundation, but were never used, with no known use cases. (Note that
2944  this does not affect JobQueueRedis which is still supported.)
2945
2946=== Deprecations in 1.33 ===
2947* The configuration option $wgUseESI has been deprecated, and is expected
2948  to be removed in a future release.
2949* The configuration option $wgSquidPurgeUseHostHeader has been deprecated,
2950  and is expected to be removed in a future release.
2951* The configuration options $wgFixArabicUnicode and $wgFixMalayalamUnicode,
2952  introduced in MW 1.17, have been deprecated.  These fixes will always be
2953  applied for Arabic and Malayalam in the future.  Please enable these on
2954  your local wiki (if you have them explicitly set to false) and run
2955  maintenance/cleanupTitles.php to fix any existing page titles.
2956* The LegacyHookPreAuthenticationProvider class, deprecated since its creation
2957  in 1.27 as part of the AuthManager re-write, now emits deprecation warnings.
2958  This will help identify the issue if you added it to $wgAuthManagerConfig.
2959* wfSplitWikiId() is now deprecated. Cache key generation should have the wiki
2960  domain ID as a key component and use makeGlobalKey().
2961* (T202094) Title::getUserCaseDBKey() is deprecated; instead, please use
2962  Title::getDBkey(), which doesn't vary case.
2963* User::getPasswordValidity() is now deprecated. User::checkPasswordValidity()
2964  returns the same information in a more useful format.
2965* For Linker::generateTOC() and Linker::tocList(), passing strings or booleans
2966  as the $lang parameter was deprecated. The same applies to DummyLinker.
2967* The PasswordPolicy 'PasswordCannotBePopular' has been deprecated. To
2968  follow best practices, it is reccommended to use 'PasswordNotInLargeBlacklist'
2969  instead which blacklists 100,000 commonly used passwords.
2970* (T208862) Action::requiresUnblock() is now called from
2971  Title::getUserPermissionsErrors() and Title::userCan(). Previously, the method
2972  was only called in Action::checkCanExecute(). Actions should ensure that their
2973  requiresUnblock() returns the proper result (the default is `true`).
2974* (T211608) The MediaWiki\Services namespace has been renamed to
2975  Wikimedia\Services. The old name is still supported, but deprecated.
2976* (T155582) Content::getNativeData has been deprecated. Please use model-
2977  specific getters, such as TextContent::getText().
2978* The class WebInstallerOutput is now marked as @private.
2979* (T209699) The jquery.async module has been deprecated. JavaScript code that
2980  needs asynchronous behaviour should use Promises.
2981* Password::equals() is deprecated, use verify().
2982* BaseTemplate::msgWiki() and QuickTemplate::msgWiki() will be removed. Use
2983  other means to fetch a properly escaped message string or Message object.
2984* (T126091) The 'ResourceLoaderTestModules' hook, which lets you declare QUnit
2985  testing code for your JavaScript modules, is deprecated. Instead, you can now
2986  use the new extension registration key 'QUnitTestModule'.
2987* (T213426) The jquery.throttle-debounce module has been deprecated. JavaScript
2988  code that needs this behaviour should use OO.ui.debounce/throttle.
2989* The mw.language.specialCharacters property from the
2990  'mediawiki.language.specialCharacters' module has been deprecated.
2991  Use require( 'mediawiki.language.specialCharacters' ) instead.
2992* ChangeTags::purgeTagUsageCache() has been deprecated, and is expected to be
2993  removed in a future release.
2994* Passing a User object or null as the third parameter to
2995  ApiBase::checkTitleUserPermissions() has been deprecated. Pass an array
2996  [ 'user' => $user ] instead.
2997* (T211578) Block::prevents is deprecated. Use Block::isEmailBlocked,
2998  Block::isCreateAccountBlocked and Block::isUsertalkEditAllowed to get and set
2999  block properties; use Block::appliesToRight and Block::appliesToUsertalk to
3000  check block behaviour.
3001* The api-feature-usage log channel now has log context. The text message is
3002  deprecated and will be removed in the future.
3003* The FileBasedSiteLookup class has been deprecated. For a cacheable SiteLookup
3004  implementation, use CachingSiteStore instead.
3005* Language::viewPrevNext function is deprecated, use
3006  SpecialPage::buildPrevNextNavigation instead
3007* ManualLogEntry::setTags() is deprecated, use ManualLogEntry::addTags()
3008  instead. The setTags() method was overriding the tags, addTags() doesn't
3009  override, only adds new tags.
3010* Block::isValid is deprecated, since it is no longer needed in core.
3011* Calling Maintenance::hasArg() as well as Maintenance::getArg() with no
3012  parameter has been deprecated. Please pass the argument number 0.
3013* ResourceLoaderContext::expandModuleNames has been deprecated.
3014  Use ResourceLoader::expandModuleNames instead.
3015
3016=== Other changes in 1.33 ===
3017* (T201747) Html::openElement() warns if given an element name with a space
3018  in it.
3019* The implementation of buildStringCast() in Wikimedia\Rdbms\Database has
3020  changed to explicitly cast. Subclasses relying on the base-class
3021  implementation should check whether they need to override it now.
3022* BagOStuff::add is now abstract and must explicitly be defined in subclasses.
3023* LinksDeletionUpdate is now a subclass of LinksUpdate. As a consequence,
3024  the following hooks will now be triggered upon page deletion in addition
3025  to page updates: LinksUpdateConstructed, LinksUpdate, LinksUpdateComplete.
3026  LinksUpdateAfterInsert is not triggered since deletions do not cause
3027  insertions into links tables.
3028* Category::newFromID( $id )->getID() will now return $id without any
3029  validation, to avoid a mostly unnecessary DB query.
3030* On Special:Version, the name for an extension can no longer be arbitrary
3031  html when no link is specified.
3032
3033= MediaWiki 1.32 =
3034
3035== MediaWiki 1.32.6 ==
3036
3037This is a security and maintenance release of the MediaWiki 1.32 branch.
3038
3039=== Changes since MediaWiki 1.32.5 ===
3040* (T236628) Fix for ArticleRevisionViewCustom hook in DifferenceEngine.php.
3041* (T181658) Do not insert page titles into querycache.qc_value.
3042* (T206013) Suppress errors when reading invalid XML file properties.
3043* (T237931) Remove references to pg_attrdef.adsrc in Postgres code.
3044* Use correct value for 'sslmode' in DatabasePostgres.
3045* (T232866) Fix support for HTTP/2 in MultiHttpClient.
3046* (T227461) Stop calling deprecated Redis delete functions.
3047* (T239561) Mark options as requiring parameters in addSite.php.
3048* (T239734) Replace deprecated lSize with lLen in Redis code.
3049* (T192134) SECURITY: Do not allow user scripts on Special:PasswordReset.
3050* (T239428) ApiEditPage: Test for bad redirect targets.
3051* (T233342) rdbms: Log debug message traces as 'exception.trace' instead of
3052  'trace'.
3053* (T226751) media: Log and fail gracefully on invalid EXIF coordinates.
3054* (T212067) SECURITY: Work around PHP bug in parse_url.
3055
3056== MediaWiki 1.32.5 ==
3057
3058This is a maintenance release of the MediaWiki 1.32 branch.
3059
3060=== Changes since MediaWiki 1.32.4 ===
3061* Compute sha1 and length if needed in maintenance/populateContentTables.php.
3062* Fix extra newlines in the installer.
3063* Followup T230402, PermissionManager doesn't exist until 1.33, so fix the
3064  backported patches to use User::isAllowed() instead.
3065
3066== MediaWiki 1.32.4 ==
3067
3068This is a security and maintenance release of the MediaWiki 1.32 branch.
3069
3070=== Changes since MediaWiki 1.32.3 ===
3071* (T207100) Updated LanguageTr for dotted and dotless I in PHP 7.3.
3072* The ImgAuthModifyHeaders hook was added to img_auth.php to allow modification
3073  of headers in private wikis.
3074* (T230402) SECURITY: Add permission check for suppressed account to
3075  Special:Redirect.
3076* (T208897) MessageCache: Restore 'loadedLanguages' tracking for load().
3077* (T200088) Remove title protection correctly for undeletions and imports.
3078* Add helper for HTTPFileStreamer header syntax.
3079* (T118799) Fix XMP parser errors due to trailing nullchar.
3080* (T233119) Improve documentation for the MinimumPasswordLengthToLogin policy.
3081* Cache redirects from Special:Redirect.
3082* (T231386) dispatchUser() should use a 302 http status code.
3083* (T227662) Split down patch-comment-table.sql and patch-actor-table.sql into
3084  separate files to help allieviate potential migration problems.
3085* Make SQLite's patch-add-3d.sql a no-op to prevent clobbering other database
3086  updates.
3087
3088== MediaWiki 1.32.3 ==
3089
3090This is a maintenance release of the MediaWiki 1.32 branch.
3091
3092=== Changes since MediaWiki 1.32.2 ===
3093* (T225558) Update installer link to PHP intl.
3094* (T225496) Detect APC for MainCacheType in CLI installer.
3095* (T226766) Remove jetbrains/phpstorm-stubs from composer dev dependencies.
3096* (T202211) Fix SQLite patch-(image|page|template)links-fix-pk.sql column order.
3097
3098== MediaWiki 1.32.2 ==
3099
3100This is a security and maintenance release of the MediaWiki 1.32 branch.
3101
3102=== Changes since MediaWiki 1.32.1 ===
3103* (T204423) Backport support for hyphenated DB names in JobQueueGroup.
3104* (T216968) Return pageid as int in both list=iwbacklinks and
3105  list=langbacklinks.
3106* (T215169) Fix for Database::update() with IGNORE option fails on PostgreSQL.
3107* (T199474) Fix typo in rebuildrecentchanges.php resulting in rogue flags.
3108* (T218608) SECURITY: Fix an issue that prevents Extension:OAuth working when
3109  $wgBlockDisablesLogin is true.
3110* (T216029) Chrome redirects to Special:BadTitle after editing a section with
3111  a non-Latin name on a page with non-Latin characters in title.
3112* Unbreak language related maintenance scripts that use StaticArrayWriter.
3113* (T219728) Added support for new Japanese era name "Reiwa".
3114* (T25227) SECURITY: action=logout now requires to be posted and have a csrf
3115  token.
3116* Updated cssjanus/cssjanus from 1.2.0 to 1.3.0.
3117* (T221045) Remove orphaned code from ConfigRepository.
3118* (T222385) resourceloader: Use AND instead of OR for upsert conds in
3119  saveFileDependencies().
3120* (T224374) Fix message parameters so that the message that says SQLite is
3121  out of date makes sense.
3122* (T200471) Prevent LBFactorySimple breaking ExternalStorage, when trying to
3123  connect to external server with local database name.
3124* (T197279) SECURITY: Fix reauth in Special:ChangeEmail.
3125* (T208881) SECURITY: blacklist CSS var().
3126* (T209794) SECURITY: rate-limit and prevent blocked users from changing email.
3127* (T199540) SECURITY: API: Respect $wgBlockCIDRLimit in action=block.
3128* (T212118) SECURITY: Fix cache mode for (un)patrolled recent changes query.
3129* (T222036, T222038) SECURITY: Add permission check for user is permitted to
3130  view the log type.
3131* (T221739) SECURITY: resources: Patch jQuery 3.3.1 for CVE-2019-11358.
3132
3133== MediaWiki 1.32.1 ==
3134
3135=== Changes since MediaWiki 1.32.0 ===
3136* (T213577) rdbms: avoid transaction status errors from ping() in rollback().
3137* rdbms: Pass required parameter.
3138* rdbms: do not treat SAVEPOINT and RELEASE SAVEPOINT as write queries.
3139* (T204531) rdbms: reduce LoadBalancer replication log spam.
3140* (T213489) Avoid session double-start in Setup.php.
3141* (T213717) Correct namespace 'Template' for gom-deva
3142* (T198054) Fix login page crash caused by unknown language via ?uselang
3143* (T215324) (T210937) list=users mistakenly reports user as missing.
3144* (T209483) Add ILBFactory::redefineLocalDomain method. This is intended for
3145use with scripts like addWiki.php to avoid mismatched domain errors.
3146* (T208871) The hard-coded Google search form on the database error page was
3147removed.
3148* (T204800) Fix Title::getFragmentForURL for bad interwiki prefix
3149* (T215566) Fix installer being unable to determine if the database exists
3150during a fresh installation.
3151
3152== MediaWiki 1.32.0 ==
3153
3154=== Changes since MediaWiki 1.32.0-rc.2 ===
3155* (T188327) Fix slow queries in migrateActors.php.
3156* (T102320) Fix $magicWords for the Sanskrit language.
3157
3158=== Changes since MediaWiki 1.32.0-rc.1 ===
3159* Fix addition of ug_expiry column to user_groups table on MSSQL.
3160* (T210307) Fix the cache timestamp for forced updates.
3161* (T210621) User: Bypass repeatable-read when creating an actor_id.
3162* (T197535) Extensions can now specify PHP versions and PHP extensions they
3163  depend on.
3164* Updated wikimedia/ip-set from v1.2.0 to v1.3.0.
3165* (T212356) When using action=delete on pages with many revisions, the module
3166  may return a boolean-true 'scheduled' and no 'logid'. This signifies that the
3167  deletion will be processed via the job queue.
3168* (T64103) Dropped columns category.cat_hidden, site_stats.ss_admins, and
3169  recentchanges.rc_cur_time from the PostgreSQL schema.
3170
3171=== Changes since MediaWiki 1.32.0-rc.0 ===
3172* (T209885) Prevent populateSearchIndex.php from breaking once actor migration
3173  has been started.
3174* (T210998) Properly set $wgLanguageCode in the generated LocalSettings.php
3175  if --lang is used with the command-line installer (install.php).
3176
3177=== Configuration changes in 1.32 ===
3178
3179==== New configuration ====
3180* $wgJpegQuality – The quality of JPEG thumbnails is now configurable through
3181  this setting. The default is 80, which matches the quality of JPEG thumbnails
3182  previously generated by ImageMagick. The quality of JPEG thumbnails generated
3183  by GD was previously 95, but now uses the $wgJpegQuality setting as well.
3184* $wgCookieSetOnIpBlock - This determines whether to set a cookie when an IP
3185  user is blocked. Doing so means that a blocked user, even after moving to a
3186  new IP address, will still be blocked.
3187* $wgRawHtmlMessages – This new configuration setting is added for listing
3188  messages which are displayed as raw HTML.
3189* $wgCSPHeader and $wgCSPReportOnlyHeader – You can now define a
3190  "Content Security Policy" for your wiki. This adds a defense-in-depth feature
3191  to stop an attacker who has found a bug in the parser allowing them to insert
3192  malicious attributes. Disabled by default. (T135963)
3193* $wgGroupPermissions – A new user group, 'interface-admin', is added for
3194  controlling access to sitewide CSS/JS (and editing other users' CSS/JS). No
3195  other group has 'editsitecss', 'editusercss', 'editsitejs' or 'edituserjs'
3196  by default.
3197* $wgGrantPermissions – A new grant group, 'editsiteconfig', is added for
3198  granting the above rights.
3199* $wgDBDefaultGroup – A default database group for use by maintenance scripts.
3200* $wgResourceLoaderEnableJSProfiler – This new configuration setting lets you
3201  enable client-side profiling of JavaScript modules; it is off by default.
3202* (T193868) $wgChangeTagsSchemaMigrationStage — This temporary configuration
3203  setting allows sysadmins to gradually migrate the database table schema for
3204  how change tags are stored.
3205* (T199334) $wgTagStatisticsNewTable — This temporary configuration setting
3206  allows sysadmins to enable the caching of Special:Tags via the new
3207  change_tag_def table.
3208
3209==== Changed configuration ====
3210* $wgUseAjax – This setting, deprecated in 1.31, is now ignored.
3211* $wgDefaultUserOptions – The default watchlist view time (watchlistdays) has
3212  been increased from 3 to 7 days. (T194414)
3213* $wgGroupPermissions – The right to edit sitewide Javascript
3214  (e.g. MediaWiki:Common.js), CSS or JSON was separated from 'editinterface'
3215  and is available under 'editsitejs'/'editsitecss'/'editsitejson'. Having
3216  'editinterface' is still necessary to edit such pages.
3217* $wgMultiContentRevisionSchemaMigrationStage now defaults to writing both the
3218  old and the new schema, but reading the new schema, so Multi-Content Revisions
3219  (MCR) are now functional per default. The new default value of the setting is
3220  SCHEMA_COMPAT_WRITE_BOTH | SCHEMA_COMPAT_READ_NEW.
3221* $wgActorTableSchemaMigrationStage no longer accepts MIGRATION_WRITE_BOTH or
3222  MIGRATION_WRITE_NEW. It instead uses SCHEMA_COMPAT_WRITE_BOTH |
3223  SCHEMA_COMPAT_READ_OLD and SCHEMA_COMPAT_WRITE_BOTH | SCHEMA_COMPAT_READ_NEW
3224  for intermediate stages of migration.
3225* $wgDBTableOptions – The default table options now use the binary charset. The
3226  default was already overridden in the installer-generated LocalSettings.php,
3227  and so is always set to binary after the installer UI option was removed. The
3228  default value is only used when the installer installs an extension.
3229* $wgPopularPasswordFile — The location of the default popular passwords file
3230  has been moved to be in line with other non-PHP files used by libraries and
3231  classes.
3232* $wgEnableImageWhitelist is now disabled by default, as it opens up a hole for
3233  potential privacy leaks by administrators. You can check
3234  "MediaWiki:External image whitelist" on your wiki to see whether the feature
3235  was ever used, and whether it needs to be re-enabled.
3236
3237==== Removed configuration ====
3238* $wgEnableAPI and $wgEnableWriteAPI – These settings, deprecated in 1.31,
3239  have been removed. (T115414)
3240* $wgSiteSupportPage – This setting, unused since 1.5, was removed.
3241* $wgBrowserBlacklist – This setting, deprecated in 1.30, was removed.
3242* $wgExperimentalHtmlIds – This setting, deprecated since 1.30, was removed.
3243  The 'html5-legacy' value for $wgFragmentMode is no longer accepted.
3244* $wgPasswordSenderName - This setting, ignored since 1.23 by MediaWiki and
3245  most extensions, is no longer set. Instead, you can modify the system
3246  message `emailsender`.
3247* $wgTidyConfig – The experimental Html5Internal and Html5Depurate tidy drivers
3248  were removed. RemexHtml, which is the default, should be used instead.
3249* (T181318) The $wgStyleVersion setting and its appendage to various script and
3250  style URLs in OutputPage, deprecated in 1.31, was removed.
3251* (T140807) The wgResourceLoaderLESSImportPaths configuration option was removed
3252  from ResourceLoader. Instead, use `@import` statements in LESS to import
3253  files directly from nearby directories within the same project.
3254* (T140804) The wgResourceLoaderLESSVars configuration option, deprecated
3255  since 1.30, was removed. Instead, to expose variables from PHP to LESS, use
3256  the ResourceLoaderModule::getLessVars() method.
3257* $wgResourceLoaderValidateStaticJS – This setting, unused since MediaWiki 1.18,
3258  was removed.
3259* Two temporary variables for deploying the feature of filters on change lists,
3260  $wgStructuredChangeFiltersShowPreference introduced in MediaWiki 1.30 and
3261  $wgStructuredChangeFiltersOnWatchlist in 1.31, were removed.
3262
3263=== New features in 1.32 ===
3264* (T112474) Generalized the ResourceLoader mechanism for overriding modules
3265  using a particular page during edit previews.
3266* (T12331) You can now log page creation events by setting $wgPageCreationLog
3267  to true.
3268* Added 'ApiParseMakeOutputPage' hook.
3269* (T174313) Added checkbox on Special:ListUsers to display only users in
3270  temporary user groups.
3271* (T152462) A cookie can now be set when an IP user is blocked to track that
3272  user if they move to a new IP address. This is disabled by default.
3273* (T194950) Added 'ApiMaxLagInfo' hook.
3274* SpecialPage::checkLoginSecurityLevel() will now preserve POST data when
3275  reauthenticating.
3276* FormSpecialPage::execute() will now call checkLoginSecurityLevel() if
3277  getLoginSecurityLevel() returns non-false.
3278* The 'ImageBeforeProduceHTML' hook is now passed three new parameters, $parser,
3279  &$query and &$widthOption, allowing extensions even finer control over the
3280  resulting HTML code.
3281* Added new 'ArticleShowPatrolFooter' hook, which allows extensions to determine
3282  if the [mark as patrolled] link should be shown at the footer of patrollable
3283  pages.
3284* The array of hidden options ($opts) passed to the 'SpecialSearchPowerBox' hook
3285  is now passed by reference, allowing extensions to modify or even unset it.
3286* Added new 'OutputPageAfterGetHeadLinksArray' hook, allowing extensions to
3287  modify the return value of OutputPage#getHeadLinksArray in order to add,
3288  remove or otherwise alter the elements to be output in the page <head>.
3289* (T28934) The 'HistoryPageToolLinks' hook allows extensions to append
3290  additional links to the subtitle of a history page.
3291* The 'GetLinkColours' hook now receives an additional $title parameter,
3292  the Title object of the page being parsed, on which the links will be shown.
3293* (T194731) DifferenceEngine supports multiple slots. Added SlotDiffRenderer to
3294  render diffs between two Content objects, and DifferenceEngine::setRevisions()
3295  to render diffs between two custom (potentially multi-content) revisions.
3296  Added GetSlotDiffRenderer hook which works like GetDifferenceEngine for slots.
3297* Added a temporary action=mcrundo to the web UI, as the normal undo logic
3298  can't yet handle MCR and deadlines are forcing is to put off fixing that.
3299  This action should be considered deprecated and should not be used directly.
3300* Extensions overriding ContentHandler::getUndoContent() will need to be
3301  updated for the changed method signature.
3302* Added a new hook, 'UserGetRightsRemove', which can be used to remove rights
3303  from user. Unlike the 'UserGetRights' it will ensure that removed rights
3304  will not be reinserted.
3305* (T197535) Extensions can now specify PHP versions and PHP extensions they
3306  depend on.
3307
3308=== External library changes in 1.32 ===
3309
3310==== New external libraries ====
3311* Added pear/Net_SMTP v1.8.0.
3312* Added wikimedia/xmp-reader v0.6.0.
3313
3314* Added cache/integration-tests v0.16.0 (dev-only).
3315* Added giorgiosironi/eris v0.10.0 (dev-only).
3316* Added seld/jsonlint v1.7.1 (dev-only).
3317
3318* Added EasyDeflate (unversioned).
3319
3320==== Changed external libraries ====
3321* Updated OOUI from v0.26.3 to v0.29.2.
3322* Updated wikimedia/base-convert from v1.0.1 to v2.0.0.
3323* Updated wikimedia/remex-html from v1.0.3 to v2.0.1.
3324* Updated wikimedia/scoped-callback from v1.0.0 to v2.0.0.
3325** ScopedCallback objects can no longer be serialized.
3326* Updated wikimedia/timestamp from v1.0.0 to v2.2.0.
3327* Updated wikimedia/wrappedstring from v2.3.0 to v3.0.1.
3328* oyejorge/less.php replaced with our fork wikimedia/less.php
3329* Updated wikimedia/ip-set from v1.2.0 to v1.3.0.
3330
3331* Updated composer/spdx-licenses from v1.3.0 to v1.4.0 (dev-only).
3332* Updated mediawiki/mediawiki-codesniffer from v18.0.0 to v22.0.0 (dev-only).
3333* Updated psy/psysh from v0.8.11 to v0.9.6 (dev-only).
3334
3335* Updated CLDRPluralRuleParser from v0.1.0 to v1.3.2-pre.
3336* Updated jquery from v3.2.1 to v3.3.1.
3337* Updated jquery.client from v2.0.0 to v2.0.1.
3338* Updated jquery.i18n from v1.0.4 to v1.0.5.
3339* Updated mustache.js from v0.8.2-d9aa703 to v1.0.0.
3340* Updated OOjs from v2.2.0 to v2.2.2.
3341* Updated qunitjs from v2.4.0 to v2.6.2.
3342* Updated sinonjs from v1.17.3 to v1.17.7.
3343
3344==== Removed external libraries ====
3345* pear/mail_mime-decode was removed.
3346
3347=== Bug fixes in 1.32 ===
3348* SpecialPage::execute() will now only call checkLoginSecurityLevel() if
3349  getLoginSecurityLevel() returns non-false.
3350* (T43720, T46197) Improved page display title handling for category pages
3351* (T65080) Fixed resetting options of some types via API action=options.
3352
3353=== Action API changes in 1.32 ===
3354* Added templated parameters.
3355  * A module can define a templated parameter like "{fruit}-quantity", where
3356    the actual parameters recognized correspond to the values of a multi-valued
3357    parameter. Then clients can make requests like
3358    "fruits=apples|bananas&apples-quantity=1&bananas-quantity=5".
3359  * action=paraminfo will return templated parameter definitions separately
3360    from normal parameters. All parameter definitions now include an "index"
3361    key to allow clients to maintain parameter ordering when merging normal and
3362    templated parameters.
3363* It is now an error to submit too many values for a multi-valued parameter.
3364  This has generated a warning since MediaWiki 1.14.
3365* Assertion failures from the 'assert' and 'assertuser' parameters will no
3366  longer use the action module's custom response format, for the few modules
3367  that use custom formatters that handle errors.
3368* (T198935) User list preferences such as `email-blacklist` and similar
3369  extension preferences are no longer represented as arrays when returned by
3370  action=query&meta=userinfo&uiprop=options.
3371* 'missingparam' errors will now use the prefixed parameter name in the code
3372  and error text, e.g. "noxxfoo" and "The 'xxfoo' parameter must be set" rather
3373  than "nofoo" and "The 'foo' parameter must be set".
3374* action=query&prop=revisions now takes a 'rvslots' parameter to indicate the
3375  multi-content revision slots for which content should be returned. It also
3376  has a new rvprop, 'roles', to indicate which roles have slots. A deprecation
3377  warning will be issued if rvprop=content or rvprop=contentmodel are used
3378  without rvslots.
3379* The rvcontentformat parameter to action=query&prop=revisions has been
3380  deprecated. Clients should be prepared to deal with the default format for
3381  relevant models.
3382* Use of the deprecated parameters rvexpandtemplates, rvgeneratexml, rvparse,
3383  rvdiffto, rvdifftotext, rvdifftotextpst, rvcontentformat, or the deprecated
3384  rvprop=parsetree is forbidden with the new 'rvslots' parameter.
3385* action=query&prop=deletedrevisions, action=query&list=allrevisions, and
3386  action=query&list=alldeletedrevisions are changed similarly to
3387  &prop=revisions (see the three previous items).
3388* (T174032) action=compare now supports multi-content revisions.
3389  * It has a 'slots' parameter to select diffing of individual slots. The
3390    default behavior is to return one combined diff.
3391  * The 'fromtext', 'fromsection', 'fromcontentmodel', 'fromcontentformat',
3392    'totext', 'tosection', 'tocontentmodel', and 'tocontentformat' parameters
3393    are deprecated. Specify the new 'fromslots' and 'toslots' to identify which
3394    slots have text supplied and the corresponding templated parameters for
3395    each slot.
3396  * The behavior of 'fromsection' and 'tosection' of extracting one section's
3397    content is not being preserved. 'fromsection-{slot}' and 'tosection-{slot}'
3398    instead expand the given text as if for a section edit. This effectively
3399    declines T183823 in favor of T185723.
3400* (T198214) The 'disabletidy' parameter to action=parse has been
3401  deprecated; untidy output will not be supported by future wikitext
3402  parsers.
3403* Added intestactionsdetail to action=query&prop=info to allow retrieving the
3404  reasons an action is not allowed.
3405* Deprecated action=query&prop=info inprop=readable in favor of
3406  intestactions=read.
3407* (T212356) When using action=delete on pages with many revisions, the module
3408  may return a boolean-true 'scheduled' and no 'logid'. This signifies that the
3409  deletion will be processed via the job queue.
3410
3411=== Action API internal changes in 1.32 ===
3412* Added 'ApiParseMakeOutputPage' hook.
3413* Parameter names may no longer contain '{' or '}', as these are now used for
3414  templated parameters.
3415* (T194950) Added 'ApiMaxLagInfo' hook.
3416* The following methods now take a RevisionRecord rather than a Revision. No
3417  external callers are known.
3418  * ApiFeedContributions::feedItemAuthor()
3419  * ApiFeedContributions::feedItemDesc()
3420  * ApiQueryRevisionsBase::extractRevisionInfo()
3421* The following deprecated methods have been removed:
3422  * ApiBase::profileIn() (deprecated in 1.25)
3423  * ApiBase::profileOut() (deprecated in 1.25)
3424  * ApiBase::safeProfileOut() (deprecated in 1.25)
3425  * ApiBase::profileDBIn() (deprecated in 1.25)
3426  * ApiBase::profileDBOut() (deprecated in 1.25)
3427  * ApiBase::dieUsage() (deprecated in 1.29)
3428  * ApiBase::dieUsageMsg() (deprecated in 1.29)
3429  * ApiBase::dieUsageMsgOrDebug() (deprecated in 1.29)
3430  * ApiBase::getErrorFromStatus() (deprecated in 1.29)
3431  * ApiBase::parseMsg() (deprecated in 1.29)
3432  * ApiBase::setWarning() (deprecated in 1.29)
3433  * ApiPageSet::getInvalidTitles() (deprecated in 1.26)
3434  * ApiQueryLogEvents::addLogParams() (deprecated in 1.25)
3435  * ApiUsageException::getCodeString() (deprecated in 1.29)
3436  * ApiUsageException::getMessageArray() (deprecated in 1.29)
3437* Class UsageException, deprecated in 1.29, has been removed.
3438* ApiErrorFormatter: Added getFormat() and newWithFormat(). In particular, you
3439  can now easily test $formatter->getFormat() === 'bc', and then call
3440  $formatter->newWithFormat( 'plaintext' ) to get a non-BC formatter.
3441
3442=== Languages updated in 1.32 ===
3443MediaWiki supports over 350 languages. Many localisations are updated regularly.
3444Below only new and removed languages are listed, as well as changes to languages
3445because of Phabricator reports.
3446
3447* (T193566) Added language support for Ambonese Malay (abs).
3448* (T194047) Added language support for Shawiya, Latin script (shy-latn).
3449* (T195940) Added language support for Batak Mandailing (btm).
3450* (T137491) Added language support for Standard Moroccan Amazigh (zgh).
3451* (T198132) Added language support for Manipuri (mni).
3452* (T201276) Added language support for Western Armenian (hyw).
3453* (T201583) Added language support for Mon (mnw).
3454
3455=== Breaking changes in 1.32 ===
3456* $wgRequestTime, deprecated in 1.25, was removed. Use
3457  $_SERVER['REQUEST_TIME_FLOAT'] or WebRequest::getElapsedTime() instead.
3458* The MediaWikiI18N class, deprecated in 1.31, was removed.
3459* QuickTemplate::setTranslator(), deprecated in 1.31, was removed. Use
3460  Skin::msg() instead.
3461* wfInitShellLocale(), deprecated in 1.30, was removed.
3462* wfShellExecDisabled(), deprecated in 1.30, was removed.
3463* The type string for the parameter $lang of DateFormatter::getInstance,
3464  deprecated in 1.31, was removed.
3465* The EDIT_TOKEN_SUFFIX constant deprecated in 1.27, was removed. Use
3466  MediaWiki\Session\Token::SUFFIX instead.
3467* EditPage::isOouiEnabled() deprecated in 1.30, was removed.
3468* mw.util.wikiGetlink(), deprecated in 1.23, was removed. Use mw.util.getUrl()
3469  instead.
3470* (T61113) The following methods and constants from the Revision class, which
3471  were deprecated in 1.25, have now been removed:
3472  * Revision::getRawUser()
3473  * Revision::getRawUserText()
3474  * Revision::getRawComment()
3475* window.gM() from mediawiki.jqueryMsg, deprecated in 1.23, was removed. Use
3476  mw.msg() or mw.message() instead.
3477* mw.util.escapeId(), deprecated in 1.30, was removed. Use
3478  mw.util.escapeIdForAttribute or mw.util.escapeIdForLink instead.
3479* mw.util.updateTooltipAccessKeys(), deprecated in 1.24, was removed. Use
3480  jquery.accessKeyLabel instead.
3481* The SqlDataUpdate class, deprecated in 1.28, has been removed.
3482* The Html5Internal and Html5Depurate tidy driver classes were removed, along
3483  with the Balancer tidy implementation. Both implementations were experimental,
3484  and were replaced by RemexHtml.
3485* (T179624) Job::insert() and ::batchInsert(), deprecated in 1.21, were both
3486  removed. Use JobQueueGroup::singleton()->push() instead.
3487* The jquery.footHovzer module, for mediawiki.debug, was removed.
3488* The es5-shim module, empty and deprecated since 1.29, was removed.
3489* the dom-level2-shim module, empty and deprecated since 1.29, was removed.
3490* the json module, empty and deprecated since 1.29, was removed.
3491* The mediawiki.widgets.visibleByteLimit module alias, deprecated in 1.32, was
3492  removed. Use mediawiki.widgets.visibleLengthLimit instead.
3493* The jquery.farbtastic module, unused since 1.18, was removed.
3494* The 'jquery.expandableField' module, unused since 1.22, was removed.
3495* The hooks 'PreferencesFormPreSave' and 'PreferencesGetLegend' may provide
3496  any HTMLForm object rather than PreferencesForm.
3497* The non namespaced TimestampException class, deprecated in 1.29, was removed.
3498  Use Wikimedia\Timestamp\TimestampException instead.
3499* The global functions codepointToUtf8, hexSequenceToUtf8, utf8ToHexSequence,
3500  utf8ToCodepoint, and escapeSingleString (deprecated in 1.25) were removed.
3501  The UtfNormal\Utils class from the utfnormal library should be used instead.
3502* The deprecated UTF8_ and UNICODE_ constants were removed. The class constants
3503  from the UtfNormal\Constants class from the utfnormal library should be used
3504* The protected methods PHPSessionHandler::returnSuccess() and returnFailure(),
3505  only needed for PHP5 compatibility, have been removed. It now uses the boolean
3506  values `true` and `false` respectively.
3507* The $parserMemc global and wfGetParserCacheStorage(), deprecated since 1.30,
3508  were removed. Use the ParserCache class instead.
3509* ScopedCallback (deprecated in 1.28) was removed. Use Wikimedia\ScopedCallback
3510  instead.
3511* Support for ResourceLoaderModule::getModifiedTime() and getModifiedHash(),
3512  deprecated since 1.26, was removed. Use getDefinitionSummary() instead.
3513* (T195256) Skins are recommended not to rely on JavaScript for the "mw-jump"
3514  and "jump-to-nav" accessibility links. To this end, the "jquery.mw-jump"
3515  is no longer loaded by default. The Vector and MonoBook skins have made a
3516  minor change to implement the toggle feature with CSS instead. To restore
3517  prior functionality, either explicitly load "jquery.mw-jump" in your skin
3518  or refer to T195256 for details on how to make the same change.
3519* Hook 'EditPageBeforeEditChecks' was removed;
3520  use 'EditPageGetCheckboxesDefinition' instead.
3521* Linker::getLinkColour() and DummyLinker::getLinkColour(), deprecated since
3522  1.28, were removed. LinkRenderer::getLinkClasses() should be used instead.
3523* Wikimedia\Rdbms\LoadBalancer::getLaggedSlaveMode(), deprecated in 1.28, has
3524  been removed. Use Wikimedia\Rdbms\LoadBalancer::getLaggedReplicaMode()
3525  instead.
3526* mw.widgets.CategoryMultiselectWidget now uses TagMultiselectWidget instead of
3527  CapsuleMultiselectWidget. The following methods may no longer be used:
3528  * setItemsFromData: Use setValue instead
3529  * getItemsData: Use getItems instead and get the data property
3530* Two OutputPage methods, addMetadataLink() and getMetadataAttribute(), were
3531  removed.  Use addLink() instead.
3532* Another two OutputPage methods, setPageTitleActionText() and
3533  getPageTitleActionText(), were removed.  They did nothing since 1.15 (almost
3534  ten years).  Use setHTMLTitle() directly.
3535* The return value of OutputPage::adaptCdnTTL() has been removed. The
3536  value returned was misleading and probably not what any caller would
3537  have wanted.
3538* All MagicWord static member variables have been removed.  Use appropriate
3539  hooks or MagicWordFactory methods instead.
3540* MagicWord::clearCache() has been removed.  Instead, create a new
3541  MagicWordFactory, such as by calling
3542  resetServiceForTesting( 'MagicWordFactory' ) on a MediaWikiServices.
3543* mw.util.init() has been removed. This function is not needed anymore and was
3544  a no-op function since 1.30.
3545* SpecialPageFactory::resetList() is a no-op.  Call overrideMwServices()
3546  instead.
3547* MediaWiki no longer supports a StartProfiler.php file. Instead, you can set
3548  $wgProfiler and $wgEnableProfileInfo.
3549* The mw.loader.addSource() is now considered a private method, and no longer
3550  supports the `id, url` signature. Use the `Object` parameter instead.
3551* The backwards-compatibility code in HTMLForm to add a drop-down control to an
3552  option that is not set to be a drop-down if the "mw-chosen" class is present,
3553  is now removed.
3554* Several collations were removed. They were workarounds for bugs in the ICU
3555  library and they are no longer needed (as of ICU 57.1):
3556  * 'uppercase-se' (NorthernSamiUppercaseCollation) - use 'uca-se' instead
3557  * 'xx-uca-et' (CollationEt) - use 'uca-et' instead
3558  * 'xx-uca-fa' (CollationFa) - use 'uca-fa' instead
3559* LanguageCode::bcp47() now always returns a valid BCP 47 code.  This means
3560  that some MediaWiki-specific language codes, such as `simple`, are mapped
3561  into valid BCP 47 codes (eg `en-simple`).
3562* The hooks 'SpecialRecentChangesFilters' & 'SpecialWatchlistFilters' deprecated
3563  in 1.23 were removed. Instead, use 'ChangesListSpecialPageStructuredFilters'.
3564  The ChangesListSpecialPage code for these legacy hooks, and their use in
3565  SpecialRecentchanges.php and SpecialWatchlist, was also removed:
3566  * ChangesListSpecialPage->getCustomFilters()
3567  * ChangesListSpecialPage->getFilterGroupDefinitionFromLegacyCustomFilters()
3568  * ChangesListSpecialPage::customFilters
3569* The global function wfUseMW, deprecated since 1.26, has now been removed. Use
3570  the "requires" property of static extension registration instead.
3571* $wgSpecialPages no longer accepts array syntax, deprecated since 1.18.
3572* The MailAddress constructor can no longer be called with a User object,
3573  behaviour which has been deprecated since 1.24.
3574* LBFactory, deprecated since 1.28, has been removed. Instead, use
3575  Wikimedia\Rdbms\LBFactory.
3576* The MimeMagic class, deprecated since 1.28 has been removed. Get a
3577  MimeAnalyzer instance from MediaWikiServices instead.
3578* The '--tidy' option to maintenance/parse.php has been removed.  Tidying
3579  the output is now the default.  Use '--no-tidy' to bypass the tidy
3580  phase.
3581* The global function wfErrorLog, deprecated since 1.25, has now been removed.
3582  Use MWLoggerLegacyLogger::emit or UDPTransport.
3583* The hooks 'SpecialRecentChangesQuery' & 'SpecialWatchlistQuery', deprecated in
3584  1.23, were removed. Instead, use ChangesListSpecialPageStructuredFilters or
3585  ChangesListSpecialPageQuery.
3586* The global function wfUsePHP, deprecated since 1.30, has now been removed. To
3587  assert a newer version of PHP than MediaWiki does, use extension registration.
3588* The hook 'ChangesListSpecialPageFilters', deprecated in 1.29, has now been
3589  removed. Use the 'ChangesListSpecialPageStructuredFilters' hook instead.
3590* DeferredUpdates::setImmediateMode(), deprecated since 1.29, has been removed.
3591* File / MediaHandler::getStreamHeaders(), deprecated since 1.30, was removed.
3592* The hook 'DoEditSectionLink', deprecated since 1.25, has been removed. Use
3593  the hook 'SkinEditSectionLinks' instead.
3594* The hook 'UserGetImplicitGroups', deprecated since 1.25, has been removed.
3595* The global function wfRunHooks, deprecated since 1.25, has now been removed.
3596  Use Hooks::run().
3597* The hook 'UnknownAction', deprecated since 1.19, has now been removed.
3598* The hook 'ParserLimitReport', deprecated since 1.22, has been removed. Use
3599  the hooks 'ParserLimitReportPrepare' and 'ParserLimitReportFormat' instead.
3600* The following deprecated API methods have been removed:
3601  * ApiBase::profileIn() (deprecated in 1.25)
3602  * ApiBase::profileOut() (deprecated in 1.25)
3603  * ApiBase::safeProfileOut() (deprecated in 1.25)
3604  * ApiBase::profileDBIn() (deprecated in 1.25)
3605  * ApiBase::profileDBOut() (deprecated in 1.25)
3606  * ApiBase::dieUsage() (deprecated in 1.29)
3607  * ApiBase::dieUsageMsg() (deprecated in 1.29)
3608  * ApiBase::dieUsageMsgOrDebug() (deprecated in 1.29)
3609  * ApiBase::getErrorFromStatus() (deprecated in 1.29)
3610  * ApiBase::parseMsg() (deprecated in 1.29)
3611  * ApiBase::setWarning() (deprecated in 1.29)
3612  * ApiPageSet::getInvalidTitles() (deprecated in 1.26)
3613  * ApiQueryLogEvents::addLogParams() (deprecated in 1.25)
3614  * ApiUsageException::getCodeString() (deprecated in 1.29)
3615  * ApiUsageException::getMessageArray() (deprecated in 1.29)
3616* Class UsageException, deprecated in 1.29, has been removed.
3617* MediaWiki no longer has a 'JavaScript-powered' wikitext toolbar built in. The
3618  old "bulletin board style toolbar", known as "the 2006 wikitext editor", has
3619  been removed, and instead sysadmins will be required to choose one (or more)
3620  of the several extensions available for this purpose if they need the
3621  functionality. The MediaWiki "tarball" releases have included the replacement
3622  extension for this, the WikiEditor extension aka "the 2010 wikitext editor",
3623  for many years now. As part of this, several parts of MediaWiki have been
3624  removed or simplified:
3625  * The user option 'showtoolbar' (shown as "Show edit toolbar") is no longer
3626    available; if an extension adds a toolbar via the EditPageBeforeEditToolbar
3627    hook, it will be shown; extensions should provide a specific user preference
3628    to disable themselves as needed.
3629  * The public methods Language::getImageFile() and ::getImageFiles(), and the
3630    related specification of $imageFiles within individual languages' code file,
3631    as well as the referenced static media assets, all of which were only used
3632    inside MediaWiki itself for providing the icons for the old toolbar, have
3633    been removed without explicit deprecation.
3634  * The internal ResourceLoader module "mediawiki.toolbar", which is unused
3635    except by MediaWiki itself and back-compatibility code, has been removed.
3636  * The internal ResourceLoaderEditToolbarModule class has been removed.
3637
3638=== Deprecations in 1.32 ===
3639* HTMLForm::setSubmitProgressive() is deprecated. No need to call it. Submit
3640  button is already marked as progressive.
3641* Skin::setupSkinUserCss() is deprecated. Adding of modules to load
3642  has been centralised to Skin::getDefaultModules(), which is now capable
3643  of queueing style modules as well.
3644* OutputPage::addModuleScripts() and ParserOutput::addModuleScripts are
3645  deprecated. Use addModules() instead.
3646* Overriding SearchEngine::{searchText,searchTitle,searchArchiveTitle}
3647  in extending classes is deprecated.  Extend related doSearch* methods
3648  instead.
3649* The following 'mediawiki.api' plugin modules were merged into mediawiki.api
3650  and deprecated: mediawiki.api.category, mediawiki.api.edit,
3651  mediawiki.api.login, mediawiki.api.options, mediawiki.api.parse,
3652  mediawiki.api.upload, mediawiki.api.user, mediawiki.api.watch,
3653  mediawiki.api.messages, and mediawiki.api.rollback.
3654* ApiBase::truncateArray() is deprecated. No replacement, as nothing is known
3655  to use it.
3656* WatchAction::getUnwatchToken is deprecated. Use WatchAction::getWatchToken
3657  with the 'unwatch' action parameter instead.
3658* IcuCollation::getICUVersion() is deprecated, as you can just use the PHP
3659  constant INTL_ICU_VERSION directly in all versions that MediaWiki supports.
3660* Parser::fetchFile() is deprecated. Use ::fetchFileAndTitle() instead.
3661* The ApiQueryContributions class has been renamed to ApiQueryUserContribs.
3662* The XMPInfo, XMPReader, and XMPValidate classes have been deprecated in favor
3663  of the namespaced classes provided by the wikimedia/xmp-reader library.
3664* SearchResultSet::{next,rewind} are deprecated. Calling code should
3665  use foreach on the SearchResultSet, or the extractResults method. Extending
3666  code should override extractResults.
3667* Instantiating SearchResultSet directly is deprecated. SearchEngine
3668  implementations must subclass SearchResultSet for their purposes.
3669* SearchResult::setExtensionData argument has been changed from accepting an
3670  array to accepting a Closure that returns the array when called.
3671* Class CryptRand, everything in MWCryptRand except generateHex() and function
3672  MediaWikiServices::getInstance()->getCryptRand() are deprecated, use
3673  random_bytes() to generate cryptographically secure random byte sequences.
3674* Parser::getConverterLanguage() is deprecated.  Use ::getTargetLanguage()
3675  instead.
3676* Language::markNoConversion() is deprecated.  It confused readers because
3677  it had unexpected behavior (only marking text if it looked like a URL)
3678  and was only used in a single place in the code.  Use
3679  LanguageConverter::markNoConversion() instead.
3680* (T197492) Language::truncate() was soft deprecated in 1.31 and is
3681  hard deprecated in this release.  It has been split into two similar
3682  methods, Language::truncateForVisual() and Language::truncateForDatabase(),
3683  which measure length in characters and bytes, respectively.  Use
3684  Language::truncateForVisual() when possible to provide equity to users
3685  of multibyte scripts.
3686* (T176526) EditPage::getContextTitle() falling back to $wgTitle when the
3687  context title is unset is now deprecated; anything creating an EditPage
3688  instance should set the context title via ::setContextTitle().
3689* The 'jquery.hidpi' module (polyfill for IMG srcset) is deprecated.
3690* ResourceLoaderStartUpModule::getStartupModules() and ::getLegacyModules()
3691  are deprecated. These concepts are obsolete and have no replacement.
3692* String type for $lang of DifferenceEngine::setTextLanguage is deprecated.
3693* The following methods of OutputPage are now deprecated in favour
3694  of using showFatalError directly: OutputPage::showFileDeleteError()
3695  OutputPage::showFileNotFoundError(), OutputPage::showFileRenameError()
3696  OutputPage::showFileCopyError() and OutputPage::showUnexpectedValueError().
3697* The Replacer, DoubleReplacer, HashtableReplacer, and RegexlikeReplacer
3698  classes are now deprecated. Use a Closure instead.
3699* (T194263) ContentHandler::makeParserOptions() is deprecated. Use
3700  WikiPage::makeParserOptions() or ParserOptions::newCanonical() instead.
3701* (T100681) Use of the Parsoid v1 API with the VirtualRESTService, deprecated in
3702  MediaWiki 1.26,  is now hard-deprecated. All known clients were converted to
3703  the Parsoid v3 API in May 2015.
3704* $input is deprecated in hook 'LogEventsListGetExtraInputs'. Use
3705  $formDescriptor instead.
3706* SearchEngine::transformSearchTerm( $term ) should no longer be called prior
3707  to running searchText. This method was mainly implemented to support the
3708  'prefix' URI param in SpecialSearch, but there are no reasons to expose this
3709  logic as it should be handled internally by SearchEngine implementations
3710  supporting this feature. SearchEngine implementations should no longer
3711  override this methods.
3712* SearchEngine::replacePrefixes( $query ) should no longer be called prior
3713  to running searchText/searchTitle.
3714* (T199657) Messages for $wgFilterLogTypes labels should be no longer be in the
3715  'log-show-hide-[type]' format. Instead use 'logeventslist-[type]-log'.
3716* Global functions  wfArrayFilter() and wfArrayFilterByKey() are deprecated.
3717  use array_filter() directly.
3718* The $wgShowSQLErrors global is deprecated and nonfunctional.
3719  Set $wgShowExceptionDetails and/or $wgShowHostnames instead.
3720* The $wgShowDBErrorBacktrace global is deprecated and nonfunctional.
3721  Set $wgShowExceptionDetails instead.
3722* Public access to the DifferenceEngine properties mOldid, mNewid, mOldRev,
3723  mNewRev, mOldPage, mNewPage, mOldContent, mNewContent, mRevisionsLoaded,
3724  mTextLoaded and mCacheHit is deprecated. Use getOldid() / getNewid() /
3725  getOldRevision() / getNewRevision() for the first four (note that the
3726  revision ones return a RevisionRecord, not a Revision), do your own lookup
3727  for page/content.
3728* The $wgExternalDiffEngine value 'wikidiff2' is deprecated. To use wikidiff2
3729  just enable the PHP extension, and it will be autodetected.
3730* (T194731) DifferenceEngine properties mOldContent and mNewContent and methods
3731  setContent(), generateContentDiffBody(), generateTextDiffBody() and textDiff()
3732  are deprecated. To interact with a single slot, use a SlotDiffRenderer (and
3733  subclass it to customize diff rendering); to diff custom (e.g. unsaved)
3734  content, use setRevisions(). Subclassing DifferenceEngine should only be done
3735  to customize page-level diff properties (such as the navigation header).
3736* The wfUseMW function, soft-deprecated in 1.26, is now hard deprecated.
3737* All MagicWord static methods are now deprecated.  Use the MagicWordFactory
3738  methods instead.
3739* PasswordFactory::init is deprecated. To get a password factory with the
3740  standard configuration, use
3741  MediaWikiServices::getInstance()->getPasswordFactory.
3742* $wgContLang is deprecated, use
3743  MediaWikiServices::getInstance()->getContentLanguage() instead.
3744* $wgParser is deprecated, use MediaWikiServices::getInstance()->getParser()
3745  instead.
3746* wfGetMainCache() is deprecated, use ObjectCache::getLocalClusterInstance()
3747  instead.
3748* wfGetCache() is deprecated, use ObjectCache::getInstance() instead.
3749* All SpecialPageFactory static methods are deprecated. Instead, call the
3750  methods on a SpecialPageFactory instance, which may be obtained from
3751  MediaWikiServices.
3752* mw.user.stickyRandomId was renamed to the more explicit
3753  mw.user.getPageviewToken to better capture its function.
3754* Passing Revision objects to ContentHandler::getUndoContent() is deprecated,
3755  Content object should be passed instead.
3756* (T197179) Parameters 'notice', 'notice-messages', 'notice-message',
3757  previously used by OOUI HTMLForm fields, are now deprecated. Use
3758  'help', 'help-message', 'help-messages' instead.
3759* (T197179) HTMLFormField::getNotices() is now deprecated.
3760* The jquery.localize module is now deprecated. Use jquery.i18n instead.
3761* The SecondaryDataUpdates hook was deprecated in favor of RevisionDataUpdates,
3762  or overriding ContentHandler::getSecondaryDataUpdates (T194038).
3763* The WikiPageDeletionUpdates hook was deprecated in favor of
3764  PageDeletionDataUpdates, or overriding ContentHandler::getDeletionDataUpdates
3765  (T194038).
3766* Content::getSecondaryDataUpdates has been deprecated in favor of
3767  ContentHandler::getSecondaryDataUpdates() for overriding by extensions
3768  (T194038).
3769  Application logic should call WikiPage::doSecondaryDataUpdates() (T194037).
3770* Content::getDeletionUpdates has been deprecated in favor of
3771  ContentHandler::getDeletionUpdates() for overriding by extensions (T194038).
3772  Application logic should call WikiPage::doSecondaryDataUpdates() (T194037).
3773* (T198214) Old Tidy-related configuration settings, which were soft-deprecated
3774  in MediaWiki 1.26, have now been hard deprecated. This affects $wgUseTidy,
3775  $wgTidyBin, $wgTidyConf, $wgTidyOpts, $wgTidyInternal, and $wgDebugTidy. Use
3776  $wgTidyConfig instead.
3777* All Tidy configurations other than Remex have been hard deprecated;
3778  future parsers will not emit compatible output for these configurations.
3779  In particular, running MediaWiki with tidy disabled has been deprecated.
3780* (T198214) OutputPage::addWikiText(), OutputPage::addWikiTextWithTitle(),
3781  and OutputPage::addWikiTextTitle() have been deprecated, since they
3782  can result in untidy output.  In addition OutputPage::addWikiTextTidy()
3783  and OutputPage::addWikiTextTitleTidy() was deprecated to make naming new
3784  methods consistent.  Use OutputPage::addWikiTextAsInterface() or
3785  OutputPage::addWikiTextAsContent() instead, which ensures the output is
3786  tidy and clarifies whether content-language specific postprocessing should
3787  be done on the text.
3788* OutputPage::parse() and OutputPage::parseInline() have been deprecated
3789  due to untidy output and inconsistent handling of wrapper divs and
3790  interface/content language defaults.  Use OutputPage::parseAsContent(),
3791  OutputPage::parseAsInterface(), or OutputPage::parseInlineAsInterface()
3792  as appropriate.
3793* QuickTemplate::msgHtml() and BaseTemplate::msgHtml() have been deprecated
3794  as they promote bad practises. I18n messages should always be properly
3795  escaped.
3796* Skin::getDynamicStylesheetQuery() has been deprecated. It always
3797  returns action=raw&ctype=text/css which callers should use directly.
3798* Class LegacyFormatter is deprecated.
3799* Use of CommentStore::insertWithTempTable() with 'img_description' is
3800  deprecated. Use CommentStore::insert() instead.
3801* Language::setCode is deprecated as public function. Use Language::factory
3802  to create a new Language object with a different language code.
3803* Several classes have been moved from the MediaWiki\Storage\ namespace to the
3804  MediaWiki\Revision\ namespace. The old class names are aliased for
3805  compatibility, but are deprecated. Classes are IncompleteRevisionException,
3806  MutableRevisionRecord, MutableRevisionSlots, RevisionAccessException,
3807  RevisionArchiveRecord, RevisionFactory, RevisionLookup, RevisionRecord,
3808  RevisionSlots, RevisionStore, RevisionStoreRecord, SlotRecord, and
3809  SuppressedDataException.
3810* When using OOUI HTMLForm containing an 'info' field which uses the 'rawrow'
3811  option, it is now deprecated to give its contents (the 'default' option)
3812  as a string. They should be given as a OOUI\FieldLayout object instead.
3813  Notably, this affects fields defined in the 'GetPreferences' hook, because
3814  Special:Preferences uses an OOUI form now. (If possible, don't use 'rawrow'.)
3815* In Skin::doEditSectionLink omitting the parameters $tooltip and $lang is
3816  deprecated. For the $lang parameter, types other than Language are
3817  deprecated.
3818* The $wgUseKeyHeader configuration option and the
3819  OutputPage::getKeyHeader() method have been deprecated; the relevant
3820  draft IETF spec expired without becoming a standard.
3821* Deprecated API action=query&prop=info inprop=readable in favor of
3822  intestactions=read.
3823
3824=== Other changes in 1.32 ===
3825* (T198811) The following tables have had their UNIQUE indexes turned into
3826  proper PRIMARY KEYs for increased maintainability: interwiki, page_props,
3827  protected_titles and site_identifiers.
3828* OOUI HTMLForm will now display help text inline after the input field,
3829  rather than in a popup. Previous behavior can be restored by using
3830  `'help-inline' => false`.
3831* The archive table's ar_rev_id field is now unique.
3832* Special:BotPasswords now requires reauthentication.
3833* (T174023) Multi-Content Revision (MCR) capabilities were introduced into the
3834  storage layer and have basic support for display. No user interface exists
3835  yet for creating or managing content in slots beides the main slot. See
3836  <https://www.mediawiki.org/wiki/Multi-Content_Revisions> for more
3837  information.
3838* The image_comment_temp database table has been removed. Since all access
3839  should be mediated by the CommentStore class, this change shouldn't affect
3840  external code.
3841* (T206147) Database::close() will no longer commit any open transactions.
3842* (T64103) Dropped columns category.cat_hidden, site_stats.ss_admins, and
3843  recentchanges.rc_cur_time from the PostgreSQL schema.
3844
3845= MediaWiki 1.31 =
3846
3847== MediaWiki 1.31.12 ==
3848
3849This is a maintenance release of the MediaWiki 1.31 branch.
3850
3851=== Changes since MediaWiki 1.31.11 ===
3852* Fixed issues relating to User::isRegistered() not existing in 1.31.
3853
3854== MediaWiki 1.31.11 ==
3855
3856This is a security and maintenance release of the MediaWiki 1.31 branch.
3857
3858=== Changes since MediaWiki 1.31.10 ===
3859* Fix undefined $wgRedirectOnLogin.
3860* (T251661, T265313) CentralIdLookup::factoryNonLocal can return null.
3861* (T263592) media: Fix case of FlashPixVersion in
3862  FormatMetadata::makeFormattedData().
3863* (T265223) BaseTemplate: Guard against passing zero arg to array_merge().
3864* (T266418) composer.json: add requirement for composer-plugin-api ^1.1.
3865* (T260631, T260633), BotPassword::save() now returns a Status object for the
3866  result rather than a bool. The length of the bot password grants and
3867  restriction fields are now validated, and an error will be thrown if it
3868  would be truncated by the database.
3869* (T264536, T233012) SectionProfiler: Do not attempt to use null values as
3870  arrays.
3871* (T269178) MemcachedClient: Cast Resource to integer.
3872* (T268917, CVE-2020-35475) SECURITY: Use Xml::element in SpecialUserrights for
3873  sanity.
3874* (T268938, CVE-2020-35479) SECURITY: BlockLogFormatter can output raw html.
3875* (T205908, CVE-2020-35477) SECURITY: Unable to change visibility of log entries
3876  when MediaWiki:Mainpage uses Special:MyLanguage.
3877* (T120883, CVE-2020-35480) SECURITY: Divergent behavior for contributions and
3878  user pages of hidden users and missing users.
3879
3880== MediaWiki 1.31.10 ==
3881
3882This is a maintenance release of the MediaWiki 1.31 branch.
3883
3884=== Changes since MediaWiki 1.31.9 ===
3885* Fixed issues relating to backporting of changes for T260485.
3886
3887== MediaWiki 1.31.9 ==
3888
3889This is a security and maintenance release of the MediaWiki 1.31 branch.
3890
3891=== Changes since MediaWiki 1.31.8 ===
3892* In the web installer, use secure session cookies.
3893* (T257207) shell: Expand documentation in firejail.profile.
3894* Added $wgForceHTTPS, which makes the HTTP to HTTPS redirect be unconditional
3895  and suppresses various hacks needed to support mixed HTTP/HTTPS wikis. We
3896  recommend this be set to true on pure HTTPS wikis.
3897* Added $wgCookieSameSite, which allows login cookies to be sent with
3898  SameSite=None. This is required for cross-site CentralAuth autologin after
3899  Chrome 84.
3900* Added $wgUseSameSiteLegacyCookies, which adds a compatibility hack to
3901  SameSite=None cookies for browsers which implemented an incompatible draft
3902  version of the specification.
3903* (T191537) Disable WebResponse setters for post-send processing.
3904* (T198525) WebReponse: Use values altered in 'WebResponseSetCookie' hook.
3905* Fix runBatchedQuery.php for no result from select.
3906* (T130906) Add Edge to MediaWiki:Clearyourcache.
3907* Use IPset in MWRestrictions::checkIP.
3908* (T260031) Add application/font-sfnt to MimeMap for ttf files.
3909* shell: Make ->restrict( RESTRICT_NONE ) actually work.
3910* (T183759) Fixes shell edge-cases in Windows.
3911* (T258390) Add CentralIdLookup::factoryNonLocal().
3912* (T246991) User: Fix pingLimiter() to use makeGlobalKey() for global rate
3913  limits.
3914* (T251661, CVE-2020-25827) SECURITY: User::pingLimiter: add user-global rate
3915  limit type.
3916* (T246991) User: enforce pingLimiter() expiry time.
3917* (T260232) don't include null page ids in query list for category dumps.
3918* (T251506) Sanitizer: Truncate IDs to a reasonable length.
3919* Explicitly wrap some XML calls in libxml_disable_entity_loader().
3920* (T263455 T247285) Set EnableJavaScriptTest to true in
3921  includes/DevelopmentSettings.php.
3922* (T232568, CVE-2020-25813) SECURITY: Special:UserRights exposes the existence
3923  of hidden users.
3924* (T258763, CVE-2020-17367, CVE-2020-17368) SECURITY: Prevent invoking
3925  firejail's --output functionality.
3926* (T86738, CVE-2020-25814) SECURITY: mediawiki.jqueryMsg: Sanitize URLs and
3927  'style' attribute.
3928* (T115888, CVE-2020-25828) SECURITY: mediawiki.js: Escape HTML in
3929  mw.message( ... ).parse().
3930* (T260485, CVE-2020-25869) SECURITY: ActorMigration: Load user from the correct
3931  database.
3932* (T260485, CVE-2020-25869) SECURITY: ensure actor ID from correct wiki is used.
3933
3934== MediaWiki 1.31.8 ==
3935
3936This is a security and maintenance release of the MediaWiki 1.31 branch.
3937
3938=== Changes since MediaWiki 1.31.7 ===
3939* (T199809) Don't invalidate BotPasswords if a password reset email is sent.
3940* (T247017) PasswordReset performance improvements.
3941* (T250568) Work around change in SimpleXMLElement behavior introduced in PHP
3942  7.3.17.
3943* Remove some rotten and out of date documentation.
3944* (T252311) Improvements to some older SQLite update patches.
3945* (T240307) Minor fixes to extension.schema.v2.json and
3946  extension.schema.v1.json.
3947* (T199474) Set rc_patrolled to 2 for autopatrolled changes in
3948  rebuildrecentchanges.php.
3949* (T229461) Update the change_tag table in rebuildrecentchanges.php.
3950* (T206476) Call ob_start() before running tests.
3951* (T234450) Per-user concurrency in SpecialContributions can now be limited by
3952  setting $wgPoolCounterConf['SpecialContributions'] appropriately.
3953* (T248947) SECURITY: img_auth.php may leak private extension images into the
3954  public cache.
3955
3956== MediaWiki 1.31.7 ==
3957
3958This is a security and maintenance release of the MediaWiki 1.31 branch.
3959
3960=== Changes since MediaWiki 1.31.6 ===
3961* (T193565, T234022) Re-add DB domain sanity checks to LoadBalancer.
3962* Use proper SemVer comparison in CheckComposerLockUpToDate.
3963* (T212738) Add the MW_VERSION constant, global $wgVersion is soft deprecated.
3964* Update comment about PHP versions supported by The PHP Group.
3965* (T247215) Fix output of RecountCategories::doWork().
3966* Add check for page existence to view.php maintenance script.
3967* (T247580) Disable some broken Selenium tests.
3968* (T236509) SECURITY: Fix HTML escaping in UserGroupMembership::getLink().
3969* (T246602) SECURITY: jquery.makeCollapsible allows applying event handler to
3970  any CSS selector.
3971
3972== MediaWiki 1.31.6 ==
3973
3974This is a security and maintenance release of the MediaWiki 1.31 branch.
3975
3976=== Changes since MediaWiki 1.31.5 ===
3977* (T181658) Do not insert page titles into querycache.qc_value.
3978* (T206013) Suppress errors when reading invalid XML file properties.
3979* (T237931) Remove references to pg_attrdef.adsrc in Postgres code.
3980* Use correct value for 'sslmode' in DatabasePostgres.
3981* (T232866) Fix support for HTTP/2 in MultiHttpClient.
3982* (T227461) Stop calling deprecated Redis delete functions.
3983* (T239561) Mark options as requiring parameters in addSite.php.
3984* (T239734) Replace deprecated lSize with lLen in Redis code.
3985* (T192134) SECURITY: Do not allow user scripts on Special:PasswordReset.
3986* (T239428) ApiEditPage: Test for bad redirect targets.
3987* (T233342) rdbms: Log debug message traces as 'exception.trace' instead of
3988  'trace'.
3989* (T226751) media: Log and fail gracefully on invalid EXIF coordinates.
3990* (T212067) Work around PHP bug in parse_url.
3991
3992== MediaWiki 1.31.5 ==
3993
3994This is a maintenance release of the MediaWiki 1.31 branch.
3995
3996=== Changes since MediaWiki 1.31.4 ===
3997* Fix extra newlines in installer.
3998* Followup T230402, PermissionManager doesn't exist until 1.33, so fix the
3999  backported patches to use User::isAllowed() instead.
4000
4001== MediaWiki 1.31.4 ==
4002
4003This is a security and maintenance release of the MediaWiki 1.31 branch.
4004
4005=== Changes since MediaWiki 1.31.3 ===
4006* (T207100) Updated LanguageTr for dotted and dotless I in PHP 7.3.
4007* The ImgAuthModifyHeaders hook was added to img_auth.php to allow modification
4008  of headers in private wikis.
4009* (T230402) SECURITY: Add permission check for suppressed account to
4010  Special:Redirect.
4011* Add helper for HTTPFileStreamer header syntax.
4012* (T118799) Fix XMP parser errors due to trailing nullchar.
4013* (T233119) Improve documentation for the MinimumPasswordLengthToLogin policy.
4014* (T202183) Give more specific error messages on Special:Redirect.
4015* Cache redirects from Special:Redirect.
4016* (T231386) dispatchUser() should use a 302 http status code.
4017* (T227662) Split down patch-comment-table.sql and patch-actor-table.sql into
4018  separate files to help allieviate potential migration problems.
4019* Make SQLite's patch-add-3d.sql a no-op to prevent clobbering other database
4020  updates.
4021
4022== MediaWiki 1.31.3 ==
4023
4024This is a maintenance release of the MediaWiki 1.31 branch.
4025
4026=== Changes since MediaWiki 1.31.2 ===
4027* (T225558) Update installer link to PHP intl.
4028* (T225496) Detect APC for MainCacheType in CLI installer.
4029* (T226766) Remove jetbrains/phpstorm-stubs from composer dev dependencies.
4030* (T202211) Fix SQLite patch-(image|page|template)links-fix-pk.sql column order.
4031
4032== MediaWiki 1.31.2 ==
4033
4034This is a security and maintenance release of the MediaWiki 1.31 branch.
4035
4036Required PHP version has been increased from 7.0.0 to 7.0.13.
4037
4038=== Changes since MediaWiki 1.31.1 ===
4039* (T204729) WatchedItemStore::countVisitingWatchersMultiple() shouldn't query
4040  all titles when asked for none.
4041* (T205967) Fix syntax error typo in postgres database upgrade file.
4042* (T200254) Add pear/Net_SMTP 1.7.3 to composer dependencies.
4043* (T206765) Load installer i18n when running update.php.
4044* (T109121) Remove deprecated pear/mail_mime-decode from composer suggested
4045  libraries.
4046  [Also in the bundled composer /vendor directory.]
4047* Various PHP 7.2 and 7.3 compatibility fixes:
4048  * (T200595, T206974) Fix PHP 7.3 warnings of using "continue" in some
4049    scenarios instead of "break".
4050    * (T206976, T206977) Also in the bundled LocalisationUpdate and
4051      ParserFunctions extensions.
4052  * (T206979) Fix PHP 7.3 warnings of using "compact()" when some variables may
4053    not be set.
4054  * (T215632) FormatMetadata and UploadStash regexes fixed to be PHP
4055    7.3-compatible.
4056  * Fix PHP warnings "preg_replace(): [...] invalid range in character class.
4057  * Avoid PHP 7.2 warnings in DBConRefTest about count() on non-Countable.
4058  * Suppress "Headers already sent" in PHP 7.2 too.
4059  * (T206476) Output only to stderr in unit tests.
4060  * (T207112) Add session_write_close() calls to SessionManager tests.
4061  * oyejorge/less.php replaced with our fork wikimedia/less.php
4062  * (T209756) Updated wikimedia/ip-set from 1.2.0 to 1.3.0.
4063  * (T213489) Avoid session double-start in Setup.php.
4064  * (T206975) Switch to our fork of less.php.
4065* (T207540) Include IP address in "Login for $1 succeeded" log entry.
4066* (T201781) Database: Allow selectFieldValues() to accept SQL fragments.
4067* (T205765) installer: Don't link to the obsolete "Extension Matrix" page.
4068* (T206013) Update ImportableUploadRevisionImporter for interwiki usernames.
4069* (T207541) Pass an email address, not a MailAddress, to mail().
4070* (T207603) SECURITY: User JS may no longer be loaded with mime type
4071  text/javascript if there is no account associated with the username.
4072* (T112937, T113042) SECURITY: Do not allow loading pages raw with a
4073  text/javascript MIME
4074  type if non-admins can edit the page.
4075* (T17491) <ins>/<del> elements can be phrasing or flow.
4076* (T200827) RemexCompatMunger: Don't call endTag() in case B/b
4077* (T207088) Upgrade wikimedia/remex-html to 2.0.1.
4078  [Also in the bundled composer /vendor directory.]
4079* (T194052) Updated wikimedia/base-convert from 1.0.1 to 2.0.0.
4080  [Also in the bundled composer /vendor directory.]
4081* (T199494) Fix notices in maintenance/removeUnusuedAccounts.php.
4082* Require ext-fileinfo in composer.json, per PHPVersionCheck.
4083* (T176390) Bundled LocalisationUpdate extension: Handle exceptions from
4084  GitHubFetcher.
4085* (T208255) Completion search should not change the search query.
4086* (T209870) Fix SQL syntax error in MS-SQL initialisation file for new wikis.
4087* (T185049) LogFormatter: Fail softer when trying to link an invalid titles.
4088* (T210998) Properly set $wgLanguageCode in the generated LocalSettings.php
4089  if --lang is used with the command-line installer (install.php).
4090* (T211061) ImageListPager: Actor migration for buildQueryConds().
4091* (T209335) Clarify the default sidebar 'Help' link is about MediaWiki itself.
4092* Fix addition of ug_expiry column to user_groups table on MSSQL.
4093* (T204767) Add join conditions to ActiveUsersPager.
4094* (T210621) User: Bypass repeatable-read when creating an actor_id.
4095* (T204531) rdbms: reduce LoadBalancer replication log spam.
4096* (T195525) Fix db error outage page.
4097* (T208871) The hard-coded Google search form on the database error page was
4098  removed.
4099* (T176097) Fix flaky MessageBlobStoreTest assertion failures.
4100* (T209423) Update required PHP version to 7.0.13.
4101* (T209885) Prevent populateSearchIndex.php from breaking once actor migration
4102  has been started.
4103* (T216968) Return pageid as int in both list=iwbacklinks and
4104  list=langbacklinks.
4105* (T215169) Fix for Database::update() with IGNORE option fails on PostgreSQL.
4106* (T204423) Backport support for hyphenated DB names in JobQueueGroup.
4107* (T199474) Fix typo in rebuildrecentchanges.php resulting in rogue flags.
4108* (T218608) SECURITY: Fix an issue that prevents Extension:OAuth working when
4109  $wgBlockDisablesLogin is true.
4110* (T216029) Chrome redirects to Special:BadTitle after editing a section with
4111  a non-Latin name on a page with non-Latin characters in title.
4112* (T219728) Added support for new Japanese era name "Reiwa".
4113* (T25227) SECURITY: action=logout now requires to be posted and have a csrf
4114  token.
4115* Updated cssjanus/cssjanus from 1.2.0 to 1.3.0.
4116* (T222385) resourceloader: Use AND instead of OR for upsert conds in
4117  saveFileDependencies().
4118* (T224374) Fix message parameters so that the message that says SQLite is out
4119  of date makes sense.
4120* SpecialPage::checkLoginSecurityLevel() will now preserve POST data when
4121  reauthenticating.
4122* FormSpecialPage::execute() will now call checkLoginSecurityLevel() if
4123  getLoginSecurityLevel() returns non-false.
4124* (T197279) SECURITY: Fix reauth in Special:ChangeEmail.
4125* (T208881) SECURITY: blacklist CSS var().
4126* (T209794) SECURITY: rate-limit and prevent blocked users from changing email.
4127* (T199540) SECURITY: API: Respect $wgBlockCIDRLimit in action=block.
4128* (T212118) SECURITY: Fix cache mode for (un)patrolled recent changes query.
4129* (T222036, T222038) SECURITY: Add permission check for user is permitted to
4130  view the log type.
4131* (T221739) SECURITY: resources: Patch jQuery 3.2.1 for CVE-2019-11358.
4132
4133== MediaWiki 1.31.1 ==
4134
4135This is a security and maintenance release of the MediaWiki 1.31 branch.
4136
4137=== Changes since MediaWiki 1.31.0 ===
4138* (T169545, CVE-2018-0503) SECURITY: $wgRateLimits entry for 'user' overrides
4139  'newbie'.
4140* (T194605, CVE-2018-0505) SECURITY: BotPasswords can bypass CentralAuth's
4141  account lock.
4142* (T199029, CVE-2018-13258) SECURITY: Tarball was missing .htaccess files.
4143* (T197229) Bundle Nuke extension, it was accidentally omitted.
4144* (T193995) Fix undefined patchPath() method call in parser tests.
4145* (T198687) Fix various selectFields methods to use the string 'NULL', not null.
4146* Special:BotPasswords now requires reauthentication.
4147* (T191608, T187638) Add 'logid' parameter to Special:Log.
4148* (T193829) Indicate when a Bot Password needs reset.
4149* (T198037) GitInfo: Don't try shelling out if it's disabled.
4150* (T151415) Log email changes.
4151* (T197206) Fix performance regression when multiple DB used without caching.
4152* (T197030) PHPSessionHandler: Suppress headers warnings in initialize().
4153* (T182377, T196793) Exif: Guard against uncountable tag values.
4154* (T200861) Fix total breakage of SQLite web upgrade.
4155* (T200864) Fix pingback over-reporting on non-MySQL databases
4156* (T202550) Unbreak SpecialListusersHeaderForm and SpecialListusersHeader
4157  hooks.
4158
4159== MediaWiki 1.31.0 ==
4160
4161=== Changes since MediaWiki 1.31.0-rc.2 ===
4162* (T195783) Initialize PSR-4 namespaces at same stage as normal autoloader.
4163* (T196092) Hide MySQL binary/utf-8 charset option in the installer.
4164* (T196185) Don't allow setting $wgDBmysql5 in the installer.
4165* (T196125) php-memcached 3.0 (provided with PHP 7.0) is now supported.
4166* (T182366) UploadBase::checkXMLEncodingMissmatch() now works on PHP 7.1+
4167* (T118683) Fix exception from &$user deref on HHVM in the TitleMoveComplete
4168  hook.
4169* (T196672) The mtime of extension.json files is now able to be zero
4170* (T180403) Validate $length in padleft/padright parser functions.
4171* (T143790) Make $wgEmailConfirmToEdit only affect edit actions.
4172
4173=== Changes since MediaWiki 1.31.0-rc.0 ===
4174* (T33223) Drop archive.ar_text and ar_flags.
4175* Add default edit rate limit of 90 edits/minute for all users.
4176* (T187645) Use codepoint as tiebreaker when getting first-letters in
4177  IcuCollation.
4178* (T191947) Don't shell during the installer if shelling out is disabled.
4179* (T194319) Improve duplicate config setting exception as part of extension
4180  registration.
4181* (T195211) Don't require trailing slash in PSR-4 autoloader directory.
4182* (T186565) Fix PHP Notice from `ob_end_flush()` in `FileRepo::streamFile()`.
4183* Do not incorrectly hide namespace input field in the installer.
4184* (T186456) Refactor checks looking for PEAR maik libraries to be clearer.
4185
4186=== Important pre-upgrade notes for 1.31 ===
4187* If you're using MySQL, SQLite, or MSSQL, are not using update.php to apply
4188  schema changes, and cannot have downtime to run migrateArchiveText.php and
4189  apply patch-drop-ar_text.sql manually, you'll have to apply a default value
4190  to the ar_text and ar_flags columns of the archive table or make those
4191  columns nullable before upgrading to MediaWiki 1.31.
4192  maintenance/archives/patch-nullable-ar_text.sql shows how to do this for
4193  MySQL.
4194
4195=== Configuration changes in 1.31 ===
4196* $wgEnableAPI and $wgEnableWriteAPI are now deprecated and will be removed in
4197  a future version. The API is now considered to be stable, secure and
4198  essential.
4199* $wgUsejQueryThree was removed, as it is now the default. This was documented
4200  as a temporary variable during the migration period, deprecated since 1.29.
4201* $wgLogoHD has been updated to support svg images and uses $wgLogo where
4202  possible for fallback images such as png.
4203* (T44246) $wgFilterLogTypes will no longer ignore 'patrol' when user does not
4204  have the right to mark things patrolled.
4205* Wikis that contain imported revisions or CentralAuth global blocks should run
4206  maintenance/cleanupUsersWithNoId.php.
4207* The configuration settings $wgResourceLoaderMinifierStatementsOnOwnLine and
4208  $wgResourceLoaderMinifierMaxLineLength, deprecated since 1.27, were removed.
4209* (T180921) $wgReferrerPolicy now supports having fallbacks for browsers that
4210  are not using the latest version of the Referrer Policy specification.
4211* $wgFragmentMode is now set to [ 'legacy', 'html5' ] by default. This is a
4212  first step of migration to human-readable section IDs that will later result
4213  in 'html5' being the default mode.
4214* CACHE_ACCEL now only supports APC(u) or WinCache. XCache support was removed
4215  as upstream is inactive and has no plans to move to PHP 7.
4216* The old CategorizedRecentChanges feature, including its related configuration
4217  option $wgAllowCategorizedRecentChanges, has been removed.
4218* (T188472) The 'comma' value for $wgArticleCountMethod is no longer supported
4219  for performance reasons, and installations with this setting will now work as
4220  if it was configured with 'any'.
4221* (T185753) MediaWiki now defaults to using RemexHtml to tidy up user input,
4222  rather than being off by default. If you wish to disable HTML tidying
4223  entirely, set $wgTidyConfig to null; if you wish to use the old, deprecated
4224  Tidy external binary, both set $wgTidyConfig to null and $wgUseTidy to true.
4225* $wgLogAutopatrol now defaults to false instead of true.
4226* $wgValidateAllHtml was removed and will be ignored.
4227* $wgScriptExtension, deprecated and ignored since 1.25, was removed. See the
4228  1.25 release notes for more information.
4229* $wgUseAjax is now marked as deprecated, just like the deprecated AJAX
4230  framework that it enables. Some extensions mistakenly used this to check
4231  whether any AJAX functionality at all should be enabled, further making this
4232  problematic to retain.
4233* $wgDBmysql5 is now deprecated, and will be removed in a future version. It
4234  has been marked as experimental ever since it was introduced.
4235
4236=== New features in 1.31 ===
4237* (T76554) User sub-pages named ….json are now protected in the same way that
4238  ….js and ….css pages are, so that configuration options can safely be placed
4239  there.
4240* Wikimedia\Rdbms\IDatabase->select() and similar methods now support joins
4241  with parentheses for grouping.
4242* As a first pass in standardizing dialog boxes across the MediaWiki product,
4243  Html class now provides helper methods for messageBox, successBox, errorBox
4244  and warningBox generation.
4245* (T9240) Imports will now record unknown (and, optionally, known) usernames in
4246  a format like "iw>Example".
4247* (T20209) Linker (used on history pages, log pages, and so on) will display
4248  usernames formed like "iw>Example" as interwiki links, as if by wikitext like
4249  [[iw:User:Example|iw>Example]].
4250* (T111605) The 'ImportHandleUnknownUser' hook allows extensions to auto-create
4251  users during an import.
4252* Added a hook, ParserOutputPostCacheTransform, to allow extensions to affect
4253  the ParserOutput::getText() post-cache transformations.
4254* Added a hook, UploadForm:getInitialPageText, to allow extensions to alter the
4255  initial page text for file uploads.
4256* (T181651) The info page for File pages now displays the file's base-16 SHA1
4257  hash value in the table of basic information.
4258* Style tags with a 'data-mw-deduplicate' attribute will be deduplicated as a
4259  ParserOutput::getText() post-cache transformation. This may be disabled by
4260  passing 'deduplicateStyles' => false to that method.
4261* The identity of the logged-in or IP "actor" for logged actions is being moved
4262  into a new actor table, with the rows in tables such as revision and logging
4263  referring to the actor ID instead of storing the user ID and name/IP in
4264  every row.
4265  * This is currently gated by $wgActorTableSchemaMigrationStage. Most wikis
4266    can set this to MIGRATION_NEW and run maintenance/migrateActors.php as
4267    soon as any necessary extensions are updated.
4268  * Most code accessing rows for logged actions from the database should use
4269    the relevant getQueryInfo() methods to get the information needed to build
4270    the SQL query. The ActorMigration class may also be used to get feature
4271    -flagged information needed to access actor-related fields during the
4272    migration period.
4273* Added Wikimedia\Rdbms\IDatabase::cancelAtomic(), to roll back an atomic
4274  section without having to roll back the whole transaction.
4275* Wikimedia\Rdbms\IDatabase::doAtomicSection(), non-native ::insertSelect(),
4276  and non-MySQL ::replace() and ::upsert() no longer roll back the whole
4277  transaction on failure.
4278* (T189785) Added a monthly heartbeat ping to the pingback feature.
4279* The CLI installer (maintenance/install.php) learned to detect and include
4280  extensions. Pass --with-extensions to enable that feature.
4281* (T184791) rc_patrolled now has three states: "0" for unpatrolled,
4282  "1" for manually patrolled and "2" for autopatrolled actions.
4283* Extensions can now set their type to "editor" if they provide an editor or
4284  enhance the editing experience.
4285* Extensions can use a PSR-4 autoloader by setting an "AutoloadNamespaces"
4286  property in extension.json. See the documentation at
4287  <https://mediawiki.org/wiki/Manual:Extension.json/Schema#AutoloadNamespaces>
4288  for more details and an example.
4289* (T19099) Tabs which link to pages that don't exist (like those to uncreated
4290  discussion pages) now have a tooltip to indicate state, not just colour.
4291
4292=== External library changes in 1.31 ===
4293* pear/mail, pear/mail_mime and pear/mail_mime-decode have been moved from
4294  suggested to required. These packages now must be installed via composer
4295  and not via PEAR itself.
4296
4297==== Upgraded external libraries ====
4298* Updated jquery.chosen from v0.9.14 to v1.8.2.
4299* Updated composer/spdx-licenses from 1.1.4 to 1.3.0 (development dependency).
4300* Updated nikic/php-parser from 2.1.0 to 3.1.3 (development dependency).
4301* Updated wikimedia/ip-set from 1.1.0 to 1.2.0.
4302* Updated wikimedia/relpath from 2.0.0 to 2.1.1.
4303* Updated wikimedia/running-stat from 1.1.0 to 1.2.0.
4304* Updated wikimedia/wrappedstring from 2.2.0 to 2.3.0.
4305* Updated mediawiki/at-ease from 1.1.0 to 1.2.0.
4306* Updated wikimedia/php-session-serializer from 1.0.4 to 1.0.6.
4307* Updated wikimedia/remex-html from 1.0.2 to 1.0.3.
4308* Updated wikimedia/html-formatter from 1.0.1 to 1.0.2.
4309
4310==== New external libraries ====
4311* Added wikimedia/object-factory 1.0.0
4312
4313==== Removed and replaced external libraries ====
4314* (T17845) The deprecated 'jquery.badge' module was removed.
4315* The deprecated 'jquery.autoEllipsis' module was removed. Use the CSS
4316  text-overflow property instead.
4317* The deprecated 'jquery.placeholder' module was removed.
4318* The deprecated 'jquery.appear' module was removed. Use the
4319  'mediawiki.viewport' module instead.
4320* mediawiki/at-ease was replaced with wikimedia/at-ease.
4321
4322=== Bug fixes in 1.31 ===
4323* (T90902) Non-breaking space in header ID breaks anchor.
4324* (T189375) CSSMin now allows quoted urls in `url()` syntax to start with a
4325  space.
4326* (T2087, T10897, T87753, T174639) Whitespace created by category and language
4327  links is now stripped rather than leaving blank lines in odd places.
4328* (T3780) Uploads with UTF-8 names now work on PHP7.1+ on Windows servers.
4329* (T182366) UploadBase::checkXMLEncodingMissmatch() now works on PHP 7.1+
4330
4331=== Action API changes in 1.31 ===
4332* (T185058) The 'name' value to tgprop for action=query&list=tags has been
4333  removed. It has never made a difference in the output, the name was always
4334  returned regardless.
4335* The 'watch' and 'unwatch' parameters for action=move have been removed. They
4336  were deprecated and also accidentally nonfunctional since 1.17 in 2010. Use
4337  'watchlist' instead.
4338
4339=== Action API internal changes in 1.31 ===
4340* ApiBase::getProfileDBTime, deprecated since 1.25, was removed.
4341* ApiBase::getModuleProfileName, deprecated since 1.25, was removed.
4342* ApiBase::getProfileTime, deprecated since 1.25, was removed.
4343
4344=== Languages updated in 1.31 ===
4345MediaWiki supports over 350 languages. Many localisations are updated
4346regularly. Below only new and removed languages are listed, as well as
4347changes to languages because of Phabricator reports.
4348
4349* (T180052) Mirandese (mwl) now supports gendered NS_USER/NS_USER_TALK.
4350* (T182305) New language support: Nyungar (nys).
4351* (T186359) New language support: Siberian Tatar [себертатар] (sty).
4352* (T186635) New language support: Guianan Creole (gcr).
4353* (T186647) New language support: Kumyk [къумукъ] (kum).
4354* (T187750) New language support: Spanish formal address (es-formal).
4355* (T187824) New language support: Hungarian formal address (hu-formal).
4356* (T189127) New language support: Gorontalo (gor).
4357
4358=== Breaking changes in 1.31 ===
4359* MessageBlobStore::insertMessageBlob(), deprecated in 1.27, was removed.
4360* The OutputPage class constructor now requires a context parameter.
4361  Instantiating without context was deprecated in 1.18.
4362* The mw.page JavaScript singleton, deprecated in 1.30, was removed.
4363* Article::getLastPurgeTimestamp(), WikiPage::getLastPurgeTimestamp(), and the
4364  related WikiPage::PURGE_* constants, deprecated in 1.29, were removed.
4365* The Article::selectFields(), ::onArticleCreate(), ::onArticleDelete(), and
4366  ::onArticleEdit() methods, deprecated in 1.24, were removed.
4367* Installer::locateExecutable() and ::locateExecutableInDefaultPaths() were
4368  removed. Use ExecutableFinder::findInDefaultPaths() instead.
4369* The deprecated MW_DIFF_VERSION constant was removed.
4370  DifferenceEngine::MW_DIFF_VERSION should be used instead.
4371* Due to significant refactoring, method ContribsPager::getUserCond() that had
4372  no access restriction has been removed.
4373* The Block class will no longer accept usable-but-missing usernames for
4374  'byText' or ->setBlocker(). Callers should either ensure the blocker exists
4375  locally or use a new interwiki-format username like "iw>Example".
4376* The following methods and constants from the WatchedItem class, which were
4377  deprecated in 1.27, have been removed:
4378  * WatchedItem::getTitle()
4379  * WatchedItem::fromUserTitle()
4380  * WatchedItem::addWatch()
4381  * WatchedItem::removeWatch()
4382  * WatchedItem::isWatched()
4383  * WatchedItem::duplicateEntries()
4384  * WatchedItem::IGNORE_USER_RIGHTS
4385  * WatchedItem::CHECK_USER_RIGHTS
4386  * WatchedItem::DEPRECATED_USAGE_TIMESTAMP
4387* The $statementsOnOwnLine parameter of JavaScriptMinifier::minify was removed.
4388  $wgResourceLoaderMinifierStatementsOnOwnLine, the corresponding configuration
4389  variable, has been deprecated since 1.27 and was removed as well.
4390* The $maxLineLength parameter of JavaScriptMinifier::minify was removed.
4391  $wgResourceLoaderMinifierMaxLineLength, the corresponding configuration
4392  variable, has been deprecated since 1.27 and was removed as well.
4393* The HtmlFormatter class, deprecated in 1.27, was removed. The namespaced
4394  HtmlFormatter\HtmlFormatter class should be used instead.
4395* The driver 'mysql' for MySQL, deprecated in MediaWiki 1.30, has been removed.
4396  The driver has been deprecated since PHP 5.5 and was removed in PHP 7.0. The
4397  default driver for MySQL has been 'mysqli' since MediaWiki 1.22.
4398* The following properties of PreparedEdit were deprecated in 1.21 and have
4399  been removed:
4400  * PreparedEdit->newText
4401  * PreparedEdit->oldText
4402  * PreparedEdit->pst
4403* ParserOutput objects which are generated using a non-default value for
4404  ParserOptions::setWrapOutputClass() can no longer be added to the parser
4405  cache.
4406* The following deprecated methods from the OutputPage class have been removed:
4407  * OutputPage::addExtensionStyle(); deprecated in 1.27
4408  * OutputPage::getExtStyle(); deprecated in 1.27
4409  * OutputPage::setETag(); deprecated in 1.28 (obsolete no-op)
4410  * OutputPage::setSquidMaxage(); deprecated in 1.27
4411  * OutputPage::readOnlyPage(); deprecated in 1.25
4412  * OutputPage::rateLimited(); deprecated in 1.25
4413  * Additionally, the protected OutputPage::$mExtStyles array, only accessed
4414    through the above and with no known uses, was removed.
4415* The no-op method Skin::showIPinHeader(), deprecated in 1.27, was removed.
4416* The following variables and methods in EditPage, deprecated in MediaWiki 1.30,
4417  were removed:
4418  * $isCssJsSubpage — use ::isUserConfigPage()
4419  * $isCssSubpage — use ::isUserCssConfigPage()
4420  * $isJsSubpage — use ::isUserJsConfigPage()
4421  * $isWrongCaseCssJsPage – use ::isWrongCaseUserConfigPage()
4422  * ::getSummaryInput() – use ::getSummaryInputWidget()
4423  * ::getSummaryInputOOUI() – use ::getSummaryInputWidget()
4424  * ::getCheckboxes() – use ::getCheckboxesWidget() or
4425      ::getCheckboxesDefinition()
4426  * ::getCheckboxesOOUI() – use ::getCheckboxesWidget() or
4427      ::getCheckboxesDefinition()
4428* ResourceLoaderModule::getPosition(), deprecated in 1.29, has been removed.
4429* In User, the cookie-related methods which were wrappers for the functions on
4430  the response object, and were deprecated in 1.27, have been removed:
4431  * ::setCookie()
4432  * ::clearCookie()
4433  * ::setExtendedLoginCookie()
4434  Note that User::setCookies() remains, and is not deprecated.
4435* Also in User, some auth-related methods which were deprecated in 1.27 have
4436  been removed:
4437  * ::getEditTokenTimestamp() – use MediaWiki\Session\Token::getTimestamp()
4438  * ::getPasswordFactory() – create a PasswordFactory directly
4439  * ::passwordChangeInputAttribs()
4440* The global functions wfProfileIn and wfProfileOut, deprecated in 1.25, have
4441  been removed.
4442* SpecialPageFactory::getList(), deprecated in 1.24, has been removed. You can
4443  use ::getNames() instead.
4444* OpenSearch::getOpenSearchTemplate(), deprecated in 1.25, has been removed. You
4445  can use ApiOpenSearch::getOpenSearchTemplate() instead.
4446* The global function wfBaseConvert, deprecated in 1.27, has been removed. Use
4447  Wikimedia\base_convert() directly.
4448* Calling Database::begin() explicitly during an implicit transaction or when
4449  DBO_TRX is set results in an exception. Calling Database::commit() explicitly
4450  for an implicit transaction also results in an exception. Previously these
4451  were logged as errors. The startAtomic() and endAtomic() methods, or
4452  AtomicSectionUpdate should be used instead.
4453* The global function wfOutputHandler() was removed, use the its replacement
4454  MediaWiki\OutputHandler::handle() instead. The global function was only
4455  sometimes defined. Its replacement is always available via the autoloader.
4456* ChangeTags::listExtensionActivatedTags and ::listExtensionDefinedTags,
4457  deprecated in 1.28, have been removed. Use ::listSoftwareActivatedTags() and
4458  ::listSoftwareDefinedTags() instead.
4459* Title::getTitleInvalidRegex(), deprecated in 1.25, has been removed. You can
4460  use MediaWikiTitleCodec::getTitleInvalidRegex() instead.
4461* HTMLForm & VFormHTMLForm::isVForm(), deprecated in 1.25, have been removed.
4462* The ProfileSection class, deprecated in 1.25 and unused, has been removed.
4463* The ResourceLoaderGetLessVars hook, deprecated in 1.30, has been removed. Use
4464  ResourceLoaderModule::getLessVars() to expose local variables instead of
4465  global ones.
4466* As part of work to modernise user-generated content clean-up, a config option
4467  and some methods related to HTML validity were removed without deprecation.
4468  The public methods MWTidy::checkErrors() and the path through which it was
4469  called, TidyDriverBase::validate(), are removed, as are the testing methods
4470  MediaWikiTestCase::assertValidHtmlSnippet() and ::assertValidHtmlDocument().
4471  The $wgValidateAllHtml configuration option is removed and will be ignored.
4472* Execution of external programs using MediaWiki\Shell\Command now applies
4473  the RESTRICT_DEFAULT Firejail restriction by default.
4474* The ResourceLoaderModule::getHashMtime() and ::getDefinitionMtime() methods,
4475  deprecated in 1.26, were removed.
4476* The deprecated 'mediawiki.widgets.CategorySelector' module alias was removed.
4477  Use the 'mediawiki.widgets.CategoryMultiselectWidget' module directly.
4478
4479=== Deprecations in 1.31 ===
4480* The Revision class was deprecated in favor of RevisionStore, BlobStore, and
4481  RevisionRecord and its subclasses.
4482* The global function wfBCP47 is deprecated in favour of LanguageCode::bcp47.
4483* The global function wfCountDown is now deprecated in favor of
4484  Maintenance::countDown.
4485* Several methods for returning lists of fields to select from the database
4486  have been deprecated in favor of similar methods that also return the tables
4487  to select from and the join conditions for those tables.
4488  * Block::selectFields() → Block::getQueryInfo()
4489  * RecentChange::selectFields() → RecentChange::getQueryInfo()
4490  * ArchivedFile::selectFields() → ArchivedFile::getQueryInfo()
4491  * LocalFile::selectFields() → LocalFile::getQueryInfo()
4492  * LocalFile::getCacheFields() with a prefix no longer works
4493  * LocalFile::getLazyCacheFields() with a prefix no longer works
4494  * OldLocalFile::selectFields() → OldLocalFile::getQueryInfo()
4495  * RecentChange::selectFields() → RecentChange::getQueryInfo()
4496  * Revision::userJoinCond() → Revision::getQueryInfo( [ 'user' ] )
4497  * Revision::selectUserFields() → Revision::getQueryInfo( [ 'user' ] )
4498  * Revision::pageJoinCond() → Revision::getQueryInfo( [ 'page' ] )
4499  * Revision::selectPageFields() → Revision::getQueryInfo( [ 'page' ] )
4500  * Revision::selectTextFields() → Revision::getQueryInfo( [ 'text' ] )
4501  * Revision::selectFields() → Revision::getQueryInfo()
4502  * Revision::selectArchiveFields() → Revision::getArchiveQueryInfo()
4503  * User::selectFields() → User::getQueryInfo()
4504  * WikiPage::selectFields() → WikiPage::getQueryInfo()
4505* Revision::setUserIdAndName() was deprecated.
4506* Access to TitleValue class properties was deprecated, the relevant getters
4507  should be used instead.
4508* DifferenceEngine::getDiffBodyCacheKey() is deprecated. Subclasses should
4509  override DifferenceEngine::getDiffBodyCacheKeyParams() instead.
4510* Use of Maintenance::error( $err, $die ) to exit script was deprecated. Use
4511  Maintenance::fatalError() instead.
4512* Passing a ParserOptions object to OutputPage::parserOptions() is deprecated.
4513* The RevisionInsertComplete hook is now deprecated; use instead the hook
4514  RevisionRecordInserted. RevisionInsertComplete is still called, but the second
4515  and third parameter will always be null. Hard deprecation is scheduled for
4516  1.32.
4517* The following methods that get and set ParserOutput state are deprecated.
4518  Callers should use the new stateless $options parameter to
4519  ParserOutput::getText() instead.
4520  * ParserOptions::getEditSection()
4521  * ParserOptions::setEditSection()
4522  * ParserOutput::getEditSectionTokens()
4523  * ParserOutput::setEditSectionTokens()
4524  * ParserOutput::getTOCEnabled()
4525  * ParserOutput::setTOCEnabled()
4526  * OutputPage::enableSectionEditLinks()
4527  * OutputPage::sectionEditLinksEnabled()
4528  * The public ParserOutput state fields $mTOCEnabled and $mEditSectionTokens
4529    are also deprecated.
4530* License::getLicenses has been deprecated; use License::getLines instead.
4531* QuickTemplate::setRef() was deprecated in favour of QuickTemplate::set().
4532  Setting template variables by reference allowed violating the principle of
4533  data being immutable once added to the skin template. In practice, this method
4534  was not being used for that. Rather, setRef() existed as memory optimisation
4535  for PHP 4.
4536* QuickTemplate::setTranslator() and MediaWikiI18N::set() were deprecated in
4537  favour of Skin::msg() parameters.
4538* MediaWikiI18N::translate() was deprecated in favour of Skin::msg() or
4539  wfMessage().
4540* Passing false to ParserOptions::setWrapOutputClass() is deprecated. Use the
4541  'unwrap' transform to ParserOutput::getText() instead.
4542* \ObjectFactory (no namespace) is deprecated, the namespaced class
4543  \Wikimedia\ObjectFactory from the wikimedia/object-factory library should be
4544  used instead.
4545* CommentStore::newKey is deprecated. Instead, get an instance from
4546  MediaWikiServices.
4547* The following CommentStore methods have had their signatures changed to
4548  introduce a $key parameter, usage of the methods on instances retrieved from
4549  CommentStore::newKey will remain unchanged but deprecated:
4550  * CommentStore::getFields
4551  * CommentStore::getJoin
4552  * CommentStore::getComment
4553  * CommentStore::getCommentLegacy
4554  * CommentStore::insert
4555  * CommentStore::insertWithTemplate
4556* The following methods in Title have been renamed, and the old ones are
4557  deprecated:
4558  * Title::getSkinFromCssJsSubpage – use ::getSkinFromConfigSubpage
4559  * Title::isCssOrJsPage – use ::isSiteConfigPage
4560  * Title::isCssJsSubpage – use ::isUserConfigPage
4561  * Title::isCssSubpage – use ::isUserCssConfigPage
4562  * Title::isJsSubpage – use ::isUserJsConfigPage
4563* The following methods related to caching of half-parsed HTML were deprecated:
4564  * Parser::serializeHalfParsedText()
4565  * Parser::unserializeHalfParsedText()
4566  * Parser::isValidHalfParsedText()
4567  * StripState::getSubState()
4568  * StripState::merge()
4569* The DeferredStringifier class is deprecated, use Message::listParam() instead.
4570* The type string for the parameter $lang of DateFormatter::getInstance is
4571  deprecated.
4572* Wikimedia\Rdbms\SavepointPostgres is deprecated.
4573* The DO_MAINTENANCE constant is deprecated. RUN_MAINTENANCE_IF_MAIN should be
4574  used instead.
4575* The function wfShellWikiCmd() has been deprecated, use
4576  MediaWiki\Shell::makeScriptCommand().
4577* In the future, the hooks 'PreferencesFormPreSave' and 'PreferencesGetLegend'
4578  will be allowed to provide any HTMLForm object rather than PreferencesForm.
4579
4580=== Other changes in 1.31 ===
4581* Browser support for Internet Explorer 10 was lowered from Grade A to Grade C.
4582* Browser support for Opera 12 and older was dropped entirely. Opera 15+
4583  continues at Grade A.
4584* Multi-content-revision capability was introduced into the storage layer. See
4585  <https://mediawiki.org/wiki/Requests_for_comment/Multi-Content_Revisions>.
4586* The "free" CSS class is now only applied to unbracketed URLs in wikitext.
4587  Links written using square brackets will get the class "text" not "free".
4588* RFC 157418: Whitespace is trimmed from wikitext headings, wikitext list items,
4589  wikitext table captions, wikitext table headings, wikitext table cells. HTML
4590  headings, HTML list items, HTML table captions, HTML table headings, HTML
4591  table cells will not have this trimming behavior.
4592
4593== Compatibility ==
4594MediaWiki 1.31 requires PHP 7.0.0 or later. Although HHVM 3.18.5 or later is
4595supported, it is generally advised to use PHP 7.0.0 or later for long term
4596support.
4597
4598MySQL/MariaDB is the recommended DBMS. PostgreSQL or SQLite can also be used,
4599but support for them is somewhat less mature. There is experimental support for
4600Oracle and Microsoft SQL Server.
4601
4602The supported versions are:
4603
4604* MySQL 5.5.8 or later
4605* PostgreSQL 9.2 or later
4606* SQLite 3.3.7 or later
4607* Oracle 9.0.1 or later
4608* Microsoft SQL Server 2005 (9.00.1399)
4609
4610== Upgrading ==
46111.31 has several database changes since 1.30, and will not work without schema
4612updates. Note that due to changes to some very large tables like the revision
4613table, the schema update may take quite long (minutes on a medium sized site,
4614many hours on a large site).
4615
4616Don't forget to always back up your database before upgrading!
4617
4618See the file UPGRADE for more detailed upgrade instructions, including
4619important information when upgrading from versions prior to 1.11.
4620
4621For notes on 1.30.x and older releases, see HISTORY.
4622
4623== Online documentation ==
4624Documentation for both end-users and site administrators is available on
4625MediaWiki.org, and is covered under the GNU Free Documentation License (except
4626for pages that explicitly state that their contents are in the public domain):
4627
4628       https://www.mediawiki.org/wiki/Special:MyLanguage/Documentation
4629
4630== Mailing list ==
4631A mailing list is available for MediaWiki user support and discussion:
4632
4633       https://lists.wikimedia.org/mailman/listinfo/mediawiki-l
4634
4635A low-traffic announcements-only list is also available:
4636
4637       https://lists.wikimedia.org/mailman/listinfo/mediawiki-announce
4638
4639It's highly recommended that you sign up for one of these lists if you're
4640going to run a public MediaWiki, so you can be notified of security fixes.
4641
4642== IRC help ==
4643There's usually someone online in #mediawiki on irc.freenode.net.
4644
4645
4646= MediaWiki 1.30 =
4647
4648== MediaWiki 1.30.2 ==
4649
4650This is a security and maintenance release of the MediaWiki 1.30 branch.
4651
4652=== Changes since MediaWiki 1.30.1 ===
4653* (T204729) WatchedItemStore::countVisitingWatchersMultiple() shouldn't query
4654  all titles when asked for none.
4655* (T109121) Remove deprecated pear/mail_mime-decode from composer suggested
4656  libraries.
4657* (T207540) Include IP address in "Login for $1 succeeded" log entry.
4658* (T205765) Don't link to the obsolete "Extension Matrix" page in installer.
4659* (T207603) SECURITY: User JS may no longer be loaded with mime type
4660  text/javascript if there is no account associated with the username.
4661* (T113042) SECURITY: Do not allow loading pages raw with a text/javascript MIME
4662  type if non-admins can edit the page.
4663* (T207541) Pass email address to mail().
4664* Fix addition of ug_expiry column to user_groups table on MSSQL.
4665* (T204531) rdbms: reduce LoadBalancer replication log spam.
4666* (T213489) Avoid session double-start in Setup.php.
4667* (T195525) Fix db error outage page.
4668* (T208871) The hard-coded Google search form on the database error page was
4669  removed.
4670* (T216968) Return pageid as int in both list=iwbacklinks and
4671  list=langbacklinks.
4672* (T218608) SECURITY: Fix an issue that prevents Extension:OAuth working when
4673  $wgBlockDisablesLogin is true.
4674* (T25227) SECURITY: action=logout now requires to be posted and have a csrf
4675  token.
4676* (T222385) resourceloader: Use AND instead of OR for upsert conds in
4677  saveFileDependencies().
4678* (T224374) Fix message parameters so that the message that says SQLite is out
4679  of date makes sense.
4680* SpecialPage::checkLoginSecurityLevel() will now preserve POST data when
4681  reauthenticating.
4682* FormSpecialPage::execute() will now call checkLoginSecurityLevel() if
4683  getLoginSecurityLevel() returns non-false.
4684* (T197279) SECURITY: Fix reauth in Special:ChangeEmail.
4685* (T208881) SECURITY: blacklist CSS var().
4686* (T209794) SECURITY: rate-limit and prevent blocked users from changing email.
4687* (T199540) SECURITY: API: Respect $wgBlockCIDRLimit in action=block.
4688* (T212118) SECURITY: Fix cache mode for (un)patrolled recent changes query.
4689* (T222036, T222038) SECURITY: Add permission check for user is permitted to
4690  view the log type.
4691* (T221739) SECURITY: resources: Patch jQuery 1.11.3 for CVE-2019-11358.
4692
4693== MediaWiki 1.30.1 ==
4694
4695This is a security and maintenance release of the MediaWiki 1.30 branch.
4696
4697=== Changes since MediaWiki 1.30.0 ===
4698* (T169545, CVE-2018-0503) SECURITY: $wgRateLimits entry for 'user' overrides
4699  'newbie'.
4700* (T194605, CVE-2018-0505) SECURITY: BotPasswords can bypass CentralAuth's
4701  account lock.
4702* (T87572) Make FormatMetadata::flattenArrayReal() work for an associative
4703  array.
4704* Updated composer/spdx-licenses from 1.1.4 to 1.3.0 (development dependency).
4705* (T189567) the CLI installer (maintenance/install.php) learned to detect and
4706  include extensions. Pass --with-extensions to enable that feature.
4707* (T190503) Let built-in web server (maintenance/dev) handle .php requests.
4708* (T167507) selenium: Run Chrome headlessly.
4709* selenium: Pass -no-sandbox to Chrome under Docker.
4710* (T179190) selenium: Move logic for running tests from package.json to
4711  selenium.sh
4712* (T192584) Stop incorrectly passing USE INDEX to RecentChange::newFromConds().
4713* Add default edit rate limit of 90 edits/minute for all users.
4714* (T186565) Fix PHP Notice from `ob_end_flush()` in `FileRepo::streamFile()`.
4715* oojs/oojs-ui updated to remove an unnecessary dependancy.
4716* (T196125) php-memcached 3.0 (provided with PHP 7.0) is now supported.
4717* (T118683) Fix exception from &$user deref on HHVM in the TitleMoveComplete
4718  hook.
4719* (T196672) The mtime of extension.json files is now able to be zero
4720* (T180403) Validate $length in padleft/padright parser functions.
4721* (T143790) Make $wgEmailConfirmToEdit only affect edit actions.
4722* (T193995) Fix undefined patchPath() method call in parser tests.
4723* Special:BotPasswords now requires reauthentication.
4724* (T191608, T187638) Add 'logid' parameter to Special:Log.
4725* (T193829) Indicate when a Bot Password needs reset.
4726* (T151415) Log email changes.
4727* (T200861) Fix total breakage of SQLite web upgrade.
4728* (T202550) Unbreak SpecialListusersHeaderForm and SpecialListusersHeader
4729  hooks.
4730* (T190539) Explicitly require Postgres 9.1.
4731* (T118420) Unbreak Oracle installer.
4732
4733== MediaWiki 1.30.0 ==
4734
4735=== Changes since MediaWiki 1.30.0-rc.0 ===
4736* Upgraded Moment.js from v2.15.0 to v2.19.3.
4737* Add ip_changes to postgres/tables.sql.
4738* Skip null shell parameters.
4739* Add wfWaitForSlaves() to maintenance/migrateComments.php.
4740* (T182245) Fix join conditions in ImageListPager.
4741* (T178626) Revert #contentSub and #jump-to-nav margin changes.
4742
4743=== MySQL version requirement in 1.30 ===
4744As of 1.30, MediaWiki now requires MySQL 5.5.8 or higher (see Compatibility
4745section).
4746
4747=== Configuration changes in 1.30 ===
4748* The "C.UTF-8" locale should be used for $wgShellLocale, if available, to avoid
4749  unexpected behavior when code uses locale-sensitive string comparisons. For
4750  example, the Scribunto extension considers "bar" < "Foo" in most locales
4751  since it ignores case.
4752* $wgShellLocale now affects LC_ALL rather than only LC_CTYPE. See
4753  documentation of $wgShellLocale for details.
4754* $wgShellLocale is now applied for all requests. wfInitShellLocale() is
4755  deprecated and a no-op, as it is no longer needed.
4756* $wgJobClasses may now specify callback functions as an alternative to plain
4757  class names. This is intended for extensions that want control over the
4758  instantiation of their jobs, to allow for proper dependency injection.
4759* $wgResourceModules may now specify callback functions as an alternative
4760  to plain class names, using the 'factory' key in the module description
4761  array. This allows dependency injection to be used for ResourceLoader modules.
4762* $wgExceptionHooks has been removed.
4763* (T163562) $wgRangeContributionsCIDRLimit was introduced to control the size
4764  of IP ranges that can be queried at Special:Contributions.
4765* (T45547) $wgUsePigLatinVariant added (off by default).
4766* (T152540) MediaWiki now supports a section ID escaping style that allows to
4767  display non-Latin characters verbatim on many modern browsers. This is
4768  controlled by the new configuration setting, $wgFragmentMode.
4769* $wgExperimentalHtmlIds is now deprecated and will be removed in a future
4770  version, use $wgFragmentMode to migrate off it to a modern alternative.
4771* $wgExternalInterwikiFragmentMode was introduced to control how fragments in
4772  sinterwikis going outside of current wiki farm are encoded.
4773* (T120333) Soft-deprecated the use of PHP extension 'mysql' in favor of
4774  'mysqli'. This PHP extension was deprecated in PHP 5.5 and removed in PHP 7.0.
4775  MediaWiki auto-selects the 'mysqli' driver since MediaWiki 1.22, except if
4776  explicitly requested through the configuration parameter $wgDBservers.
4777* $wgOOUIEditPage was removed, as it is now the default. This was documented as
4778  a temporary variable during the migration period.
4779
4780=== New features in 1.30 ===
4781* (T37247) Output from Parser::parse() will now be wrapped in a div with
4782  class="mw-parser-output" by default. This may be changed or disabled using
4783  ParserOptions::setWrapOutputClass().
4784* (T163562) Added ability to search for contributions within an IP ranges
4785  at Special:Contributions.
4786* Added 'ChangeTagsAllowedAdd' hook, enabling extensions to allow software-
4787  specific tags to be added by users.
4788* Added a 'ParserOptionsRegister' hook to allow extensions to register
4789  additional parser options.
4790* (T45547) Included Pig Latin, a language game in English, as a
4791  LanguageConverter variant.  This allows English-speaking developers
4792  to develop and test LanguageConverter more easily.  Pig Latin can be
4793  enabled by setting $wgUsePigLatinVariant to true.
4794* Added RecentChangesPurgeRows hook to allow extensions to purge data that
4795  depends on the recentchanges table.
4796* Added JS config values wgDiffOldId/wgDiffNewId to the output of diff pages.
4797* (T2424) Added direct unwatch links to entries in Special:Watchlist (if the
4798  'watchlistunwatchlinks' preference option is enabled). With JavaScript
4799  enabled, these links toggle so the user can also re-watch pages that have
4800  just been unwatched.
4801* Added $wgParserTestMediaHandlers, where mock media handlers can be passed to
4802  MediaHandlerFactory for parser tests.
4803* Edit summaries, block reasons, and other "comments" are now stored in a
4804  separate database table. Use the CommentFormatter class to access them.
4805** This is currently gated by $wgCommentTableSchemaMigrationStage. Most wikis
4806   can set this to MIGRATION_NEW and run maintenance/migrateComments.php as
4807   soon as any necessary extensions are updated.
4808* (T138166) Added ability for users to prohibit other users from sending them
4809  emails with Special:Emailuser. Can be enabled by setting
4810  $wgEnableUserEmailBlacklist to true.
4811* (T67297) $wgBrowserBlacklist is deprecated, and changing it will have no
4812  effect. Instead, users using browsers that do not support Unicode will be
4813  unable to edit and should upgrade to a modern browser instead.
4814
4815=== External library changes in 1.30 ===
4816
4817==== Upgraded external libraries ====
4818* Updated justinrainbow/json-schema from v3.0 to v5.2.
4819* Updated mediawiki/mediawiki-codesniffer from v0.7.2 to v0.12.0.
4820* Updated wikimedia/composer-merge-plugin from v1.4.0 to v1.4.1.
4821* Updated wikimedia/relpath from v1.0.3 to v2.0.0.
4822* Updated OOjs from v2.0.0 to v2.1.0.
4823* Updated OOUI from v0.21.1 to v0.23.0.
4824* Updated QUnit from v1.23.1 to v2.4.0.
4825* Updated phpunit/phpunit from v4.8.35 to v4.8.36.
4826* Upgraded Moment.js from v2.15.0 to v2.19.3.
4827
4828==== New external libraries ====
4829* The class \TestingAccessWrapper has been moved to the external library
4830  wikimedia/testing-access-wrapper and renamed \Wikimedia\TestingAccessWrapper.
4831* Purtle, a fast, lightweight RDF generator.
4832
4833=== Bug fixes in 1.30 ===
4834* (T151633) Ordered list items use now Devanagari digits in Nepalese
4835  (thanks to Sfic)
4836
4837=== Action API changes in 1.30 ===
4838* (T37247) action=parse output will be wrapped in a div with
4839  class="mw-parser-output" by default. This may be changed or disabled using
4840  the new 'wrapoutputclass' parameter.
4841* When errorformat is not 'bc', abort reasons from action=login will be
4842  formatted as specified by the error formatter parameters.
4843* action=compare can now handle arbitrary text, deleted revisions, and
4844  returning users and edit comments.
4845* (T164106) The 'rvdifftotext', 'rvdifftotextpst', 'rvdiffto',
4846  'rvexpandtemplates', 'rvgeneratexml', 'rvparse', and 'rvprop=parsetree'
4847  parameters to prop=revisions are deprecated, as are the similarly named
4848  parameters to prop=deletedrevisions, list=allrevisions, and
4849  list=alldeletedrevisions. Use action=compare, action=parse, or
4850  action=expandtemplates instead.
4851
4852=== Action API internal changes in 1.30 ===
4853* ApiBase::getDescriptionMessage() and the "apihelp-*-description" messages are
4854  deprecated. The existing message should be split between "apihelp-*-summary"
4855  and "apihelp-*-extended-description".
4856* (T123931) Individual values of multi-valued parameters can now be marked as
4857  deprecated.
4858
4859=== Languages updated in 1.30 ===
4860MediaWiki supports over 350 languages. Many localisations are updated
4861regularly. Below only new and removed languages are listed, as well as
4862changes to languages because of Phabricator reports.
4863
4864* Added: kbp (Kabɩyɛ / Kabiyè)
4865* Added: skr (Saraiki, سرائیکی)
4866* Added: tay (Tayal / Atayal)
4867* Removed: tokipona (Toki Pona)
4868
4869==== Pig Latin added ====
4870* (T45547) Added Pig Latin, a made-up English variant (en-x-piglatin),
4871  for easier variant development and testing. Disabled by default. It can be
4872  enabled by setting $wgUsePigLatinVariant to true.
4873
4874=== Other changes in 1.30 ===
4875* The use of an associative array for $wgProxyList, where the IP address is in
4876  the key instead of the value, is deprecated (e.g. [ '127.0.0.1' => 'value' ]).
4877  Please convert these arrays to indexed/sequential ones (e.g. [ '127.0.0.1' ]).
4878* mw.user.bucket (deprecated in 1.23) was removed.
4879* LoadBalancer::getServerInfo() and LoadBalancer::setServerInfo() are
4880  deprecated. There are no known callers.
4881* File::getStreamHeaders() was deprecated.
4882* MediaHandler::getStreamHeaders() was deprecated.
4883* Title::canTalk() was deprecated. The new Title::canHaveTalkPage() should be
4884  used instead.
4885* MWNamespace::canTalk() was deprecated. The new MWNamespace::hasTalkNamespace()
4886  should be used instead.
4887* The ExtractThumbParameters hook (deprecated in 1.21) was removed.
4888* The OutputPage::addParserOutputNoText and ::getHeadLinks methods (both
4889  deprecated in 1.24) were removed.
4890* wfMemcKey() and wfGlobalCacheKey() were deprecated. BagOStuff::makeKey() and
4891  BagOStuff::makeGlobalKey() should be used instead.
4892* (T146304) Preprocessor handling of LanguageConverter markup has been improved.
4893  As a result of the new uniform handling, '-{' may need to be escaped
4894  (for example, as '-<nowiki/>{') where it occurs inside template arguments
4895  or wikilinks.
4896* (T163966) Page moves are now counted as edits for the purposes of
4897  autopromotion, i.e., they increment the user_editcount field in the database.
4898* Two new hooks, LogEventsListLineEnding and NewPagesLineEnding, were added for
4899  manipulating Special:Log and Special:NewPages lines.
4900* The OldChangesListRecentChangesLine, EnhancedChangesListModifyLineData,
4901  PageHistoryLineEnding, ContributionsLineEnding and
4902  DeletedContributionsLineEnding hooks have an additional parameter, for
4903  manipulating HTML data attributes of RC/history lines.
4904  EnhancedChangesListModifyBlockLineData can do that via the
4905  $data['attribs'] subarray.
4906* (T130632) The OutputPage::enableTOC() method was removed.
4907* WikiPage::getParserOutput() will now throw an exception if passed
4908  ParserOptions that would pollute the parser cache. Callers should use
4909  WikiPage::makeParserOptions() to create the ParserOptions object and only
4910  change options that affect the parser cache key.
4911* Article::viewRedirect() is deprecated.
4912* IP::isValidBlock() was deprecated. Use the equivalent IP::isValidRange().
4913* DeprecatedGlobal no longer supports passing in a direct value, it requires a
4914  callable factory function or a class name.
4915* The $parserMemc global, wfGetParserCacheStorage(), and
4916  ParserCache::singleton() are all deprecated. The main ParserCache instance
4917  should be obtained from MediaWikiServices instead. Access to the underlying
4918  BagOStuff is possible through the new ParserCache::getCacheStorage() method.
4919* .mw-ui-constructive CSS class (deprecated in 1.27) was removed.
4920* Sanitizer::escapeId() was deprecated, use escapeIdForAttribute(),
4921  escapeIdForLink() or escapeIdForExternalInterwiki() instead.
4922* Title::escapeFragmentForURL() was deprecated, use one of the aforementioned
4923  Sanitizer functions or, if possible, Title::getFragmentForURL().
4924* Second parameter to Sanitizer::escapeIdReferenceList() ($options) now does
4925  nothing and is deprecated.
4926* mw.util.escapeId() was deprecated, use escapeIdForAttribute() or
4927  escapeIdForLink().
4928* MagicWord::replaceMultiple() (deprecated in 1.25) was removed.
4929* WikiImporter now requires the second parameter to be an instance of the
4930  Config, class. Prior to that, the Config parameter was optional (a behavior
4931  deprecated in 1.25).
4932* Removed 'jquery.mwExtension' module. (deprecated since 1.26)
4933* mediawiki.ui: Deprecate greys, which are not part of WikimediaUI color palette
4934  any more.
4935* CdbReader, CdbWriter, CdbException classes (deprecated in 1.25) were removed.
4936  The namespaced classes in the Cdb namespace should be used instead.
4937* IPSet class (deprecated in 1.26) was removed. The namespaced IPSet\IPSet
4938  should be used instead.
4939* RunningStat class (deprecated in 1.27) was removed. The namespaced
4940  RunningStat\RunningStat should be used instead.
4941* MWMemcached and MemCachedClientforWiki classes (deprecated in 1.27) were
4942  removed.
4943  The MemcachedClient class should be used instead.
4944* EditPage underwent some refactoring and deprecations:
4945  * EditPage::isOouiEnabled() is deprecated and will always return true.
4946  * EditPage::getSummaryInput() and ::getSummaryInputOOUI() are deprecated.
4947    Please use ::getSummaryInputWidget() instead.
4948  * EditPage::getCheckboxes() and ::getCheckboxesOOUI() are deprecated. Please
4949    use ::getCheckboxesWidget() instead.
4950  * Creating an EditPage instance without calling EditPage::setContextTitle()
4951    should be avoided and will be deprecated in a future release.
4952  * EditPage::safeUnicodeInput() and ::safeUnicodeOutput() are deprecated and
4953    no-ops.
4954  * EditPage::$isCssJsSubpage, ::$isCssSubpage, and ::$isJsSubpage are
4955    deprecated. The corresponding methods from Title should be used instead.
4956  * EditPage::$isWrongCaseCssJsPage is deprecated. There is no replacement.
4957  * EditPage::$mArticle and ::$mTitle are deprecated for public usage. The
4958    getters ::getArticle() and ::getTitle() should be used instead.
4959  * Trying to control or fake EditPage context by overriding $wgUser,
4960    $wgRequest, $wgOut, and $wgLang is no longer supported and won't work. The
4961    IContextSource returned from EditPage::getContext() must be modified
4962    instead.
4963* Parser::getRandomString() (deprecated in 1.26) was removed.
4964* Parser::uniqPrefix() (deprecated in 1.26) was removed.
4965* Parser::extractTagsAndParams() now only accepts three arguments. The fourth,
4966  $uniq_prefix was deprecated in 1.26 and has now been removed.
4967* (T172514) The following tables have had their UNIQUE indexes turned into
4968  proper PRIMARY KEYs for increased maintainability: categorylinks, imagelinks,
4969  iwlinks, langlinks, log_search, module_deps, objectcache, pagelinks,
4970  query_cache, site_stats, templatelinks, text, transcache, user_former_groups,
4971  user_properties.
4972* IDatabase::nextSequenceValue() is no longer needed by any database backends
4973  (formerly it was needed by PostgreSQL and Oracle), and is now deprecated.
4974* (T146591) The lc_lang_key index on the l10n_cache table has been changed into
4975  a PRIMARY KEY.
4976* (T157227) bot_password.bp_user, change_tag.ct_log_id, change_tag.ct_rev_id,
4977  page_restrictions.pr_user, tag_summary.ts_log_id, tag_summary.ts_rev_id and
4978  user_properties.up_user have all been made unsigned on MySQL.
4979* DB_SLAVE is deprecated. DB_REPLICA should be used instead.
4980* wfUsePHP() is deprecated.
4981* wfFixSessionID() was removed.
4982* wfShellExec() and related functions are deprecated, use Shell::command(). This
4983  also slightly changes the behavior of how execution time limits are calculated
4984  when only some of defaults are overridden per-call. When in doubt, always
4985  override both wall clock and CPU time.
4986* (T138166) SpecialEmailUser::getTarget() now requires a second argument, the
4987  sending user object. Using the method without the second argument is
4988  deprecated.
4989* (T67297) Browsers that don't support Unicode will have their edits rejected.
4990* (T178450) The module 'jquery.badge' is deprecated and will be removed in a
4991  future release. For notifying the user of an event, the Notifications ("Echo")
4992  system should be used instead.
4993* (T178451) SECURITY: Potential XSS when $wgShowExceptionDetails = false and
4994  browser sends non-standard url escaping.
4995* (T165846) SECURITY: BotPassword login attempts weren't throttled.
4996
4997= MediaWiki 1.29 =
4998
4999== MediaWiki 1.29.3 ==
5000
5001This is a security and maintenance release of the MediaWiki 1.29 branch.
5002
5003=== Changes since 1.29.2 ===
5004* (T169545, CVE-2018-0503) SECURITY: $wgRateLimits entry for 'user' overrides
5005  'newbie'.
5006* (T194605, CVE-2018-0505) SECURITY: BotPasswords can bypass CentralAuth's
5007  account lock.
5008* (T180551) Fix LanguageSrTest for language converter
5009* (T180552) Fix language converter parser test with self-close tags
5010* (T180537) Remove $wgAuth usage from wrapOldPasswords.php
5011* (T180485) InputBox: Have inputbox langconvert certain attributes
5012* (T161732, T181547) Upgraded Moment.js from v2.15.0 to v2.19.3.
5013* (T172927) Drop vendor from MW release branch
5014* (T87572) Make FormatMetadata::flattenArrayReal() work for an associative array
5015* Updated composer/spdx-licenses from 1.1.4 to 1.3.0 (development dependency).
5016* (T189567) the CLI installer (maintenance/install.php) learned to detect and
5017  include extensions. Pass --with-extensions to enable that feature.
5018* (T182381) Mask deprecated call in WatchedItemUnitTest
5019* (T190503) Let built-in web server (maintenance/dev) handle .php requests.
5020* The karma qunit tests would fail on some configuration due to headers already
5021  sent. Check headers_sent() before sending cpPosTime headers
5022* (T167507) selenium: Run Chrome headlessly.
5023* selenium: Pass -no-sandbox to Chrome under Docker
5024* (T191247) Use MediaWiki\SuppressWarnings around trigger_error('') instead @
5025* (T75174, T161041) Unit test ChangesListSpecialPageTest::testFilterUserExpLevel
5026  fails under SQLite.
5027* (T192584) Stop incorrectly passing USE INDEX to RecentChange::newFromConds().
5028* (T179190) selenium: Move test running logic from package.json to selenium.sh.
5029* (T117839, T193200) PDFHandler: Fix for pdfinfo changes in poppler-utils 0.48.
5030* Add default edit rate limit of 90 edits/minute for all users.
5031* (T196125) php-memcached 3.0 (provided with PHP 7.0) is now supported.
5032* (T196672) The mtime of extension.json files is now able to be zero
5033* (T180403) Validate $length in padleft/padright parser functions.
5034* (T143790) Make $wgEmailConfirmToEdit only affect edit actions.
5035* (T194237) Special:BotPasswords now requires reauthentication.
5036* (T191608, T187638) Add 'logid' parameter to Special:Log.
5037* (T176097) resourceloader: Disable a flaky MessageBlobStoreTest case
5038* (T193829) Indicate when a Bot Password needs reset.
5039* (T151415) Log email changes.
5040* (T118420) Unbreak Oracle installer.
5041
5042== MediaWiki 1.29.2 ==
5043
5044This is a security and maintenance release of the MediaWiki 1.29 branch.
5045
5046=== Changes since 1.29.1 ===
5047* (T166757) Avoid scoped lock errors in Category::refreshCounts() due to
5048  nesting.
5049* (T175439) Unbreak Postgres Updater when setting defaults for a column.
5050* (T160298) Remove use of implicitGroupBy() in ActiveUsersPager.
5051* Fixed login button label to accept RawMessage.
5052* Fixed case of SpecialRecentChanges class usage.
5053* (T174255) Declare uploadCount property in importDump.php.
5054* (T163646) Pass a string not an int to mysql_real_escape_string().
5055* (T180143) Bump justinrainbow/json-schema development dependency to ~5.2.
5056* Updated dev dependancy phpunit/phpunit from v4.8.35 to v4.8.36.
5057* (T178451) SECURITY: Potential XSS when $wgShowExceptionDetails = false and
5058  browser sends non-standard url escaping.
5059* (T165846) SECURITY: BotPassword login attempts weren't throttled.
5060* (T128209) SECURITY: Reflected File Download from api.php.
5061* (T134100) SECURITY: Do not reveal if user exists during login failure.
5062* (T176247) SECURITY: Ensure Message::rawParams can't lead to XSS.
5063* (T125163) SECURITY: Make anchor for headlines escape > and <.
5064* (T180237) SECURITY: Protect vendor folder with .htaccess.
5065* (T180231) SECURITY: Remove PHPUnit file with known RCE if exists in
5066  update.php.
5067* (T124404) SECURITY: XSS in langconverter when regex hits pcre.backtrack_limit.
5068* (T119158) SECURITY: Handle -{}- syntax in attributes safely.
5069* (T180488) (T125177) "api.log contains passwords in plaintext" wasn't correctly
5070  fixed in all branches in the previous security release.
5071
5072== MediaWiki 1.29.1 ==
5073
5074This is a maintenance release of the MediaWiki 1.29 branch.
5075
5076The SpamBlacklist and PdfHandler extensions were missing from the generated
5077packages.
5078
5079=== Changes since 1.29.1 ===
5080* (T164999) Define mw.Upload.Dialog.static.name in mediawiki.Upload.Dialog.js.
5081* (T172061) Fix fatal when passing a category to refreshLinks.php.
5082
5083== MediaWiki 1.29.0 ==
5084
5085=== Configuration changes in 1.29 ===
5086* Default cookie expiration time has been reduced to 30 days. Login cookie
5087  expiration time is kept at 180 days.
5088* A new configuration variable has been added: $wgCookieSetOnAutoblock. This
5089  determines whether to set a cookie when a user is autoblocked. Doing so means
5090  that a blocked user, even after logging out and moving to a new IP address,
5091  will still be blocked.
5092* The resetpassword right and associated password reset capture feature has
5093  been removed.
5094* The $error parameter to the EmailUser hook should be set to a Status object
5095  or boolean false. This should be compatible with at least MediaWiki 1.23 if
5096  not earlier. Returning a raw HTML string is now deprecated.
5097* The $message parameter to the ApiCheckCanExecute hook should be set to an
5098  ApiMessage. This is compatible with MediaWiki 1.27 and later. Returning a
5099  code for ApiBase::parseMsg() will no longer work.
5100* ApiBase::$messageMap is no longer public. Code attempting to access it will
5101  result in a PHP fatal error.
5102* $wgUserEmailUseReplyTo is now true by default to work around restrictive DMARC
5103  policies.
5104* Subpages are now enabled by default in the Template namespace. Set
5105  $wgNamespacesWithSubpages[NS_TEMPLATE] to false to keep the old behavior.
5106* $wgRunJobsAsync is now false by default (T142751). This change only affects
5107  wikis with $wgJobRunRate > 0.
5108* (T158474) "Unknown user" has been added to $wgReservedUsernames.
5109* (T156983) $wgRateLimitsExcludedIPs now accepts CIDR ranges as well as single
5110  IPs.
5111* $wgDummyLanguageCodes is deprecated. Additional language code mappings may be
5112  added to $wgExtraLanguageCodes instead.
5113* (T161453) LocalisationCache will no longer use the temporary directory in it's
5114  fallback chain when trying to work out where to write the cache.
5115* The user right 'editusercssjs' (deprecated in 1.16) was removed. Use
5116  'editusercss' and 'edituserjs' in $wgGroupPermissions and elsewhere instead.
5117
5118=== New features in 1.29 ===
5119* (T5233) A cookie can now be set when a user is autoblocked, to track that user
5120  if they move to a new IP address. This is disabled by default.
5121* Added ILocalizedException interface to standardize the use of localized
5122  exceptions, largely so the API can handle them more sensibly.
5123* Blocks created automatically by MediaWiki, such as for configured proxies or
5124  dnsbls, are now indicated as such and use a new i18n message when displayed.
5125* Added new $wgHTTPImportTimeout setting. Sets timeout for
5126  downloading the XML dump during a transwiki import in seconds.
5127* Parser limit report is now available in machine-readable format to JavaScript
5128  via mw.config.get('wgPageParseReport').
5129* Added $wgSoftBlockRanges, to allow for automatically blocking anonymous edits
5130  from certain IP ranges (e.g. private IPs).
5131* (T59603) Added new magic word {{PAGELANGUAGE}} which returns the language code
5132  of the page being parsed.
5133* HTML5 form validation attributes will no longer be suppressed. Originally
5134  browsers had poor support for them, but modern browsers handle them fine.
5135  This might affect some forms that used them and only worked because the
5136  attributes were not actually being set.
5137* Expiry times can now be specified when users are added to user groups.
5138* Completely new user interface for the RecentChanges page, which
5139  structures filters into user-friendly groups.  This has corresponding
5140  changes to how filters are registered by core and extensions.
5141* The edit form now uses pretty OOjs UI buttons, checkboxes and summary input.
5142  Because this change can cause problems for extensions and on-wiki
5143  scripts depending on the exact HTML, the old version is still available
5144  and can be used by setting $wgOOUIEditPage = false; in LocalSettings.php.
5145  This will be removed later and OOjs UI will become the only option.
5146  To make testing easier, users can also force either mode by adding
5147  &ooui=true or &ooui=false to the action=edit URL.
5148
5149=== External library changes in 1.29 ===
5150
5151==== Upgraded external libraries ====
5152* Updated QUnit from v1.22.0 to v1.23.1.
5153* Updated cssjanus from v1.1.2 to v1.2.0.
5154* Updated psr/log from v1.0.0 to v1.0.2.
5155* Update Moment.js from v2.8.4 to v2.15.0.
5156* Updated oyejorge/less.php from v1.7.0.10 to v1.7.0.14.
5157* Updated monolog from v1.18.2 to 1.22.1.
5158* Updated wikimedia/composer-merge-plugin from v1.3.1 to v1.4.0.
5159* Updated OOjs from v1.1.10 to v2.0.0.
5160* Updated jQuery from v1.11.3 to v3.2.1 (including jQuery Migrate v3.0.0).
5161
5162==== New external libraries ====
5163* Added wikimedia/timestamp v1.0.0.
5164* Added wikimedia/remex-html v1.0.1.
5165
5166==== Removed and replaced external libraries ====
5167
5168=== Bug fixes in 1.29 ===
5169* (T62604) Core parser functions returning a number now format the number
5170  according to the page content language, not wiki content language.
5171* (T27187) Search suggestions based on jquery.suggestions will now correctly
5172  only highlight prefix matches in the results.
5173* (T157035) "new mw.Uri()" was ignoring options when using default URI.
5174* Special:Allpages can no longer be filtered by redirect in miser mode.
5175* (T160519) CACHE_ANYTHING will not be CACHE_ACCEL if no accelerator is
5176  installed.
5177* (T109140) (T122209) SECURITY: Special:UserLogin and Special:Search allow
5178  redirect to interwiki links.
5179* (T144845) SECURITY: XSS in SearchHighlighter::highlightText() when
5180  $wgAdvancedSearchHighlighting is true.
5181* (T125177) SECURITY: API parameters may now be marked as "sensitive" to keep
5182  their values out of the logs.
5183* (T150044) SECURITY: "Mark all pages visited" on the watchlist now requires a
5184  CSRF token.
5185* (T156184) SECURITY: Escape content model/format url parameter in message.
5186* (T151735) SECURITY: SVG filter evasion using default attribute values in DTD
5187  declaration.
5188* (T161453) SECURITY: LocalisationCache will no longer use the temporary
5189  directory in it's fallback chain when trying to work out where to write the
5190  cache.
5191* (T48143) SECURITY: Spam blacklist ineffective on encoded URLs inside file
5192  inclusion syntax's link parameter.
5193* (T108138) SECURITY: Sysops can undelete pages, although the page is protected
5194  against it.
5195
5196=== Action API changes in 1.29 ===
5197* Submitting sensitive authentication request parameters to action=login,
5198  action=clientlogin, action=createaccount, action=linkaccount, and
5199  action=changeauthenticationdata in the query string is now an error. They
5200  should be submitted in the POST body instead.
5201* The capture option for action=resetpassword has been removed
5202* action=clearhasmsg now requires a POST.
5203* (T47843) API errors and warnings may be requested in non-English languages
5204  using the new 'errorformat', 'errorlang', and 'errorsuselocal' parameters.
5205* API error codes may have changed. Most notably, errors from modules using
5206  parameter prefixes (e.g. all query submodules) will no longer be prefixed.
5207* ApiPageSet-using modules will report the 'invalidreason' using the specified
5208  'errorformat'.
5209* action=emailuser may return a "Warnings" status, and now returns 'warnings'
5210  and 'errors' subelements (as applicable) instead of 'message'.
5211* action=imagerotate returns an 'errors' subelement rather than 'errormessage'.
5212* action=move now reports errors when moving the talk page as an array under
5213  key 'talkmove-errors', rather than using 'talkmove-error-code' and
5214  'talkmove-error-info'. The format for subpage move errors has also changed.
5215* action=revisiondelete no longer includes a "rendered" property on warnings
5216  and errors for each item. Use errorformat=wikitext if you're wanting parsed
5217  output.
5218* action=rollback no longer returns a "messageHtml" property. Use
5219  errorformat=html if you're wanting HTML formatting of error messages.
5220* action=upload now reports optional stash failures as an array under key
5221  'stasherrors' rather than a 'stashfailed' text string.
5222* action=watch reports 'errors' and 'warnings' instead of a single 'error', and
5223  no longer returns a 'message' on success.
5224* Added action=validatepassword to validate passwords for the account creation
5225  and password change forms.
5226* action=purge now requires a POST.
5227* There is a new `languagevariants` siprop for action=query&meta=siteinfo,
5228  which returns a list of languages with active LanguageConverter instances.
5229* action=query&query=allpages will no longer filter redirects using a database
5230  query in miser mode. This may result in less results being returned than were
5231  requested.
5232
5233=== Action API internal changes in 1.29 ===
5234* New methods were added to ApiBase to handle errors and warnings using i18n
5235  keys. Methods for using hard-coded English messages were deprecated:
5236  * ApiBase::dieUsage() was deprecated
5237  * ApiBase::dieUsageMsg() was deprecated
5238  * ApiBase::dieUsageMsgOrDebug() was deprecated
5239  * ApiBase::getErrorFromStatus() was deprecated
5240  * ApiBase::parseMsg() was deprecated
5241  * ApiBase::setWarning() was deprecated
5242* ApiBase::$messageMap is no longer public. Code attempting to access it will
5243  result in a PHP fatal error.
5244* The $message parameter to the ApiCheckCanExecute hook should be set to an
5245  ApiMessage. This is compatible with MediaWiki 1.27 and later. Returning a
5246  code for ApiBase::parseMsg() will no longer work.
5247* UsageException is deprecated in favor of ApiUsageException. For the time
5248  being ApiUsageException is a subclass of UsageException to allow things that
5249  catch only UsageException to still function properly.
5250* If, for some strange reason, code was using an ApiErrorFormatter instead of
5251  ApiErrorFormatter_BackCompat, note that the result format has changed and
5252  various methods now take a module path rather than a module name.
5253* ApiMessageTrait::getApiCode() now strips 'apierror-' and 'apiwarn-' prefixes
5254  from the message key, and maps some message keys for backwards compatibility.
5255* API parameters may now be marked as "sensitive" to keep their values out of
5256  the logs.
5257
5258=== Languages updated in 1.29 ===
5259
5260MediaWiki supports over 350 languages. Many localisations are updated
5261regularly. Below only new and removed languages are listed, as well as
5262changes to languages because of Phabricator reports.
5263
5264* Based as always on linguistic studies on intelligibility and language
5265  knowledge by geography, language fallbacks have been expanded. When a
5266  translation is missing in the user's preferred interface language, the
5267  corresponding translation for the fallback language will be used instead.
5268  English will only be used as last resort when there are no translations.
5269  Some configurations (such as date formats and gender namespaces) have also
5270  been updated when using the fallback language's configuration was inadequate.
5271  The new or reinstated language fallbacks are (after cs ↔ sk in 1.28):
5272  ca ↔ oc; hsb ↔ dsb; io → eo; mdf → ru; pnt → el; roa-tara → it; rup → ro;
5273  sh → bs, sr-el, hr.
5274* (T137376) New language support: Atikamekw (atj).
5275* (T163600) New language support: Dinka (din).
5276* (T155957) Talk Namespaces for Javanese language (jv) have been updated.
5277
5278==== No fallback for Ukrainian ====
5279* (T39314) The fallback from Ukrainian to Russian was removed. The Ukrainian
5280  language will now use the default fallback language: English. When a
5281  translation to Ukrainian is not available, an English string will be shown.
5282
5283=== Other changes in 1.29 ===
5284* Database::getSearchEngine() (deprecated in 1.28) was removed. Use
5285  SearchEngineFactory::getSearchEngineClass() instead.
5286* $wgSessionsInMemcached (deprecated in 1.20) was removed. No replacement is
5287  required as all sessions are stored in Object Cache now.
5288* MWHttpRequest::execute() should be considered to return a StatusValue; the
5289  Status return type is deprecated.
5290* User::edits() (deprecated in 1.21) was removed.
5291* Xml::escapeJsString() (deprecated in 1.21) was removed.
5292* Article::getText() and Article::prepareTextForEdit() (deprecated in 1.21)
5293  were removed.
5294* Article::getAutosummary() and WikiPage::getAutosummary() (deprecated in 1.21)
5295  were removed.
5296* Hook ArticleViewCustom (deprecated in 1.21) was removed. Use
5297  ArticleContentViewCustom instead.
5298* Hooks EditPageGetDiffText and ShowRawCssJs (deprecated in 1.21) were removed.
5299* Class RevisiondeleteAction (deprecated in 1.25) was removed.
5300* WikiPage::prepareTextForEdit() (deprecated in 1.21) was removed.
5301* WikiPage::getText() (deprecated in 1.21) was removed.
5302* Article::fetchContent() (deprecated in 1.21) was removed.
5303* User::getPassword() (deprecated in 1.27) was removed.
5304* User::getTemporaryPassword() (deprecated in 1.27) was removed.
5305* User::isPasswordReminderThrottled() (deprecated in 1.27) was removed.
5306* Class FSRepo (deprecated in 1.19) was removed.
5307* WebRequest::checkSessionCookie() (deprecated in 1.27) was removed. Use
5308  \MediaWiki\Session\SessionManager::singleton()->getPersistedSessionId()
5309  instead.
5310* Class ImageGallery (deprecated in 1.22) was removed.
5311  Use ImageGalleryBase::factory instead.
5312* Title::moveNoAuth() (deprecated in 1.25) was removed. Use MovePage class
5313  instead.
5314* Hook UnknownAction (deprecated in 1.19) was actually deprecated (it will now
5315  emit warnings). Create a subclass of Action and add it to $wgActions instead.
5316* WikiRevision::getText() (deprecated since 1.21) is no longer marked
5317  deprecated.
5318* Linker::getInterwikiLinkAttributes() (deprecated since 1.25) was removed.
5319* Linker::getInternalLinkAttributes() (deprecated since 1.25) was removed.
5320* Linker::getInternalLinkAttributesObj() (deprecated since 1.25) was removed.
5321* Linker::getLinkAttributesInternal() (deprecated since 1.25) was removed.
5322* RedisConnectionPool::handleException (deprecated since 1.23) was removed.
5323* The static properties mw.Api.errors and mw.Api.warnings, containing incomplete
5324  and outdated lists of errors/warnings returned by the API, are now deprecated.
5325* wiki.phtml entry point was removed.  Refer to index.php instead. If you want
5326  "wiki.phtml" URLs to continue to work, set up redirects. In Apache, this can
5327  be done by enabling mod_rewrite and adding the following rules to your
5328  configuration:
5329
5330    RewriteEngine On
5331    RewriteBase /
5332    RewriteRule ^/w/wiki\.phtml$ /w/index.php [R=301,L]
5333* Hook ArticleAfterFetchContent (deprecated in 1.21) was removed.
5334  Use ArticleAfterFetchContentObject instead.
5335* Hook ArticleInsertComplete (deprecated in 1.21) was removed.
5336  Use PageContentInsertComplete instead.
5337* Hook ArticleSave (deprecated in 1.21) was removed.
5338  Use PageContentSave instead.
5339* Hook ArticleSaveComplete (deprecated in 1.21) was removed.
5340  Use PageContentSaveComplete instead.
5341* Hook EditFilterMerged (deprecated in 1.21) was removed.
5342  Use EditFilterMergedContent instead.
5343* Hook EditPageGetPreviewText (deprecated in 1.21) was removed.
5344  Use EditPageGetPreviewContent instead.
5345* Hook TitleIsCssOrJsPage (deprecated in 1.21) was removed.
5346  Use ContentHandlerDefaultModelFor instead.
5347* Hook TitleIsWikitextPage (deprecated in 1.21) was removed.
5348  Use ContentHandlerDefaultModelFor instead.
5349* Article::getContent() (deprecated in 1.21) was removed.
5350* Revision::getText() (deprecated in 1.21) was removed.
5351* Article::doEdit() and WikiPage::doEdit() (deprecated in 1.21) were removed.
5352* Parser::replaceUnusualEscapes() (deprecated in 1.24) was removed.
5353* Article::doEditContent() was marked as deprecated, to be removed in 1.30
5354  or later.
5355* ContentHandler::runLegacyHooks() was removed.
5356* refreshLinks.php now can be limited to a particular category with
5357  --category=... or a tracking category with --tracking-category=...
5358* User-like objects that are passed to SpecialUserRights and its subclasses are
5359  now required to have a getGroupMemberships() method. See UserRightsProxy for
5360  an example.
5361* User::$mGroups (instance variable) was marked private. Use User::getGroups()
5362  instead.
5363* User::getGroupName(), User::getGroupMember(), User:getGroupPage(),
5364  User::makeGroupLinkHTML(), and User::makeGroupLinkWiki() were deprecated.
5365  Use equivalent methods on the UserGroupMembership class.
5366* Maintenance scripts and tests that call User::addGroup() must now ensure that
5367  User objects have been added to the database prior to calling addGroup().
5368* Protected function UsersPager::getGroups() was removed, and protected function
5369  UsersPager::buildGroupLink() was changed from a static to an instance method.
5370* The third parameter ($cache) to the UsersPagerDoBatchLookups hook was changed;
5371  see docs/hooks.txt.
5372* User::crypt() (deprecated in 1.24) was removed.
5373* User::comparePasswords() (deprecated in 1.24) was removed.
5374* ArchivedFile::getUserText() (deprecated in 1.23) was removed.
5375* HTMLFileCache::newFromTitle() (deprecated in 1.24) was removed.
5376* BREAKING CHANGE: Internal signature changes to ChangesListSpecialPage
5377  and subclasses.  It should only break if you call buildMainQueryConds
5378  (changed to buildQuery with new signature) or doMainQuery (new
5379  signature).  Subclasses are likely to call at least doMainQuery
5380  (possibly both), but other classes might too, because they were
5381  public.
5382  Also, some related hooks were deprecated, but this is not yet a
5383  breaking change.
5384* Removed 'jquery.arrowSteps' module. (deprecated since 1.28)
5385* The 'jquery.autoEllipsis' ResourceLoader module is now deprecated.
5386* WikiRevision::$fileIsTemp was deprecated.
5387* WikiRevision::$importer was deprecated.
5388* WikiRevision::$user was deprecated.
5389* Article::getLastPurgeTimestamp(), WikiPage::getLastPurgeTimestamp(), and the
5390  WikiPage::PURGE_* constants are deprecated, and the functions will always
5391  return false. They were a hack for an issue that has since been fixed.
5392* Hook 'EditPageBeforeEditChecks' is now deprecated. Instead use the new hook
5393  'EditPageGetCheckboxesDefinition', or 'EditPage::showStandardInputs:options'
5394  if you don't actually care about checkboxes and just want to add some HTML
5395  to the page.
5396* Selflinks are now rendered as href-less <a> tags with the class mw-selflink
5397  rather than <strong> tags. The old class name, "selflink", was deprecated
5398  and will be removed in a future release. (T160480)
5399* (T156184) $wgRawHtml will no longer apply to internationalization messages.
5400* Browser support for non-ES5 JavaScript browsers, including Android 2,
5401  Opera <12.10, and Internet Explorer 9, was lowered from Grade A to Grade C.
5402* Removed wikibits global methods deprecated since MediaWiki 1.17 (T122755):
5403  is_gecko, is_chrome_mac, is_chrome, webkit_version, is_safari_win, is_safari,
5404  webkit_match, is_ff2, ff2_bugs, is_ff2_win, is_ff2_x11, opera95_bugs,
5405  opera7_bugs, opera6_bugs, is_opera_95, is_opera_preseven, is_opera,
5406  ie6_bugs, clientPC, changeText, killEvt, addHandler, hookEvent,
5407  addClickHandler, removeHandler, getElementsByClassName, getInnerText,
5408  setupCheckboxShiftClick, addCheckboxClickHandlers, mwEditButtons,
5409  mwCustomEditButtons, injectSpinner, removeSpinner, escapeQuotes,
5410  escapeQuotesHTML, jsMsg, addPortletLink, appendCSS, tooltipAccessKeyPrefix,
5411  tooltipAccessKeyRegexp, updateTooltipAccessKeys.
5412* The ID of the <li> element containing the login link has changed from
5413  'pt-login' to 'pt-login-private' in private wikis.
5414* The old, neglected "bulletin board style toolbar" in the edit form is now
5415  deprecated (T30856). This old code dates from 2006, and was replaced in the
5416  MediaWiki release tarball and in Wikimedia production by the WikiEditor
5417  extension in 2010. It is only shown to users if no other editor was
5418  installed, and leads to confusion.
5419* (T92459) Loading ResourceLoader modules containing JavaScript through
5420  addModuleStyles() is deprecated and will log a warning server-side.
5421
5422= MediaWiki 1.28 =
5423
5424== MediaWiki 1.28.3 ==
5425
5426This is a security and maintenance release of the MediaWiki 1.28 branch.
5427
5428=== Changes since 1.28.2 ==
5429* (T168856) Allow SVGs created by Dia to be uploaded.
5430* (T157545) Add missing doUpdates() call to refreshLinks.php.
5431* (T165714) (T100085) Better handling of jobs execution in post-connection
5432  shutdown.
5433* (T154425) (T154438) (T157679) Use AutoCommitUpdate instead of
5434  Database->onTransactionIdle.
5435* (T154425) Make DeferredUpdates detect LBFactory transaction rounds.
5436* (T149454) Restore erroneously removed realTableName call from
5437  DatabasePostgres.
5438* (T167798) Fix phrase search and highlighting for phrase queries.
5439* (T151136) Provide credits information to callbacks in extension registration.
5440* (T160462) Allow namespaces defined in extension.json to be overwritten
5441  locally.
5442* (T168337) Fix ErrorPageError to work from non-UI contexts.
5443* (T143788) Backports for PHP 7.0 and 7.1 support.
5444* (T175439) Unbreak Postgres Updater when setting defaults for a column.
5445* (T160298) Remove use of implicitGroupBy() in ActiveUsersPager.
5446* (T174255) Declare uploadCount property in importDump.php.
5447* (T180231) SECURITY: Updated dev dependancy phpunit/phpunit from v4.8.24 to
5448  v4.8.36.
5449* (T178451) SECURITY: Potential XSS when $wgShowExceptionDetails = false and
5450  browser sends non-standard url escaping.
5451* (T165846) SECURITY: BotPassword login attempts weren't throttled.
5452* (T128209) SECURITY: Reflected File Download from api.php.
5453* (T134100) SECURITY: Do not reveal if user exists during login failure.
5454* (T176247) SECURITY: Ensure Message::rawParams can't lead to XSS.
5455* (T125163) SECURITY: Make anchor for headlines escape > and <.
5456* (T180237) SECURITY: Protect vendor folder with .htaccess.
5457* (T180231) SECURITY: Remove PHPUnit file with known RCE if exists in
5458  update.php.
5459* (T124404) SECURITY: XSS in langconverter when regex hits pcre.backtrack_limit.
5460* (T119158) SECURITY: Handle -{}- syntax in attributes safely.
5461
5462== MediaWiki 1.28.2 ==
5463
5464Due to a packaging error, the wrong version of the SyntaxHighlight extension was
5465included in the tarball version of MediaWiki 1.28.1. The version included had a
5466serious security issue in it (T158689). There was also some minor code fixes in
5467MediaWiki itself since 1.28.1, but none of them were security relevant.
5468
5469== MediaWiki 1.28.1 ==
5470
5471This is a security and maintenance release of the MediaWiki 1.28 branch.
5472
5473=== Changes since 1.28.0 ===
5474
5475* $wgRunJobsAsync is now false by default (T142751). This change only affects
5476  wikis with $wgJobRunRate > 0.
5477* Fix fatal from "WaitConditionLoop" not being found, experienced when a wiki
5478  has more than one database server setup.
5479* (T152717) Better escaping for PHP mail() command,
5480* (T154670) A missing method causing the MySQL installer to fatal in rare
5481  circumstances was restored.
5482* (T154672) Un-deprecate ArticleAfterFetchContentObject hook.
5483* (T158766) Avoid SQL error on MSSQL when using selectRowCount().
5484* (T145635) Fix too long index error when installing with MSSQL.
5485* (T156184) $wgRawHtml will no longer apply to internationalization messages.
5486* (T160519) CACHE_ANYTHING will not be CACHE_ACCEL if no accelerator is
5487  installed.
5488* (T154872) Fix incorrect ar_usertext_timestamp index names in new 1.28
5489  installs.
5490* (T109140) (T122209) SECURITY: Special:UserLogin and Special:Search allow
5491  redirect to interwiki links.
5492* (T144845) SECURITY: XSS in SearchHighlighter::highlightText() when
5493  $wgAdvancedSearchHighlighting is true.
5494* (T125177) SECURITY: API parameters may now be marked as "sensitive" to keep
5495  their values out of the logs.
5496* (T150044) SECURITY: "Mark all pages visited" on the watchlist now requires a
5497  CSRF token.
5498* (T156184) SECURITY: Escape content model/format url parameter in message.
5499* (T151735) SECURITY: SVG filter evasion using default attribute values in DTD
5500  declaration.
5501* (T161453) SECURITY: LocalisationCache will no longer use the temporary
5502  directory in it's fallback chain when trying to work out where to write the
5503  cache.
5504* (T48143) SECURITY: Spam blacklist ineffective on encoded URLs inside file
5505  inclusion syntax's link parameter.
5506* (T108138) SECURITY: Sysops can undelete pages, although the page is protected
5507  against it.
5508
5509== MediaWiki 1.28 ==
5510
5511=== Changes since 1.28.0-rc1 ===
5512* (T148957) Replace wgShowExceptionDetails with wgShowDBErrorBacktrace on db
5513  errors.
5514* (T148956) Only apply wgDBschema to postgres/mssql.
5515* (T145991) Introduce separate log action for deleting pages on move.
5516* (T141474) (T110464) Bypass login page if no user input is required.
5517
5518=== Changes since 1.28.0-rc0 ===
5519* (T142210) The changes to move the parser "NewPP limit report" from a HTML
5520  comment to a machine-readable JavaScript config option 'wgPageParseReport'
5521  have been undone. They caused the human-readable limit report to be shown
5522  incompletely or not at all. ParserOutput::setLimitReportData() and
5523  getLimitReportData() behave as they did in MediaWiki 1.27 again.
5524* (T149510) Value of {{DISPLAYTITLE:}} parser function will not be used for
5525  the text of subheadings on a category page when creating it. This wasn't
5526  working correctly.
5527* (T106793) MediaWiki will no longer try to perform a HTTP redirect to the
5528  canonical pretty URL when a non-pretty URL is used. It resulted in redirect
5529  loops in some clients and in some server configurations. This undoes a change
5530  made in MediaWiki 1.26.
5531* (T149759) manifest_version: 2 was removed.
5532
5533=== Configuration changes in 1.28 ===
5534* $wgSend404Code now affects status code of action=history if the page is not
5535  there.
5536* BREAKING CHANGE: $wgHTTPProxy is now *required* for all external requests
5537  made by MediaWiki via a proxy. Relying on the http_proxy environment
5538  variable is no longer supported.
5539* The load.php entry point now enforces the existing policy of not allowing
5540  access to session data, which includes the session user and the session
5541  user's language. If such access is attempted, an exception will be thrown.
5542* The number of internal PBKDF2 iterations used to derive the session secret
5543  is configurable via $wgSessionPbkdf2Iterations.
5544* Upload dialog's file upload log comment can now be configured separately for
5545  local and foreign uploads.
5546* $wgForeignUploadTargets now defaults to `[ 'local' ]`, where `'local'`
5547  signifies local uploads. A value of `[]` (empty array) now means that
5548  no upload targets are allowed, effectively disabling the upload dialog.
5549* The deprecated $wgEditEncoding variable has been removed; it was only used
5550  for Esperanto language character conversion. You are now recommended to use
5551  input methods provided by the UniversalLanguageSelector extension.
5552* When $wgPingback is true, MediaWiki will periodically ping
5553  https://www.mediawiki.org/beacon with basic information about the local
5554  MediaWiki installation. This data includes, for example, the type of system,
5555  PHP version, and chosen database backend. This behavior is off by default.
5556* When $wgEditSubmitButtonLabelPublish is true, MediaWiki will label the button
5557  to store-to-database-and-show-to-others as "Publish page"/"Publish changes";
5558  if false, the default, they will be "Save page"/"Save changes".
5559* The 'editcontentmodel' permission is now granted to all logged-in users
5560  ('user').
5561  instead of just administrators ('sysop'). Documentation for this feature is
5562  available at <https://www.mediawiki.org/wiki/Help:ChangeContentModel>.
5563* $wgRevisionCacheExpiry is now set to one week by default instead of being
5564  disabled.
5565* Magic links are now disabled by default, and can be re-enabled by modifying
5566  the value of $wgEnableMagicLinks. Their usage is discouraged, but if they are
5567  manually enabled, a tracking category will be added to help identify usage and
5568  make it easier to migrate away from. If you depend upon magic link
5569  functionality, it is requested that you comment on
5570  <https://www.mediawiki.org/wiki/Requests_for_comment/Future_of_magic_links>
5571  and explain your use case(s).
5572* New config variable $wgCSPFalsePositiveUrls to control what URLs to ignore
5573  in upcoming Content-Security-Policy feature's reporting.
5574
5575=== New features in 1.28 ===
5576* User::isBot() method for checking if an account is a bot role account.
5577* Added a new 'slideshow' mode for galleries.
5578* Added a new hook, 'UserIsBot', to aid in determining if a user is a bot.
5579* Added a new hook, 'ApiMakeParserOptions', to allow extensions to better
5580  interact with API parsing.
5581* Added a new hook, 'UploadVerifyUpload', which can be used to reject a file
5582  upload. Unlike 'UploadVerifyFile' it provides information about upload comment
5583  and the file description page, but does not run for uploads to stash.
5584* (T141604) Extensions can now provide a better error message when their
5585  maintenance scripts are run without the extension being installed.
5586* (T8948) Numeric sorting in categories is now supported by setting
5587  $wgCategoryCollation to 'uca-default-u-kn' or 'uca-<langcode>-u-kn'. If you
5588  can't use UCA collations, a 'numeric' collation is also available. If
5589  migrating from another collation, you will need to run the updateCollation.php
5590  maintenance script.
5591* Two new codes have been added to #time parser function: "xit" for days in
5592  current month, and "xiz" for days passed in the year, both in Iranian
5593  calendar.
5594* mw.Api has a new option, useUS, to use U+001F (Unit Separator) when
5595  appropriate for sending multi-valued parameters. This defaults to true when
5596  the mw.Api instance seems to be for the local wiki.
5597* After a client performs an action which alters a database that has replica
5598  databases, MediaWiki will wait for the replica databases to synchronize with
5599  the master database while it renders the HTML output. However, if the output
5600  is a redirect to another wiki on the wiki farm with a different domain,
5601  MediaWiki will instead alter the redirect URL to include a ?cpPosTime
5602  parameter that triggers the database synchronization when the URL is followed
5603  by the client. The same-domain case uses a new cpPosTime cookie.
5604* Added new hooks, 'ApiQueryBaseBeforeQuery', 'ApiQueryBaseAfterQuery', and
5605  'ApiQueryBaseProcessRow', to make it easier for extensions to add 'prop' and
5606  'show' parameters to existing API query modules.
5607
5608=== External library changes in 1.28 ===
5609
5610==== Upgraded external libraries ====
5611* Updated es5-shim from v4.1.5 to v4.5.8
5612* Updated composer/semver from v1.4.1 to v1.4.2
5613* Updated wikimedia/php-session-serializer from v1.0.3 to v1.0.4
5614
5615==== New external libraries ====
5616* Added wikimedia/scoped-callback v1.0.0
5617* Added wikimedia/wait-condition-loop v1.0.1
5618
5619=== Bug fixes in 1.28 ===
5620* (T146496) action=history pages should return 404 HTTP error code if the page
5621  does not exist
5622* (T137264) SECURITY: XSS in unclosed internal links
5623* (T133147) SECURITY: Escape '<' and ']]>' in inline <style> blocks
5624* (T133147) SECURITY: Require login to preview user CSS pages
5625* (T132926) SECURITY: Do not allow undeleting a revision deleted file if it is
5626  the top file
5627* (T129738) SECURITY: Make $wgBlockDisablesLogin also restrict logged in
5628  permissions
5629* (T129738) SECURITY: Make blocks log users out if $wgBlockDisablesLogin is true
5630* (T139670) Move 'UserGetRights' call before application of
5631  Session::getAllowedUserRights()
5632
5633=== Action API changes in 1.28 ===
5634* Added 'maxarticlesize' property to action=query&meta=siteinfo which contains
5635  the value of $wgMaxArticleSize.
5636* Property 'modulemessages' from action=parse&prop=modules was removed
5637  (deprecated since 1.26).
5638* The following response properties from action=login, deprecated in 1.27, are
5639  now removed: lgtoken, cookieprefix, sessionid. Clients should handle cookies
5640  to properly manage session state.
5641* Submitting the lgtoken and lgpassword parameters in the query string to
5642  action=login is now deprecated and outputs a warning. They should be submitted
5643  in the POST body instead.
5644* Submitting sensitive authentication request parameters to action=clientlogin,
5645  action=createaccount, action=linkaccount, and action=changeauthenticationdata
5646  in the query string is now deprecated and outputs a warning. They should be
5647  submitted in the POST body instead.
5648* (T141960) Multi-valued parameters may now be separated using U+001F
5649  (Unit Separator) instead of the pipe character. This will be useful if some of
5650  the multiple values need to contain pipes, e.g. for action=options.
5651* The API will now warn if input is not NFC-normalized Unicode or if it
5652  contains invalid characters.
5653* The 'normalized' list output by action=query and other modules that use
5654  ApiPageSet may contain entries where the 'from' value is percent-encoded as
5655  the raw value cannot be represented in a valid API response. These are
5656  indicated by a 'fromencoded' boolean alongside the existing 'from' parameter.
5657* (T28680) action=paraminfo can now return info about all submodules of a
5658  module without listing them all explicitly.
5659* (T146770) It is now possible to assert that the current user is a specific
5660  named user, using the 'assertuser' parameter.
5661* (T141963) Added a 'known' property when missing-but-known titles (e.g. from
5662  the 'TitleIsAlwaysKnown' hook) are output in various modules.
5663
5664=== Action API internal changes in 1.28 ===
5665* Added a new hook, 'ApiMakeParserOptions', to allow extensions to better
5666  interact with ApiParse and ApiExpandTemplates.
5667* (T139565) SECURITY: API: Generate head items in the context of the given title
5668* (T115333) SECURITY: Check read permission when loading page content in
5669  ApiParse
5670* ApiBase::getResultData() was removed (deprecated since 1.25)
5671* ApiBase::makeHelpArrayToString() was removed (deprecated since 1.25)
5672* ApiBase::makeHelpMsgParameters() was removed (deprecated since 1.25)
5673* ApiBase::makeHelpMsg() was removed (deprecated since 1.25)
5674* ApiFormatBase::formatHTML() was removed (deprecated since 1.25)
5675* ApiFormatBase::getNeedsRawData() was removed (deprecated since 1.25)
5676* ApiFormatBase::getWantsHelp() was removed (deprecated since 1.25)
5677* ApiFormatBase::setBufferResult() was removed (deprecated since 1.25)
5678* ApiFormatBase::setHelp() was removed (deprecated since 1.25)
5679* ApiFormatBase::setUnescapeAmps() was removed (deprecated since 1.25)
5680* ApiMain::makeHelpMsgHeader() was removed (deprecated since 1.25)
5681* ApiMain::reallyMakeHelpMsg() was removed (deprecated since 1.25)
5682* ApiMain::setHelp() was removed (deprecated since 1.25)
5683* ApiResult::beginContinuation() was removed (deprecated since 1.25)
5684* ApiResult::cleanUpUTF8() was removed (deprecated since 1.25)
5685* ApiResult::convertStatusToArray() was removed (deprecated since 1.25)
5686* ApiResult::disableSizeCheck() was removed (deprecated since 1.24)
5687* ApiResult::enableSizeCheck() was removed (deprecated since 1.24)
5688* ApiResult::endContinuation() was removed (deprecated since 1.25)
5689* ApiResult::getData() was removed (deprecated since 1.25)
5690* ApiResult::getIsRawMode() was removed (deprecated since 1.25)
5691* ApiResult::setContent() was removed (deprecated since 1.25)
5692* ApiResult::setContinueParam() was removed (deprecated since 1.25)
5693* ApiResult::setElement() was removed (deprecated since 1.25)
5694* ApiResult::setGeneratorContinueParam() was removed (deprecated since 1.25)
5695* ApiResult::setIndexedTagName_internal() was removed (deprecated since 1.25)
5696* ApiResult::setIndexedTagName_recursive() was removed (deprecated since 1.25)
5697* ApiResult::setMainForContinuation() was removed (deprecated since 1.25)
5698* ApiResult::setParsedLimit() was removed (deprecated since 1.25)
5699* ApiResult::setRawMode() was removed (deprecated since 1.25)
5700* ApiResult::size() was removed (deprecated since 1.25)
5701* Added new hooks, 'ApiQueryBaseBeforeQuery', 'ApiQueryBaseAfterQuery', and
5702  'ApiQueryBaseProcessRow', to make it easier for extensions to add 'prop' and
5703  'show' parameters to existing API query modules. A query module can enable
5704  these hooks by passing an array for $hookData to ApiQueryBase::select() and
5705  by calling ApiQueryBase->processRow() before adding a row's data to the
5706  result.
5707
5708=== Languages updated in 1.28 ===
5709
5710MediaWiki supports over 375 languages. Many localisations are updated
5711regularly. Below only new and removed languages are listed, as well as
5712changes to languages because of Phabricator reports.
5713
5714* (T137411) ban (Balinese), thanks to translators Adi Mayndra, Andru,
5715  BASAbali, M. Adiputra, Naval Scene, Nemo bis, NoiX180, and 아라.
5716* (T135867) shn (Shan), thanks to translators Khun Sar, Piangpha,
5717  Saiddzone Saimawnkham, Saosukham, and Sengwan.
5718* Czech (cs) and Slovak (sk) set as reciprocal fallbacks.
5719* (T146744) Livvi-Karelian (olo) namespace messages created thanks to translator
5720  Ilja.mos.
5721
5722=== Other changes in 1.28 ===
5723* (T128697) Improved handling of large diffs.
5724* [BREAKING CHANGE] $wgExtendedLoginCookies has been removed. You can
5725  use or update a custom session provider if needed.
5726* Deprecated APIEditBeforeSave hook in favor of EditFilterMergedContent.
5727* The 'UploadVerification' hook is deprecated. Use 'UploadVerifyFile' instead.
5728* SiteConfiguration::isLocalVHost() was removed (deprecated since 1.25).
5729* The 'UserLoginComplete' hook has a new parameter to differentiate between
5730  actual login and visiting the login page while already logged in.
5731* ResourceLoader::makeLoaderURL() was removed (deprecated since 1.24).
5732* $.fn.liveAndTestAtStart was removed (deprecated since 1.24).
5733* mw.util.tooltipAccessKeyPrefix was removed (deprecated since 1.24).
5734* mw.util.tooltipAccessKeyRegexp was removed (deprecated since 1.24).
5735* Linker::link() and Linker::linkKnown() were deprecated; please instead use
5736  MediaWiki\Linker\LinkRenderer. In addition, the LinkBegin and LinkEnd hooks
5737  were replaced by HtmlPageLinkRendererBegin and HtmlPageLinkRendererEnd
5738  respectively. See docs/hooks.txt for the specific changes needed for those
5739  hooks.
5740* Linker::formatSize() was deprecated. Use Language::formatSize() directly.
5741* Aliases for Linker methods, deprecated since 1.21, were removed from Skin:
5742  * Skin::commentBlock() (use Linker::commentBlock() instead)
5743  * Skin::generateRollback() (use Linker::generateRollback() instead)
5744  * Skin::link() (use MediaWiki\Linker\LinkRenderer instead)
5745  * Skin::linkKnown() (use MediaWiki\Linker\LinkRenderer instead)
5746  * Skin::userLink() (use Linker::userLink() instead)
5747  * Skin::userToolLinks() (use Linker::userToolLinks() instead)
5748* Disabled "bug 2702" HTML tidying of parsed UI messages on wikis where Tidy is
5749  disabled.
5750* DifferenceEngine::generateDiffBody() was removed (deprecated since 1.21).
5751* UploadBase::stashFileGetKey() and UploadBase::stashSession() were deprecated.
5752  Use ...->stashFile()->getFileKey() instead.
5753* "Public domain" was removed as a wiki license option from the installer, in
5754  favour of CC-0.
5755* AuthenticationRequest::$required is now changed from REQUIRED to
5756  PRIMARY_REQUIRED on requests needed by primary providers even if all primaries
5757  need them.
5758  Primary providers are discouraged from returning multiple REQUIRED requests.
5759* OOjs UI PHP widgets constructed with the `'infusable' => true` config option
5760  will no longer be automatically infused. You should call `OO.ui.infuse()`
5761  on them yourself from your JavaScript code.
5762* parserTests.php has moved to tests/parser/parserTests.php
5763* The command line options specific to parser tests have been removed from
5764  phpunit.php: --regex and --keep-uploads. Instead of --regex, use --filter.
5765  Instead of --keep-uploads, use the same option to parserTests.php, but you
5766  must specify a directory with --upload-dir.
5767* The 'jquery.arrowSteps' ResourceLoader module is now deprecated.
5768* IP::isConfiguredProxy() and IP::isTrustedProxy() were removed. Callers should
5769  migrate to using the same functions on a ProxyLookup instance, obtainable from
5770  MediaWikiServices.
5771* The ArticleAfterFetchContent, ArticleInsertComplete, ArticleSave,
5772  ArticleSaveComplete, ArticleViewCustom, EditFilterMerged, EditPageGetDiffText,
5773  EditPageGetPreviewText and ShowRawCssJs hooks will now emit deprecation
5774  warnings if used.
5775* (T68404) CSS3 attr() function with url type is no longer allowed
5776  in inline styles.
5777* Database::getSearchEngine() is deprecated, use
5778  SearchEngineFactory::getSearchEngineClass instead.
5779
5780== Compatibility ==
5781
5782MediaWiki 1.28 requires PHP 5.5.9 or later. There is experimental support for
5783HHVM 3.6.5 or later.
5784
5785MySQL is the recommended DBMS. PostgreSQL or SQLite can also be used, but
5786support for them is somewhat less mature. There is experimental support for
5787Oracle and Microsoft SQL Server.
5788
5789The supported versions are:
5790
5791* MySQL 5.0.3 or later
5792* PostgreSQL 8.3 or later
5793* SQLite 3.3.7 or later
5794* Oracle 9.0.1 or later
5795* Microsoft SQL Server 2005 (9.00.1399)
5796
5797== Upgrading ==
5798
57991.28 has several database changes since 1.27, and will not work without schema
5800updates. Note that due to changes to some very large tables like the revision
5801table, the schema update may take quite long (minutes on a medium sized site,
5802many hours on a large site).
5803
5804If upgrading from before 1.11, and you are using a wiki as a commons
5805repository, make sure that it is updated as well. Otherwise, errors may arise
5806due to database schema changes.
5807
5808If upgrading from before 1.7, you may want to run refreshLinks.php to ensure
5809new database fields are filled with data.
5810
5811If you are upgrading from MediaWiki 1.4.x or earlier, you should upgrade to
58121.5 first. The upgrade script maintenance/upgrade1_5.php has been removed
5813with MediaWiki 1.21.
5814
5815Don't forget to always back up your database before upgrading!
5816
5817See the file UPGRADE for more detailed upgrade instructions.
5818
5819For notes on 1.27.x and older releases, see HISTORY.
5820
5821== Online documentation ==
5822
5823Documentation for both end-users and site administrators is available on
5824MediaWiki.org, and is covered under the GNU Free Documentation License (except
5825for pages that explicitly state that their contents are in the public domain):
5826
5827       https://www.mediawiki.org/wiki/Special:MyLanguage/Documentation
5828
5829== Mailing list ==
5830
5831A mailing list is available for MediaWiki user support and discussion:
5832
5833       https://lists.wikimedia.org/mailman/listinfo/mediawiki-l
5834
5835A low-traffic announcements-only list is also available:
5836
5837       https://lists.wikimedia.org/mailman/listinfo/mediawiki-announce
5838
5839It's highly recommended that you sign up for one of these lists if you're
5840going to run a public MediaWiki, so you can be notified of security fixes.
5841
5842== IRC help ==
5843
5844There's usually someone online in #mediawiki on irc.freenode.net.
5845
5846= MediaWiki 1.27 =
5847
5848== MediaWiki 1.27.7 ==
5849
5850This is a maintenance release of the MediaWiki 1.27 branch.
5851
5852=== Changes since MediaWiki 1.27.6 ===
5853* Add missing `use MediaWiki\MediaWikiServices;` to LogEventsList.php.
5854* Remove broken tests from ApiBlockTest.php.
5855
5856== MediaWiki 1.27.6 ==
5857
5858This is a security and maintenance release of the MediaWiki 1.27 branch.
5859
5860=== Changes since MediaWiki 1.27.5 ===
5861* (T204729) WatchedItemStore::countVisitingWatchersMultiple() shouldn't query
5862  all titles when asked for none.
5863* (T109121) Remove deprecated pear/mail_mime-decode from composer suggested
5864  libraries.
5865* (T207241) Augment precision of updatelist time.
5866* (T207540) Include IP address in "Login for $1 succeeded" log entry.
5867* (T205765) Don't link to the obsolete "Extension Matrix" page in installer.
5868* (T207603) SECURITY: User JS may no longer be loaded with mime type
5869  text/javascript if there is no account associated with the username.
5870* (T113042) SECURITY: Do not allow loading pages raw with a text/javascript MIME
5871  type if non-admins can edit the page.
5872* (T207541) Pass email address to mail().
5873* (T209335) Clarify the default sidebar 'Help' link is about MediaWiki itself.
5874* (T213359) Update mediawiki/mediawiki-codesniffer to 0.8.1.
5875* (T208871) The hard-coded Google search form on the database error page was
5876  removed.
5877* (T216968) Return pageid as int in both list=iwbacklinks and
5878  list=langbacklinks.
5879* (T218608) Fix an issue that prevents Extension:OAuth working when
5880  $wgBlockDisablesLogin is true.
5881* (T219728) Added support for new Japanese era name "Reiwa".
5882* (T25227) SECURITY: action=logout now requires to be posted and have a csrf
5883  token.
5884* SpecialPage::checkLoginSecurityLevel() will now preserve POST data when
5885  reauthenticating.
5886* FormSpecialPage::execute() will now call checkLoginSecurityLevel() if
5887  getLoginSecurityLevel() returns non-false.
5888* (T197279) SECURITY: Fix reauth in Special:ChangeEmail.
5889* (T208881) SECURITY: blacklist CSS var().
5890* (T209794) SECURITY: rate-limit and prevent blocked users from changing email.
5891* (T199540) SECURITY: API: Respect $wgBlockCIDRLimit in action=block.
5892* (T212118) SECURITY: Fix cache mode for (un)patrolled recent changes query.
5893* (T222036, T222038) SECURITY: Add permission check for user is permitted to
5894  view the log type.
5895* (T221739) SECURITY: resources: Patch jQuery 1.11.3 for CVE-2019-11358.
5896
5897== MediaWiki 1.27.5 ==
5898
5899This is a security and maintenance release of the MediaWiki 1.27 branch.
5900
5901=== Changes since 1.27.4 ===
5902* (T169545, CVE-2018-0503) SECURITY: $wgRateLimits entry for 'user' overrides
5903  'newbie'.
5904* (T194605, CVE-2018-0505) SECURITY: BotPasswords can bypass CentralAuth's
5905  account lock.
5906* Upgraded Moment.js from v2.8.4 to v2.19.3.
5907* (T160298) Fixed Special:ActiveUsers due to bad backport.
5908* (T87572) Make FormatMetadata::flattenArrayReal() work for an associative
5909  array.
5910* Updated list of SPDX licenses for extensions.
5911* (T189567) the CLI installer (maintenance/install.php) learned to detect and
5912  include extensions. Pass --with-extensions to enable that feature.
5913* (T192584) Stop incorrectly passing USE INDEX to RecentChange::newFromConds().
5914* Add default edit rate limit of 90 edits/minute for all users.
5915* (T196125) php-memcached 3.0 (provided with PHP 7.0) is now supported.
5916* (T196672) The mtime of extension.json files is now able to be zero.
5917* (T118683) Fix exception from &$user deref on HHVM in the TitleMoveComplete
5918  hook.
5919* (T180403) Validate $length in padleft/padright parser functions.
5920* (T143790) Make $wgEmailConfirmToEdit only affect edit actions.
5921* Special:BotPasswords now requires reauthentication.
5922* (T191608, T187638) Add 'logid' parameter to Special:Log.
5923* (T193829) Indicate when a Bot Password needs reset.
5924* (T151415) Log email changes.
5925* (T118420) Unbreak Oracle installer.
5926
5927== MediaWiki 1.27.4 ==
5928This is a security and maintenance release of the MediaWiki 1.27 branch.
5929
5930=== Changes since 1.27.3 ===
5931* (T100085) Better handling of jobs execution in post-connection shutdown.
5932* (T141604) Support conditionally registered namespaces.
5933* (T167798) Fix highlighting for phrase queries and phrase search.
5934* (T151136) Provide credits information to callbacks.
5935* (T160462) Allow namespaces defined in extension.json to be overwritten
5936  locally.
5937* (T168856) Allow SVGs created by Dia to be uploaded.
5938* (T144705) (T148662) Password reset link is no longer shown when no reset
5939  options are available.
5940* (T143788) (T174262) Various backports for PHP 7.0 and 7.1 support.
5941* (T66795) $wgUserEmailUseReplyTo is now true by default to work around
5942  restrictive DMARC policies.
5943* DB_REPLICA constant added from REL1_28+ to ease backports to extensions and
5944  core.
5945* (T175439) Unbreak Postgres Updater when setting defaults for a column.
5946* (T160298) Remove use of implicitGroupBy() in ActiveUsersPager.
5947* (T142304) Allow putting the app ID in the password for bot passwords.
5948* Updated dev dependancy phpunit/phpunit from v4.8.24 to v4.8.36.
5949* (T178451) SECURITY: Potential XSS when $wgShowExceptionDetails = false and
5950  browser sends non-standard url escaping.
5951* (T165846) SECURITY: BotPassword login attempts weren't throttled.
5952* (T128209) SECURITY: Reflected File Download from api.php.
5953* (T134100) SECURITY: Do not reveal if user exists during login failure.
5954* (T176247) SECURITY: Ensure Message::rawParams can't lead to XSS.
5955* (T125163) SECURITY: Make anchor for headlines escape > and <.
5956* (T180237) SECURITY: Protect vendor folder with .htaccess.
5957* (T180231) SECURITY: Remove PHPUnit file with known RCE if exists in
5958  update.php.
5959* (T124404) SECURITY: XSS in langconverter when regex hits pcre.backtrack_limit.
5960* (T119158) SECURITY: Handle -{}- syntax in attributes safely.
5961
5962== MediaWiki 1.27.3 ==
5963Due to a packaging error, the wrong version of the SyntaxHighlight extension was
5964included in the tarball version of MediaWiki 1.27.2. The version included had a
5965serious security issue in it (T158689). There was also some minor code fixes in
5966MediaWiki itself since 1.27.2, but none of them were security relevant.
5967
5968=== Changes since 1.27.2 ===
5969* (T145664) Fix broken wincache merge() implementation
5970* (T163434) Add wikimedia/testing-access-wrapper for forwards compatibility
5971* (T153505) Fix php warnings on php 7.1 due to use of &$this
5972
5973== MediaWiki 1.27.2 ==
5974This is a security and maintenance release of the MediaWiki 1.27 branch.
5975
5976ApiCreateAccount was removed in 1.27.0. It was incorrectly still marked as
5977deprecated (rather than already removed) in the RELEASE-NOTES at the point
59781.27.0 was released.
5979
5980=== Changes since 1.27.1 ===
5981
5982* (T68404) CSS3 attr() function with url type argument is no longer allowed
5983  in inline styles.
5984* $wgRunJobsAsync is now false by default (T142751). This change only affects
5985  wikis with $wgJobRunRate > 0.
5986* (T152717) Better escaping for PHP mail() command
5987* Submitting the lgtoken and lgpassword parameters in the query string to
5988  action=login is now deprecated and outputs a warning. They should be submitted
5989  in the POST body instead.
5990* Submitting sensitive authentication request parameters to action=clientlogin,
5991  action=createaccount, action=linkaccount, and action=changeauthenticationdata
5992  in the query string is now deprecated and outputs a warning. They should be
5993  submitted in the POST body instead.
5994* (T158766) Avoid SQL error on MSSQL when using selectRowCount()
5995* (T145635) Fix too long index error when installing with MSSQL.
5996* (T156184) $wgRawHtml will no longer apply to internationalization messages.
5997* (T160519) CACHE_ANYTHING will not be CACHE_ACCEL if no accelerator is
5998  installed.
5999* (T109140) (T122209) SECURITY: Special:UserLogin and Special:Search allow
6000  redirect to interwiki links.
6001* (T144845) SECURITY: XSS in SearchHighlighter::highlightText() when
6002  $wgAdvancedSearchHighlighting is true.
6003* (T125177) SECURITY: API parameters may now be marked as "sensitive" to keep
6004  their values out of the logs.
6005* (T150044) SECURITY: "Mark all pages visited" on the watchlist now requires a
6006  CSRF token.
6007* (T156184) SECURITY: Escape content model/format url parameter in message.
6008* (T151735) SECURITY: SVG filter evasion using default attribute values in DTD
6009  declaration.
6010* (T161453) SECURITY: LocalisationCache will no longer use the temporary
6011  directory in it's fallback chain when trying to work out where to write the
6012 cache.
6013* (T48143) SECURITY: Spam blacklist ineffective on encoded URLs inside file
6014  inclusion syntax's link parameter.
6015* (T108138) SECURITY: Sysops can undelete pages, although the page is protected
6016  against it.
6017
6018== MediaWiki 1.27.1 ==
6019
6020This is a maintenance release of the MediaWiki 1.27 branch.
6021
6022=== Changes since 1.27.0 ===
6023* BREAKING CHANGE: $wgHTTPProxy is now *required* for all external requests
6024  made by MediaWiki via a proxy. Relying on the http_proxy environment
6025  variable is no longer supported.
6026* (T139565) SECURITY: API: Generate head items in the context of the given title
6027* (T137264) SECURITY: XSS in unclosed internal links
6028* (T133147) SECURITY: Escape '<' and ']]>' in inline <style> blocks
6029* (T133147) SECURITY: Require login to preview user CSS pages
6030* (T132926) SECURITY: Do not allow undeleting a revision deleted file if it is
6031  the top file
6032* (T129738) SECURITY: Make $wgBlockDisablesLogin also restrict logged in
6033  permissions
6034* (T129738) SECURITY: Make blocks log users out if $wgBlockDisablesLogin is true
6035* (T115333) SECURITY: Check read permission when loading page content in
6036  ApiParse
6037* (T57548) Remove support for $wgWellFormedXml = false, all output is now well
6038  formed
6039* (T139670) Move 'UserGetRights' call before application of
6040  Session::getAllowedUserRights()
6041
6042== MediaWiki 1.27.0 ==
6043
6044=== PHP version requirement in 1.27 ===
6045As of 1.27, MediaWiki now requires PHP 5.5.9 or higher (see Compatibility
6046section). Additionally, the following PHP extensions are required:
6047* ctype
6048* iconv
6049* json
6050* mbstring (new requirement in 1.27)
6051* xml
6052The following PHP extensions are strongly recommended:
6053* openssl
6054
6055=== Configuration changes in 1.27 ===
6056* $wgAllowMicrodataAttributes and $wgAllowRdfaAttributes were removed,
6057  now always enabled. If you use RDFa on your wiki, you now have to explicitly
6058  set $wgHtml5Version to 'HTML+RDFa 1.0' or 'XHTML+RDFa 1.0'.
6059* $wgUseLinkNamespaceDBFields was removed.
6060* Deprecated $wgResourceLoaderMinifierStatementsOnOwnLine and
6061  $wgResourceLoaderMinifierMaxLineLength, because there was little value in
6062  making the behavior configurable. The default values (`false` for the former,
6063  1000 for the latter) are now hard-coded.
6064* $wgDebugDumpSqlLength was removed (deprecated in 1.24).
6065* $wgDebugDBTransactions was removed (deprecated in 1.20).
6066* $wgUseXVO has been removed, as it provides functionality only used by
6067  custom Wikimedia patches against Squid 2.x that probably noone uses in
6068  production anymore. There is now $wgUseKeyHeader that provides similar
6069  functionality but instead of the MediaWiki-specific X-Vary-Options header,
6070  uses the draft Key header standard.
6071* $wgScriptExtension (and support for '.php5' entry points) was removed. See the
6072  deprecation notice in the release notes for version 1.25 for advice on how to
6073  preserve support for '.php5' entry points via URL rewriting.
6074* Password handling via the User object has been deprecated and partially
6075  removed, pending the future introduction of AuthManager. In particular:
6076** expirePassword(), getPasswordExpireDate(), resetPasswordExpiration(), and
6077   getPasswordExpired() have been removed. They were unused outside of core.
6078** The mPassword, mNewpassword, mNewpassTime, and mPasswordExpires fields are
6079   now private and will be removed in the future.
6080** The getPassword() and getTemporaryPassword() methods now throw
6081   BadMethodCallException and will be removed in the future.
6082** The ability to pass 'password' and 'newpassword' to createNew() has been
6083   removed. The only users of it seem to have been using it to set invalid
6084   passwords, and so shouldn't be greatly affected.
6085** setPassword(), setInternalPassword(), and setNewpassword() have been
6086   deprecated, pending the introduction of AuthManager.
6087** User::randomPassword() is deprecated in favor of a new method
6088   PasswordFactory::generateRandomPasswordString()
6089** User::getPasswordFactory() is deprecated, callers should just create a
6090   PasswordFactory themselves.
6091** A new constructor, User::newSystemUser(), has been added to simplify the
6092   creation of passwordless "system" users for logged actions.
6093* $wgMaxSquidPurgeTitles was removed.
6094* $wgAjaxWatch was removed. This is now enabled by default.
6095* $wgUseInstantCommons now hotlinks Commons images by default instead of
6096  downloading originals and thumbnailing them locally. This allows wikis to save
6097  on CPU and bandwidth while reducing time to first byte for pages, even without
6098  a thumbnail handler. See $wgForeignFileRepos documentation for tweaks.
6099* (T27397) WebP is enabled by default as an uploadable filetype.
6100* (T48998) $wgArticlePath must now be either a full url, or start with a "/".
6101* $wgRateLimitLog was removed; use $wgDebugLogGroups['ratelimit'] instead.
6102* Deprecated API formats dbg, txt, and yaml have been removed.
6103* CLDRPluralRule* classes have been replaced with
6104  wikimedia/cldr-plural-rule-parser.
6105* Removed $wgProfilePerHost, $wgUDPProfilerHost, $wgUDPProfilerPort,
6106  $wgUDPProfilerFormatString, $wgStatsMethod, $wgAggregateStatsID,
6107  $wgStatsFormatString, and $wgProfileCallTree (deprecated since 1.20).
6108* For proper operation of LocalIdLookup with shared user tables, ensure that
6109  $wgSharedDB and $wgSharedTables are properly set even on the "central" wiki
6110  that all others are sharing from and that $wgLocalDatabases is set to the
6111  full list of sharing wikis on all those wikis.
6112* Massive overhaul to session handling:
6113** $wgSessionsInObjectCache is no longer supported and must be true, due to
6114   MediaWiki\Session\SessionManager. $wgSessionHandler is similarly no longer
6115   used.
6116** ObjectCacheSessionHandler is removed, replaced with
6117   MediaWiki\Session\PhpSessionHandler.
6118** PHP session handling in general ($_SESSION, session_id(), and so on) is
6119   deprecated. Use MediaWiki\Session\SessionManager instead. A new config
6120   variable, $wgPHPSessionHandling, is available to cause use of $_SESSION to
6121   issue a deprecation warning or to cause most PHP session handling to throw
6122   exceptions.
6123** Deprecated UserSetCookies hook. Session-handling extensions should generally
6124   be creating a custom subclass of CookieSessionProvider. Other extensions
6125   messing with cookies can no longer count on user data being saved in cookies
6126   versus other methods.
6127** Deprecated UserLoadFromSession hook, extensions should create a
6128   MediaWiki\Session\SessionProvider.
6129** The User cannot be loaded from session until after Setup.php completes.
6130   Attempts to do so will be ignored and the User will remain unloaded.
6131** CSRF tokens may be fetched from the MediaWiki\Session\Session, which uses
6132   the MediaWiki\Session\Token class.
6133* MediaWiki will now auto-create users as necessary, removing the need for
6134  extensions to do so. An 'autocreateaccount' right is added to allow
6135  auto-creation when 'createaccount' is not granted to all users.
6136* Deprecated AuthPluginAutoCreate hook in favor of LocalUserCreated.
6137* Most cookie-handling methods in User are deprecated.
6138* $wgAllowAsyncCopyUploads and $CopyUploadAsyncTimeout were removed. This was an
6139  experimental feature that has never worked.
6140* Login and createaccount tokens now vary by timestamp.
6141* LoginForm::getLoginToken() and LoginForm::getCreateaccountToken()
6142  return a MediaWiki\Session\Token, and tokens must be checked using that
6143  class's methods.
6144* $wgEnotifUseJobQ was removed and the job queue is always used.
6145* The functionality of the ApiSandbox extension has been merged into core. The
6146  extension should no longer be used.
6147* $wgPreloadJavaScriptMwUtil was removed (deprecated in 1.26).
6148  Extensions, skins, gadgets and scripts that use the mediawiki.util module must
6149  express a dependency on it.
6150* $wgIncludeLegacyJavaScript, deprecated in MediaWiki 1.26, now defaults false.
6151  Extensions, skins, gadgets and scripts that need the mediawiki.legacy.wikibits
6152  module should express a dependency on it.
6153* Removed configuration option $wgCopyrightIcon (deprecated since 1.18). Use
6154  $wgFooterIcons['copyright']['copyright'] instead.
6155* If the openssl and mcrypt PHP extensions are both unavailable, secure
6156  session storage (used for login) will raise an exception. This exception may
6157  be bypassed by setting $wgSessionInsecureSecrets = true.
6158* Massive overhaul to authentication:
6159** AuthPlugin and AuthPluginUser are deprecated.
6160** LoginForm and associated templates are deprecated. Extensions which called
6161   static LoginForm methods should be converted into authentication providers.
6162** The following hooks are deprecated:
6163*** AbortAutoAccount (create a MediaWiki\Auth\PreAuthenticationProvider instead)
6164*** AbortLogin (create a MediaWiki\Auth\PreAuthenticationProvider instead)
6165*** AbortNewAccount (create a MediaWiki\Auth\PreAuthenticationProvider instead)
6166*** AddNewAccount (use LocalUserCreated instead)
6167*** AuthPluginSetup (create a MediaWiki\Auth\PrimaryAuthenticationProvider
6168    instead)
6169*** ChangePasswordForm (use AuthChangeFormFields instead, or security levels)
6170*** LoginUserMigrated (create a MediaWiki\Auth\PreAuthenticationProvider
6171    instead)
6172*** UserCreateForm (create a MediaWiki\Auth\AuthenticationProvider of some type
6173    instead)
6174*** UserLoginForm (create a MediaWiki\Auth\AuthenticationProvider of some type
6175    instead)
6176** The following hooks are removed:
6177*** AbortChangePassword
6178*** LoginPasswordResetMessage
6179*** PrefsPasswordAudit
6180** The UserLoginComplete hook will no longer be called for all logins, only for
6181   those via the web UI. Use UserLoggedIn if you need to do something on all
6182   logins.
6183** $wgRequirePasswordforEmailChange is removed.
6184
6185=== New features in 1.27 ===
6186* $wgDataCenterUpdateStickTTL was also added. This decides how long a user
6187  sticks to the primary DC (via cookies) after they make changes to the site.
6188* Added a new hook, 'UserMailerTransformContent', to transform the contents
6189  of an email. This is similar to the EmailUser hook but applies to all mail
6190  sent via UserMailer.
6191* Added a new hook, 'UserMailerTransformMessage', to transform the contents
6192  of an emai after MIME encoding.
6193* Added a new hook, 'UserMailerSplitTo', to control which users have to be
6194  emailed separately (ie. there is a single address in the To: field) so
6195  user-specific changes to the email can be applied safely.
6196* $wgCdnMaxageLagged was added, which limits the CDN cache TTL
6197  when any load balancer uses a DB that is lagged beyond the 'max lag'
6198  setting in the relevant section of $wgLBFactoryConf.
6199* User::newSystemUser() may be used to simplify the creation of passwordless
6200  "system" users for logged actions from scripts and extensions.
6201* Extensions can now return detailed error information via the API when
6202  preventing user actions using 'getUserPermissionsErrors' and similar hooks
6203  by using ApiMessage instances instead of strings for the $result value.
6204* $wgAPIMaxLagThreshold was added to limit bot changes when databases lag
6205  becomes too high.
6206* Skins and extensions can now use FlexBox mixins (.flex-display(@display: flex)
6207  and .flex(@grow: 1, @shrink: 1, @width: auto, @order: 1)) in Less to create
6208  cross-browser-compatible FlexBox rules. Users will still need to add fallback
6209  float rules or the like for compatibility with IE9- separately.
6210* Added MWTimestamp::getTimezoneString() which returns the localized timezone
6211  string, if available. To localize this string, see the comments of
6212  $wgLocaltimezone in includes/DefaultSettings.php.
6213* Added CentralIdLookup, a service that allows extensions needing a concept of
6214  "central" users to get that without having to know about specific central
6215  authentication extensions.
6216* $wgMaxUserDBWriteDuration added to limit huge user-generated transactions.
6217  Regular web request transactions that takes longer than this are aborted.
6218* Added a new hook, 'TitleMoveCompleting', which runs before a page move is
6219  committed.
6220* $wgCdnReboundPurgeDelay was added to provide secondary delayed purges of URLs
6221  from CDN to mitigate DB replication lag and WAN cache purge lag.
6222* (T49162) Installer will default to setting CACHE_ACCEL as the main cache type
6223  if it is available.
6224* It is now possible to patrol file uploads (both for new files and new versions
6225  of existing files). Special:NewFiles has gained an option to filter by patrol
6226  status. This functionality can be disabled using $wgUseFilePatrol.
6227* MediaWiki\Session infrastructure allows for easier use of session mechanisms
6228  other than the usual cookies.
6229** SessionMetadata and SessionCheckInfo hooks allow for setting and checking
6230   custom session metadata.
6231* Added MWGrants and associated configuration settings $wgGrantPermissions and
6232  $wgGrantPermissionGroups to hold configuration for authentication features
6233  such as OAuth that want to allow restricting the user rights a user may make
6234  use of.
6235** If you're already using the OAuth extension, these new variables are
6236   identical to (and will replace) $wgMWOAuthGrantPermissions and
6237   $wgMWOAuthGrantPermissionGroups.
6238* Added MWRestrictions as a class to check restrictions on a WebRequest, e.g.
6239  to assert that the request comes from a particular IP range.
6240* Added bot passwords, a rights-restricted login mechanism for API-using bots.
6241* Whitelisted the following HTML attributes for all elements in wikitext:
6242  aria-describedby, aria-flowto, aria-label, aria-labelledby, aria-owns.
6243* Removed "presentation" restriction on the HTML role attribute in wikitext.
6244  All values are now allowed for the role attribute.
6245* $wgContentHandlers now also supports callbacks to create an instance of the
6246  appropriate ContentHandler subclass.
6247* Added $wgAuthenticationTokenVersion, which if non-null prevents the
6248  user_token database field from being exposed in cookies. Setting this would
6249  be a good idea, but will log out all current sessions.
6250* $wgEventRelayerConfig was added, for managing PubSub event relay
6251  configuration, specifically for reliable CDN url purges.
6252* Requests have unique IDs, equal to the UNIQUE_ID environment variable (when
6253  MediaWiki is behind Apache+mod_unique_id or something similar) or a randomly-
6254  generated 24-character string. This request ID is used to annotate log records
6255  and error messages. It is available client-side via
6256  mw.config.get( 'wgRequestId' ).
6257  The request ID supplants exception IDs. Accordingly,
6258  MWExceptionHandler::getLogId() is deprecated.
6259* (T33313) Add a preference for watching uploads by default, also applies
6260  to API-based upload tools.
6261* $wgJpegPixelFormat was added to override chroma subsampling for JPEG image
6262  thumbnails created via ImageMagick. Defaults to 'yuv420', providing bandwidth
6263  savings versus the previous behavior on many files.
6264* MediaWiki\Auth infrastructure (called "AuthManager") allows for more flexible
6265  configuration of multiple authentication pieces that was possible with
6266  AuthPlugin. For example, it's now easy to plug in second-factor
6267  authentication, or add additional checks to the login process, or to support
6268  multiple login methods at once, or to support non-password-based login
6269  methods.
6270** Providers are configured via the global setting $wgAuthManagerConfig.
6271** A global, $wgDisableAuthManager, is temporarily available to disable
6272   AuthManager until extensions are ready to support it.
6273** New hook, AuthChangeFormFields, to adjust the form fields on
6274   AuthManager-related special pages.
6275** New hook, AuthManagerLoginAuthenticateAudit, for additional logging of
6276   AuthManager-related authentication requests.
6277** New hook, ChangeAuthenticationDataAudit, for additional logging of
6278   AuthManager-related authentication data changes.
6279** New hook, SecuritySensitiveOperationStatus, to work with the new mechanism
6280   for requiring a recent login before taking security-sensitive operations
6281   like changing a password.
6282** Two new globals, $wgChangeCredentialsBlacklist and
6283   $wgRemoveCredentialsBlacklist can be used to prevent the web UI and the API
6284   changing certain authentication data.
6285* The file upload dialog (available if you install WikiEditor or VisualEditor)
6286  can now be configured using $wgUploadDialog.
6287
6288=== External library changes in 1.27 ===
6289
6290==== Upgraded external libraries ====
6291* Updated oojs/oojs-ui from v0.12.12 to v0.13.3.
6292* Updated composer/semver from v1.0.0 to v1.2.0.
6293* Updated liuggio/statsd-php-client to 1.0.18.
6294* Updated QUnit from v1.18.0 to v1.22.0.
6295
6296==== New external libraries ====
6297* Added wikimedia/base-convert v1.0.1.
6298* Added wikimedia/cldr-plural-rule-parser v1.0.0.
6299* Added wikimedia/relpath v1.0.3.
6300* Added wikimedia/running-stat v1.1.0.
6301* Added wikimedia/php-session-serializer v1.0.3.
6302
6303==== Removed and replaced external libraries ====
6304
6305=== Bug fixes in 1.27 ===
6306* Special:Upload will now display correct maximum allowed file size when running
6307  under HHVM (T116347).
6308* (T54077) The APIEditBeforeSave hook will once again give only the content of
6309  the section being edited, rather than the whole revision. This reverts the
6310  change made in MediaWiki 1.22.
6311
6312=== Action API changes in 1.27 ===
6313* Added list=allrevisions.
6314* generator=recentchanges now has the option to generate revids.
6315* ApiPageSet::setRedirectMergePolicy() was added. This allows generator
6316  modules to define how generator data for a redirect source gets merged
6317  into the redirect destination.
6318* prop=imageinfo&iiprop=uploadwarning will no longer include the possibility of
6319  "was-deleted" warning.
6320* Added difftotextpst to query=revisions which preforms a pre-save transform on
6321  the text before diffing it.
6322* Deprecated formats dbg, txt, and yaml have been removed.
6323* (T47988) The protect log event details now use new-style formatting.
6324* The following response properties from action=login are deprecated, and may
6325  be removed in the future: lgtoken, cookieprefix, sessionid. Clients should
6326  handle cookies to properly manage session state.
6327* action=login transparently allows login using bot passwords. Clients should
6328  merely need to change the username and password used after setting up a bot
6329  password.
6330* action=upload no longer understands statuskey, asyncdownload or leavemessage.
6331* Several changes when $wgDisableAuthManager is false:
6332** action=login is deprecated for uses other than bot passwords.
6333** list=users can now indicate if a missing username is creatable.
6334** action=createaccount is changed in a non-backwards-compatible manner.
6335** Added action=query&meta=authmanagerinfo.
6336** Added action=clientlogin to be used to log into the main account instead of
6337   action=login.
6338** Added action=linkaccount.
6339** Added action=unlinkaccount.
6340** Added action=changeauthenticationdata.
6341** Added action=removeauthenticationdata.
6342** Added action=resetpassword.
6343
6344=== Action API internal changes in 1.27 ===
6345* ApiQueryORM removed.
6346* The following classes have been removed:
6347** ApiFormatDbg
6348** ApiFormatTxt
6349** ApiFormatYaml
6350* ApiBase::addTokenProperties() was removed (deprecated since 1.24).
6351* ApiBase::getFinalPossibleErrors() was removed (deprecated since 1.24).
6352* ApiBase::getFinalResultProperties() was removed (deprecated since 1.24).
6353* ApiBase::getRequireAtLeastOneParameterErrorMessages() was removed (deprecated
6354  since 1.24).
6355* ApiBase::getPossibleErrors() was removed (deprecated since 1.24).
6356* ApiBase::getRequireMaxOneParameterErrorMessages() was removed (deprecated
6357  since 1.24).
6358* ApiBase::getRequireOnlyOneParameterErrorMessages() was removed (deprecated
6359  since 1.24).
6360* ApiBase::getResultProperties() was removed (deprecated since 1.24).
6361* ApiBase::getTitleOrPageIdErrorMessage() was removed (deprecated since 1.24).
6362* ApiBase::parseErrors() was removed (deprecated since 1.24).
6363* ApiQueryBase::titleToKey(), ApiQueryBase::keyToTitle() and
6364  ApiQueryBase::keyPartToTitle() all removed (deprecated since 1.24).
6365* ApiQueryBase::checkRowCount() was removed (deprecated since 1.24).
6366* ApiQueryBase::getDirectionDescription() was removed (deprecated since 1.25).
6367* ApiQuery::getGenerators() was removed (deprecated since 1.21).
6368* ApiQuery::getModules() was removed (deprecated since 1.21).
6369* ApiQuery::getModuleType() was removed (deprecated since 1.21).
6370* ApiQuery::setGeneratorContinue() was removed (deprecated since 1.24).
6371* ApiMain::getModules() was removed (deprecated since 1.21).
6372* ApiBase::getVersion() was removed (deprecated since 1.21).
6373* ApiMain::getShowVersions() was removed (deprecated in 1.21).
6374* ApiMain::addModule() was removed (deprecated in 1.21).
6375* ApiMain::addFormat() was removed (deprecated in 1.21).
6376* ApiMain::getFormats() was removed (deprecated in 1.21).
6377* ApiPageSet::finishPageSetGeneration() was removed (deprecated in 1.21).
6378* ApiCreateAccount was removed.
6379
6380=== Languages updated in 1.27 ===
6381
6382MediaWiki supports over 350 languages. Many localisations are updated
6383regularly. Below only new and removed languages are listed, as well as
6384changes to languages because of Phabricator reports.
6385
6386* (T113688) Change default numerals from Gurmukhi to Arabic for Punjabi locale.
6387* (T116020) Aliases of magic words in MessagesXx.php are sorted by usage.
6388
6389=== Other changes in 1.27 ===
6390* Added dependency injection (DI) infrastructure, see docs/injection.txt for
6391  details.
6392  It is planned to incrementally move MediaWiki code towards using DI, using the
6393  service locator (SL) pattern as a stepping stone.
6394* ProfilerOutputUdp was removed. Note that there is a ProfilerOutputStats class.
6395* WikiPage::doDeleteArticleReal() and WikiPage::doDeleteArticle() now
6396  ignore the 2nd and 3rd arguments (formerly $id and $commit).
6397* Removed "loaderScripts" option from ResourceLoaderFileModule class.
6398* Removed ORM-like wrapper added in 1.20.
6399* LinkCache::getGoodLinks and LinkCache::getBadLinks were removed
6400  (deprecated in 1.26).
6401* WikiPage::doQuickEdit() was removed (deprecated since 1.21).
6402* Removed SiteObject and SiteArray classes (deprecated in 1.21).
6403* MessageBlobStore::getInstance() was removed (deprecated since 1.25).
6404* (T84937) Free external links ("autolinked" urls) will now be terminated
6405  by &nbsp; and HTML entity encodings of &nbsp, <, and >.
6406* (T36948) The default file revert message's timestamp is now in
6407  $wgLocaltimezone, instead of UTC.
6408* The default name of the 'suppress' group page has been changed from
6409  'Project:Oversight' to 'Project:Suppress'.
6410* DatabaseBase::resultObject() is now protected (use outside Database classes
6411  not necessary since 1.11).
6412* Calling ResourceLoaderFileModule::readStyleFiles() without a
6413  ResourceLoaderContext instance is deprecated.
6414* ResourceLoader::getLessCompiler() now takes an optional parameter of
6415  additional LESS variables to set for the compiler.
6416* wfBaseConvert() marked as deprecated, use Wikimedia\base_convert() directly
6417  instead.
6418* Obsolete maintenance scripts clearCacheStats.php and showCacheStats.php
6419  were removed. The underlying data is sent to StatsD (see $wgStatsdServer).
6420* Removed msg_resource_links database table and associated code.
6421* Removed msg_resource database table and associated code.
6422* Skin::getNamespaceNotice() was removed.
6423* wfIsConfiguredProxy() was removed (deprecated since 1.24).
6424* wfDebugTimer() was removed (deprecated since 1.25).
6425* wfIsTrustedProxy() was removed (deprecated since 1.24).
6426* wfGetIP() was removed (deprecated since 1.19).
6427* MWHookException was removed.
6428* OutputPage::appendSubtitle() was removed (deprecated since 1.19).
6429* OutputPage::loginToUse() was removed (deprecated since 1.19).
6430* Article::loadContent() was removed (deprecated since 1.19).
6431* User::editToken() was removed (deprecated since 1.19).
6432* Removed --force-normal option of dumpBackup.php, as it no longer served
6433  any useful purpose since 1.22.
6434* The functions processOption() and processArgs() on the BackupDumper and
6435  TextPassDumper classes have been removed.
6436* The maintenance/backupTextPass.inc file was deleted. You should include
6437  maintenance/dumpTextPass.php instead.
6438* WikiPage::getUsedTemplates() was removed (deprecated since 1.19).
6439* wfEmptyMsg() was removed (deprecated since 1.18).
6440* OutputPage::permissionRequired() was removed (deprecated since 1.18).
6441* OutputPage::blockedPage() was removed (deprecated since 1.18).
6442* User::getSkin() was removed (deprecated since 1.18).
6443* OutputPage::includeJQuery() was removed (deprecated since 1.17).
6444* WikiPage::updateRestrictions() was removed (deprecated since 1.19).
6445* WikiPage::testPreSaveTransform() was removed (deprecated since 1.19).
6446* LogPage::logName() was removed (deprecated since 1.19).
6447* LogPage::logHeader() was removed (deprecated since 1.19).
6448* wfCheckLimits() was removed (deprecated since 1.24).
6449* Linker::makeKnownLinkObj() was removed (deprecated since 1.16).
6450* Linker::makeLinkObj() was removed (deprecated since 1.16).
6451* wfMsgForContentNoTrans() was removed (deprecated since 1.18).
6452* ChangesList::usePatrol was removed (deprecated since 1.22).
6453* wfMsgNoTrans() was removed (deprecated since 1.18).
6454* Linker::makeImageLink2 was removed (deprecated since 1.20).
6455* Title::userIsWatching() was removed (deprecated since 1.20).
6456* Removed WaitForSlave maintenance script; use SELECT MASTER_POS_WAIT()
6457  database function directly instead.
6458* wfMsg() was removed (deprecated since 1.18).
6459* wfMsgForContent() was removed (deprecated since 1.18).
6460* wfMsgReal() was removed (deprecated since 1.18).
6461* wfMsgGetKey() was removed (deprecated since 1.18).
6462* wfMsgHtml() was removed (deprecated since 1.18).
6463* wfMsgWikiHtml() was removed (deprecated since 1.18).
6464* wfMsgExt() was removed (deprecated since 1.18).
6465* Language::armourMath() was removed (deprecated since 1.22).
6466* LanguageConverter::armourMath() was removed (deprecated since 1.22).
6467* FakeConverter::armourMath() was removed (deprecated since 1.22).
6468* The unused jquery.validate ResourceLoader module was removed.
6469* FileRepo::getRootUrl() was removed (deprecated since 1.20).
6470* User::generateToken() was removed (deprecated since 1.20).
6471* WikiPage::getRawText() was removed (deprecated since 1.21).
6472* ParserOutput::hasCustomDataUpdates() was removed (deprecated since 1.25).
6473* ParserOutput::addSecondaryDataUpdate() was removed (deprecated since 1.25).
6474* ParserOutput::getSecondaryDataUpdates() was removed (deprecated since 1.25).
6475* Gallery images with multiple caption pipes no longer concatenate them all
6476  together but instead pick the final one, similar to image syntax.
6477* XML-like parser tags (such as <gallery>), when unclosed, will be left unparsed
6478  rather than consume everything until the end of the page.
6479* New maintenance script resetUserEmail.php allows sysadmins to reset user
6480  emails in case a user forgot password/account was stolen.
6481* wfCheckEntropy() was removed (deprecated in 1.27).
6482* Browser support for Internet Explorer 8 lowered from Grade A to Grade C.
6483* ContentHandler::supportsCategories method added. Default is true.
6484  CategoryMembershipChangeJob updates are skipped for content that
6485  does not support categories.
6486* wikidiff difference engine is no longer supported, anyone still using it are
6487  encouraged to upgrade to wikidiff2 which is actively maintained and has better
6488  package availability.
6489* Database logic was removed from WatchedItem and a WatchedItemStore was
6490  created:
6491** WatchedItem::IGNORE_USER_RIGHTS and WatchedItem::CHECK_USER_RIGHTS were
6492   deprecated. User::IGNORE_USER_RIGHTS and User::CHECK_USER_RIGHTS were
6493   introduced.
6494** WatchedItem::fromUserTitle was deprecated in favour of the constructor.
6495** WatchedItem::resetNotificationTimestamp was deprecated.
6496** WatchedItem::batchAddWatch was deprecated.
6497** WatchedItem::addWatch was deprecated.
6498** WatchedItem::removeWatch was deprecated.
6499** WatchedItem::isWatched was deprecated.
6500** WatchedItem::duplicateEntries was deprecated.
6501** EmailNotification::updateWatchlistTimestamp was deprecated.
6502** User::getWatchedItem was removed.
6503* Unit tests don't work with external PHPUnit anymore, Composer is now the only
6504  supported way. Run `composer install` to install it and other dev dependencies
6505  to run unit tests.
6506* wl_id field added to the watchlist table.
6507* Revision::getRawText() was removed (deprecated since 1.21).
6508* WikiPage::replaceSection() was removed (deprecated since 1.21).
6509* Article::replaceSection() was removed (deprecated since 1.21).
6510* Language::getLangObj() was removed (deprecated since 1.24).
6511* Language::getLanguageName() was removed (deprecated since 1.20).
6512* Language::getLanguageNames() was removed (deprecated since 1.20).
6513* Language::getTranslatedLanguageNames() was removed (deprecated since 1.20).
6514* Language::specialPage() was removed (deprecated since 1.24).
6515* MediaWikiTestCase::assertException() was removed (deprecated since 1.22).
6516* OutputPage::getHeadItems() was removed (deprecated since 1.24).
6517* OutputPage::getScript() was removed (deprecated since 1.24).
6518* OutputPage::out() was removed (deprecated since 1.22).
6519* OutputPage::setAllowedModules() was removed (deprecated since 1.24).
6520* UserrightsPage::makeGroupNameListForLog() was removed (deprecated since 1.21).
6521* MediaWikiSite::newFromGlobalId() was removed (deprecated since 1.21).
6522* Title::newFromRedirect() was removed (deprecated since 1.21).
6523* Skin::commonPrintStylesheet() was removed (deprecated since 1.22).
6524* Skin::getCommonStylePath() was removed (deprecated since 1.24).
6525* Skin::newFromKey() was removed (deprecated since 1.24).
6526* Skin::getUsableSkins() was removed (deprecated since 1.23).
6527* LoadBalancer::pickRandom() was removed (deprecated in 1.21).
6528* Article::getUndoText() and WikiPage::getUndoText were removed (deprecated
6529  since 1.21).
6530* DifferenceEngine::setText() was removed (deprecated in 1.21).
6531* Title::newFromRedirectArray() was removed (deprecated in 1.21).
6532* UserMailer::send() no longer accepts $replyto as the 5th argument and
6533  $contentType as the 6th. These must be passed in the options array now.
6534* Title::newFromRedirectRecurse() was removed (deprecated in 1.21).
6535* Skin::accesskey was removed (deprecated since 1.21).
6536* Skin::blockLink was removed (deprecated since 1.21).
6537* Skin::buildRollbackLink was removed (deprecated since 1.21).
6538* Skin::emailLink was removed (deprecated since 1.21).
6539* Skin::formatComment was removed (deprecated since 1.21).
6540* Skin::formatHiddenCategories was removed (deprecated since 1.21).
6541* Skin::formatLinksInComment was removed (deprecated since 1.21).
6542* Skin::formatRevisionSize was removed (deprecated since 1.21).
6543* Skin::formatSize was removed (deprecated since 1.21).
6544* Skin::formatTemplates was removed (deprecated since 1.21).
6545* Skin::generateTOC was removed (deprecated since 1.21).
6546* Skin::getInternalLinkAttributes was removed (deprecated since 1.21).
6547* Skin::getInternalLinkAttributesObj was removed (deprecated since 1.21).
6548* Skin::getInterwikiLinkAttributes was removed (deprecated since 1.21).
6549* Skin::getInvalidTitleDescription was removed (deprecated since 1.21).
6550* Skin::getLinkColour was removed (deprecated since 1.21).
6551* Skin::getRevDeleteLink was removed (deprecated since 1.21).
6552* Skin::getRollbackEditCount was removed (deprecated since 1.21).
6553* Skin::makeBrokenImageLinkObj was removed (deprecated since 1.21).
6554* Skin::makeCommentLink was removed (deprecated since 1.21).
6555* Skin::makeExternalImage was removed (deprecated since 1.21).
6556* Skin::makeExternalLink was removed (deprecated since 1.21).
6557* Skin::makeHeadline was removed (deprecated since 1.21).
6558* Skin::makeImageLink was removed (deprecated since 1.21).
6559* Skin::makeMediaLinkFile was removed (deprecated since 1.21).
6560* Skin::makeMediaLinkObj was removed (deprecated since 1.21).
6561* Skin::makeSelfLinkObj was removed (deprecated since 1.21).
6562* Skin::makeThumbLink2 was removed (deprecated since 1.21).
6563* Skin::makeThumbLinkObj was removed (deprecated since 1.21).
6564* Skin::normaliseSpecialPage was removed (deprecated since 1.21).
6565* Skin::normalizeSubpageLink was removed (deprecated since 1.21).
6566* Skin::processResponsiveImages was removed (deprecated since 1.21).
6567* Skin::revComment was removed (deprecated since 1.21).
6568* Skin::revDeleteLink was removed (deprecated since 1.21).
6569* Skin::revDeleteLinkDisabled was removed (deprecated since 1.21).
6570* Skin::revUserLink was removed (deprecated since 1.21).
6571* Skin::revUserTools was removed (deprecated since 1.21).
6572* Skin::specialLink was removed (deprecated since 1.21).
6573* Skin::splitTrail was removed (deprecated since 1.21).
6574* Skin::titleAttrib was removed (deprecated since 1.21).
6575* Skin::tocIndent was removed (deprecated since 1.21).
6576* Skin::tocLine was removed (deprecated since 1.21).
6577* Skin::tocLineEnd was removed (deprecated since 1.21).
6578* Skin::tocList was removed (deprecated since 1.21).
6579* Skin::tocUnindent was removed (deprecated since 1.21).
6580* Skin::tooltip was removed (deprecated since 1.21).
6581* Skin::tooltipAndAccesskeyAttribs was removed (deprecated since 1.21).
6582* Skin::userTalkLink was removed (deprecated since 1.21).
6583* Skin::userToolLinksRedContribs was removed (deprecated since 1.21).
6584* wikidiff3 is now the default and only PHP diff engine. It provides improved
6585  diff performance on complex changes. $wgExternalDiffEngine = 'wikidiff3'
6586  therefore makes no difference now. Users are still recommended to use
6587  wikidiff2 if possible, though.
6588* User::addNewUserLogEntry() was deprecated.
6589* User::addNewUserLogEntryAutoCreate() was deprecated.
6590* User::isPasswordReminderThrottled() was deprecated.
6591* Bot-oriented parameters to Special:UserLogin (wpCookieCheck,
6592  wpSkipCookieCheck) were removed.
6593* Installer can now be customized without patching MediaWiki code, see
6594  mw-config/overrides/README for details.
6595
6596=== Compatibility ===
6597
6598MediaWiki 1.27 requires PHP 5.5.9 or later. There is experimental support for
6599HHVM 3.6.5 or later.
6600
6601MySQL is the recommended DBMS. PostgreSQL or SQLite can also be used, but
6602support for them is somewhat less mature. There is experimental support for
6603Oracle and Microsoft SQL Server.
6604
6605The supported versions are:
6606
6607* MySQL 5.0.3 or later
6608* PostgreSQL 8.3 or later
6609* SQLite 3.3.7 or later
6610* Oracle 9.0.1 or later
6611* Microsoft SQL Server 2005 (9.00.1399)
6612
6613=== Upgrading ===
6614
66151.27 has several database changes since 1.26, and will not work without schema
6616updates. Note that due to changes to some very large tables like the revision
6617table, the schema update may take quite long (minutes on a medium sized site,
6618many hours on a large site).
6619
6620If upgrading from before 1.11, and you are using a wiki as a commons
6621repository, make sure that it is updated as well. Otherwise, errors may arise
6622due to database schema changes.
6623
6624If upgrading from before 1.7, you may want to run refreshLinks.php to ensure
6625new database fields are filled with data.
6626
6627If you are upgrading from MediaWiki 1.4.x or earlier, you should upgrade to
66281.5 first. The upgrade script maintenance/upgrade1_5.php has been removed
6629with MediaWiki 1.21.
6630
6631Don't forget to always back up your database before upgrading!
6632
6633See the file UPGRADE for more detailed upgrade instructions.
6634
6635For notes on 1.26.x and older releases, see HISTORY.
6636
6637
6638= MediaWiki 1.26 =
6639
6640== MediaWiki 1.26.4 ==
6641
6642This is a maintenance release of the MediaWiki 1.26 branch.
6643
6644=== Changes since 1.26.3 ===
6645* BREAKING CHANGE: $wgHTTPProxy is now *required* for all external requests
6646  made by MediaWiki via a proxy. Relying on the http_proxy environment
6647  variable is no longer supported.
6648* (T124163) Fixed fatal error in DifferenceEngine under HHVM.
6649* (T139565) SECURITY: API: Generate head items in the context of the given title
6650* (T137264) SECURITY: XSS in unclosed internal links
6651* (T133147) SECURITY: Escape '<' and ']]>' in inline <style> blocks
6652* (T133147) SECURITY: Require login to preview user CSS pages
6653* (T132926) SECURITY: Do not allow undeleting a revision deleted file if it is
6654  the top file
6655* (T129738) SECURITY: Make $wgBlockDisablesLogin also restrict logged in
6656  permissions
6657* (T129738) SECURITY: Make blocks log users out if $wgBlockDisablesLogin is true
6658* (T115333) SECURITY: Check read permission when loading page content in
6659  ApiParse
6660* Remove support for $wgWellFormedXml = false, all output is now well formed
6661
6662== MediaWiki 1.26.3 ==
6663
6664This is a maintenance release of the MediaWiki 1.26 branch.
6665
6666=== Changes since 1.26.2 ===
6667* (T116266) Fixed undefined property notices in DairikiDiff under HHVM.
6668* (T123166) Fix fatal error when importing pages to titles which cannot be
6669  created, such as invalid titles or titles the user is not allowed to edit.
6670* (T122056) Old tokens are remaining valid within a new session
6671* (T127114) Login throttle can be tricked using non-canonicalized usernames
6672* (T123653) Cross-domain policy regexp is too narrow
6673* (T123071) Incorrectly identifying http link in a's href attributes, due to
6674  m modifier in regex
6675* (T129506) MediaWiki:Gadget-popups.js isn't renderable
6676* (T125283) Users occasionally logged in as different users after
6677  SessionManager deployment
6678* (T103239) Patrol allows click catching and patrolling of any page
6679* (T122807) [tracking] Check php crypto primatives
6680* (T98313) Graphs can leak tokens, leading to CSRF
6681* (T130947) Diff generation should use PoolCounter
6682* (T133507) Careless use of $wgExternalLinkTarget is insecure
6683* (T132874) API action=move is not rate limited
6684* (T110143) strip markers can be used to get around html attribute escaping in
6685  (many?) parser tags
6686* (T116030) Increase pbkdf2 parameter strengths
6687* (T127420) Pbkdf2Password does not check if hash_pbkdf2() succeeded
6688* (T126685) Globally throttle password attempts
6689
6690== MediaWiki 1.26.2 ==
6691
6692This is a maintenance release of the MediaWiki 1.26 branch.
6693
6694=== Changes since 1.26.1 ===
6695* (T121892) Fix fatal error on some Special pages, introduced in 1.26.1.
6696
6697== MediaWiki 1.26.1 ==
6698
6699This is a maintenance release of the MediaWiki 1.26 branch.
6700
6701=== Changes since 1.26.0 ===
6702* (T117899) SECURITY: $wgArticlePath can no longer be set to relative paths
6703  that do not begin with a slash. This enabled trivial XSS attacks.
6704  Configuration values such as "http://my.wiki.com/wiki/$1" are fine, as are
6705  "/wiki/$1". A value such as "$1" or "wiki/$1" is not and will now throw an
6706  error.
6707* (T119309) SECURITY: Use hash_compare() for edit token comparison
6708* (T118032) SECURITY: Don't allow cURL to interpret POST parameters starting
6709  with '@' as file uploads
6710* (T115522) SECURITY: Passwords generated by User::randomPassword() can no
6711  longer be shorter than $wgMinimalPasswordLength
6712* (T97897) SECURITY: Improve IP parsing and trimming. Previous behavior could
6713  result in improper blocks being issued
6714* (T109724) SECURITY: Special:MyPage, Special:MyTalk, Special:MyContributions
6715  and related pages no longer use HTTP redirects and are now redirected by
6716  MediaWiki
6717* Fixed ConfigException in ExpandTemplates due to AlwaysUseTidy.
6718* Fixed stray literal \n in Special:Search.
6719* Fix issue that breaks HHVM Repo Authorative mode.
6720* (T120267) Work around APCu memory corruption bug
6721
6722== MediaWiki 1.26.0 ==
6723
6724=== Configuration changes in 1.26 ===
6725* $wgPasswordResetRoutes['email'] = true by default.
6726* $wgEnableParserCache was deprecated, set $wgParserCacheType to CACHE_NONE
6727  instead if you want to disable the parser cache.
6728* New-style continuation is now the default for API action=continue. Clients may
6729  use the 'rawcontinue' parameter to receive raw query-continue data, but the
6730  new style is encouraged as it's harder to implement incorrectly.
6731* Deprecated API formats dump and wddx have been completely removed.
6732* (T7645) The "Signature" button on the edit toolbar is now hidden by default
6733  in non-talk namespaces. A new configuration variable,
6734  $wgExtraSignatureNamespaces, controls in which subject (non-talk) namespaces
6735  the "Signature" button on the edit toolbar will be displayed.
6736* $wgResourceLoaderUseESI was deprecated and removed. This was an experimental
6737  feature that was never enabled by default.
6738* $wgResourceLoaderExperimentalAsyncLoading was deprecated and removed.
6739  This experimental feature was never enabled by default and is obsolete as of
6740  MediaWiki 1.26, in where ResourceLoader became fully asynchronous.
6741* $wgMasterWaitTimeout was removed (deprecated in 1.24).
6742* Fields in ParserOptions are now private. Use the accessors instead.
6743* Custom LESS functions (defined via $wgResourceLoaderLESSFunctions or
6744  in extension.json) have been removed, after being deprecated in 1.24.
6745* $wgAlwaysUseTidy has been removed.
6746* ResetSessionID hook has been removed. Nothing seems to use it.
6747* Certain AuthPlugin methods are deprecated in favor of new hooks:
6748** AuthPlugin::initUser() is replaced by LocalUserCreated.
6749** AuthPlugin::updateUser() is replaced by UserLoggedIn.
6750** AuthPlugin::updateExternalDB() is replaced by the existing UserSaveSettings.
6751** AuthPlugin::updateExternalDBGroups() is replaced by UserGroupsChanged.
6752** AuthPluginUser::isHidden() is replaced by UserIsHidden.
6753** AuthPluginUser::isLocked() is replaced by UserIsLocked.
6754* The UserRights hook is deprecated in favor of the new UserGroupsChanged hook.
6755* AuthPlugin::initUser() and AuthPlugin::updateUser() should no longer replace
6756  the passed User object.
6757* $wgBlockAllowsUTEdit is now set to true by default. This allows
6758  blocked users to edit their talk pages unless explicitly disabled
6759  when they are being blocked.
6760
6761=== New features in 1.26 ===
6762* (T51506) Now action=info gives estimates of actual watchers for a page.
6763  See $wgRCMaxAge, $wgWatchersMaxAge and $wgUnwatchedPageSecret
6764  to learn how to configure if needed.
6765* Change tags can now be hidden in the interface by disabling the associated
6766  "tag-<id>" interface message.
6767* ':' (colon) is now invalid in usernames for new accounts. Existing accounts
6768  are not affected.
6769* Added a new hook, 'LogException', to log exceptions in nonstandard ways.
6770* Revive the 'SpecialSearchResultsAppend' hook which occurs after the list of
6771  search results are rendered. The initial use case is to append a "give us
6772  feedback" link beneath the search results.
6773* Added a new hook, 'RejectParserCacheValue', which allows extensions to
6774  reject an otherwise-successful parser cache lookup. The intent is to allow
6775  extensions to manage the eviction of archaic HTML output from the cache.
6776* (T68699) The expiration of the UserID and Token login cookies
6777  ($wgExtendedLoginCookieExpiration) can be configured independently of the
6778  expiration of all other cookies ($wgCookieExpiration).
6779* (T50519) Support for generating JPEG/PNG thumbnails from WebP images added
6780  if ImageMagick is used as image scaler ($wgUseImageMagick = true). Uploading
6781  of WebP images still disabled by default. Add $wgFileExtensions[] =
6782  'webp'; to LocalSettings.php to enable uploading of WebP images.
6783* Added new hooks 'EnhancedChangesListModifyLineData' &
6784  'EnhancedChangesListModifyBlockLineData', to modify the data used to build
6785  lines in enhanced recentchanges and watchlist.
6786* Caches that need purging ability now use the WANObjectCache interface.
6787  This corresponds to a new $wgMainWANCache setting, which defaults to using
6788  the $wgMainCacheType settings.
6789* Callers needing fast light-weight data stores use $wgMainStash to select
6790  the store type from $wgObjectCaches. The default is the local database.
6791* Interface message overrides in the MediaWiki namespace will now be cached in
6792  memcached and APC (if available), rather than memcached and local files.
6793* Added a new hook, 'RandomPageQuery', to allow modification of the query used
6794  by Special:Random to select random pages.
6795* $wgTransactionalTimeLimit was added, which controls the request time limit
6796  for potentially slow POST requests that need to be as atomic as possible.
6797* ResourceLoader now loads all scripts asynchronously. The top-queue and
6798  startup modules are no longer synchronously loaded.
6799* 'mediawiki.ui.button' styles are no longer unconditionally loaded on every
6800  page. During the deprecation period, the styles will only be loaded on pages
6801  which contain 'mw-ui-button' in their HTML. Starting in 1.28, the styles will
6802  only be loaded if explicitly required.
6803* If search returns zero results and current search engine has a "did you mean"
6804  suggestion, results for suggestion will be shown. Can be disabled by setting
6805  $wgSearchRunSuggestedQuery to false.
6806* Added several JavaScript libraries for uploading files to MediaWiki
6807  from the client-side. See documentation for mw.Upload and its
6808  subclasses for more information.
6809* Added OOUI dialogs and layout for file upload interfaces. See
6810  documentation for mw.Upload.Dialog, mw.Upload.BookletLayout and its
6811  subclasses for more information.
6812
6813=== extension.json changes in 1.26 ===
6814* (T99344) The extension.json schema is now versioned. All extensions
6815  and skins should set a "manifest_version" property corresponding to
6816  the schema version they were written for. The only supported version
6817  currently is "1".
6818* (T102523) The error message if a non-array attribute is set was improved.
6819* (T107646) Configuration settings can now specify how they should be merged,
6820  which is necessary for arrays using integer keys.
6821* (T110389) Adding namespaces through extension.json now actually works
6822* $wgNamespaceProtection can now be set in extension.json.
6823* $wgCapitalLinkOverrides can now be set in extension.json.
6824* (T97186) Extensions using a custom prefix for their configuration settings
6825  can now set a "_prefix" key to override the default of "wg".
6826* (T99084) Extensions can now specify what MediaWiki core versions they
6827  depend upon.
6828* (T105236) The extension.json schema now validates custom classes in
6829  the "ResourceModules" property properly.
6830
6831=== External library changes in 1.26 ===
6832==== Upgraded external libraries ====
6833* Updated es5-shim from v4.0.0 to v4.1.5.
6834* Updated json2 from revision 2014-02-04 to 2015-05-03.
6835* Updated Sinon.JS from 1.10.3 to 1.15.4.
6836* Updated jQuery Client from v1.0.0 to v2.0.0.
6837* Updated QUnit from v1.17.1 to v1.18.0.
6838* Updated liuggio/statsd-php-client from v1.0.12 to v1.0.16.
6839* Updated oojs/oojs-ui from v0.11.3 to v0.12.12.
6840* Updated wikimedia/cdb from v1.0.1 to v1.3.0.
6841* Updated wikimedia/utfnormal from v1.0.2 to v1.0.3.
6842* Updated wikimedia/composer-merge-plugin from v1.0.0 to v1.3.0.
6843* Updated zordius/lightncandy from v0.18 to v0.21.
6844
6845==== New external libraries ====
6846* Added composer/semver v1.0.0.
6847* Added mediawiki/at-ease v1.1.0.
6848* Added wikimedia/assert v0.2.2.
6849* Added wikimedia/ip-set v1.0.1.
6850* Added wikimedia/wrappedstring v2.0.0.
6851
6852==== Removed and replaced external libraries ====
6853* Replaced leafo/lessphp v0.5.0 with oyejorge/less.php v1.7.0.9.
6854
6855=== Bug fixes in 1.26 ===
6856* (T53283) load.php sometimes sends 304 response without full headers
6857* (T65198) Talk page tabs now have a "rel=discussion" attribute
6858* (T98841) {{msgnw:}} now preserves comments even when subst: is not used.
6859* (T104142) $wgEmergencyContact and $wgPasswordSender now use their default
6860  value if set to an empty string.
6861
6862=== Action API changes in 1.26 ===
6863* New-style continuation is now the default for action=continue. Clients may
6864  use the 'rawcontinue' parameter to receive raw query-continue data, but the
6865  new style is encouraged as it's harder to implement incorrectly.
6866* Deprecated API formats dump and wddx have been completely removed.
6867* API action=query&list=tags: The displayname can now be boolean false if the
6868  tag is meant to be hidden from user interfaces.
6869* action=import no longer allows both the namespace= and rootpage= parameters
6870  to be set. If they are both set, the value of rootpage= will be ignored.
6871* prop=revision output in enum mode is now sorted by timestamp rather than
6872  revision ID. This usually won't make any difference.
6873* (T102645) Namespace list from meta=siteinfo&siprop=namespaces is now an array
6874  with formatversion=2.
6875* Various other output from meta=siteinfo will now always be arrays instead of
6876  sometimes being numerically-indexed objects with formatversion=2.
6877* When errors about users being blocked are returned, they now include
6878  information about the relevant block.
6879* (T99926) list=random has higher limits, in line with other API modules.
6880* list=random's rnredirect parameter is deprecated in favor of a new
6881  rnfilterredir parameter that also allows for listing both redirects and
6882  non-redirects.
6883* list=random now supports continuation.
6884* API responses to GET requests may now include ETag and Last-Modified headers,
6885  and will honor corresponding If-None-Match and If-Modified-Since on such
6886  requests.
6887
6888=== Action API internal changes in 1.26 ===
6889* New metadata item ApiResult::META_KVP_MERGE to allow for merging the KVP key
6890  into the value when the value is an assoc.
6891* API action modules may now provide values for the RFC 7232 ETag and
6892  Last-Modified headers. The API will check these against If-None-Match and
6893  If-Modified-Since request headers on GET requests and avoid executing the
6894  module when appropriate.
6895
6896=== Languages updated in 1.26 ===
6897
6898MediaWiki supports over 350 languages. Many localisations are updated
6899regularly. Below only new and removed languages are listed, as well as
6900changes to languages because of Phabricator reports.
6901
6902* Languages added:
6903** ase (American sign language), thanks to translator Icemandeaf
6904** dty (डोटेली/Doteli), thanks to translators जनक राज भट्ट, बिप्लब आनन्द,
6905   मेश सिंह बोहरा, and राम प्रसाद जोशी
6906** luz (لئری دوٙمینی / Southern Luri)
6907** olo (Livvinкarjala / Livvi-Karelian), thanks to translators Denö, Hiloin
6908   Natoi, Ilja.mos, and Mashoi7
6909
6910=== Other changes in 1.26 ===
6911* ChangeTags::tagDescription() will return false if the interface message
6912  for the tag is disabled.
6913* Added PageHistoryPager::doBatchLookups hook.
6914* Added $wikiId parameter to FormatAutocomments hook.
6915* Added ParserCacheSaveComplete to ParserCache
6916* supportsDirectEditing and supportsDirectApiEditing methods added to
6917  ContentHandler, to provide a way for ApiEditPage and EditPage to check
6918  if direct editing of content is allowed. These methods return false,
6919  by default for the ContentHandler base class and true for TextContentHandler
6920  and it's derivative classes (everything in core). For Content types that
6921  do not support direct editing, an alternative mechanism should be provided
6922  for editing, such as action overrides or specific api modules.
6923* mediaWiki.confirmCloseWindow now returns an object of functions, instead of
6924  one function. The callback can't be called directly any more. The callback
6925  function is replaced with confirmCloseWindow.release().
6926* BREAKING CHANGE: Added an optional ResouceLoaderContext parameter to
6927  ResourceLoaderModule::getDependencies(). Extension classes that override that
6928  method should be updated. If they aren't updated, PHP Strict standards
6929  warnings will appear when E_STRICT error reporting is enabled. Note: in the
6930  near future, this parameter will probably become non-optional.
6931* Removed maintenance script deleteImageMemcached.php.
6932* MWFunction::newObj() was removed (deprecated in 1.25).
6933  ObjectFactory::getObjectFromSpec() should be used instead.
6934* The parser will no longer randomize the string it uses to mark the place of
6935  items that were stripped during parsing. It will use a fixed string instead.
6936  This causes the parser to re-use the regular expressions it uses to search
6937  and replace markers rather than generate novel expressions on each parse.
6938  Re-using regular expressions will improve performance on HHVM and the
6939  forthcoming PHP 7. The interfaces changes accompanying this change are:
6940  - Parser::getRandomString() and Parser::uniqPrefix() have been deprecated.
6941  - The $uniq_prefix argument for Parser::extractTagsAndParams() and the
6942    $prefix argument for StripState::_construct() are deprecated and their
6943    value is ignored.
6944* wfSuppressWarnings() and wfRestoreWarnings() were split into a separate
6945  library, mediawiki/at-ease, and are now deprecated. Callers should use
6946  MediaWiki\suppressWarnings() and MediaWiki\restoreWarnings() directly.
6947* The Block class constructor now takes an associative array of parameters
6948  instead of many optional positional arguments. Calling the constructor the old
6949  way will issue a deprecation warning.
6950* The jquery.mwExtension module was deprecated.
6951* $wgSpecialPageGroups was removed (deprecated in 1.21).
6952* SpecialPageFactory::setGroup was removed (deprecated in 1.21).
6953* SpecialPageFactory::getGroup was removed (deprecated in 1.21).
6954* DatabaseBase::ignoreErrors() is now protected.
6955* BREAKING CHANGE: mediawiki.legacy.ajax has been removed, following
6956  a lengthy deprecation period.
6957* The ScopedPHPTimeout class was removed.
6958* Removed maintenance script fixSlaveDesync.php.
6959* Watchlist tokens, SpecialResetTokens, and User::getTokenFromOption()
6960  are deprecated. Applications using those can work via the OAuth
6961  extension instead. New tokens types should not be added.
6962* DatabaseBase::errorCount() was removed (unused).
6963* $wgDeferredUpdateList was removed.
6964* DeferredUpdates::addHTMLCacheUpdate() was removed.
6965
6966= MediaWiki 1.25 =
6967
6968== MediaWiki 1.25.6 ==
6969
6970This is a maintenance release of the MediaWiki 1.25 branch.
6971
6972=== Changes since 1.25.5 ===
6973* (T123166) Fix fatal error when importing pages to titles which cannot be
6974  created, such as invalid titles or titles the user is not allowed to edit.
6975* (T122056) Old tokens are remaining valid within a new session
6976* (T127114) Login throttle can be tricked using non-canonicalized usernames
6977* (T123653) Cross-domain policy regexp is too narrow
6978* (T123071) Incorrectly identifying http link in a's href attributes, due to
6979  m modifier in regex
6980* (T129506) MediaWiki:Gadget-popups.js isn't renderable
6981* (T125283) Users occasionally logged in as different users after
6982  SessionManager deployment
6983* (T103239) Patrol allows click catching and patrolling of any page
6984* (T122807) [tracking] Check php crypto primatives
6985* (T98313) Graphs can leak tokens, leading to CSRF
6986* (T130947) Diff generation should use PoolCounter
6987* (T133507) Careless use of $wgExternalLinkTarget is insecure
6988* (T132874) API action=move is not rate limited
6989* (T110143) strip markers can be used to get around html attribute escaping in
6990  (many?) parser tags
6991* (T116030) Increase pbkdf2 parameter strengths
6992* (T127420) Pbkdf2Password does not check if hash_pbkdf2() succeeded
6993* (T126685) Globally throttle password attempts
6994
6995== MediaWiki 1.25.5 ==
6996
6997This is a maintenance release of the MediaWiki 1.25 branch.
6998
6999=== Changes since 1.25.4 ===
7000* (T121892) Fix fatal error on some Special pages, introduced in 1.25.4.
7001
7002== MediaWiki 1.25.4 ==
7003
7004This is a security and maintenance release of the MediaWiki 1.25 branch.
7005
7006=== Changes since 1.25.3 ===
7007* (T117899) SECURITY: $wgArticlePath can no longer be set to relative paths
7008  that do not begin with a slash. This enabled trivial XSS attacks.
7009  Configuration values such as "http://my.wiki.com/wiki/$1" are fine, as are
7010  "/wiki/$1". A value such as "$1" or "wiki/$1" is not and will now throw an
7011  error.
7012* (T119309) SECURITY: Use hash_compare() for edit token comparison
7013* (T118032) SECURITY: Don't allow cURL to interpret POST parameters starting
7014  with '@' as file uploads
7015* (T115522) SECURITY: Passwords generated by User::randomPassword() can no
7016  longer be shorter than $wgMinimalPasswordLength
7017* (T97897) SECURITY: Improve IP parsing and trimming. Previous behavior could
7018  result in improper blocks being issued
7019* (T109724) SECURITY: Special:MyPage, Special:MyTalk, Special:MyContributions
7020  and related pages no longer use HTTP redirects and are now redirected by
7021  MediaWiki
7022* (T103237) $wgUseGzip had no effect when using file cache.
7023* (T114606) mw.notify was not correctly fixed to the page if
7024  initialized while not at the top of the page.
7025* Fix issue that breaks HHVM Repo Authorative mode.
7026
7027== MediaWiki 1.25.3 ==
7028
7029This is a security and maintenance release of the MediaWiki 1.25 branch.
7030
7031=== Changes since 1.25.2 ===
7032
7033* (T98975) Fix having multiple callbacks for a single hook.
7034* (T107632) maintenance/refreshLinks.php did not always remove all links
7035  pointing to nonexistent pages.
7036* (T104142) $wgEmergencyContact and $wgPasswordSender now use their default
7037  value if set to an empty string.
7038* (T62174) Provide fallbacks for use of mb_convert_encoding() in
7039  HtmlFormatter. It was causing an error when accessing the api help page
7040  if the mbstring PHP extension was not installed.
7041* (T105896) Confirmation emails would sometimes contain invalid codes.
7042* (T105597) Fixed edit stash inclusion queries.
7043* (T91850) SECURITY: Add throttle check in ApiUpload and SpecialUpload
7044* (T91203, T91205) SECURITY: API: Improve validation in chunked uploading
7045* (T95589) SECURITY: RevDel: Check all revisions for suppression, not just the
7046  first
7047* (T108616) SECURITY: Avoid exposure of local path in PNG thumbnails
7048
7049== MediaWiki 1.25.2 ==
7050
7051This is a security and maintenance release of the MediaWiki 1.25 branch.
7052
7053=== Changes since 1.25.1 ===
7054
7055* (T94116) SECURITY: Compare API watchlist token in constant time
7056* (T97391) SECURITY: Escape error message strings in thumb.php
7057* (T106893) SECURITY: Don't leak autoblocked IP addresses on
7058  Special:DeletedContributions
7059* (T102562) Fix InstantCommons parameters to handle the new HTTPS-only
7060  policy of Wikimedia Commons.
7061* (T100767) Setting a configuration setting for skin or extension to
7062  false in LocalSettings.php was not working.
7063* (T100635) API action=opensearch json output no longer breaks when
7064  $wgDebugToolbar is enabled.
7065* (T102522) Using an extension.json or skin.json file which has
7066  a "manifest_version" property for 1.26 compatability will no longer
7067  trigger warnings.
7068* (T86156) Running updateSearchIndex.php will not throw an error as
7069  page_restrictions has been added to the locked table list.
7070* Special:Version would throw notices if using SVN due to an incorrectly
7071  named variable. Add an additional check that an index is defined.
7072
7073== MediaWiki 1.25.1 ==
7074
7075This is a bug fix release of the MediaWiki 1.25 branch.
7076
7077=== Changes since 1.25 ===
7078* (T100351) Fix syntax errors in extension.json of ConfirmEdit extension
7079
7080== MediaWiki 1.25.0 ==
7081
7082=== Configuration changes in 1.25 ===
7083* $wgPageShowWatchingUsers was removed.
7084* $wgLocalVirtualHosts has been added to replace $wgConf->localVHosts.
7085* $wgAntiLockFlags was removed.
7086* $wgJavaScriptTestConfig was removed.
7087* Edit tokens returned from User::getEditToken may change on every call. Token
7088  validity must be checked by passing the user-supplied token to
7089  User::matchEditToken rather than by testing for equality with a
7090  newly-generated token.
7091* (T74951) The UserGetLanguageObject hook may be passed any IContextSource
7092  for its $context parameter. Formerly it was documented as receiving a
7093  RequestContext specifically.
7094* Profiling was restructured and $wgProfiler now requires an 'output' parameter.
7095  See StartProfiler.sample for details.
7096* $wgMangleFlashPolicy was added to make MediaWiki's mangling of anything that
7097  might be a flash policy directive configurable.
7098* ApiOpenSearch now supports XML output. The OpenSearchXml extension should no
7099  longer be used. If extracts and page images are desired, the TextExtracts and
7100  PageImages extensions are required.
7101* $wgOpenSearchTemplate is deprecated in favor of $wgOpenSearchTemplates.
7102* Edits are now prepared via AJAX as users type edit summaries. This behavior
7103  can be disabled via $wgAjaxEditStash.
7104* (T46740) The temporary option $wgIncludejQueryMigrate was removed, along
7105  with the jQuery Migrate library, as indicated when this option was provided in
7106  MediaWiki 1.24.
7107* ProfilerStandard and ProfilerSimpleTrace were removed. Make sure that any
7108  StartProfiler.php config is updated to reflect this. Xhprof is available
7109  for zend/hhvm. Also, for hhvm, one can consider using its xenon profiler.
7110* Default value of $wgSVGConverters['rsvg'] now uses the 'rsvg-convert' binary
7111  rather than 'rsvg'.
7112* Default value of $wgSVGConverters['ImageMagick'] now uses transparent
7113  background with white fallback color, rather than just white background.
7114 * MediaWikiBagOStuff class removed, make sure any object cache config
7115   uses SqlBagOStuff instead.
7116* The 'daemonized' flag must be set to true in $wgJobTypeConf for any redis
7117  job queues. This means that mediawiki/services/jobrunner service has to
7118  be installed and running for any such queues to work.
7119* $wgAutopromoteOnce no longer supports the 'view' event. For keeping some
7120  compatibility, any 'view' event triggers will still trigger on 'edit'.
7121* $wgExtensionDirectory was added for when your extensions directory is
7122  somewhere other than $IP/extensions (as $wgStyleDirectory does with the skins
7123  directory).
7124
7125=== New features in 1.25 ===
7126* (T64861) Updated plural rules to CLDR 26. Includes incompatible changes
7127  for plural forms in Russian, Prussian, Tagalog, Manx and several languages
7128  that fall back to Russian.
7129* (T60139) ResourceLoaderFileModule now supports language fallback
7130  for 'languageScripts'.
7131* Added a new hook, "ContentAlterParserOutput", to allow extensions to modify
7132  the parser output for a content object before links update.
7133* (T37785) Enhanced recent changes and extended watchlist are now default.
7134  Documentation: https://meta.wikimedia.org/wiki/Help:Enhanced_recent_changes
7135  and https://www.mediawiki.org/wiki/Manual:$wgDefaultUserOptions
7136* (T69341) SVG images will no longer be base64-encoded when being embedded
7137  in CSS. This results in slight size increase before gzip compression (due to
7138  percent-encoding), but up to 20% decrease after it.
7139* Update jStorage to v0.4.12.
7140* MediaWiki now natively supports page status indicators: icons (or short text
7141  snippets) usually displayed in the top-right corner of the page. They have
7142  been in use on Wikipedia for a long time, implemented using templates and CSS
7143  absolute positioning.
7144  - Basic wikitext syntax:
7145    <indicator name="foo">[[File:Foo.svg|20px]]</indicator>
7146  - Usage instructions:
7147    https://www.mediawiki.org/wiki/Help:Page_status_indicators
7148  - Adjusting custom skins to support indicators:
7149    https://www.mediawiki.org/wiki/Manual:Skinning#Page_status_indicators
7150* Edit tokens may now be time-limited: passing a maximum age to
7151  User::matchEditToken will reject any older tokens.
7152* The debug logging internals have been overhauled, and are now using the
7153  PSR-3 interfaces.
7154* Update CSSJanus to v1.1.1.
7155* Update lessphp to v0.5.0.
7156* Added a hook, "ApiOpenSearchSuggest", to allow extensions to provide extracts
7157  and images for ApiOpenSearch output. The semantics are identical to the
7158  "OpenSearchXml" hook provided by the OpenSearchXml extension.
7159* PrefixSearchBackend hook now has an $offset parameter. Combined with $limit,
7160  this allows for pagination of prefix results. Extensions using this hook
7161  should implement supporting behavior. Not doing so can result in undefined
7162  behavior from API clients trying to continue through prefix results.
7163* Update jQuery from v1.11.1 to v1.11.3.
7164* External libraries installed via composer will now be displayed
7165  on Special:Version in their own section. Extensions or skins that are
7166  installed via composer will not be shown in this section as it is assumed
7167  they will add the proper credits to the skins or extensions section. They
7168  can also be accessed through the API via the new siprop=libraries to
7169  ApiQuerySiteinfo.
7170* Update QUnit from v1.14.0 to v1.16.0.
7171* Update Moment.js from v2.8.3 to v2.8.4.
7172* Special:Tags now allows for manipulating the list of user-modifiable change
7173  tags.
7174* Added 'managetags' user right and 'ChangeTagCanCreate', 'ChangeTagCanDelete',
7175  and 'ChangeTagCanCreate' hooks to allow for managing user-modifiable change
7176  tags.
7177* Added 'ChangeTagsListActive' hook, to separate the concepts of "defined" and
7178  "active" formerly conflated by the 'ListDefinedTags' hook.
7179* Added TemplateParser class that provides a server-side interface to cachable
7180  dynamically-compiled Mustache templates (currently uses lightncandy library).
7181* Clickable anchors for each section heading in the content are now generated
7182  and appear in the gutter on hovering over the heading.
7183* Added 'CategoryViewer::doCategoryQuery' and 'CategoryViewer::generateLink'
7184  hooks to allow extensions to override how links to pages are rendered within
7185  NS_CATEGORY
7186* (T19665) Special:WantedPages only lists page which having at least one red
7187  link pointing to it.
7188* New hooks 'ApiMain::moduleManager' and 'ApiQuery::moduleManager', can be
7189  used for conditional registration of API modules.
7190* New hook 'EnhancedChangesList::getLogText' to alter, remove or add to the
7191  links of a group of changes in EnhancedChangesList.
7192* A full interface for StatsD metric reporting has been added to the context
7193  interface, reachable via IContextSource::getStats().
7194* Move the jQuery Client library from being mastered in MediaWiki as v0.1.0 to a
7195  proper, published library, which is now tagged as v1.0.0.
7196* A new message (defaulting to blank), 'editnotice-notext', can be shown to
7197  users when they are editing if no edit notices apply to the page being edited.
7198* (T94536) You can now make the sitenotice appear to logged-in users only by
7199  editing MediaWiki:Anonnotice and replacing its content with "". Setting it to
7200  "-" (default) will continue disable it and fallback to MediaWiki:Sitenotice.
7201* Modifying the tagging of a revision or log entry is now available via
7202  Special:EditTags, generally accessed via the revision-deletion-like interface
7203  on history pages and Special:Log is likely to be more useful.
7204* Added 'applychangetags' and 'changetags' user rights.
7205* (T35235) LogFormatter subclasses are now responsible for formatting the
7206  parameters for API log event output. Extensions should implement the new
7207  getParametersForApi() method in their log formatters.
7208
7209==== External libraries ====
7210* MediaWiki now requires certain external libraries to be installed. In the past
7211  these were bundled inside the Git repository of MediaWiki core, but now they
7212  need to be installed separately. For users using the tarball, this will be
7213  taken care of and no action will be required. Users using Git will either need
7214  to use composer to fetch dependencies or use the mediawiki/vendor repository
7215  which includes all dependencies for MediaWiki core and ones used in Wikimedia
7216  deployment. Detailed instructions can be found at:
7217  https://www.mediawiki.org/wiki/Download_from_Git#Fetch_external_libraries
7218* The following libraries are now required:
7219** psr/log
7220   This library provides the interfaces set by the PSR-3 standard
7221   (http://www.php-fig.org/psr/psr-3/) which are used by MediaWiki internally
7222   via the MediaWiki\Logger\LoggerFactory class.
7223   See the structured logging RfC
7224   <https://www.mediawiki.org/wiki/Requests_for_comment/Structured_logging>
7225   for more background information.
7226** cssjanus/cssjanus
7227   This library was formerly bundled with MediaWiki core and has been removed.
7228   It automatically flips CSS for RTL support.
7229** leafo/lessphp
7230   This library was formerly bundled with MediaWiki core and has been removed.
7231   It compiles LESS files into CSS.
7232** wikimedia/cdb
7233   This library was formerly a part of MediaWiki core, and has been moved into a
7234   separate library. It provides CDB functions which are used in the Interwiki
7235   and Localization caches. More information about the library can be found at
7236   https://www.mediawiki.org/wiki/CDB.
7237** liuggio/statsd-php-client
7238   This library provides a StatsD client API for logging application metrics to
7239   a remote server.
7240
7241=== Bug fixes in 1.25 ===
7242* (T73003) No additional code will be generated to try to load CSS-embedded
7243  SVG images in Internet Explorer 6 and 7, as they don't support them anyway.
7244* (T69021) On Special:BookSources, corrected validation of ISBNs (both
7245  10- and 13-digit forms) containing "X".
7246* Page moving was refactored into a MovePage class. As part of that:
7247** The AbortMove hook was removed.
7248** MovePageIsValidMove is for extensions to specify whether a page
7249   cannot be moved for technical reasons, and should not be overridden.
7250** MovePageCheckPermissions is for checking whether the given user is
7251   allowed to make the move.
7252** Title::moveNoAuth() was deprecated. Use the MovePage class instead.
7253** Title::moveTo() was deprecated. Use the MovePage class instead.
7254** Title::isValidMoveOperation() broken down into MovePage::isValidMove()
7255   and MovePage::checkPermissions().
7256* (T18530) Multiple autocomments are now formatted in an edit summary.
7257* (T70361) Autocomments containing "/*" are parsed correctly.
7258* The Special:WhatLinksHere page linked from 'Number of redirects to this page'
7259  on action=info about a file page does not list file links anymore.
7260* (T78637) Search bar is not autofocused unless it is empty so that proper
7261  scrolling using arrow keys is possible.
7262* (T50853) Database::makeList() modified to handle 'NULL' separately when
7263  building IN clause
7264* (T85192) Captcha position modified in Usercreate template. As a result:
7265** extrafields parameter added to Usercreate.php to insert additional data
7266** 'extend' method added to QuickTemplate to append additional values to any
7267  field of data array
7268* (T86974) Several Title methods now load from the database when necessary
7269  (instead of returning incorrect results) even when the page ID is known.
7270* (T74070) Duplicate search for archived files on file upload now omits the
7271  extension.
7272  This requires the fa_sha1 field being populated.
7273* Removed rel="archives" from the "View history" link, as it did not pass
7274  HTML validation.
7275* $wgUseTidy is now set when parserTests are run with the tidy option to match
7276  output on wiki.
7277* (T37472) update.php will purge ResourceLoader cache unless --nopurge is passed
7278  to it.
7279* (T72109) mediawiki.language should respect $wgTranslateNumerals in
7280  convertNumber().
7281
7282=== Action API changes in 1.25 ===
7283* (T67403) XML tag highlighting is now only performed for formats
7284  "xmlfm" and "wddxfm".
7285* action=paraminfo supports generalized submodules (modules=query+value),
7286  querymodules and formatmodules are deprecated
7287* action=paraminfo no longer outputs descriptions and other help text by
7288  default. If needed, it may be requested using the new 'helpformat' parameter.
7289* action=help has been completely rewritten, and outputs help in HTML
7290  rather than plain text.
7291* Hitting api.php without specifying an action now displays only the help for
7292  the main module, with links to submodule help.
7293* API help is no longer displayed on errors.
7294* 'uselang' is now a recognized API parameter; "uselang=user" may be used to
7295  explicitly select the language from the current user's preferences, and
7296  "uselang=content" may be used to select the wiki's content language.
7297* Default output format for the API is now jsonfm.
7298* Simplified continuation will return a "batchcomplete" property in the result
7299  when a batch of pages is complete.
7300* Pretty-printed HTML output now has nicer formatting and (if available)
7301  better syntax highlighting.
7302* Deprecated list=deletedrevs in favor of newly-added prop=deletedrevisions and
7303  list=alldeletedrevisions.
7304* prop=revisions will gracefully continue when given too many revids or titles,
7305  rather than just ignoring the extras.
7306* prop=revisions will no longer die if rvcontentformat doesn't match a
7307  revision's content model; it will instead warn and omit the content.
7308* If the user has the 'deletedhistory' right, action=query's revids parameter
7309  will now recognize deleted revids.
7310* prop=revisions may be used as a generator, generating revids.
7311* (T68776) format=json results will no longer be corrupted when
7312  $wgMangleFlashPolicy is in effect. format=php results will cleanly return an
7313  error instead of returning invalid serialized data.
7314* Generators may now return data for the generated pages when used with
7315  action=query.
7316* Query page data for generator=search and generator=prefixsearch will now
7317  include an "index" field, which may be used by the client for sorting the
7318  search results.
7319* ApiOpenSearch now supports XML output.
7320* ApiOpenSearch will now output descriptions and URLs as array indexes 2 and 3
7321  in JSON format.
7322* (T76051) list=tags will now continue correctly.
7323* (T76052) list=tags can now indicate whether a tag is defined.
7324* (T75522) list=prefixsearch now supports continuation
7325* (T78737) action=expandtemplates can now return page properties.
7326* (T78690) list=allimages now accepts multiple pipe-separated values
7327  for the 'aimime' parameter.
7328* prop=info with inprop=protections will now return applicable protection types
7329  with the 'restrictiontypes' key.
7330* (T85417) When resolving redirects, ApiPageSet will now add the targets of
7331  interwiki redirects to the list of interwiki titles.
7332* (T85417) When outputting the list of redirect titles, a 'tointerwiki'
7333  property (like the existing 'tofragment' property) will be set.
7334* Added action=managetags to allow for managing the list of
7335  user-modifiable change tags. Actually modifying the tagging of a revision or
7336  log entry is not implemented yet.
7337* list=tags has additional properties to indicate 'active' status and tag
7338  sources.
7339* siprop=libraries was added to ApiQuerySiteinfo to list installed external
7340  libraries.
7341* (T88010) Added action=checktoken, to test a CSRF token's validity.
7342* (T88010) Added intestactions to prop=info, to allow querying of
7343  Title::userCan() via the API.
7344* Default type param for query list=watchlist and list=recentchanges has
7345  been changed from all types (e.g. including 'external') to 'edit|new|log'.
7346* Added formatversion to format=json. Still "experimental" as further changes
7347  to the output formatting might still be made.
7348* (T73020) Log event details are now always under a 'params' subkey for
7349  list=logevents, and a 'logparams' subkey for list=watchlist and
7350  list=recentchanges.
7351* Log event details are changing formatting:
7352  * block events now report flags as an array rather than as a comma-separated
7353    list.
7354  * patrol events now report the 'auto' flag as a boolean (absent/empty string
7355    for BC formats) rather than as an integer.
7356  * rights events now report the old and new group lists as arrays rather than
7357    as comma-separated lists.
7358  * merge events use new-style formatting.
7359  * delete/event and delete/revision events use new-style formatting.
7360* The root node and various other nodes will now always be an object in formats
7361  such as json that distinguish between arrays and objects.
7362  * Except for action=opensearch where the spec requires an array.
7363
7364=== Action API internal changes in 1.25 ===
7365* ApiHelp has been rewritten to support i18n and paginated HTML output.
7366  Most existing modules should continue working without changes, but should do
7367  the following:
7368  * Add an i18n message "apihelp-{$moduleName}-description" to replace
7369    getDescription().
7370  * Add i18n messages "apihelp-{$moduleName}-param-{$param}" for each parameter
7371    to replace getParamDescription(). If necessary, the settings array returned
7372    by getParams() can use the new ApiBase::PARAM_HELP_MSG key to override the
7373    message.
7374  * Implement getExamplesMessages() to replace getExamples().
7375* Modules with submodules (like action=query) must have their submodules
7376  override ApiBase::getParent() to return the correct parent object.
7377* The 'APIGetDescription' and 'APIGetParamDescription' hooks are deprecated,
7378  and will have no effect for modules using i18n messages. Use
7379  'APIGetDescriptionMessages' and 'APIGetParamDescriptionMessages' instead.
7380* Api formatters will no longer be asked to display the help screen on errors.
7381* ApiMain::getCredits() was removed. The credits are available in the
7382  'api-credits' i18n message.
7383* ApiFormatBase has been changed to support i18n and syntax highlighting via
7384  extensions with the new 'ApiFormatHighlight' hook. Core syntax highlighting
7385  has been removed.
7386* ApiFormatBase now always buffers. Output is done when
7387  ApiFormatBase::closePrinter is called.
7388* Much of the logic in ApiQueryRevisions has been split into
7389  ApiQueryRevisionsBase.
7390* The 'revids' parameter supplied by ApiPageSet will now count deleted
7391  revisions as "good" if the user has the 'deletedhistory' right. New methods
7392  ApiPageSet::getLiveRevisionIDs() and ApiPageSet::getDeletedRevisionIDs() are
7393  provided to access just the live or just the deleted revids.
7394* Added ApiPageSet::setGeneratorData() and ApiPageSet::populateGeneratorData()
7395  to allow generators to include data in the action=query result.
7396* New hooks 'ApiMain::moduleManager' and 'ApiQuery::moduleManager', can be
7397  used for conditional registration of API modules.
7398* Added ApiBase::lacksSameOriginSecurity() to allow modules to easily check if
7399  the current request was sent with the 'callback' parameter (or any future
7400  method that breaks the same-origin policy).
7401* Profiling methods in ApiBase are deprecated and no longer need to be called.
7402* ApiResult was greatly overhauled. See inline documentation for details.
7403* ApiResult will automatically convert objects to strings or arrays (depending
7404  on whether a __toString() method exists on the object), and will refuse to
7405  add unsupported value types.
7406  * An informal interface, ApiSerializable, exists to override the default
7407    object conversion.
7408* ApiResult/ApiFormatBase "raw mode" is deprecated.
7409* ApiFormatXml now assumes defaults and so on instead of throwing errors when
7410  metadata isn't set.
7411* (T35235) LogFormatter subclasses are now responsible for formatting log event
7412  parameters for the API.
7413* Many modules have changed result data formats. While this shouldn't affect
7414  clients not using the experimental formatversion=2, code using
7415  ApiResult::getResultData() without the transformations for backwards
7416  compatibility may need updating, as will code that wasn't following the old
7417  conventions for API boolean output.
7418* The following methods have been deprecated and may be removed in a future
7419  release:
7420  * ApiBase::getDescription
7421  * ApiBase::getParamDescription
7422  * ApiBase::getExamples
7423  * ApiBase::makeHelpMsg
7424  * ApiBase::makeHelpArrayToString
7425  * ApiBase::makeHelpMsgParameters
7426  * ApiBase::getModuleProfileName
7427  * ApiBase::profileIn
7428  * ApiBase::profileOut
7429  * ApiBase::safeProfileOut
7430  * ApiBase::getProfileTime
7431  * ApiBase::profileDBIn
7432  * ApiBase::profileDBOut
7433  * ApiBase::getProfileDBTime
7434  * ApiBase::getResultData
7435  * ApiFormatBase::setUnescapeAmps
7436  * ApiFormatBase::getWantsHelp
7437  * ApiFormatBase::setHelp
7438  * ApiFormatBase::formatHTML
7439  * ApiFormatBase::setBufferResult
7440  * ApiFormatBase::getDescription
7441  * ApiFormatBase::getNeedsRawData
7442  * ApiMain::setHelp
7443  * ApiMain::reallyMakeHelpMsg
7444  * ApiMain::makeHelpMsgHeader
7445  * ApiResult::setRawMode
7446  * ApiResult::getIsRawMode
7447  * ApiResult::getData
7448  * ApiResult::setElement
7449  * ApiResult::setContent
7450  * ApiResult::setIndexedTagName_recursive
7451  * ApiResult::setIndexedTagName_internal
7452  * ApiResult::setParsedLimit
7453  * ApiResult::beginContinuation
7454  * ApiResult::setContinueParam
7455  * ApiResult::setGeneratorContinueParam
7456  * ApiResult::endContinuation
7457  * ApiResult::size
7458  * ApiResult::convertStatusToArray
7459  * ApiQueryImageInfo::getPropertyDescriptions
7460  * ApiQueryLogEvents::addLogParams
7461* The following classes have been deprecated and may be removed in a future
7462  release:
7463  * ApiQueryDeletedrevs
7464
7465=== Languages updated in 1.25 ===
7466
7467MediaWiki supports over 350 languages. Many localisations are updated
7468regularly. Below only new and removed languages are listed, as well as
7469changes to languages because of Bugzilla reports.
7470
7471* Languages added:
7472** awa (अवधी / Awadhi), thanks to translator 1AnuraagPandey;
7473** bgn (بلوچی رخشانی / Western Balochi), thanks to translators
7474   Baloch Afghanistan, Ibrahim khashrowdi and Rachitrali;
7475** ses (Koyraboro Senni), thanks to translator Songhay.
7476* (T66440) Kazakh (kk) wikis should no longer forcefully reset the user's
7477  interface language to kk where unexpected.
7478* The Chinese conversion table was substantially updated to fix a lot of
7479  bugs and ensure better reading experience for different variants.
7480
7481=== Other changes in 1.25 ===
7482* (T45591) Links to MediaWiki.org translatable help were added to indicators,
7483  mostly in special pages. Local custom target titles can be placed in the
7484  relevant '(namespace-X|action name|special page name)-helppage' system
7485  message. Extensions can use the addHelpLink() function to do the same.
7486* The skin autodiscovery mechanism, deprecated in MediaWiki 1.23, has been
7487  removed. See https://www.mediawiki.org/wiki/Manual:Skin_autodiscovery for
7488  migration guide for creators and users of custom skins that relied on it.
7489* Javascript variables 'wgFileCanRotate' and 'wgFileExtensions' now only
7490  available on Special:Upload.
7491* (T58257) Set site logo from mediawiki.skinning.interface module instead of
7492  inline styles in the HTML.
7493* Removed ApiQueryUsers::getAutoGroups(). (deprecated since 1.20)
7494* Removed XmlDumpWriter::schemaVersion(). (deprecated since 1.20)
7495* Removed LogEventsList::getDisplayTitle(). (deprecated since 1.20)
7496* Removed Preferences::trySetUserEmail(). (deprecated since 1.20)
7497* Removed mw.user.name() and mw.user.anonymous() methods. (deprecated since
7498  1.20)
7499* Removed 'ok' and 'err' parameters in the mediawiki.api modules. (deprecated
7500  since 1.20)
7501* Removed 'async' parameter from the  mw.Api#getCategories() method. (deprecated
7502  since 1.20)
7503* Removed 'jquery.json' module. (deprecated since 1.24)
7504  Use the 'json' module and global JSON object instead.
7505* Deprecated OutputPage::readOnlyPage() and OutputPage::rateLimited().
7506  Also, the former will now throw an MWException if called with one or more
7507  arguments.
7508* Removed hitcounters and associated code.
7509* The "temp" zone of the upload respository is now considered private. If it
7510  already exists (such as under the images/ directory), please make sure that
7511  the directory is not web readable (e.g. via a .htaccess file).
7512* BREAKING CHANGE: In the XML dump format used by Special:Export and
7513  dumpBackup.php, the <model> and <format> tags now apprear before the <text>
7514  tag, instead of after the <text> and <sha1> tags.
7515  The new schema version is 0.10, the new schema URI is:
7516  https://www.mediawiki.org/xml/export-0.10.xsd
7517* MWFunction::call() and MWFunction::callArray() were removed, having being
7518  deprecated in 1.22.
7519* Deprecated the getInternalLinkAttributes, getInternalLinkAttributesObj,
7520  and getInternalLinkAttributes methods in Linker, and removed
7521  getExternalLinkAttributes method, which was deprecated in MediaWiki 1.18.
7522* Removed Sites class, which was deprecated in 1.21 and replaced by
7523  SiteSQLStore.
7524* Added wgRelevantArticleId to the client-side config, for use on special pages.
7525* Deprecated the TitleIsCssOrJsPage hook. Superseded by the
7526  ContentHandlerDefaultModelFor hook since MediaWiki 1.21.
7527* Deprecated the TitleIsWikitextPage hook. Superseded by the
7528  ContentHandlerDefaultModelFor hook since MediaWiki 1.21.
7529* Changed parsing of variables in schema (.sql) files:
7530** The substituted values are no longer parsed. (Formerly, several passes
7531   were made for each variable, so depending on the order in which variables
7532   were defined, variables might have been found inside encoded values. This
7533   is no longer the case.)
7534** Variables are no longer string encoded when the /*$var*/ syntax is used.
7535   If string encoding is necessary, use the '{$var}' syntax instead.
7536** Variable names must only consist of one or more of the characters
7537   "A-Za-z0-9_".
7538** In source text of the form '{$A}'{$B}' or `{$A}`{$B}`, where variable A
7539   does not exist yet variable B does, the latter may not be replaced.
7540   However, this difference is unlikely to arise in practice.
7541* (T67278) RFC, PMID, and ISBN "magic links" must be surrounded by non-word
7542  characters on both sides.
7543* The FormatAutocomments hook will now receive $pre and $post as booleans,
7544  rather than as strings that must be prepended or appended to $comment.
7545* (T30950, T31025) RFC, PMID, and ISBN "magic links" can no longer contain
7546  newlines; but they can contain &nbsp; and other non-newline whitespace.
7547* The 'mediawiki.action.edit' ResourceLoader module no longer generates the edit
7548  toolbar, which has been moved to a separate 'mediawiki.toolbar' module. If you
7549  relied on this behavior, update your scripts' dependencies.
7550* HTMLForm's 'vform' display style has been separated to a subclass. Therefore:
7551  * HTMLForm::isVForm() is now deprecated.
7552  * You can no longer do this:
7553      $form = new HTMLForm( … );
7554      $form->setDisplayFormat( 'vform' ); // throws exception
7555    Instead, do this:
7556      $form = HTMLForm::factory( 'vform', … );
7557* Deprecated Revision methods getRawUser(), getRawUserText() and
7558  getRawComment().
7559* BREAKING CHANGE: mediawiki.user.generateRandomSessionId:
7560  The alphabet of the prior string returned was A-Za-z0-9 and now it is 0-9A-F
7561* (T87504) Avoid serving SVG background-images in CSS for Opera 12, which
7562  renders them incorrectly when combined with border-radius or background-size.
7563* Removed maintenance script dumpSisterSites.php.
7564* DatabaseBase class constructors must be called using the array argument style.
7565  Ideally, DatabaseBase:factory() should be used instead in most cases.
7566* Deprecated ParserOutput::addSecondaryDataUpdate and
7567  ParserOutput::getSecondaryDataUpdates.
7568  This is a hard deprecation, with getSecondaryDataUpdates returning an empty
7569  array and addSecondaryDataUpdate throwing an exception. These functions will
7570  be removed in 1.26, since they interfere with caching of ParserOutput objects.
7571* Introduced new hook 'SecondaryDataUpdates' that allows extensions to inject
7572  custom updates.
7573* Introduced new hook 'OpportunisticLinksUpdate' that allows extensions to
7574  perform updates when a page is re-rendered.
7575* EditPage::attemptSave has been modified not to call handleStatus itself and
7576  instead just returns the Status object. Extension calling it should be aware
7577  of this.
7578* Removed class DBObject. (unused since 1.10)
7579* wfDiff() is deprecated.
7580* The -m (maximum replication lag) option of refreshLinks.php was removed.
7581  It had no effect since MediaWiki 1.18 and should be removed from any cron
7582  jobs or similar scripts you may have set up.
7583* (T85864) The following messages no longer support raw html: redirectto,
7584  thisisdeleted, viewdeleted, editlink, retrievedfrom, version-poweredby-others,
7585  retrievedfrom, thisisdeleted, viewsourcelink, lastmodifiedat, laggedslavemode,
7586  protect-summary-cascade
7587* All BloomCache related code has been removed. This was largely experimental.
7588* $wgResourceModuleSkinStyles no longer supports per-module local or remote
7589  paths. They can only be set for the entire skin.
7590* Removed global function swap(). (deprecated since 1.24)
7591* Deprecated the ".php5" file extension entry points and the $wgScriptExtension
7592  configuration variable. Refer to the ".php" files instead. If you want
7593  ".php5" URLs to continue to work, set up redirects. In Apache, this can be
7594  done by enabling mod_rewrite and adding the following rules to your
7595  configuration:
7596
7597    RewriteEngine On
7598    RewriteBase /
7599    RewriteRule ^(.*)\.php5 $1.php [R=301,L]
7600
7601* The global importScriptURI and importStylesheetURI functions, as well as the
7602  loadedScripts object, from wikibits.js (deprecated since 1.17) now emit
7603  warnings through mw.log.warn when accessed.
7604
7605= MediaWiki 1.24 =
7606
7607== MediaWiki 1.24.6 ==
7608
7609This is a maintenance release of the MediaWiki 1.24 branch.
7610
7611=== Changes since 1.24.5 ===
7612* (T121892) Fix fatal error on some Special pages, introduced in 1.24.5.
7613
7614== MediaWiki 1.24.5 ==
7615
7616This is a security and maintenance release of the MediaWiki 1.23 branch.
7617
7618=== Changes since 1.24.4 ===
7619* (T117899) SECURITY: $wgArticlePath can no longer be set to relative paths
7620  that do not begin with a slash. This enabled trivial XSS attacks.
7621  Configuration values such as "http://my.wiki.com/wiki/$1" are fine, as are
7622  "/wiki/$1". A value such as "$1" or "wiki/$1" is not and will now throw an
7623  error.
7624* (T119309) SECURITY: Use hash_compare() for edit token comparison
7625* (T118032) SECURITY: Don't allow cURL to interpret POST parameters starting
7626  with '@' as file uploads
7627* (T115522) SECURITY: Passwords generated by User::randomPassword() can no
7628  longer be shorter than $wgMinimalPasswordLength
7629* (T97897) SECURITY: Improve IP parsing and trimming. Previous behavior could
7630  result in improper blocks being issued
7631* (T109724) SECURITY: Special:MyPage, Special:MyTalk, Special:MyContributions
7632  and related pages no longer use HTTP redirects and are now redirected by
7633  MediaWiki
7634* (T103237) $wgUseGzip had no effect when using file cache.
7635
7636== MediaWiki 1.24.4 ==
7637
7638This is a security and maintenance release of the MediaWiki 1.24 branch.
7639
7640=== Changes since 1.24.3 ===
7641
7642* (T91653) Minimal PSR-3 debug logger to support backports from 1.25+.
7643* (T68650) Fix indexing of moved pages with PostgreSQL. Requires running
7644  update.php to fix.
7645* (T91850) SECURITY: Add throttle check in ApiUpload and SpecialUpload
7646* (T91203, T91205) SECURITY: API: Improve validation in chunked uploading
7647* (T95589) SECURITY: RevDel: Check all revisions for suppression, not just the
7648  first
7649* (T108616) SECURITY: Avoid exposure of local path in PNG thumbnails
7650
7651== MediaWiki 1.24.3 ==
7652
7653This is a security and maintenance release of the MediaWiki 1.24 branch.
7654
7655=== Changes since 1.24.2 ===
7656
7657* (T94116) SECURITY: Compare API watchlist token in constant time
7658* (T97391) SECURITY: Escape error message strings in thumb.php
7659* (T106893) SECURITY: Don't leak autoblocked IP addresses on
7660  Special:DeletedContributions
7661* Update jQuery from v1.11.2 to v1.11.3.
7662* (T102562) Fix InstantCommons parameters to handle the new HTTPS-only
7663  policy of Wikimedia Commons.
7664
7665== MediaWiki 1.24.2 ==
7666
7667This is a security and maintenance release of the MediaWiki 1.24 branch.
7668
7669=== Changes since 1.24.1 ===
7670
7671* (T85848, T71210) SECURITY: Don't parse XMP blocks that contain XML entities,
7672  to prevent various DoS attacks.
7673* (T85848) SECURITY: Don't allow directly calling Xml::isWellFormed, to reduce
7674  likelihood of DoS.
7675* (T88310) SECURITY: Always expand xml entities when checking SVG's.
7676* (T73394) SECURITY: Escape > in Html::expandAttributes to prevent XSS.
7677* (T85855) SECURITY: Don't execute another user's CSS or JS on preview.
7678* (T64685) SECURITY: Allow setting maximal password length to prevent DoS when
7679  using PBKDF2.
7680* (T85349, T85850, T86711) SECURITY: Multiple issues fixed in SVG filtering to
7681  prevent XSS and protect viewer's privacy.
7682* Fix case of SpecialAllPages/SpecialAllMessages in SpecialPageFactory to fix
7683  loading these special pages when $wgAutoloadAttemptLowercase is false.
7684* (bug T70087) Fix Special:ActiveUsers page for installations using
7685  PostgreSQL.
7686* (bug T76254) Fix deleting of pages with PostgreSQL. Requires a schema change
7687  and running update.php to fix.
7688
7689== MediaWiki 1.24.1 ==
7690
7691This is a security and maintenance release of the MediaWiki 1.24 branch.
7692
7693=== Changes since 1.24.0 ===
7694
7695* (bug T76686) [SECURITY] thumb.php outputs wikitext message as raw HTML, which
7696  could lead to xss. Permission to edit MediaWiki namespace is required to
7697  exploit this.
7698* (bug T77028) [SECURITY] Malicious site can bypass CORS restrictions in
7699  $wgCrossSiteAJAXdomains in API calls if it only included an allowed domain as
7700  part of its name.
7701* (bug T74222) The original patch for T74222 was reverted as unnecessary.
7702* Fixed a couple of entries in RELEASE-NOTES-1.24.
7703* (bug T76168) OutputPage: Add accessors for some protected properties.
7704* (bug T74834) Make 1.24 branch directly installable under PostgreSQL.
7705
7706== MediaWiki 1.24.0 ==
7707
7708=== Configuration changes in 1.24 ===
7709* MediaWiki will no longer run if register_globals is enabled. It has been
7710  deprecated for 5 years now, and was removed in PHP 5.4. For more information
7711  about why, see <https://www.mediawiki.org/wiki/register_globals>.
7712* MediaWiki now requires PHP's iconv extension. openSUSE users may need to
7713  install the php5-iconv package. Users of other systems may need to add
7714  extension=iconv.so to php.ini or recompile PHP without --without-iconv.
7715* MediaWiki will no longer function if magic quotes are enabled. It has
7716  been deprecated for 5 years now, and was removed in PHP 5.4.
7717* The server's canonical hostname is available as $wgServerName, which is
7718  exposed in both mw.config and ApiQuerySiteinfo.
7719* Introduced $wgPagePropsHaveSortkey as a backwards-compatibility switch,
7720  for using the old schema of the page_props table, in case the respective
7721  schema update was not applied.
7722* $wgSearchEverythingOnlyLoggedIn was removed as the 'searcheverything'
7723  user option was removed. Use $wgNamespacesToBeSearchedDefault instead or
7724  if you used to have $wgDefaultUserOptions['searcheverything'] = 1.
7725* $wgMasterWaitTimeout has been deprecated.
7726* $wgDBClusterTimeout has been removed.
7727* $wgProxyKey has been removed. It is no longer used by MediaWiki core.
7728  Ensure $wgSecretKey is set in LocalSettings.php.
7729* $wgExtraInterlanguageLinkPrefixes is a new configuration variable that
7730  contains an array of interwiki prefixes that should be treated as language
7731  prefixes (i.e. turned into interlanguage links when $wgInterwikiMagic is set
7732  to true).
7733* $wgParserTestRemote has been removed.
7734* $wgCountTotalSearchHits has been removed. If you're concerned about efficiency
7735  of search, you should use something like CirrusSearch instead of built in
7736  search.
7737* Users in the 'sysop' group have access to Special:MergeHistory by default.
7738* $wgFileStore was removed after having been deprecated in 1.17. Alternative
7739  configurations are $wgDeletedDirectory and $wgHashedUploadDirectory.
7740* The deprecated $wgUseCommaCount variable has been removed.
7741* $wgEnableSorbs and $wgSorbsUrl have been removed.
7742* The UserCryptPassword and UserComparePassword hooks are no longer called.
7743  Any extensions using them must be updated to use the Password Hashing API.
7744* $wgCompiledFiles has been removed.
7745* $wgSortSpecialPages was removed, the listing on Special:SpecialPages is
7746  now always sorted.
7747* $wgSpecialPages may now use callback functions as an alternative to plain
7748  class names. This allows more control over constructor parameters.
7749* $wgHTCPMulticastAddress, $wgHTCPMulticastRouting and $wgHTCPPort were removed.
7750* $wgRC2UDPAddress, $wgRC2UDPInterwikiPrefix, $wgRC2UDPOmitBots, $wgRC2UDPPort
7751  and $wgRC2UDPPrefix have been removed.
7752* The default password type for MediaWiki has been changed from MD5 to PBKDF2.
7753  Password hashes will automatically be updated as users log in. If necessary,
7754  the old MD5 hashing can be restored by changing $wgPasswordDefault to 'B'.
7755  In addition, there is a maintenance script wrapOldPassword.php that can wrap
7756  all passwords in PBKDF2 (or the hashing algorithm of your choice) if you don't
7757  want to wait for your users to log in.
7758* $wgImportSources can now either be a regular array, or an associative map
7759  specifying subprojects on the interwiki map of the target wiki, or a mix of
7760  the two. Existing configurations will still work.
7761* Users must be able to edit through a page's protection to be able to delete
7762  it.
7763* The default thumb size ($wgDefaultUserOptions['thumbsize']) is now 300px, up
7764  from 180px. If you have altered the number of entries in $wgThumbLimits for
7765  your wiki, you may need to adjust your default user settings to compensate for
7766  the index change.
7767* $wgDeferredUpdateList is now deprecated, you should use
7768  DeferredUpdates::addUpdate() instead.
7769* $wgCanonicalLanguageLinks has been removed. Per Google recommendations, we
7770  will not send a rel=canonical pointing to a variant-neutral page, however
7771  we will send rel=alternate.
7772* $wgResourceLoaderLESSFunctions has been deprecated and will be removed in the
7773  future.
7774* $wgGoToEdit has been removed. Use the SpecialSearchNogomatch hook for similar
7775  functionality.
7776
7777=== New features in 1.24 ===
7778* Added new hook WatchlistEditorBeforeFormRender, allowing subscribers to
7779  manipulate the list of pages and/or preload lots of data at once.
7780* Added new argument &$link in hook WatchlistEditorBuildRemoveLine, allowing the
7781  link to the title to be changed.
7782* Added a new hook, "WhatLinksHereProps", to allow extensions to annotate
7783  WhatLinksHere entries.
7784* Added a new hook, "ContentGetParserOutput", to customize parser output for
7785  a given content object.
7786* Deprecated the hook "ShowRawCssJs", use "ContentGetParserOutput" instead.
7787* HTMLForm's HTMLTextField now supports the 'url' type.
7788* HTMLForm fields may now be dynamically hidden based on the values of other
7789  fields in the form.
7790* HTMLForm now supports multiple copies of an input field or set of input
7791  fields, e.g. the form may request "one or more usernames" without having to
7792  have the user enter delimited list of names into a text field.
7793* Added a new hook, "SidebarBeforeOutput", to allow to edit the structure of
7794  the sidebar just before its display.
7795* (bug 49156) Added the mediawiki.cookie ResourceLoader module, which wraps
7796  jquery.cookie so that getting/setting a cookie is syntactically and
7797  functionally similar to using the WebRequest::getCookie() and
7798  WebResponse::setcookie() methods.
7799* (bug 44740) jQuery upgraded from 1.8.3 to 1.11.1. A new configuration option,
7800  $wgIncludejQueryMigrate, also loads the jQuery Migrate hack to let extensions
7801  and gadgets use the long-deprecated functions that were removed in jQuery 1.9.
7802  This option is turned off by default, and will be removed in MediaWiki 1.25.
7803* (bug 47076) jQuery UI upgraded from 1.8.24 to 1.9.2.
7804* Changes to content typography (fonts, etc.). See
7805  https://www.mediawiki.org/wiki/Typography_refresh for further information.
7806* WikitextContent will now render redirects with the expected "redirect"
7807  header, rather than as an ordered list. Code calling Article::viewRedirect
7808  can probably be changed to no longer special-case redirects.
7809* Header font set to a serif font stack. See
7810  https://www.mediawiki.org/wiki/Typography_refresh for further information.
7811* (bug 65567) Added a new hook, "BeforeHttpsRedirect", to allow cancellation of
7812  the HTTP to HTTPS redirect due to forceHTTPS cookie, userRequires, etc. This
7813  is only for page views, since this hook doesn't affect UserLogin, OAuth,
7814  CentralAuth, etc. ATTENTION: This hook is likely to be removed soon due to
7815  overall design of the system.
7816* (bug 17367) It is now possible to add pages to your watchlist from
7817  Special:UnwatchedPages without reloading the special page.
7818* New methods setVolatile and isVolatile are added to PPFrame, so that
7819  extensions such as Cite.php can mark that their output is volatile and
7820  shouldn't be cached.
7821* (bug 52817) Advanced search options are now saved on the search page itself,
7822  rather than in a dedicated pane in the preferences panel.
7823* (bug 44591) The dropdown actions menu (little triangle next to page tabs) in
7824  the Vector skin has gained a label that should make it more discoverable.
7825* MWCryptHKDF added for fast, cryptographically secure random number generation
7826  that won't deplete openssl's entropy pool.
7827* ResourceLoader: File modules can now provide a skip function that uses an
7828  inline feature test to bypass loading of the module.
7829* (bug 20210) Special pages may now provide autocompletion of their subpage
7830  names in search suggestions. Right now the only useful implementation is in
7831  Special:Log, but more are to come.
7832* Special:MostLinkedTemplates is no longer limited to transclusions from the
7833  Template namespace.
7834* Skins can now use 'remoteSkinPath' when defining ResourceLoader modules.
7835  This works the same as 'remoteExtPath' but is relative to the skins/ folder
7836  instead of the extensions/ folder.
7837* Added the json2.js polyfill for the ES5 JSON.stringify and JSON.parse methods.
7838  Exposed as module "json" with a skip function to optimise loading.
7839* Extensions and skins may now use 'namemsg' in $wgExtensionCredits in addition
7840  to 'name', to allow for the name to be localizable. 'name' should still be
7841  specified for backwards-compatibility and to define the path Special:Version
7842  uses to find extension license information.
7843* Browser tests are now included to verify basic wiki functionality in developer
7844  environments. For details on running tests, see
7845  tests/browser/README.mediawiki.
7846* Upgrade jStorage to v0.4.10.
7847* {{!}} is now a magic word that produces the | character. This removes the need
7848  for Template:! for purposes such as passing pipes inside of parameters.
7849* (bug 20790) The block log snippet on Special:Contributions and while
7850  editing user and user talk pages now works for IP range blocks.
7851* (bug 9360) Added ability to change the page language for MediaWiki pages using
7852  Special:PageLanguage. All pages are set to wiki language by default.
7853  The feature needs to be enabled with $wgPageLanguageUseDB=true and
7854  permission needs to be set for 'pagelang'.
7855* Upgrade Moment.js to v2.8.3.
7856* (bug 67042) Added support for the HTML5 <rtc> tag for East Asian typography.
7857* Upgrade Sinon.JS to 1.10.3.
7858* Added the es5-shim polyfill for older or non-compliant javascript engines.
7859* Upgrade jQuery Cookie to v1.3.1.
7860* (bug 20476) Add a "viewsuppressed" user right to be able to view
7861  suppressed content but not suppress it ("suppressrevision" right).
7862* (bug 66440) The MediaWiki web installer will now allow you to choose the skins
7863  to enable (from the ones included in download tarball) and decide which one
7864  should be the default.
7865* (bug 68085, 68802) Links like [[localInterwikiPrefix:languageCode:pageTitle]],
7866  where localInterwikiPrefix is a member of the $wgLocalInterwikis array, will
7867  no longer be displayed in the sidebar when $wgInterwikiMagic is true. In a
7868  similar way, links like [[localInterwikiPrefix:File:Image.png]] and
7869  [[localInterwikiPrefix:Category:Hello]] will now render as regular links, and
7870  will not include the file or add the page to the category.
7871* New special page, MyLanguage, to redirect users to subpages with localised
7872  versions of a page. (Integrated from Extension:Translate)
7873* MediaWiki now supports multiple password types, including bcrypt and PBKDF2.
7874  The default type can be changed with $wgPasswordDefault and the type
7875  configurations can be changed with $wgPasswordConfig.
7876* Skins can now define custom styles for default ResourceLoader modules using
7877  the $wgResourceModuleSkinStyles global. See the Vector skin for examples.
7878* (bug 4488) There is now a preference to watch pages where the user has
7879  rollbacked an edit by default.
7880* (bug 15484) Users will now be redirected to the login page when they need to
7881  log in, rather than being shown a page asking them to log in and having to
7882  click another link to actually get to the login page.
7883* A JsonContent and JsonContentHandler were added for extensions to extend.
7884* (bug 35045) Redirects to sections will now update the URL in browser's address
7885  bar using the HTML5 History API. When [[Dog]] redirects to [[Animals#Dog]],
7886  the user will now see "Animals#Dog" in their browser instead of "Dog#Dog".
7887* API token handling has been rewritten. Any API module using tokens will need
7888  to be updated. See the entry below under "Action API internal changes".
7889* Added HTMLAutoCompleteSelectField.
7890* Added a new hook, "SkinPreloadExistence", to allow extensions to add titles to
7891  link existence cache before the page is rendered.
7892* Config::set() was moved to its own interface, MutableConfig.
7893  GlobalVarConfig::set() is now deprecated, does not implement MutableConfig.
7894* A MutableConfig named HashConfig was added, that stores an array of
7895  configuration settings.
7896* (bug 69418) A MultiConfig implementation was added that supports fallback
7897  to multiple Config instances.
7898* Update CSSJanus to v1.1.0.
7899* Added FormatJson::parse() returning status with result or localized error
7900  message
7901* Added DeletedContribsPager::reallyDoQuery hook allowing extensions to data to
7902  Special:DeletedContributions
7903* Added DeletedContributionsLineEnding hook allowing extensions to format
7904  Special:DeletedContributions lines
7905* (T69525) You can now make MediaWiki speed up its thumbnail rendering by using
7906  intermediary thumbnails. $wgThumbnailBuckets must be set to a list of target
7907  thumbnail widths; when a new thumbnail needs to be rendered, MediaWiki will
7908  find the smallest bucket smaller than the original but larger than the target
7909  width + $wgThumbnailMinimumBucketDistance, and it will scale that thumbnail,
7910  rather than the original, down to the target size at greater speed in return
7911  for minor loss of fidelity.
7912
7913=== Bug fixes in 1.24 ===
7914* (bug 50572) MediaWiki:Blockip should support gender
7915* (bug 49116) Footer copyright notice is now always displayed in user language
7916  rather than content language (same as copyright notice for editing interface).
7917* (bug 62258) A bug was fixed in File::getUnscaledThumb when a height
7918  restriction was present in the parameters. Images with both the "frame"
7919  option and a size specification set will now always ignore the provided
7920  size and display an unscaled image, as the documentation has always
7921  claimed it would.
7922* (bug 39035) Improved Vector skin performance by removing collapsibleNav,
7923  which used to collapse some sidebar elements by default.
7924  This removes -list id suffixes like p-lang-list: instead of using things like
7925  #p-lang-list, you can do #p-lang .body ul.
7926* (bug 890) Links in Special:RecentChanges and Special:Watchlist no longer
7927  follow redirects to their target pages.
7928* Parser now dies early if called recursively, instead of producing subtle bugs.
7929* (bug 14323) Redirect pages, when viewed with redirect=no, no longer hide the
7930  remaining page content.
7931* (bug 52587) Maintenance script deleteBatch.php no longer follows redirects
7932  in the file namespace and delete the file on the target page. It will still
7933  however delete the redirect page.
7934* (bug 22683) {{msgnw:}} and other uses of PPFrame::RECOVER_ORIG will correctly
7935  recover the original code of extension tags.
7936* (bug 65757) MSSQL: Update script drops unnamed constraints to be prepared
7937  for future updates. Because it's doing so heuristically, it may fail or drop
7938  wrong constraints.
7939* (bug 67870) wfShellExec() cuts off stdout at multiples of 8192 bytes.
7940* $wgRunJobsAsync now works with private wikis (e.g. read requires login).
7941* (bugs 57238, 65206) Blank pages can now be directly created.
7942* (bug 69789) Title::getContentModel() now loads from the database when
7943  necessary instead of incorrectly returning the default content model.
7944* (bug 69249) wfBaseConvert() now works around PHP Bug #50175 when using GMP.
7945* (bug 57909) URLs in the externallinks table will no longer have certain
7946  characters decoded in the query string.
7947* (bug 67368) LESS mixins like .background-image() correctly flip image
7948  references for RTL stylesheets now.
7949
7950=== Action API changes in 1.24 ===
7951* action=parse API now supports prop=modules, which provides the list of
7952  ResourceLoader modules that should be used to enhance the parsed content.
7953* action=query&meta=siteinfo&siprop=interwikimap returns a new "protorel"
7954  field which is true if protocol-relative urls can be used to access
7955  a particular interwiki map entry.
7956* list=logevents now provides logpage, which is the page ID from the
7957  logging table, if ids are requested and the user has the permissions.
7958* action=edit now requires that appendtext, prependtext, or section=new be used
7959  when using the 'redirect' parameter, to prevent clients accidentally
7960  overwriting the target page with the content of the redirect.
7961* list=logevents will now return an error if both letitle and leprefix are
7962  specified.
7963* list=logevents has a new parameter, lenamespace, to allow filtering by
7964  namespace.
7965* action=expandtemplates has a new parameter, prop, and a new output format.
7966  The old format is still used if prop isn't provided, but this is deprecated.
7967* meta=userinfo can now return the count of unread pages on the watchlist.
7968* list=watchlist can now filter by unread status.
7969* The deprecated action=parse&prop=languageshtml has been removed.
7970* (bug 48071) action=setnotificationtimestamp no longer throws PHP or database
7971  errors when no pages are given.
7972* (bug 60734) Actions that use ApiPageSet (e.g. purge, watch,
7973  setnotificationtimestamp) will now include continuation information when
7974  using a generator.
7975* Removed 'props' and 'errors' from action=paraminfo, as they have extremely
7976  limited use and are generally inaccurate, unmaintained, and impossible to
7977  properly maintain.
7978* Formats dbg, dump, txt, wddx, and yaml are now deprecated.
7979* action=paraminfo now indicates when a parameter is specifying a submodule.
7980* The iwurl parameter to prop=iwlinks is deprecated in favor of iwprop=url, for
7981  parallelism with prop=langlinks.
7982* All tokens should be fetched from action=query&meta=tokens; all other methods
7983  of fetching tokens are deprecated. The value needed for meta=tokens's 'type'
7984  parameter for each module is documented in the action=help output and is
7985  returned from action=paraminfo.
7986* New action ClearHasMsg that can be used to clear HasMsg flag.
7987* The cmstartsortkey and cmendsortkey parameters to list=categorymembers are
7988  deprecated in favor of cmstarthexsortkey and cmendhexsortkey.
7989* (bug 63326) Add blockedtimestamp field to output of blockinfo property for
7990  the list=allusers and list=users modules.
7991* prop=imageinfo no longer requires iiurlwidth to be set when using iiurlparam.
7992* Added prop=linkshere, prop=fileusage, and prop=transcludedin, which are
7993  roughly equivalent to list=backlinks, list=imageusage, and list=embeddedin
7994  but can work on a list of titles (including titles from a generator).
7995* prop=redirects can now filter returned redirects by namespace.
7996
7997=== Action API internal changes in 1.24 ===
7998* Methods for handling continuation are added to ApiResult, so actions other
7999  than query that use generators can easily support continuation.
8000* $wgAPIModules (and the related $wgAPIFormatModules, $wgAPIMetaModules,
8001  $wgAPIPropModules, and $wgAPIListModules settings) now allow API modules
8002  to be specified using a "module spec" array instead of a plain class name.
8003  A "module spec" is an associative array containing at least the 'class' key
8004  for the module's class, and optionally a 'factory' key for the factory
8005  function to use for the module. This is intended for extensions that want
8006  control over the instantiation of their API modules, to allow for proper
8007  dependency injection.
8008* A new param type 'submodule' is available. Parameters of this type will take
8009  the list of valid values from the module's ApiModuleManager for the group
8010  corresponding to the parameter name.
8011* The 'APIGetPossibleErrors' and 'APIGetResultProperties' hooks are no longer
8012  used.
8013* API token handling has been rewritten. Any API module using tokens will need
8014  to be updated:
8015  * ApiBase::needsToken now returns a token type instead of boolean true when a
8016    token is needed. Returning true will throw an exception. See documentation
8017    of that method for details.
8018  * Information for the 'token' parameter is automatically set by ApiBase
8019    getFinalParams and getFinalParamDescription.
8020  * ApiBase::getTokenSalt has been removed.
8021  * The hooks APIQueryInfoTokens, APIQueryRevisionsTokens,
8022    APIQueryRecentChangesTokens, APIQueryUsersTokens, and
8023    ApiTokensGetTokenTypes are deprecated, but are still called to support
8024    backwards-compatible token access.
8025* ApiBase::validateLimit and ApiBase::validateTimestamp are now protected.
8026* ApiQueryRedirects was removed; prop=redirects is now implemented by
8027  ApiQueryBacklinksProp along with the newly-added prop modules.
8028* The following methods have been deprecated and may be removed in a future
8029  release:
8030  * ApiBase::getResultProperties
8031  * ApiBase::getFinalResultProperties
8032  * ApiBase::addTokenProperties
8033  * ApiBase::getRequireOnlyOneParameterErrorMessages
8034  * ApiBase::getRequireMaxOneParameterErrorMessages
8035  * ApiBase::getRequireAtLeastOneParameterErrorMessages
8036  * ApiBase::getTitleOrPageIdErrorMessage
8037  * ApiBase::getPossibleErrors
8038  * ApiBase::getFinalPossibleErrors
8039  * ApiBase::parseErrors
8040  * ApiQuery::setGeneratorContinue
8041  * ApiQueryBase::checkRowCount
8042  * ApiQueryBase::titleToKey
8043  * ApiQueryBase::keyToTitle
8044  * ApiQueryBase::keyPartToTitle
8045  * ApiQueryInfo::getTokenFunctions
8046  * ApiQueryInfo::resetTokenCache
8047  * ApiQueryInfo::getEditToken
8048  * ApiQueryInfo::getDeleteToken
8049  * ApiQueryInfo::getProtectToken
8050  * ApiQueryInfo::getMoveToken
8051  * ApiQueryInfo::getBlockToken
8052  * ApiQueryInfo::getUnblockToken
8053  * ApiQueryInfo::getEmailToken
8054  * ApiQueryInfo::getImportToken
8055  * ApiQueryInfo::getWatchToken
8056  * ApiQueryInfo::getOptionsToken
8057  * ApiQueryRecentChanges::getTokenFunctions
8058  * ApiQueryRecentChanges::getPatrolToken
8059  * ApiQueryRevisions::getTokenFunctions
8060  * ApiQueryRevisions::getRollbackToken
8061  * ApiQueryUsers::getTokenFunctions
8062  * ApiQueryUsers::getUserrightsToken
8063* The following classes have been deprecated and may be removed in a future
8064  release:
8065  * ApiFormatDbg
8066  * ApiFormatDump
8067  * ApiFormatTxt
8068  * ApiFormatWddx
8069  * ApiFormatYaml
8070  * ApiTokens
8071* The following class constants have been deprecated and may be removed in a
8072  future release:
8073  * ApiBase::PROP_ROOT
8074  * ApiBase::PROP_LIST
8075  * ApiBase::PROP_TYPE
8076  * ApiBase::PROP_NULLABLE
8077
8078=== Languages updated in 1.24 ===
8079
8080MediaWiki supports over 350 languages. Many localisations are updated
8081regularly. Below only new and removed languages are listed, as well as
8082changes to languages because of Bugzilla reports.
8083
8084=== Other changes in 1.24 ===
8085* The deprecated jquery.delayedBind ResourceLoader module was removed.
8086* The deprecated function mw.util.toggleToc was removed.
8087* The Special:Search hooks SpecialSearchGo and SpecialSearchResultsAppend
8088  were removed as they were unused.
8089* (bug 65477) User::pingLimiter() now has an additional profile point varying
8090  by action being used.
8091* mediawiki.util.$content no longer supports old versions of the Vector,
8092  Monobook, Modern and CologneBlue skins that don't yet implement the "mw-body"
8093  and/or "mw-body-primary" class name in their html.
8094* Added pp_sortkey column to page_props table, so pages can be efficiently
8095  queried and sorted by property value (bug 58032).
8096  See $wgPagePropsHaveSortkey if you want to postpone the schema change.
8097* BREAKING CHANGE: All four built-in MediaWiki skins (Vector, MonoBook, Modern
8098  and Cologne Blue) were moved out of MediaWiki core to their own respective
8099  repositories. They will be installed with the release tarball, but you must
8100  install them separately if installing MediaWiki from source code. A warning
8101  message displayed until you do it should guide you through the process. See
8102  also <https://www.mediawiki.org/wiki/Manual:Skin_configuration>.
8103* BREAKING CHANGE: Skins built for MediaWiki 1.15 and earlier that do not use
8104  the "headelement" template key are no longer supported. Setting
8105  $useHeadElement = false; is no longer supported and will not cause old keys
8106  like "headlinks", "skinnameclass", etc. to be defined.
8107* BREAKING CHANGE: The files commonElements.css, commonContent.css and
8108  commonInterface.css (in skins/common/) have been removed. Skins may no longer
8109  rely on their presence and include them in their style modules. ResourceLoader
8110  modules introduced in MediaWiki 1.23 should be loaded instead:
8111  - skins/common/commonElements.css  → 'mediawiki.skinning.elements' module
8112  - skins/common/commonContent.css   → 'mediawiki.skinning.content' module
8113  - skins/common/commonInterface.css → 'mediawiki.skinning.interface' module
8114* The deprecated 'SpecialVersionExtensionTypes' hook was removed.
8115* (bug 63891) Add 'X-Robots-Tag: noindex' header in action=render pages.
8116* SpecialPage no longer supports the syntax for invoking wfSpecial*() functions.
8117  Special pages should subclass SpecialPage and implement the execute() method.
8118* (bug 63755) The deprecated constants RC_MOVE and RC_MOVE_OVER_REDIRECT were
8119  removed.
8120* Special:MostLinkedTemplates has been renamed to Special:MostTranscludedPages.
8121* The skin autodiscovery mechanism has been deprecated and will be removed in
8122  MediaWiki 1.25. See https://www.mediawiki.org/wiki/Manual:Skin_autodiscovery
8123  for migration guide for creators and users of custom skins that relied on it.
8124* ResourceLoaderFileModule#getAllStyleFiles now returns all style files and all
8125  skin style files used by the module.
8126* Removed getLang() from IContextSource and subclasses. (deprecated since 1.19)
8127* Removed setLang() from subclasses of IContextSource. (deprecated since 1.19)
8128* Removed WebRequest::escapeAppendQuery(). (deprecated since 1.20)
8129* Removed info(), purge(), revert() and rollback() from the Article class; they
8130  have since become subclasses of the Action class. (deprecated since 1.19)
8131* SearchEngineReplacePrefixesComplete hook was removed.
8132* The "jquery.json" module has been deprecated. Use the "json" module instead.
8133* Removed HTMLForm::addJS(). (deprecated since 1.18)
8134* Removed LogEventsList::showHeader(). (deprecated since 1.19)
8135* Removed ImageGalleryBase::useSkin(). (deprecated since 1.18)
8136* Removed DatabaseMysqlBase::getLagFromProcesslist(). (deprecated since 1.19)
8137* Removed LoadBalancer::closeConnecton(). (deprecated since 1.18)
8138* Removed ApiBase::createContext(). (deprecated since 1.19)
8139* BREAKING CHANGE: The undocumented Special{$this->getName()}BeforeFormDisplay
8140  set of hooks has been removed and replaced by a single new hook
8141  SpecialPageBeforeFormDisplay.
8142* (bug 65781) Removed block warning on included {{Special:Contributions}}
8143* Removed Skin::makeGlobalVariablesScript(). (deprecated since 1.19)
8144* Removed MWNamespace::isMain(). (deprecated since 1.19)
8145* Removed Preferences::loadOldSearchNs(). (deprecated since 1.19)
8146* Removed OutputPage::getStatusMessage(). (deprecated since 1.18)
8147* Removed OutputPage::isUserJsAllowed(). (deprecated since 1.18)
8148* Removed Title::updateTitleProtection(). (deprecated since 1.19)
8149* Removed ParserOptions::setSkin(). (deprecated since 1.19)
8150* Removed Title::escapeCanonicalURL(). (deprecated since 1.19)
8151* Removed Title::escapeLocalURL(). (deprecated since 1.19)
8152* Removed Title::escapeFullURL(). (deprecated since 1.19)
8153* Removed User::isValidEmailAddr(). (deprecated since 1.18)
8154* Removed Title::getEscapedText(). (deprecated since 1.19)
8155* Removed Language::getFallbackLanguageCode(). (deprecated since 1.19)
8156* Removed WikiPage::isBigDeletion(). (deprecated since 1.19)
8157* Removed MWInit class which contained functions related to a now discontinued
8158  PHP compiler called hphpc. (deprecated since 1.22)
8159* ApiResult::enableSizeCheck() and disableSizeCheck() are now obsolete.
8160* Removed ResourceLoaderGetStartupModules hook. (deprecated since 1.23)
8161* Removed getFormFields(), onSubmit() and onSuccess() from FormlessAction, as
8162  these were meant specifically for FormAction instead.
8163* Removed Action::execute().
8164* Removed AjaxAddScript which has been obsolete since ResourceLoader and
8165  is unused by any modern extension.
8166* Removed maintenance/nextJobDB.php; no longer in use.
8167* Removed global function wfViewPrevNext(). (deprecated since 1.19)
8168* Removed global function xmlsafe() from Export.php. (moved to OAIRepo
8169  extension)
8170* Removed Title::userCanRead(). (deprecated since 1.19)
8171* Removed maintenance script importTextFile.php. Use edit.php script instead.
8172* A _from_namespace field has been added to the templatelinks, pagelinks,
8173  and filelinks tables. Run update.php to apply this change to the schema.
8174* Removed File::sha1Base36(). (deprecated since 1.19)
8175* Removed File::getPropsFromPath(). (deprecated since 1.19)
8176* Removed functions blockedPage(), noCreatePermission(), readOnlyPage() and
8177  userNotLoggedInPage() from EditPage.php. (deprecated since 1.19)
8178* Removed functions getContent(), getPreloadedText(), mergeChangesInto() and
8179  setPreloadedText() from EditPage.php. (deprecated since 1.21)
8180* Removed global functions wfArrayLookup(), wfArrayMerge(),
8181  wfDebugDieBacktrace() and wfTime(). (deprecated since 1.22)
8182* Browser support for Internet Explorer 6 and 7 lowered from Grade A to Grade C,
8183  meaning that JavaScript is no longer executed in these browser versions.
8184* Browser support for Opera 11 lowered from Grade A to Grade C.
8185* Removed IEFixes module which existed purely to provide support for MSIE
8186  versions below 7 (conditionally loaded only for those browsers).
8187* Deprecated SpecialPageFactory::getList() in favor of
8188  SpecialPageFactory::getNames()
8189* Action::checkCanExecute() no longer has a return value.
8190* Removed cleanupForIRC(), loadFromCurRow(), newFromCurRow(), notifyRC2UDP()
8191  and sendToUDP() from RecentChange.php. (deprecated since 1.22)
8192* Removed EnhancedChangesList::arrow(), sideArrow(), downArrow(), spacerArrow().
8193* Removed Xml::namespaceSelector(). (deprecated since 1.19)
8194* Removed WikiPage::estimateRevisionCount(). (deprecated since 1.19)
8195* MYSQL: Enum item added to "major MIME type" columns.
8196  Running update.php on MySQL < v5.1 may result in heavy processing.
8197* RSS and Atom feeds generated by MediaWiki no longer include a fallback
8198  stylesheet. It was ignored by most browsers these days anyway.
8199* SpecialSearchNoResults hook has been removed. SpecialSearchResults is now
8200  called unconditionally.
8201* TablePager::getBody() is now 'final' and can't be overridden in subclasses.
8202* TablePager::getBody() is deprecated, use getBodyOutput() or getFullOutput().
8203* Added $outputPage parameter to the SkinTemplateGetLanguageLink hook.
8204* log_page for move log entries store the original page ID, rather than that
8205  of the new redirect page. This is not retroactive.
8206* LCStoreAccel was removed. $wgLocalisationCacheConf can no longer be set to
8207  use this store class.
8208* Html::infoBox() no longer accepts paths relative to skins/common/images/.
8209* Deprecated defunct Skin::getCommonStylePath().
8210* Some extensions had their ResourceLoader modules depend on the "mediawiki"
8211  and "jquery" modules. In the past, this behavior was undefined, now it will
8212  throw an error.
8213* Removed BagOStuff::replace(). (deprecated since 1.23)
8214* In Linker.php, link(), linkText() and makeBrokenImageLinkObj() now display
8215  warnings if their first parameter is not a Title object. Also makeImageLink()
8216  now requires a Parser as its first parameter.
8217* (bug 67368) LESS functions embed() and embeddable(), added in MediaWiki 1.23
8218  and broken by design, have been removed. Use appropriate LESS mixins instead.
8219* Removed cssjanus.py from maintenance directory as it was unused.
8220* Removed maintenance/purgeOldText.inc and the PurgeRedundantText() function
8221  it contained (superseded by Maintenance::purgeRedundantText() in 1.16).
8222  The purgeOldText.php maintenance script has been retained.
8223* PHPUnit tests can be found by directory discovery, by adding the directory
8224  path from your UnitTestsList callback. Older versions of MediaWiki core will
8225  barf at this usage.
8226
8227==== Renamed classes ====
8228* CLDRPluralRuleConverter_Expression to CLDRPluralRuleConverterExpression
8229* CLDRPluralRuleConverter_Fragment to CLDRPluralRuleConverterFragment
8230* CLDRPluralRuleConverter_Operator to CLDRPluralRuleConverterOperator
8231* CLDRPluralRuleEvaluator_Range to CLDRPluralRuleEvaluatorRange
8232* CSSJanus_Tokenizer to CSSJanusTokenizer
8233* MediaWiki_I18N to MediaWikiI18N
8234* Parser_DiffTest to ParserDiffTest
8235* RevDel_ArchiveItem to RevDelArchiveItem
8236* RevDel_ArchiveList to RevDelArchiveList
8237* RevDel_ArchivedFileItem to RevDelArchivedFileItem
8238* RevDel_ArchivedFileList to RevDelArchivedFileList
8239* RevDel_ArchivedRevisionItem to RevDelArchivedRevisionItem
8240* RevDel_FileItem to RevDelFileItem
8241* RevDel_FileList to RevDelFileList
8242* RevDel_Item to RevDelItem
8243* RevDel_List to RevDelList
8244* RevDel_LogItem to RevDelLogItem
8245* RevDel_LogList to RevDelLogList
8246* RevDel_RevisionItem to RevDelRevisionItem
8247* RevDel_RevisionList to RevDelRevisionList
8248* WebInstaller_Complete to WebInstallerComplete
8249* WebInstaller_Copying to WebInstallerCopying
8250* WebInstaller_DBConnect to WebInstallerDBConnect
8251* WebInstaller_DBSettings to WebInstallerDBSettings
8252* WebInstaller_Document to WebInstallerDocument
8253* WebInstaller_ExistingWiki to WebInstallerExistingWiki
8254* WebInstaller_Install to WebInstallerInstall
8255* WebInstaller_Language to WebInstallerLanguage
8256* WebInstaller_Name to WebInstallerName
8257* WebInstaller_Options to WebInstallerOptions
8258* WebInstaller_Readme to WebInstallerReadme
8259* WebInstaller_ReleaseNotes to WebInstallerReleaseNotes
8260* WebInstaller_Restart to WebInstallerRestart
8261* WebInstaller_Upgrade to WebInstallerUpgrade
8262* WebInstaller_UpgradeDoc to WebInstallerUpgradeDoc
8263* WebInstaller_Welcome to WebInstallerWelcome
8264
8265==== Removed classes ====
8266* IPBlockForm - Use SpecialBlock directly
8267* WatchlistEditor - Use SpecialEditWatchlist directly
8268* FormatExif - Use FormatMetadata directly
8269* RevertFileAction - Use RevertAction directly
8270* HistoryPage - Use HistoryAction directly
8271* RawPage - Use RawAction directly
8272* StubContLang - Use Language::factory() instead
8273* XMLReader2 - Use XMLReader directly
8274* ResourceLoaderLESSFunctions - No longer in use, not intended for public usage
8275
8276==== Removed files ====
8277The skins/common/ directory, previously containing some assets intended to be
8278used by skins and a number of legacy styles and scripts, has been removed. Its
8279contents have been deleted or relocated into the resources/ directory. Full list
8280of files that are no longer available follows.
8281
8282* skins/common/ajax.js
8283* skins/common/commonContent.css
8284* skins/common/commonElements.css
8285* skins/common/commonInterface.css
8286* skins/common/commonPrint.css
8287* skins/common/config-cc.css
8288* skins/common/config.css
8289* skins/common/config.js
8290* skins/common/feed.css
8291* skins/common/IEFixes.js
8292* skins/common/oldshared.css
8293* skins/common/protect.js
8294* skins/common/shared.css
8295* skins/common/upload.js
8296* skins/common/wikibits.js
8297* skins/common/images/add.png
8298* skins/common/images/ajax-loader.gif
8299* skins/common/images/arrow_disabled_first_25.png
8300* skins/common/images/arrow_disabled_last_25.png
8301* skins/common/images/arrow_disabled_left_25.png
8302* skins/common/images/arrow_disabled_right_25.png
8303* skins/common/images/arrow_first_25.png
8304* skins/common/images/arrow_last_25.png
8305* skins/common/images/arrow_left_25.png
8306* skins/common/images/arrow_right_25.png
8307* skins/common/images/Arr_.png
8308* skins/common/images/Arr_d.png
8309* skins/common/images/Arr_l.png
8310* skins/common/images/Arr_r.png
8311* skins/common/images/Arr_u.png
8312* skins/common/images/bullet.gif
8313* skins/common/images/button_bold.png
8314* skins/common/images/button_extlink.png
8315* skins/common/images/button_headline.png
8316* skins/common/images/button_hr.png
8317* skins/common/images/button_image.png
8318* skins/common/images/button_italic.png
8319* skins/common/images/button_link.png
8320* skins/common/images/button_media.png
8321* skins/common/images/button_nowiki.png
8322* skins/common/images/button_sig.png
8323* skins/common/images/button_template.png
8324* skins/common/images/cc-0.png
8325* skins/common/images/cc-by-nc-sa.png
8326* skins/common/images/cc-by-sa.png
8327* skins/common/images/cc-by.png
8328* skins/common/images/Checker-16x16.png
8329* skins/common/images/closewindow.png
8330* skins/common/images/closewindow19x19.png
8331* skins/common/images/critical-32.png
8332* skins/common/images/diffunderline.gif
8333* skins/common/images/download-32.png
8334* skins/common/images/feed-icon.png
8335* skins/common/images/feed-icon.svg
8336* skins/common/images/gnu-fdl.png
8337* skins/common/images/help-question-hover.gif
8338* skins/common/images/help-question.gif
8339* skins/common/images/info-32.png
8340* skins/common/images/link_icon.gif
8341* skins/common/images/magnify-clip-rtl.png
8342* skins/common/images/magnify-clip.png
8343* skins/common/images/mediawiki.png
8344* skins/common/images/nextredirectltr.png
8345* skins/common/images/nextredirectrtl.png
8346* skins/common/images/poweredby_mediawiki_88x31.png
8347* skins/common/images/public-domain.png
8348* skins/common/images/question-small.png
8349* skins/common/images/question.svg
8350* skins/common/images/redirectltr.png
8351* skins/common/images/redirectrtl.png
8352* skins/common/images/remove.png
8353* skins/common/images/spinner.gif
8354* skins/common/images/tick-32.png
8355* skins/common/images/tipsy-arrow.gif
8356* skins/common/images/tooltip_icon.png
8357* skins/common/images/warning-32.png
8358* skins/common/images/wiki.png
8359* skins/common/images/Zoom_sans.gif
8360* skins/common/images/ar/button_bold.png
8361* skins/common/images/ar/button_headline.png
8362* skins/common/images/ar/button_italic.png
8363* skins/common/images/ar/button_link.png
8364* skins/common/images/ar/button_nowiki.png
8365* skins/common/images/be-tarask/button_bold.png
8366* skins/common/images/be-tarask/button_italic.png
8367* skins/common/images/be-tarask/button_link.png
8368* skins/common/images/cyrl/button_bold.png
8369* skins/common/images/cyrl/button_italic.png
8370* skins/common/images/cyrl/button_link.png
8371* skins/common/images/de/button_bold.png
8372* skins/common/images/de/button_italic.png
8373* skins/common/images/fa/button_bold.png
8374* skins/common/images/fa/button_headline.png
8375* skins/common/images/fa/button_italic.png
8376* skins/common/images/fa/button_link.png
8377* skins/common/images/fa/button_nowiki.png
8378* skins/common/images/icons/fileicon-c.png
8379* skins/common/images/icons/fileicon-cpp.png
8380* skins/common/images/icons/fileicon-deb.png
8381* skins/common/images/icons/fileicon-djvu.png
8382* skins/common/images/icons/fileicon-djvu.xcf
8383* skins/common/images/icons/fileicon-dvi.png
8384* skins/common/images/icons/fileicon-exe.png
8385* skins/common/images/icons/fileicon-h.png
8386* skins/common/images/icons/fileicon-html.png
8387* skins/common/images/icons/fileicon-iso.png
8388* skins/common/images/icons/fileicon-java.png
8389* skins/common/images/icons/fileicon-mid.png
8390* skins/common/images/icons/fileicon-mov.png
8391* skins/common/images/icons/fileicon-o.png
8392* skins/common/images/icons/fileicon-ogg.png
8393* skins/common/images/icons/fileicon-ogg.xcf
8394* skins/common/images/icons/fileicon-pdf.png
8395* skins/common/images/icons/fileicon-ps.png
8396* skins/common/images/icons/fileicon-psd.png
8397* skins/common/images/icons/fileicon-rm.png
8398* skins/common/images/icons/fileicon-rpm.png
8399* skins/common/images/icons/fileicon-svg.png
8400* skins/common/images/icons/fileicon-tar.png
8401* skins/common/images/icons/fileicon-tex.png
8402* skins/common/images/icons/fileicon-ttf.png
8403* skins/common/images/icons/fileicon-txt.png
8404* skins/common/images/icons/fileicon.png
8405* skins/common/images/ksh/button_S_italic.png
8406
8407= MediaWiki 1.23 =
8408
8409== MediaWiki 1.23.17 ==
8410
8411=== Changes since 1.23.16 === <!--T:69-->
8412* Fix syntax errors introduced in 1.23.16 when running PHP 5.3.
8413
8414== MediaWiki 1.23.16 ==
8415This is a security and maintenance release of the MediaWiki 1.23 branch.
8416
8417=== Changes since 1.23.15 ===
8418* (T68404) CSS3 attr() function with url type is no longer allowed
8419  in inline styles.
8420* (T156184) $wgRawHtml will no longer apply to internationalization messages.
8421* Submitting the lgtoken and lgpassword parameters in the query string to
8422  action=login is now deprecated and outputs a warning. They should be submitted
8423  in the POST body instead.
8424* (T109140) (T122209) SECURITY: Special:UserLogin and Special:Search allow
8425  redirect to interwiki links.
8426* (T144845) SECURITY: XSS in SearchHighlighter::highlightText() when
8427  $wgAdvancedSearchHighlighting is true.
8428* (T125177) SECURITY: API parameters may now be marked as "sensitive" to keep
8429  their values out of the logs.
8430* (T150044) SECURITY: "Mark all pages visited" on the watchlist now requires a
8431  CSRF token.
8432* (T156184) SECURITY: Escape content model/format url parameter in message.
8433* (T151735) SECURITY: SVG filter evasion using default attribute values in DTD
8434  declaration.
8435* (T48143) SECURITY: Spam blacklist ineffective on encoded URLs inside file
8436  inclusion syntax's link parameter.
8437* (T108138) SECURITY: Sysops can undelete pages, although the page is protected
8438  against it.
8439
8440== MediaWiki 1.23.15 ==
8441
8442This is a maintenance release of the MediaWiki 1.23 branch.
8443
8444=== Changes since 1.23.14 ===
8445* BREAKING CHANGE: $wgHTTPProxy is now *required* for all external requests
8446  made by MediaWiki via a proxy. Relying on the http_proxy environment
8447  variable is no longer supported.
8448* (T139565) SECURITY: API: Generate head items in the context of the given title
8449* (T137264) SECURITY: XSS in unclosed internal links
8450* (T133147) SECURITY: Escape '<' and ']]>' in inline <style> blocks
8451* (T133147) SECURITY: Require login to preview user CSS pages
8452* (T132926) SECURITY: Do not allow undeleting a revision deleted file if it is
8453  the top file
8454* (T129738) SECURITY: Make $wgBlockDisablesLogin also restrict logged in
8455  permissions
8456* (T129738) SECURITY: Make blocks log users out if $wgBlockDisablesLogin is true
8457* (T115333) SECURITY: Check read permission when loading page content in
8458  ApiParse
8459* Remove support for $wgWellFormedXml = false, all output is now well formed
8460
8461== MediaWiki 1.23.13 ==
8462
8463This is a maintenance release of the MediaWiki 1.23 branch.
8464
8465=== Changes since 1.23.12 ===
8466* (T121892) Fix fatal errors on some Special pages, introduced in 1.23.12.
8467
8468== MediaWiki 1.23.12 ==
8469
8470This is a security and maintenance release of the MediaWiki 1.23 branch.
8471
8472=== Changes since 1.23.11 ===
8473* (T117899) SECURITY: $wgArticlePath can no longer be set to relative paths
8474  that do not begin with a slash. This enabled trivial XSS attacks.
8475  Configuration values such as "http://my.wiki.com/wiki/$1" are fine, as are
8476  "/wiki/$1". A value such as "$1" or "wiki/$1" is not and will now throw an
8477  error.
8478* (T119309) SECURITY: Use hash_compare() for edit token comparison
8479* (T118032) SECURITY: Don't allow cURL to interpret POST parameters starting
8480  with '@' as file uploads
8481* (T115522) SECURITY: Passwords generated by User::randomPassword() can no
8482  longer be shorter than $wgMinimalPasswordLength
8483* (T97897) SECURITY: Improve IP parsing and trimming. Previous behavior could
8484  result in improper blocks being issued
8485* (T109724) SECURITY: Special:MyPage, Special:MyTalk, Special:MyContributions
8486  and related pages no longer use HTTP redirects and are now redirected by
8487  MediaWiki
8488
8489== MediaWiki 1.23.11 ==
8490
8491This is a security and maintenance release of the MediaWiki 1.23 branch.
8492
8493=== Changes since 1.23.10 ===
8494
8495* (T91850) SECURITY: Add throttle check in ApiUpload and SpecialUpload
8496* (T91203, T91205) SECURITY: API: Improve validation in chunked uploading
8497* (T108616) SECURITY: Avoid exposure of local path in PNG thumbnails
8498
8499== MediaWiki 1.23.10 ==
8500
8501This is a security and maintenance release of the MediaWiki 1.23 branch.
8502
8503=== Changes since 1.23.9 ===
8504
8505* (T94116) SECURITY: Compare API watchlist token in constant time
8506* (T97391) SECURITY: Escape error message strings in thumb.php
8507* (T106893) SECURITY: Don't leak autoblocked IP addresses on
8508  Special:DeletedContributions
8509* (bug 67644) Make AutoLoaderTest handle namespaces
8510* (T91653) Minimal PSR-3 debug logger to support backports from 1.25+.
8511* (T102562) Fix InstantCommons parameters to handle the new HTTPS-only
8512  policy of Wikimedia Commons.
8513
8514== MediaWiki 1.23.9 ==
8515
8516This is a security and maintenance release of the MediaWiki 1.23 branch.
8517
8518=== Changes since 1.23.8 ===
8519
8520* (T85848, T71210) SECURITY: Don't parse XMP blocks that contain XML entities,
8521  to prevent various DoS attacks.
8522* (T85848) SECURITY: Don't allow directly calling Xml::isWellFormed, to reduce
8523  likelihood of DoS.
8524* (T88310) SECURITY: Always expand xml entities when checking SVG's.
8525* (T73394) SECURITY: Escape > in Html::expandAttributes to prevent XSS.
8526* (T85855) SECURITY: Don't execute another user's CSS or JS on preview.
8527* (T85349, T85850, T86711) SECURITY: Multiple issues fixed in SVG filtering to
8528  prevent XSS and protect viewer's privacy.
8529* (bug T68650) Fix indexing of moved pages with PostgreSQL. Requires running
8530  update.php to fix.
8531* (bug T70087) Fix Special:ActiveUsers page for installations using
8532  PostgreSQL.
8533
8534== MediaWiki 1.23.8 ==
8535
8536This is a security and maintenance release of the MediaWiki 1.23 branch.
8537
8538=== Changes since 1.23.7 ===
8539
8540* (bug T76686) [SECURITY] thumb.php outputs wikitext message as raw HTML, which
8541  could lead to xss. Permission to edit MediaWiki namespace is required to
8542  exploit this.
8543* (bug T77028) [SECURITY] Malicious site can bypass CORS restrictions in
8544  $wgCrossSiteAJAXdomains in API calls if it only included an allowed domain as
8545  part of its name.
8546* (bug T74222) The original patch for T74222 was reverted as unnecessary.
8547
8548== MediaWiki 1.23.7 ==
8549
8550This is a security and maintenance release of the MediaWiki 1.23 branch.
8551
8552=== Changes since 1.23.6 ===
8553
8554* (bugs 66776, 71478) SECURITY:  User PleaseStand reported a way to inject code
8555  into API clients that used format=php to process pages that underwent flash
8556  policy mangling. This was fixed along with improving how the mangling was done
8557  for format=json, and allowing sites to disable the mangling using
8558  $wgMangleFlashPolicy.
8559* (bug 70901) SECURITY: User Jackmcbarn reported that the ability to update
8560  the content model for a page could allow an unprivileged attacker to edit
8561  another user's common.js under certain circumstances. The user right
8562  "editcontentmodel" was added, and is needed to change a revision's content
8563  model.
8564* (bug 71111) SECURITY: User PleaseStand reported that on wikis that allow raw
8565  HTML, it is not safe to preview wikitext coming from an untrusted source such
8566  as a cross-site request. Thus add an edit token to the form, and when raw HTML
8567  is allowed, ensure the token is provided before showing the preview. This
8568  check is not performed on wikis that both allow raw HTML and anonymous
8569  editing, since there are easier ways to exploit that scenario.
8570* (bug 72222) SECURITY: Do not show log action when the entry is revdeleted with
8571  DELETED_ACTION. NOTICE: this may be reverted in a future release pending a
8572  public RFC about the desired functionality. This issue was reported by user
8573  Bawolff.
8574* (bug 71621) Make allowing site-wide styles on restricted special pages a
8575  config option.
8576* (bug 42723) Added updated version history from 1.19.2 to 1.22.13
8577* $wgMangleFlashPolicy was added to make MediaWiki's mangling of anything that
8578  might be a flash policy directive configurable.
8579
8580== MediaWiki 1.23.6 ==
8581
8582This is a maintenance release of the MediaWiki 1.23 branch.
8583
8584=== Changes since 1.23.5 ===
8585* (Bug 72274) Job queue not running (HTTP 411) due to missing
8586  Content-Length: header
8587* (Bug 67440) Allow classes to be registered properly from installer
8588
8589== MediaWiki 1.23.5 ==
8590
8591This is a security release of the MediaWiki 1.23 branch.
8592
8593=== Changes since 1.23.4 ===
8594* (bug 70672) SECURITY: OutputPage: Remove separation of css and js module
8595  allowance.
8596
8597== MediaWiki 1.23.4 ==
8598
8599This is a security and maintenance release of the MediaWiki 1.23 branch.
8600
8601=== Changes since 1.23.3 ===
8602
8603* (bug 69008) SECURITY: Enhance CSS filtering in SVG files. Filter <style>
8604  elements; normalize style elements and attributes before filtering; add
8605  checks for attributes that contain css; add unit tests for html5sec and
8606  reported bugs.
8607* (bug 65998) Make MySQLi work with non-standard socket.
8608* (bug 66986) GlobalVarConfig shouldn't throw exceptions for null-valued config
8609  settings.
8610
8611== MediaWiki 1.23.3 ==
8612
8613This is a maintenance release of the MediaWiki 1.23 branch.
8614
8615=== Changes since 1.23.2 ===
8616
8617* (bug 68501) Correctly handle incorrect namespace in cleanupTitles.php.
8618* (bug 64970) Fix support for blobs on DatabaseOracle::update.
8619* (bug 66574) Display MediaWiki:Loginprompt on the login page.
8620* (bug 67870) wfShellExec() cuts off stdout at multiples of 8192 bytes.
8621* (bug 60629) Handle invalid language code gracefully in
8622  Language::fetchLanguageNames.
8623* (bug 62017) Restore the number of rows shown on Special:Watchlist.
8624* Check for boolean false result from database query in SqlBagOStuff.
8625
8626== MediaWiki 1.23.2 ==
8627
8628This is a security and maintenance release of the MediaWiki 1.23 branch.
8629
8630=== Changes since 1.23.1 ===
8631
8632* (bug 68187) SECURITY: Prepend jsonp callback with comment.
8633* (bug 66608) SECURITY: Fix for XSS issue in bug 66608: Generate the URL used
8634  for loading a new page in Javascript,instead of relying on the URL in the link
8635  that has been clicked.
8636* (bug 65778) SECURITY: Copy prevent-clickjacking between OutputPage and
8637  ParserOutput.
8638* (bug 68313) Preferences: Turn stubthreshold back into a combo box.
8639* (bug 65214) Fix initSiteStats.php maintenance script.
8640* (bug 67594) Special:ActiveUsers: Fix to work with PostgreSQL.
8641
8642== MediaWiki 1.23.1 ==
8643
8644This is a security and maintenance release of the MediaWiki 1.23 branch.
8645
8646=== Changes since 1.23.0 ===
8647
8648* (bug 65839) SECURITY: Prevent external resources in SVG files.
8649* (bug 67025) Special:Watchlist: Don't try to render empty row.
8650* (bug 66922) Don't allow some E_NOTICE messages to end up in the
8651  LocalSettings.php.
8652* (bug 66467) FileBackend: Avoid using popen() when "parallelize" is disabled.
8653* (bug 66428) MimeMagic: Don't seek before BOF. This has weird side effects
8654  like only extracting the tail of the file partially or not at all.
8655* (bug 66182) Removed -x flag on some php files.
8656
8657== MediaWiki 1.23.0 ==
8658
8659=== Configuration changes in 1.23 ===
8660* (bug 13250) Restored method for clearing a watchlist in web UI
8661  so that users with large watchlists don't have to perform
8662  contortions to clear them.
8663* When $wgJobRunRate is higher than zero, jobs are now executed via an
8664  asynchronous HTTP request to a MediaWiki entry point. This may require
8665  increasing the number of server worker threads. $wgRunJobsAsync has been
8666  added to disable this feature if needed, falling back to executing the job
8667  on the same process but making the execution synchronously.
8668* $wgDebugLogGroups values may be set to an associative array with a
8669  'destination' key specifying the log destination. The array may also contain
8670  a 'sample' key with a positive integer value N indicating that the log group
8671  should be sampled by dispatching one in every N messages on average. The
8672  sampling is random.
8673* In addition to the current exception log format, MediaWiki now serializes
8674  exception metadata to JSON and logs it to the 'exception-json' log group.
8675  This makes MediaWiki easier to integrate with log aggregation and analysis
8676  tools.
8677* $wgSquidServersNoPurge now supports the use of Classless Inter-Domain
8678  Routing (CIDR) notation to specify contiguous blocks of IPv4 and/or IPv6
8679  addresses that should be trusted to provide X-Forwarded-For headers.
8680* Preferences 'watchcreations', 'watchdefault', 'enotifwatchlistpages' ("Add
8681  pages I create and files I upload to my watchlist", "Add pages and files I
8682  edit to my watchlist", "Email me when a page or file on my watchlist is
8683  changed") are now enabled by default. In addition new user accounts' personal
8684  and talk pages are now watched by them by default.
8685* $wgLBFactoryConf: Class names have had underscores removed. The configuration
8686  should be updated if LBFactory_Simple or LBFactory_Multi is configured.
8687* $wgPasswordSenderName has been removed and is no longer functional. To set a
8688  custom mailer name, the system message 'emailsender' should be modified
8689  (default: "{{SITENAME}}").
8690* (bug 63269) Email notifications were not correctly handling the
8691  [[MediaWiki:Helppage]] message being set to a full URL (the default).
8692  If you customized [[MediaWiki:Enotif body]] (the text of email notifications),
8693  you'll need to edit it locally to include the URL via the new variable
8694  $HELPPAGE instead of the parser functions fullurl and canonicalurl; otherwise
8695  you don't have to do anything.
8696* $wgDBAhandler was removed as the only class using it was also removed
8697* The 'max threads' setting was removed from $wgDBservers.
8698* Support for AdminSettings.php has been completely removed. All configuration
8699  belongs in LocalSettings.php.
8700* $wgSkipSkin, which has been replaceable by $wgSkipSkins since 2005 (r9249), is
8701  now formally deprecated.
8702* Removed deprecated $wgDisabledActions as it is hardly used anywhere.
8703* $wgRateLimitLog has been deprecated and replaced by
8704  $wgDebugLogGroup['ratelimit'].
8705* $wgLocalInterwikis is an array containing multiple local interwiki prefixes
8706  (interwiki prefixes that point back to the current wiki). This effectively
8707  allows more than one value of $wgLocalInterwiki to be specified and
8708  understood by the parser. The value of $wgLocalInterwiki is automatically
8709  prepended to the start of this array.
8710* $wgQueryPages has been removed. Query Pages should be added to by using the
8711  wgQueryPages hook.
8712* $wgHttpOnlyBlacklist has been removed.
8713* $wgLicenseTerms has been removed as it was unused.
8714* $wgProfileOnly is now deprecated; set the log file in
8715  $wgDebugLogGroups['profileoutput'] to replace it.
8716* $wgMaxBacklinksInvalidate was removed; use $wgJobBackoffThrottling instead
8717* Deprecated ResourceLoaderGetStartupModules hook.
8718
8719=== New features in 1.23 ===
8720* ResourceLoader can utilize the Web Storage API to cache modules client-side.
8721  Compared to the browser cache, caching in Web Storage allows ResourceLoader
8722  to be more granular about evicting stale modules from the cache while
8723  retaining the ability to retrieve multiple modules in a single HTTP request.
8724  This capability can be enabled by setting $wgResourceLoaderStorageEnabled to
8725  true. This feature is currently considered experimental and should only be
8726  enabled with care.
8727* (bug 6092) Add expensive parser functions {{REVISIONID:}}, {{REVISIONUSER:}}
8728  and {{REVISIONTIMESTAMP:}} (with friends).
8729* Add "wgRelevantUserName" to mw.config containing the current
8730  Skin::getRelevantUser value.
8731* (bug 56033) Add content model to the page information.
8732* Added Article::MissingArticleConditions hook to give extensions a chance to
8733  hide their (unrelated) log entries.
8734* Added LonelyPagesQuery hook to let extensions modify the query used to
8735  generate Special:LonelyPages.
8736* Added $wgOpenSearchDefaultLimit defining the default number of entries to show
8737  on action=opensearch API call.
8738* For namespaces with $wgNamespaceProtection (including the MediaWiki
8739  namespace), the "protect" tab will be shown only if there are restriction
8740  levels available that would restrict editing beyond what
8741  $wgNamespaceProtection already applies. The protection form will offer only
8742  those protection levels.
8743* Added $wgAPIFormatModules, allowing extensions to add additional output
8744  formatting modules for the API.
8745* (bug 47812) The MediaWiki:Group-user.{css,js} pages can now be used to add
8746  custom CSS or JavaScript enabled only for registered users.
8747* (bug 52005) Special pages RecentChanges, RecentChangesLinked and Watchlist
8748  now include a legend describing the symbols used in lists of changes.
8749* Improved the accessibility of the tabs in Special:Preferences.
8750* Added ApiBeforeMain hook, roughly equivalent to the BeforeInitialize hook:
8751  it's called after everything is set up but before any major processing
8752  happens.
8753* The jquery.client module now performs a component-wise version comparison in
8754  its #test method when strings are used in the browser map: version '1.10' is
8755  now correctly considered larger than '1.2'. Using numbers in the version map
8756  is not affected.
8757* All API modules now support an assert parameter, which can either be
8758  'user' or 'bot'. The API will throw an error if the user is not logged
8759  in (user) or does not have the 'bot' userright (bot). Based off of the
8760  AssertEdit extension by Steve Sanbeg.
8761* [[Special:Diff]] was added, allowing users to create internal links to
8762  revision comparison pages using syntax such as [[Special:Diff/12345]],
8763  [[Special:Diff/12345/prev]] or [[Special:Diff/12345/98765]].
8764* New user accounts' personal and talk pages are now watched by them by default.
8765* Added SkinTemplateGetLanguageLink hook to allow changing the html of language
8766  links.
8767* Added MessageCache::get hook as a new way to customize messages across
8768  multiple sites.
8769* Added jquery.throttle-debounce ResourceLoader module to limit the number of
8770  callbacks for frequently occurring events.
8771* Special:ProtectedPages shows now a table. The timestamp, the reason and
8772  the protecting user are also shown.
8773* Added experimental support for using Microsoft SQL Server as the database
8774  backend.
8775** Added new Microsoft SQL Server-specific configuration variable
8776   $wgDBWindowsAuthentication, which makes the web server authenticate against
8777   the database server using Integrated Windows Authentication instead of
8778   $wgDBuser/$wgDBpassword.
8779* HTMLForm 'select', 'selectandother', 'selectorother', 'multiselect', and
8780  'radio' fields can now use message keys as labels via the 'options-messages'
8781  parameter, which overrides the 'options' parameter.
8782* Admins can expire users passwords manually, or on a schedule using the
8783  $wgPasswordExpirationDays configuration setting.
8784* Add new hook SendWatchlistEmailNotification, this will be used to determine
8785  whether to send a watchlist email notification.
8786* (bug 42026) Special:Contributions now includes an option to filter page
8787  creations, similar to the topOnly option.
8788* Add mediawiki.ui.button styling to all pages so wiki content can use styled
8789  buttons.
8790* Special:UserLogin/signup now does AJAX checks for invalid and taken usernames,
8791  displaying the error live.
8792* Added BaseTemplateAfterPortlet hook to allow injecting html after portlets in
8793  skins.
8794* Support has been added for a JSON based localisation file format. The
8795  installer has been updated to use it.
8796* Changes to content typography (colors, line-height etc.). See
8797  https://www.mediawiki.org/wiki/Typography_refresh for further information.
8798* The Vector skin's visual treatment of external links has been simplified to a
8799  single icon (from nine). This should not affect local rules unless they were
8800  re-using these icons, which have now been deleted.
8801* ResourceLoader: mw.loader.using() now implements a Promise interface.
8802* Add new hook ChangesListInitRows accessed via
8803  ChangesList::initChangesListRows.
8804  If called by the ChangesList consumer this gives extensions a chance to batch
8805  process the result set prior to rendering.
8806* A PoolCounterRedis class was added which can be make use of in
8807  $wgPoolCounterConf. This requires at least one Redis 2.6+ server.
8808* $wgProfileToDatabase was removed. Set $wgProfiler to ProfilerSimpleDB
8809  in StartProfiler.php instead of using this.
8810* (bug 63444) Made it possible to change the indent string (default: 4 spaces)
8811  used by FormatJson::encode().
8812
8813=== Bug fixes in 1.23 ===
8814* (bug 41759) The "updated since last visit" markers (on history pages, recent
8815  changes and watchlist) and the talk page message indicator are now correctly
8816  updated when the user is viewing old revisions of pages, instead of always
8817  acting as if the latest revision was being viewed.
8818* (bug 56443) Special:ConfirmEmail no longer shows a "Mail a confirmation code"
8819  when the email address is already confirmed. Also, consistently use
8820  "confirmed", rather than "authenticated", when messaging whether or not the
8821  user has confirmed an email address.
8822* (bug 19415) action=render no longer shows section edit links. This affects
8823  behavior of several other features where (bogus) section edit links will
8824  disappear, such as file description pages loaded via $wgUseInstantCommons or
8825  pages transcluded cross-wiki via $wgEnableScaryTranscluding.
8826* (bug 56912) Show correct link color on cached result of Special:DeadendPages.
8827* Classes TitleListDependency and TitleDependency have been removed, as they
8828  have been found unused in core and extensions for a long time.
8829* (bug 57098) SpecialPasswordReset now obeys returnto parameter
8830* (bug 37812) ResourceLoader will notice when a module's definition changes and
8831  recompile it accordingly.
8832* (bug 57201) SpecialRecentChangesFilters hook is now executed for feeds.
8833* (bug 58640) Fixed a compatibility issue with PCRE 8.34 that caused pages
8834  to appear blank or with missing text.
8835* (bug 56931) Updated the plural rules to CLDR 24. They are in new format
8836  which is detailed in UTS 35 Rev 33. The PHP parser and evaluator as well as
8837  the JavaScript evaluator were updated to support the new format. Plural rules
8838  for some languages have changed, most notably Russian. Affected software
8839  messages have been updated and marked for review at translatewiki.net.
8840* (bug 23542) imagelinks now stores both the redirect and target (as
8841  templatelinks does).
8842* (bug 58167) The web installer no longer throws an exception when PHP is
8843  compiled without support for MySQL yet with support for another DBMS.
8844* (bug 56199) Raw option of parser functions must now match complete word,
8845  to take effect.
8846* (bug 60543) Special:PrefixIndex forgot stripprefix=1 for "Next page" link
8847* (bug 29762) Undoing an already-undone edit will now display an appropriate
8848  message instead of leading the user to make a null edit.
8849* (bug 52659) mediawiki.notification: Notification area remained visible when
8850  empty and thus was stealing pointer events from links on the page.
8851* (bug 26811) When a DBUnexpectedError occurs, DB server hostnames are now
8852  hidden unless $wgShowExceptionDetails is true, and $wgShowDBErrorBacktrace
8853  no longer applies in such cases.
8854* (bug 60960) Avoid doing file_exist() checks on data: URIs, as they cause
8855  warnings to be printed on Windows due to large path length.
8856* (bug 48084) Fixed a bug in the installer that could cause $wgLogo to hold
8857  the wrong path to the placeholder logo (skins/common/images/wiki.png).
8858* (bug 64289) jquery.textSelection: Don't throw errors on empty collections.
8859
8860=== Web API changes in 1.23 ===
8861* (bug 54884) action=parse&prop=categories now indicates hidden and missing
8862  categories.
8863* action=query&meta=filerepoinfo now returns additional information for each
8864  repo.
8865* action=parse&prop=languageshtml was deprecated in 1.18 and will be removed in
8866  MediaWiki 1.24.
8867* action=parse now has disabletoc flag to disable table of contents in output.
8868* (bug 25702) list=allcategories, list=allimages, list=alllinks, list=allpages,
8869  list=deletedrevs and list=filearchive did not handle case-sensitivity
8870  properly for all parameters.
8871* ApiQueryBase::titlePartToKey allows an extra parameter that indicates the
8872  namespace in order to properly capitalize the title part.
8873* (bug 57874) action=feedcontributions no longer has one item more than limit.
8874* All API modules now support an assert parameter. See the new features section
8875  for more details.
8876* Added prop=contributors to fetch the list of contributors to the page.
8877* The following API modules will now return entries where fields have been
8878  revision-deleted: list=deletedrevs, list=filearchive, list=recentchanges,
8879  list=watchlist. "hidden" indicators will be included, in the same style as is
8880  already done for prop=revisions.
8881* The following API modules will now return the content of revision-deleted
8882  fields, in addition to the "hidden" indicators, if the querying user has the
8883  necessary rights: list=logevents, list=usercontribs, prop=imageinfo,
8884  prop=revisions.
8885* The above modules, where applicable, will now return entries filtered by
8886  revision-deleted fields if the querying user has the necessary rights. For
8887  example, prop=revisions with rvuser or rvexcludeuser will no longer skip
8888  revisions where the user was revision-deleted if the current user has the
8889  deletedhistory right.
8890* The 'hideuser' right, used when blocking, is no longer necessary or
8891  sufficient for seeing contributions with revision-deleted in
8892  list=usercontribs.
8893* list=watchlist now uses the querying user's rights rather than the wlowner's
8894  rights when checking whether wlprop=patrol is allowed.
8895* (bug 32151) ApiWatch now has pageset capabilities (titles/pageids/generators).
8896  Title parameter is now deprecated.
8897* (bug 23005) Added action=revisiondelete.
8898* Added siprop=restrictions to API action=query&meta=siteinfo for querying
8899  possible page restriction (protection) levels and types.
8900* Added prop 'limitreportdata' and 'limitreporthtml' to action=parse.
8901* (bug 58627) Provide language names on action=parse&prop=langlinks.
8902* Deprecated llurl= in favour of llprop=url for action=query&prop=langlinks.
8903* Added llprop=langname and llprop=autonym for action=query&prop=langlinks.
8904* prop=redirects is added, to return redirects to the pages in the query.
8905* list=allredirects is added, to list all redirects pointing to a namespace.
8906* (bug 42026) Added ucshow={new,!new,top,!top} to list=usercontribs.
8907  Also added newonly to action=feedcontributions.
8908* (bug 42026) Deprecated uctoponly in favor of ucshow=top.
8909* list=search no longer has a "srredirects" parameter. Redirects are now
8910  included in all searches.
8911* Added list=prefixsearch that works like action=opensearch but can be used as
8912  a generator.
8913* (bug 24782) Various modules will now use unique continuation parameters.
8914* (bug 63249) Cache RecentChanges Atom feed in varnish for 15 seconds.
8915
8916=== Languages updated in 1.23 ===
8917
8918MediaWiki supports over 350 languages. Many localisations are updated
8919regularly. Below only new and removed languages are listed, as well as
8920changes to languages because of Bugzilla reports.
8921
8922* Support was added for Algerian Spoken Arabic (arq).
8923* Support was added for Riograndenser Hunsrückisch (hrx).
8924* Support was added for Northern Luri (lrc).
8925
8926=== Other changes in 1.23 ===
8927* The rc_type field in the recentchanges table has been superseded by a new
8928  rc_source field.  The rc_source field is a string representation of the
8929  change type where rc_type was a numeric constant.  This field is not yet
8930  queried but will be in a future release.
8931** Utilize update.php to create and populate this new field.  On larger wikis
8932   which do not wish to update recentchanges table in one large update please
8933   review the SQL and comments in maintenance/archives/patch-rc_source.sql.
8934** The rc_type field of recentchanges will be deprecated in a future release.
8935* The global variable $wgArticle has been removed after a lengthy deprecation.
8936* The global functions addButton and insertTags (for mw.toolbar.addButton and
8937  mw.toolbar.insertTags) now emits mw.log.warn when accessed.
8938* The ExpandTemplates extension has been moved into MediaWiki core.
8939* (bug 52812) Removed "Disable search suggestions" from Preference.
8940* (bug 52809) Removed "Disable browser page caching" from Preference.
8941* Three new modules intended for use by custom skins were added:
8942  'mediawiki.skinning.elements', 'mediawiki.skinning.content', and
8943  'mediawiki.skinning.interface', representing three levels of standard
8944  MediaWiki styling. Previously skin creators wishing to use them had to refer
8945  to the file names of appropriate files directly, which is now discouraged.
8946* The modules 'skins.vector' and 'skins.monobook' have been renamed to
8947  'skins.vector.styles' and 'skins.monobook.styles', respectively,
8948  and their definition was changed not to include the common*.css files;
8949  the two skins now load the 'mediawiki.skinning.interface' module instead.
8950* A page_links_updated field has been added to the page table.
8951* SpecialPage::getTitle has been deprecated in favor of
8952  SpecialPage::getPageTitle.
8953* BREAKING CHANGE: Two potentially backwards-incompatible changes have been made
8954  to the 'SpecialWatchlistQuery' hook's last parameter (array $values) to make
8955  the hook more consistent with the 'SpecialRecentChangesQuery' one:
8956** Several array keys have been renamed: hideMinor → hideminor,
8957   hideBots → hidebots, hideAnons → hideanons, hideLiu → hideliu,
8958   hidePatrolled → hidepatrolled, hideOwn → hidemyself.
8959** The parameter value is now a FormOptions object, not a plain array (array
8960   access operators should continue to work, as it implements the ArrayAccess
8961   interface).
8962* Option to mark hooks as deprecated has been added.
8963* (bug 52811) Preference "Enable section editing via [edit] links" was removed.
8964* (bug 52813) Preference "Show table of contents (for pages with more than
8965  3 headings)" was removed.
8966* (bug 52810) Preference "Justify paragraphs" was removed.
8967* OutputPage::showErrorPage raises a notice if arguments are incoherent.
8968* Thumbnails that keep failing to render in thumb.php will be rate-limited
8969  against further render attempts for 1 hour. $wgAttemptFailureEpoch can be
8970  altered to reset all rate-limited thumbnails at once.
8971* (bug 56572) Builds of the OOjs and OOjs UI libraries are now available.
8972* mw.loader.go and mw.loader.version have been removed.
8973* (bug 52815) Preference "Enable simplified search bar (Vector skin only)"
8974  was removed.
8975* A user_password_expires column has been added to the user table. The User
8976  object expects this column to exist. Use update.php to create this new field.
8977* The jquery.delayedBind ResourceLoader module was deprecated in favor of the
8978  jquery.throttle-debounce module. It will be removed in MediaWiki 1.24.
8979* mw.user.bucket has been deprecated.
8980* On Special:PrefixIndex, a table#mw-prefixindex-list-table was changed to
8981  table.mw-prefixindex-list-table to avoid duplicate ids when the special page
8982  is transcluded.
8983* (bug 62198) window.$j has been deprecated.
8984* Preference "Disable link title conversion" was removed.
8985* SpecialRecentChanges no longer includes any functionality for generating feeds
8986  - it has been factored out to ApiFeedRecentChanges. Old URLs redirect to new
8987  ones.
8988* RecentChange::mExtra['lang'] is no longer set and should no longer be used.
8989  Extensions should read from other configuration variables, including
8990  $wgLocalInterwikis, to identify the current wiki.
8991* Sections in the parser test framework have been renamed and the old
8992  section names are deprecated.  Please use "!!wikitext" and "!!html"
8993  (or "!!html/php") instead of "!!input" and "!!result".  This allows
8994  us to extend parser tests to accommodate additional input/output
8995  pairs, such as "!!html/parsoid" (for the output of the Parsoid
8996  parser, where it differs from the PHP parser).
8997* Special:Search no longer has an "include redirects" option on the advanced
8998  tab. Redirects are now included in all searches.
8999* mediawiki.api.category's getCategories() 'async' parameter was deprecated.
9000* The locations of resources have been split between upstream libraries, now in
9001  resources/lib/, local libaries in resources/src/, and local forks of upstream
9002  libraries, also in resources/src/.
9003* BREAKING CHANGE: The automatically-generated function closure with which
9004  ResourceLoader wraps all modules' JavaScript code now binds the identifier
9005  names 'jQuery' and '$' to the jQuery object of the version of jQuery that is
9006  bundled with MediaWiki. If you bind these names to other objects in global
9007  scope (like Zepto.js or document.querySelectorAll, for example) you will need
9008  to use different names to or re-bind them at the top of each
9009  ResourceLoader-loaded module.
9010* (bug 52342) Preference "Remember my login" was removed.
9011* The skin autodiscovery mechanism has been deprecated and will be removed in
9012  MediaWiki 1.25. See https://www.mediawiki.org/wiki/Manual:Skin_autodiscovery
9013  for migration guide for creators and users of custom skins that relied on it.
9014
9015==== Removed classes ====
9016* FakeMemCachedClient (deprecated in 1.18)
9017* RdfMetaData (unused)
9018* TitleDependency (unused)
9019* TitleListDependency (unused)
9020* WikiError (deprecated in 1.17)
9021* WikiXmlError (deprecated in 1.17)
9022* WikiErrorMsg (deprecated in 1.17)
9023
9024==== Renamed classes ====
9025* CdbReader_DBA to CdbReaderDBA
9026* CdbReader_PHP to CdbReaderPHP
9027* CdbWriter_DBA to CdbWriterDBA
9028* CdbWriter_PHP to CdbWriterPHP
9029* DiffOp_Add to DiffOpAdd
9030* DiffOp_Change to DiffOpChange
9031* DiffOp_Copy to DiffOpCopy
9032* DiffOp_Delete to DiffOpDelete
9033* HWLDF_WordAccumulator to HWLDFWordAccumulator
9034* LBFactory_Fake to LBFactoryFake
9035* LBFactory_Multi to LBFactoryMulti
9036* LBFactory_Simple to LBFactorySimple
9037* LBFactory_Single to LBFactorySingle
9038* LCStore_Accel to LCStoreAccel
9039* LCStore_CDB to LCStoreCDB
9040* LCStore_DB to LCStoreDB
9041* LCStore_Null to LCStoreNull
9042* LoadBalancer_Single to LoadBalancerSingle
9043* LoadMonitor_MySQL to LoadMonitorMySQL
9044* LoadMonitor_Null to LoadMonitorNull
9045* LocalisationCache_BulkLoad to LocalisationCacheBulkLoad
9046* csvStatsOutput to CsvStatsOutput
9047* extensionLanguages to ExtensionLanguages
9048* languages to Languages
9049* statsOutput to StatsOutput
9050* textStatsOutput to TextStatsOutput
9051* wikiStatsOutput to WikiStatsOutput
9052
9053==== Removed methods ====
9054* ApiBase::getValidNamespaces() (deprecated in 1.17)
9055* ApiMain::setCachePrivate() (deprecated in 1.17)
9056* ApiMain::setVaryCookie (deprecated in 1.17)
9057* Article::doRedirect() (deprecated in 1.18)
9058* Article::doUnwatch() (deprecated in 1.18)
9059* Article::doWatch() (deprecated in 1.18)
9060* Article::forUpdate() (deprecated in 1.18)
9061* Article::markpatrolled() (deprecated in 1.18)
9062* Article::unwatch() (deprecated in 1.18)
9063* Article::watch() (deprecated in 1.18)
9064* Block::clear() (deprecated in 1.18)
9065* Block::decodeExpiry() (deprecated in 1.18)
9066* Block::encodeExpiry() (deprecated in 1.18)
9067* Block::forUpdate() (deprecated in 1.18)
9068* Block::infinity() (deprecated in 1.18)
9069* Block::load() (deprecated in 1.18)
9070* Block::newFromDB() (deprecated in 1.18)
9071* Block::normaliseRange() (deprecated in 1.18)
9072* Block::parseExpiryInput() (deprecated in 1.18)
9073* CategoryViewer::addSubcategory() (deprecated in 1.17)
9074* EditPage::spamPage() (deprecated since 1.17)
9075* Exif::getFormattedData() (deprecated in 1.18)
9076* Exif::makeFormattedData() (deprecated in 1.18)
9077* in_string (deprecated in 1.21)
9078* Language::convertLinkToAllVariants() (deprecated in 1.17)
9079* LanguageConverter::convertLinkToAllVariants() (deprecated in 1.17)
9080* Linker::makeBrokenLink() (deprecated in 1.16)
9081* Linker::makeBrokenLinkObj() (deprecated in 1.16)
9082* Linker::makeColouredLinkObj() (deprecated in 1.16)
9083* Linker::makeSizeLinkObj() (deprecated in 1.17)
9084* MediaWiki::articleFromTitle() (deprecated in 1.18)
9085* ParserOptions::getkin() (deprecated 1.18)
9086* ProfilerSimple::getCpuTime (deprecated in 1.20)
9087* Revision::revText() (deprecated in 1.17)
9088* SkinTemplate::jstext() (deprecated in 1.21)
9089* SpecialPage::__call() (deprecated in 1.17)
9090* SpecialPage::executePath() (deprecated in 1.18)
9091* SpecialPage::exists() (deprecated in 1.18)
9092* SpecialPage::file() (deprecated in 1.18)
9093* SpecialPage::func() (deprecated in 1.18)
9094* SpecialPage::getGroup() (deprecated in 1.18)
9095* SpecialPage::getPage() (deprecated in 1.18)
9096* SpecialPage::getPageByAlias() (deprecated in 1.18)
9097* SpecialPage::getLocalNameFor() (deprecated in 1.18)
9098* SpecialPage::getRegularPages() (deprecated in 1.18)
9099* SpecialPage::getRestrictedPages() (deprecated in 1.18)
9100* SpecialPage::getTitleForAlias() (deprecated in 1.18)
9101* SpecialPage::getUsablePages() (deprecated in 1.18)
9102* SpecialPage::includable() (deprecated in 1.18)
9103* SpecialPage::init()
9104* SpecialPage::initAliasList() (deprecated in 1.18)
9105* SpecialPage::initList() (deprecated in 1.18)
9106* SpecialPage::name() (deprecated in 1.18)
9107* SpecialPage::removePage() (deprecated in 1.18)
9108* SpecialPage::resolveAlias() (deprecated in 1.18)
9109* SpecialPage::resolveAliasWithSubpage() (deprecated in 1.18)
9110* SpecialPage::restriction() (deprecated in 1.18)
9111* SpecialPage::setGroup() (deprecated in 1.18)
9112* SpecialRecentChanges::feedSetup()
9113* SpecialRevisionDelete::extractBitField() (deprecated in 1.22)
9114* User::getPageRenderingHash() (deprecated in 1.17)
9115* WebRequest::getFileSize() (deprecated in 1.17)
9116* WebRequest::isPathInfoBad() (deprecated in 1.17)
9117* wfGenerateToken (deprecated in 1.20)
9118* wfStreamFile (deprecated in 1.19)
9119* wfUILang (deprecated in 1.18)
9120* WikiPage::createUpdates() (deprecated in 1.18)
9121* WikiPage::quickEdit() (deprecated in 1.18)
9122* WikiPage::useParserCache() (deprecated in 1.18)
9123* WikiPage::viewUpdates() (deprecated in 1.18)
9124
9125==== Removed globals ====
9126* $wgBetterDirectionality (deprecated in 1.18)
9127
9128= MediaWiki 1.22 =
9129
9130== MediaWiki 1.22.15 ==
9131
9132This is a security and maintenance release of the MediaWiki 1.22 branch.
9133
9134=== Changes since 1.22.14 ===
9135
9136* (bug T76686) [SECURITY] thumb.php outputs wikitext message as raw HTML, which
9137  could lead to xss. Permission to edit MediaWiki namespace is required to
9138  exploit this.
9139* (bug T77028) [SECURITY] Malicious site can bypass CORS restrictions in
9140  $wgCrossSiteAJAXdomains in API calls if it only included an allowed domain as
9141  part of its name.
9142* (bug T74222) The original patch for T74222 was reverted as unnecessary.
9143
9144== MediaWiki 1.22.14 ==
9145
9146This is a security and maintenance release of the MediaWiki 1.22 branch.
9147
9148=== Changes since 1.22.13 ===
9149
9150* (bugs 66776, 71478) SECURITY:  User PleaseStand reported a way to inject code
9151  into API clients that used format=php to process pages that underwent flash
9152  policy mangling. This was fixed along with improving how the mangling was done
9153  for format=json, and allowing sites to disable the mangling using
9154  $wgMangleFlashPolicy.
9155* (bug 70901) SECURITY: User Jackmcbarn reported that the ability to update
9156  the content model for a page could allow an unprivileged attacker to edit
9157  another user's common.js under certain circumstances. The user right
9158  "editcontentmodel" was added, and is needed to change a revision's content
9159  model.
9160* (bug 72222) SECURITY: Do not show log action when the entry is revdeleted with
9161  DELETED_ACTION. NOTICE: this may be reverted in a future release pending a
9162  public RFC about the desired functionality. This issue was reported by user
9163  Bawolff.
9164* (bug 71621) Make allowing site-wide styles on restricted special pages a
9165  config option.
9166* $wgMangleFlashPolicy was added to make MediaWiki's mangling of anything that
9167  might be a flash policy directive configurable.
9168
9169== MediaWiki 1.22.13 ==
9170This is a maintenance release of the MediaWiki 1.22 branch.
9171
9172=== Changes since 1.22.12 ===
9173* (bug 67440) Allow classes to be registered properly from installer
9174
9175== MediaWiki 1.22.12 ==
9176This is a security release of the MediaWiki 1.22 branch.
9177
9178=== Changes since 1.22.11 ===
9179* (bug 70672) SECURITY: OutputPage: Remove separation of css and js module
9180  allowance.
9181
9182== MediaWiki 1.22.11 ==
9183This is a security release of the MediaWiki 1.22 branch.
9184
9185=== Changes since 1.22.10 ===
9186* (bug 69008) SECURITY: Enhance CSS filtering in SVG files. Filter <style>
9187  elements; normalize style elements and attributes before filtering; add checks
9188  for attributes that contain css; add unit tests for html5sec and reported
9189  bugs.
9190
9191== MediaWiki 1.22.10 ==
9192This is a maintenance release of the MediaWiki 1.22 branch.
9193
9194=== Changes since 1.22.9 ===
9195* (bug 64970) Fix support for blobs on DatabaseOracle::update
9196* (bug 60719) In MediaWiki 1.22, the job queue execution on each page request
9197  was changed (Gerrit change 59797) so, instead of executing the job inside the
9198  same PHP process that's rendering the page, a new PHP cli command is spawned
9199  to execute runJobs.php in the background. It will only work if $wgPhpCli is
9200  set to an actual path or safe mode is off, otherwise, the old method will be
9201  used. See
9202  https://www.mediawiki.org/wiki/Manual:Job_queue#Changes_in_MediaWiki_1.22
9203  for more information. This change was in earlier releases of 1.22 but was not
9204  noted here until now.
9205
9206== MediaWiki 1.22.9 ==
9207This is a security and maintenance release of the MediaWiki 1.22 branch.
9208
9209=== Changes since 1.22.8 ===
9210* (bug 68187) SECURITY: Prepend jsonp callback with comment.
9211* (bug 66608) SECURITY: Fix for XSS issue in bug 66608: Generate the URL used
9212  for loading a new page in Javascript,instead of relying on the URL in the
9213  link that has been clicked.
9214* (bug 65778) SECURITY: Copy prevent-clickjacking between OutputPage and
9215  ParserOutput.
9216* (bug 59147) The img_metadata field was not being decoded from bytea into text.
9217
9218== MediaWiki 1.22.8 ==
9219This is a security and maintenance release of the MediaWiki 1.22 branch.
9220
9221=== Changes since 1.22.7 ===
9222* (bug 65839) SECURITY: Prevent external resources in SVG files.
9223* (bug 66428) MimeMagic: Don't seek before BOF. This has weird side effects like
9224  only extracting the tail of the file partially or not at all.
9225
9226== MediaWiki 1.22.7 ==
9227This is a security and maintenance release of the MediaWiki 1.22 branch.
9228
9229=== Changes since 1.22.6 ===
9230* (bug 65501) SECURITY: Don't parse usernames as wikitext on
9231  Special:PasswordReset.
9232* (bug 36356) Add space between two feed links.
9233* (bug 63269) Email notifications were not correctly handling the
9234  MediaWiki:Helppage message being set to a full URL. This is a regression from
9235  the 1.22.5 point release, which made the default value for it a URL. If you
9236  customized MediaWiki:Enotif body (the text of email notifications), you'll
9237  need to edit it locally to include the URL via the new variable $HELPPAGE
9238  instead of the parser functions fullurl and canonicalurl; otherwise you don't
9239  have to do anything.
9240* Add missing uploadstash.us_props for PostgreSQL.
9241* (bug 56047) Fixed stream wrapper in PhpHttpRequest.
9242
9243== MediaWiki 1.22.6 ==
9244This is a security release of the MediaWiki 1.22 branch.
9245
9246=== Changes since 1.22.5 ===
9247* (bug 63251) SECURITY: Escape sortKey in pageInfo.
9248
9249== MediaWiki 1.22.5 ==
9250This is a security and maintenance release of the MediaWiki 1.22 branch.
9251
9252=== Changes since 1.22.4 ===
9253* (bug 62497) SECURITY: Add CSRF token on Special:ChangePassword.
9254* (bug 62467) Set a title for the context during import on the cli.
9255* Fix custom local MediaWiki:Helppage values.
9256* mediawiki.js: Fix documentation breakage.
9257* (bug 58153) Make MySQLi work with non standard port.
9258* (bug 53887) Reintroduced a link to help pages in the default sidebar, that any
9259  sysop can customize by editing MediaWiki:Sidebar locally. The link now points
9260  to a mediawiki.org page which is guaranteed to exist. Nothing needs to be done
9261  on your end, but remember to adjust MediaWiki:Sidebar for the needs of your
9262  wikis. Everyone can help with the shared documentation by translating:
9263  https://www.mediawiki.org/wiki/Special:Translate/agg-Help_pages .
9264* (bug 53888) Corrected a regression in 1.22 which introduced red links on the
9265  login page. If you previously installed 1.22.x and have created a local page
9266  to make the red link blue, write its title as in MediaWiki:helplogin-url if
9267  you didn't already. Otherwise, you don't need to do anything, but you can
9268  translate the help page at <https://www.mediawiki.org/wiki/Help:Logging_in>.
9269
9270== MediaWiki 1.22.4 ==
9271This is a maintenance release of the MediaWiki 1.22 branch.
9272
9273=== Changes since 1.22.3 ===
9274* Use the correct branch of the extensions' git repositories.
9275
9276== MediaWiki 1.22.3 ==
9277This is a security and bugfix release of the MediaWiki 1.22 branch.
9278
9279=== Changes since 1.22.2 ===
9280* (bug 60771) SECURITY: Disallow uploading SVG files using non-whitelisted
9281  namespaces. Also disallow iframe elements. * User will get an error including
9282  the namespace name if they use a non- whitelisted namespace.
9283* (bug 61346) SECURITY: Make token comparison use constant time. It seems like
9284  our token comparison would be vulnerable to timing attacks. This will take
9285  constant time.
9286* (bug 61362) SECURITY: API: Don't find links in the middle of api.php links.
9287* (bug 53710) Add sequence support for upsert in DatabaseOracle in the same way
9288  as in selectInsert
9289* (bug 60231, bug 58719) Various fixes to job running code in Wiki.php: Make it
9290  async on Windows. Fixed possible "invalid filename" errors on Windows.
9291  Redirect output to dev/null to avoid hanging PHP.
9292* (bug 60083) Correct sequence name for fresh Postgres installation. Spotted by
9293  gebhkla
9294* (bug 60531) Avoid variable naming conflicts in
9295  DatabasePostgres::selectSQLText. Spotted by gebhkla
9296* (bug 60094) Fix rebuildall.php fatal error with PostgreSQL.
9297* (bug 43817) Add error handling if descriptionmsg isn't defined for extension.
9298* (bug 60543) Special:PrefixIndex omits stripprefix=1 for "Next page" link.
9299
9300== MediaWiki 1.22.2 ==
9301This is a security and bugfix release of the MediaWiki 1.22 branch.
9302
9303=== Changes since 1.22.1 ===
9304* (bug 60339) SECURITY: Sanitize shell arguments to DjVu files, and other media
9305  formats
9306* (bug 58253) Check for very old PCRE versions in installer and updater
9307* (bug 60054) Make WikiPage::$mPreparedEdit public
9308
9309== MediaWiki 1.22.1 ==
9310This is a security and maintenance release of the MediaWiki 1.22 branch.
9311
9312=== Changes since 1.22.0 ===
9313* (bug 57550) SECURITY: Disallow stylesheets in SVG Uploads
9314* (bug 58088) SECURITY: Don't normalize U+FF3C to \ in CSS Checks
9315* (bug 58472) SECURITY: Disallow -o-link in styles
9316* (bug 58553) SECURITY: Return error on invalid XML for SVG Uploads
9317* (bug 58699) SECURITY: Fix RevDel log entry information leaks
9318* (bug 58178) Restore compatibility with curl < 7.16.2.
9319* (bug 56931) Updated the plural rules to CLDR 24. They are in new format which
9320  is detailed in UTS 35 Rev 33. The PHP parser and evaluator as well as the
9321  JavaScript evaluator were updated to support the new format. Plural rules for
9322  some languages have changed, most notably Russian. Affected software messages
9323  have been updated and marked for review at translatewiki.net. This change is
9324  backported from the development branch of MediaWiki 1.23.
9325* (bug 58434) The broken installer for database backend Oracle was fixed.
9326* (bug 58167) The web installer no longer throws an exception when PHP is
9327  compiled without support for MySQL yet with support for another DBMS.
9328* (bug 58640) Fixed a compatibility issue with PCRE 8.34 that caused pages to
9329  appear blank or with missing text.
9330* (bug 47055) Changed FOR UPDATE handling in Postgresql
9331* (bug 57026) Avoid extra parsing in prepareContentForEdit()
9332
9333== MediaWiki 1.22.0 ==
9334
9335=== Configuration changes in 1.22 ===
9336* $wgRedirectScript was removed. It was unused.
9337* Removed $wgLocalMessageCacheSerialized, it is now always true.
9338* $wgVectorUseIconWatch is now enabled by default.
9339* $wgCascadingRestrictionLevels was added.
9340* ftps, ssh, sftp, xmpp, sip, sips, tel, sms, bitcoin, magnet, urn, and geo
9341  have been whitelisted inside of $wgUrlProtocols.
9342* $wgDocType and $wgDTD have been removed and are no longer used for the
9343  DOCTYPE.
9344* $wgHtml5 is no longer used by core. Setting it to false will no longer disable
9345  HTML5. It is still set to true for extension compatibility but doing so in
9346  extensions is deprecated.
9347* $wgXhtmlDefaultNamespace is no longer used by core. Setting it will no longer
9348  change the xmlns used by MediaWiki. Reliance on this variable by extensions
9349  is deprecated.
9350* $wgHandheldStyle was removed.
9351* $wgHandheldForIPhone was removed.
9352* $wgJsMimeType is no longer used by core. Most usage has been removed since
9353  HTML output is now exclusively HTML5.
9354* $wgDBOracleDRCP added. True enables persistent connection with DRCP on Oracle.
9355* $wgLogAutopatrol added to allow disabling logging of autopatrol edits in the
9356  logging table.
9357  Default for $wgLogAutopatrol is true.
9358* The 'edit' right no longer allows for editing a user's own CSS and JS.
9359* New rights 'editmyusercss', 'editmyuserjs', 'viewmywatchlist',
9360  'editmywatchlist', 'viewmyprivateinfo', 'editmyprivateinfo', and
9361  'editmyoptions' restrict actions that were formerly allowed by default. They
9362  have been added to the default for $wgGroupPermissions['*'].
9363* The 'editprotected' right no longer allows bypassing of all page protection
9364  restrictions. Any group using it for this purpose will now need to have all
9365  the individual rights listed in $wgRestrictionTypes for the same effect.
9366* The 'protect' and 'autoconfirmed' rights are no longer used for the default
9367  page protection levels. The rights 'editprotected' and 'editsemiprotected'
9368  are now used for this purpose instead.
9369* (bug 40866) wgOldChangeTagsIndex removed.
9370* $wgNoFollowDomainExceptions now only matches entire domains. For example,
9371  an entry for 'bar.com' will still match 'foo.bar.com' but not 'foobar.com'.
9372* $wgCopyUploadTimeout and $wgCopyUploadAsyncTimeout added to change the timeout
9373  times for fetching the file during upload by url.
9374* New key added to $wgGalleryOptions - $wgGalleryOptions['mode'] to set
9375  default gallery mode.
9376* New hook 'GalleryGetModes' to allow extensions to make new gallery modes.
9377* The checkbox for staying in HTTPS displayed on the login form when
9378  $wgSecureLogin is enabled has been removed. Instead, whether the user stays in
9379  HTTPS will be determined
9380  based on the user's preferences, and whether they came from HTTPS or not.
9381* $wgRC2UDPAddress, $wgRC2UDPInterwikiPrefix, $wgRC2UDPOmitBots, $wgRC2UDPPort,
9382  and $wgRC2UDPPrefix configuration options have been deprecated in favor of a
9383  $wgRCFeeds configuration array. $wgRCFeeds makes both the format and
9384  destination of recent change notifications customizable, and allows for
9385  multiple destinations to be specified.
9386* (bug 53862) portal-url, currentevents-url and helppage have been removed from
9387  the default Sidebar.
9388* The 'vector-simplesearch' preference is now enabled by default. Previously
9389  it was only enabled if the Vector extension was installed.
9390* The precise format of metric datagrams produced by the UDP profiler and stats
9391  counter may now be specified as $wgUDPProfilerFormatString and
9392  $wgStatsFormatString, respectively.
9393* (bug 54597) $wgBlockOpenProxies, $wgProxyPorts, $wgProxyScriptPath, and
9394  $wgProxyMemcExpiry have been removed, along with the open proxy scanner
9395  script they were added for.
9396* Default value of $wgMaxShellMemory has been tripled (it's now 300 MB).
9397
9398=== New features in 1.22 ===
9399* You can now install extensions using Composer.
9400  See https://www.mediawiki.org/wiki/Composer
9401* (bug 44525) mediawiki.jqueryMsg can now parse (whitelisted) HTML elements and
9402  attributes.
9403* (bug 33454) Language::sprintfDate now has a timezone parameter, and supports
9404  the "eIOPTZ" formatting characters.
9405* EditWarning: A warning is shown when an editor leaves the edit form without
9406  saving (enabled by default, users can opt-out via the 'useeditwarning'
9407  preference). This feature was moved from the Vector extension, and is now part
9408  of core for all skins. Take care when upgrading that you don't use an older
9409  version of the Vector extension as this feature may conflict.
9410* New 'mediawiki.ui' CSS module providing mw-ui-* styles for buttons and a
9411  compact vertical form layout.
9412* HTMLForm supports a new display format 'vform' which applies this compact
9413  vertical
9414  layout and button styling. Special:PasswordReset uses this format.
9415* New versions of login (Special:UserLogin) and create account
9416  (Special:UserLogin/signup) forms using the "vform" compact vertical form
9417  layout. These forms use new messages that assume a "Help logging in" link, see
9418  https://www.mediawiki.org/wiki/Manual:Page_customizations;
9419  https://www.mediawiki.org/wiki/Account_creation_user_experience/Strings lists
9420  the message key changes.
9421* (bug 23343) Implemented ability to apply IP blocks to the contents of
9422  X-Forwarded-For headers by adding a new configuration variable
9423  $wgApplyIpBlocksToXff (disabled by default).
9424* The new hook 'APIGetPossibleErrors' to modify the list of possible errors was
9425  added.
9426* (bug 25592) LogEventsList::showLogExtract() will now ignore various
9427  Pager-related WebRequest parameters by default, as this is overwhelmingly
9428  likely to be what was intended by users of the method. If any caller wishes
9429  to use these parameters, the new param 'useRequestParams' may be set to true.
9430* mw.util.addPortletLink: Tooltip is no longer required to be plain (without
9431  an accesskey in it already). As such it now rountrips. Creating a link with a
9432  message as tooltip, grabbing the title attribute and using it to create
9433  another portlet will work as expected.
9434* (bug 6747) {{ROOTPAGENAME}} introduced, contains the name of the topmost
9435  page without namespace.
9436* BREAKING CHANGE: (bug 41729) Display editsection links next to headings. Also
9437  change their class name from .editsection to .mw-editsection and place them at
9438  the end of the heading element instead of the beginning. Client-side code and
9439  screen-scrapers will have to be adjusted to handle both cases (old HTML will
9440  still be visible on cached page renders until they are purged); extensions
9441  using the DoEditSectionLink or EditSectionLink hooks might need adjustments as
9442  well.
9443* (bug 45535) introduced the new 'LanguageLinks' hook for manipulating the
9444  language links associated with a page before display.
9445* Chosen (http://harvesthq.github.io/chosen/) was added as module
9446  'jquery.chosen'
9447* HTMLForm will turn multiselect checkboxes into a Chosen interface when setting
9448  cssclass 'mw-chosen'
9449* rebuildLocalisationCache learned --lang option. Let you rebuild l10n caches
9450  of the specified languages instead of all of them.
9451* New GetNewMessagesAlert hook allowing extensions to disable or modify the new
9452  messages alert
9453* New wgUserNewMsgRevisionId JS global for logged in users. This will be null
9454  if the user has no new talk page messages. Otherwise it will be set to the
9455  revision ID of the oldest new talk page message. This will allow gadgets and
9456  extensions to create their own new message alerts on the client side.
9457* mediawiki.log: Added log.warn wrapper (uses console.warn and console.trace).
9458* mediawiki.log: Implemented log.deprecate. This method defines a property and
9459  uses ES5 getter/setter to emit a warning when they are used.
9460* $wgCascadingRestrictionLevels was added, allowing one to specify restriction
9461  levels which can be cascading (previously 'sysop' was hard-coded as the only
9462  one).
9463* XHTML5 support has been improved. If you set
9464  $wgMimeType = 'application/xhtml+xml' MediaWiki will try outputting markup
9465  according to XHTML5 rules.
9466* Altered hook 'ProtectionForm::save', adding the reason page protection is
9467  changed as third parameter.
9468* New hook 'TitleSquidURLs' for manipulating the list of URLs to be purged from
9469  HTTP caches when a page is changed.
9470* Changed the patrolling system to always show the link for patrolling in case
9471  the current revision is patrollable. This also removed the usage of the rcid
9472  URI parameters.
9473* Oracle DB backend now supports Database Resident Connection Pooling (DRCP).
9474  Can be enabled by setting $wgDBOracleDRCP=true.
9475  Requires Oracle DB 11gR1 or above, enabled DRCP inside the DB itself and a
9476  propper connect string.
9477  More about DRCP can be found at:
9478  https://oracle-base.com/articles/11g/database-resident-connection-pool-11gr1
9479* Add a new parameter $patrolFooterShown to hook ArticleViewFooter so the hook
9480  handlers can take further action based on the status of the patrol footer
9481* A new hook TitleQuickPermissions was added to allow overriding of quick
9482  permissions in the Title class.
9483* LinkCache singleton can now be altered or cleared, letting one to specify
9484  another instance that does not rely on a database backend.
9485* MediaWiki's PHPUnit tests can now use PHPUnit installed using composer --dev.
9486* (bug 43689) The lists of templates used on the page and hidden categories it
9487  is a member of, shown below the edit form, are now collapsible (and collapsed
9488  by default).
9489* Parser profiling data, formerly only available in the "NewPP limit report"
9490  HTML comment, is now also displayed at the bottom of page previews.
9491* Added ParserLimitReportPrepare and ParserLimitReportFormat hooks, deprecated
9492  ParserLimitReport hook.
9493* New user rights have been added to increase granularity in rights management
9494  for extensions such as OAuth:
9495** editmyusercss controls whether a user may edit their own CSS subpages.
9496** editmyuserjs controls whether a user may edit their own JS subpages.
9497** viewmywatchlist controls whether a user may view their watchlist.
9498** editmywatchlist controls whether a user may edit their watchlist.
9499** viewmyprivateinfo controls whether a user may access their private
9500   information (e.g. registered email address, real name).
9501** editmyprivateinfo controls whether a user may change their private
9502   information.
9503** editmyoptions controls whether a user may change their preferences.
9504* Add new hook AbortTalkPageEmailNotification, this will be used to determine
9505  whether to send the regular talk page email notification
9506* Action classes registered in $wgActions are now also supported in the form of
9507  a callback (which returns an instance of Action) instead of providing the name
9508  of a subclass of Action.
9509* (bug 46513) Vector: Add the collapsibleTabs script from the Vector extension.
9510* Added $wgRecentChangesFlags for defining new flags for RecentChanges and
9511  watchlists.
9512* (bug 40518) mw.toolbar: Implemented mw.toolbar.addButtons for adding multiple
9513 button objects in one call.
9514* Rights used for the default protection levels ('sysop' and 'autoconfirmed')
9515  are now used just for that purpose, instead of overloading other rights. This
9516  allows easy granting of the ability to edit sysop-protected pages without
9517  also granting the ability to protect and unprotect.
9518* (bug 48256) Make brackets in section edit links accessible to CSS.
9519  They are now wrapped in <span class="mw-editsection-bracket" />.
9520* (bug 8480) Allow handler specific parameters in galleries (like page number)
9521* jquery.client: Add detection for Opera 15 and Internet Explorer 11.
9522* Change tags (used by the AbuseFilter extension) are now shown on diff pages.
9523* Change tag lists (shown on recent changes, watchlist, user contributions,
9524  history pages, diff pages) now include a link to Special:Tags to distinguish
9525  them from edit summaries.
9526* Added a new method and hook, User::isEveryoneAllowed() and
9527  UserIsEveryoneAllowed, for use in situations where a "does everyone have this
9528  right?" check is used to avoid more expensive checks.
9529* (bug 14431) Display "(No difference)" instead of an empty diff (when comparing
9530  revisions in the history or when previewing changes while editing).
9531* New hook 'IsUploadAllowedFromUrl' is added which can be used to intercept
9532  uploads by URL, useful for blacklisting specific URLs
9533* (bug 21912) Watchlist token implementation has been refactored and
9534  Special:ResetTokens was added to allow users to reset their tokens
9535  instead of presenting them in Preferences.
9536* Special:PrefixIndex now lets you strip the searched prefix from the displayed
9537  titles. Given a list of articles named Bug1, Bug2, you can now transclude the
9538  list of bug numbers using: {{Special:PrefixIndex/Bug|stripprefix=1}}.
9539  The special page form received a new checkbox matching that option.
9540* (bug 23580) Implement javascript callback interface "mw.hook".
9541* (bug 30713) New mw.hook "wikipage.content".
9542* (bug 40430) jquery.placeholder gets a new parameter to set the attribute value
9543  to be used.
9544* $wgHTCPMulticastRouting renamed $wgHTCPRouting since it accepts unicast.
9545* $wgHTCPRouting rules can now be passed an array of hosts/ports to send purge
9546  too. Can be used whenever several multicast group could be interested by a
9547  specific purge.
9548* (bug 25931) Add Special:RandomInCategory.
9549* mediawiki.util: addPortletLink now supports passing a jQuery object as
9550  nextnode.
9551* <wbr> can now be used inside WikiText.
9552* WebResponse::setcookie is much more featureful. Callers using PHP's
9553  setcookie() or setrawcookie() should begin using this instead.
9554* New hook WebResponseSetCookie, called from WebResponse::setcookie().
9555* New hook ResetSessionID, called when the session id is reset.
9556* Add a mode parameter to <gallery> tag with potential options of "traditional",
9557  "nolines", "packed", "packed-overlay", or "packed-hover".
9558* (bug 47399) A success message is now displayed after changing the password.
9559* Make thumb.php give HTTP redirects for file redirects
9560* (bug 30607) Special:ListFiles can now show old versions of files. Additionally
9561  Special:AllMyUploads was introduced so the user can get a list of all things
9562  they have ever uploaded, even if it was subsequently overridden.
9563* Introduced Special:MyFiles and Special:AllMyFiles as an alias for
9564  Special:MyUploads and Special:AllMyUploads respectively.
9565* IPv6 addresses in X-Forwarded-For headers are now normalised before checking
9566  against allowed proxy lists.
9567* Add deferrable update support for callback/closure.
9568* Add TitleMove hook before page renames.
9569* Revision deletion backend code is moved out of SpecialRevisiondelete
9570* Added {{REVISIONSIZE}} variable to get the current size of a revision.
9571* Add support for the LESS stylesheet language to ResourceLoader. LESS is a
9572  stylesheet language that compiles into CSS. ResourceLoader file modules may
9573  include LESS style files; ResourceLoader will compile these files into CSS
9574  before sending them to the client.
9575** The $wgResourceLoaderLESSVars configuration variable is an associative array
9576   mapping variable names to string CSS values. These variables are considered
9577   declared for all LESS files. Additional variables may be registered by
9578   adding keys to the array.
9579** $wgResourceLoaderLESSFunctions is an associative array of custom LESS
9580   function names to PHP callables. See
9581   <http://leafo.net/lessphp/docs/#custom_functions>
9582   for more details regarding custom functions.
9583** $wgResourceLoaderLESSImportPaths is an array of file system paths. Files
9584   referenced in LESS '@import' statements are looked up here first.
9585* ResourceLoader supports hashes as module cache invalidation trigger (instead
9586  of or in addition to timestamps).
9587* Added $wgExtensionEntryPointListFiles for use in mergeMessageFileList.php.
9588* Added a hook, APIQuerySiteInfoStatisticsInfo, to allow extensions to modify
9589  the output of the API query meta=siteinfo&siprop=statistics
9590* Primary keys have been added to both the archive table and the externallinks
9591  tables.
9592* Added $wgEnableParserLimitReporting to control whether the NewPP limit report
9593  is output in a HTML comment.
9594* The 'UnwatchArticle' and 'WatchArticle' hooks now support a Status object
9595  instead of just a boolean return value to abort the hook.
9596* Added a hook, SpecialWatchlistGetNonRevisionTypes, to allow extensions
9597  with custom recentchanges entries to hook into the Watchlist without
9598  clobbering each other.
9599* A hidden, empty input field was added to the edit form, and any edit that
9600  fills it in will be rejected. This prevents against the simplest form of
9601  spambots. Previously in the "SimpleAntiSpam" extension by Ryan Schmidt.
9602* populateRevisionLength.php maintenance script updated to also populate
9603  archive.ar_len field.
9604* (bug 43571) DatabaseMySQLBase learned to list views, optionally filtered by a
9605  prefix. Also fixed PHPUnit test suite when using a MySQL backend containing
9606  views.
9607
9608=== Bug fixes in 1.22 ===
9609* (bug 47271) $wgContentHandlerUseDB should be set to false during the upgrade
9610* Disable Special:PasswordReset when $wgEnableEmail is false. Previously one
9611  could still navigate to the page by entering the URL directly.
9612* (bug 47138) Fixed a fatal error when a blocked user tries to automatically
9613  create an account on login due external authentication in some circumstances.
9614* (bug 23393) HTML <hN> headings containing line breaks are now handled
9615  correctly.
9616* (bug 45803) Whitespace within == Headline == syntax and within <hN> headings
9617  is now non-significant and not preserved in the HTML output.
9618* (bug 47218) Special:BlockList now handles correctly user names with spaces
9619  when passed as subpage.
9620* Pager's properly validate which fields are allowed to be sorted on.
9621* mw.util.tooltipAccessKeyRegexp: The regex now matches "option-" as well.
9622  Support for Mac "option" was added in 1.16, but the regex was never updated.
9623* (bug 46768) Usernames of blocking users now display correctly, even if
9624  numeric.
9625* (bug 39590) Self-transclusions now show the most up to date result always
9626  after save instead of being a revision behind.
9627* A bias in wfRandomString() toward digits 1-7 has been corrected. Generated
9628  strings will now start with digits 0 and 8-f as often as they should.
9629* (bug 45371) Removed Parser_LinkHooks and CoreLinkFunctions classes.
9630* (bug 41545) Allow <kbd>, <samp>, and <var> to be nested like allowed in html.
9631* PLURAL magic word no longer causes a PHP notice when no matching form exists.
9632* (bug 36641) Patrol page links no longer show on non-existent revisions.
9633* (bug 35810) Pages not linked from Special:RecentChanges or Special:NewPages
9634  are patrollable now.
9635* (bug 30213) JavaScript for search suggestions is now disabled when the API
9636  is disabled, and AJAX patrolling and watching are now disabled when use of
9637  the write API is not allowed.
9638* (bug 48294) API: Fix chunk upload async mode.
9639* (bug 46749) Broken files tracking category removed from pages if an image
9640  with that name is uploaded.
9641* (bug 14176) System messages that are empty were previously incorrectly treated
9642  as non-existent, causing a fallback to the default. This stopped users from
9643  overriding system messages to make them blank.
9644* (bug 48319) action=parse no longer returns an error if passed none of 'oldid',
9645  'pageid', 'page', 'title', and 'text' (e.g. if only passed 'summary'). A
9646  warning will instead be issued if 'title' is non-default, unless no props are
9647  requested.
9648* Special:Recentchangeslinked will now include upload log entries
9649* (bug 41281) Fixed ugly output if file size could not be extracted for
9650  multi-page media.
9651* (bug 50315) list=logevents API module will now output log entries by anonymous
9652  users.
9653* (bug 38911) Handle headers with rowspan in jquery.tablesorter
9654* (bug 658) Converted the table of contents on wiki pages from <table> to <div>
9655  and adjusted skin CSS accordingly. The CSS was carefully crafted to be
9656  backwards-compatible in all reasonable cases (uses of the __TOC__ magic word,
9657  the #toc CSS id and the .toc CSS class). However, particularly bad abuse of
9658  the id or the class can possibly break.
9659* CSSJanus now supports rgb, hsl, rgba, and hsla color syntaxes.
9660* Special:Listfiles can no longer be sorted by image name when filtering
9661  by user in miser mode.
9662* (bug 49074) CSSJanus: Handle values of border-radius correctly.
9663* Handle relative inclusions ({{../name}}) in main namespace with subpages
9664  enabled correctly (previously MediaWiki tried to include Template:Parent/name
9665  instead of just Parent/name).
9666* Added $wgAPIUselessQueryPages to allow extensions to flag their query pages
9667  for non-inclusion in ApiQueryQueryPages.
9668* (bug 50870) mediawiki.notification: Notification area should remain visible
9669  when scrolled down.
9670* (bug 13438) Special:MIMESearch no longer an expensive special page.
9671* (bug 48342) Fixed a fatal error when $wgValidateAllHtml is set to true and
9672  the function apache_request_headers() function is not available.
9673* (bug 33399) LivePreview: Re-run wikipage content handlers
9674  (jquery.makeCollapsible, jquery.tablesorter) after preview content is loaded.
9675* (bug 51891) Fixed PHP notice on Special:PagesWithProp when no properties
9676  are defined.
9677* (bug 52006) Corrected documentation of $wgTranscludeCacheExpiry.
9678* (bug 52077) The APIEditBeforeSave hook is giving the content of the whole
9679  revision as second argument now, rather than just the current section.
9680* (bug 49694) $wgSpamRegex is now also applied on the new section headline text
9681  adding a new topic on a page
9682* (bug 41756) Improve treatment of multiple comments on a blank line.
9683* (bug 51064) Purge upstream caches when deleting file assets.
9684* (bug 39012) File types with a mime that we do not know the extension for
9685  can no longer be uploaded as an extension that we do know the mime type
9686  for.
9687* (bug 51742) Add data-sort-value for better sorting of hitcounts Special:Tags
9688* (bug 26811) On DB error pages, server hostnames are now hidden when both
9689  $wgShowHostnames and $wgShowSQLErrors are false.
9690* (bug 6200) line breaks in <blockquote> are handled like they are in <div>
9691* (bug 14931) Default character set now set to 'utf8' when a new MySQL
9692  database is created.
9693* (bug 47191) Fixed "Column 'si_title' cannot be part of FULLTEXT index"
9694  MySQL error when installing using the binary character set option.
9695* (bug 45288) Support mysqli PHP extension
9696* (bug 55818) BREAKING CHANGE: Removed undocumented 'Debug' hook in wfDebug.
9697  This resolves an infinite loop when using $wgDebugFunctionEntry = true.
9698* (bug 56707) Correct tooltip of "Next n results" on query special pages.
9699* (bug 56770) mw.util.addPortletLink: Check length before access array index.
9700
9701=== API changes in 1.22 ===
9702* (bug 25553) The JSON output formatter now leaves forward slashes unescaped
9703  to improve human readability of URLs and similar strings. Also, a "utf8"
9704  option is now provided to use UTF-8 encoding instead of hex escape codes
9705  for most non-ASCII characters.
9706* (bug 46626) xmldoublequote parameter was removed. Because of a bug, the
9707  parameter has had no effect since MediaWiki 1.16, and so its removal is
9708  unlikely to impact existing clients.
9709* (bug 47216) action=query&meta=siteinfo&siprop=skins will now indicate which
9710  skin is the default and which are unusable (e.g. listed in $wgSkipSkins).
9711* (bug 25325) Added support for wlshow filtering (bots/anon/minor/patrolled)
9712  to action=feedwatchlist.
9713* WDDX formatted output will actually be formatted (and normal output will no
9714  longer be), and will no longer choke on booleans.
9715* action=opensearch no longer silently ignores the format parameter.
9716* action=opensearch now supports format=jsonfm.
9717* list=usercontribs&ucprop=ids will now include the parent revision id.
9718* BREAKING CHANGE: action=parse no longer returns all langlinks for the page
9719  with prop=langlinks by default. The new effectivelanglinks parameter will
9720  request that the LanguageLinks hook be called to determine the effective
9721  language links.
9722* BREAKING CHANGE: list=allpages, list=langbacklinks, and prop=langlinks do not
9723  apply the new LanguageLinks hook, and thus only consider language links
9724  stored in the database.
9725* (bug 47219) Allow specifying change type of Wikipedia feed items
9726* prop=imageinfo now allows setting iiurlheight without setting iiurlwidth
9727* prop=info now adds the content model and page language of the title.
9728* New upload log entries will now contain information on the relevant
9729  image (sha1 and timestamp).
9730* (bug 49239) action=parse now can parse in preview and section preview modes.
9731* (bug 49259) action=patrol now accepts revision ids.
9732* (bug 48129) list=blocks&bkip= now correctly handles IPv6 CIDR ranges and
9733  honors $wgBlockCIDRLimit. Note any clients passing invalid values to bkip
9734  will now receive an error, rather than the previous behavior listing all
9735  user blocks.
9736* (bug 48201) action=parse&text=foo now assumes wikitext if no title is given,
9737  rather than using the content model of the page "API".
9738* action=watch no longer silently ignores hook abort.
9739* (bug 50785) action=purge with forcelinkupdate=1 no longer queues refreshLinks
9740  jobs in the job queue for link table updates of pages that use the given page
9741  as a template. Instead, forcerecursivelinkupdate=1 is introduced and should
9742  be used if that behaviour is desirable.
9743* The 'debugLog' property (enabled by $wgDebugToolbar) no longer sets the log
9744  entry values through ApiResult::content but directly. This changes the JSON
9745  output from an array of objects with content in '*' to an array of strings
9746  with the content.
9747* (bug 51342) prop=imageinfo iicontinue now contains the dbkey, not the text
9748  version of the title.
9749* (bug 52538) action=edit will now use empty text instead of the contents
9750  of section 0 when passed prependtext or appendtext with section=new.
9751* Support for the 'gettoken' parameter to action=block and action=unblock,
9752  deprecated since 1.20, has been removed.
9753* (bug 49090) Token-getting functions will fail when using jsonp callbacks.
9754* (bug 52699) action=upload returns normalized file name on warning
9755  "exists-normalized" instead of filename to be uploaded to.
9756* (bug 53884) action=edit will now return an error when the specified section
9757  does not exist in the page.
9758* Added meta=filerepoinfo API module for getting information about foreign
9759  file repositories, and related ForeignAPIRepo methods getInfo and getApiUrl.
9760* The new query module list=allfileusages to enumerate file usages was added.
9761
9762=== Languages updated in 1.22 ===
9763
9764MediaWiki supports over 350 languages. Many localisations are updated
9765regularly. Below only new and removed languages are listed, as well as
9766changes to languages because of Bugzilla reports.
9767
9768* Batak Toba (bbc-latn) added.
9769* (bug 46751) Made Buryat (Russia) (буряад) (bxr) fallback to Russian.
9770
9771=== Other changes in 1.22 ===
9772* BREAKING CHANGE: Implementation of MediaWiki's JS and JSON value encoding
9773  has changed:
9774** MediaWiki no longer supports PHP installations in which the native JSON
9775   extension is missing or disabled.
9776** XmlJsCode objects can no longer be nested inside objects or arrays.
9777   (For Xml::encodeJsCall(), this individually applies to each argument.)
9778** The sets of characters escaped by default, along with the precise escape
9779   sequences used, have changed (except for the Xml::escapeJsString()
9780   function, which is now deprecated).
9781* BREAKING CHANGE: The Services_JSON class has been removed. If necessary,
9782  be sure to upgrade affected extensions at the same time (e.g. Collection).
9783* redirect.php was removed. It was unused.
9784* ClickTracking integration was dropped from the mediaWiki.user.bucket
9785  JavaScript function. The 'tracked' option is now ignored.
9786* BREAKING CHANGE: Legacy skins Simple, MySkin, Chick, Standard and Nostalgia
9787  were all removed. (Nostalgia was moved to an extension.) The SkinLegacy and
9788  LegacyTemplate classes that supported them were removed as well and are now a
9789  part of the Nostalgia extension.
9790* Event namespace used by jquery.makeCollapsible has been changed from
9791  'mw-collapse' to 'mw-collapsible' for consistency with the module name.
9792* BREAKING CHANGE: The "ExternalAuth" authentication subsystem was removed,
9793  along with its associated globals of $wgExternalAuthType, $wgExternalAuthConf,
9794  $wgAutocreatePolicy and $wgAllowPrefChange. Affected users are encouraged to
9795  use AuthPlugin for external authentication/authorization needs.
9796* The Quickbar feature of the legacy skin model and the last remnants of it
9797  throughout the code base have been removed.
9798* Externaledit/externaldiff preference was removed. Very few users used this
9799  feature, and improper configuration can actually prevent a user from editing
9800* Calling Linker methods using a skin will now output deprecation warnings.
9801* (bug 46680) "Return to" links are no longer tagged with rel="next".
9802* BREAKING CHANGE: mw.util.tooltipAccessKeyRegexp: The match group for the
9803  accesskey character is now $6 instead of $5.
9804* HipHop compiler (hphpc) support was removed. HipHop VM support (hhvm) was
9805  added.
9806* A new Special:Redirect page was added, providing lookup by revision ID,
9807  user ID, or file name.  The old Special:Filepath page was reimplemented
9808  to redirect through Special:Redirect.
9809* Monobook: Removed the old conditional stylesheets for Opera 6, 7 and 9.
9810* Support for XHTML 1.0 has been removed. MediaWiki now only outputs (X)HTML5.
9811* wikibits: User-agent related globals have been deprecated. The following
9812  properties now default to false and emit mw.log.warn: is_gecko, is_chrome_mac,
9813  is_chrome, webkit_version, is_safari_win, is_safari, webkit_match, is_ff2,
9814  ff2_bugs, is_ff2_win, is_ff2_x11, opera95_bugs, opera7_bugs, opera6_bugs,
9815  is_opera_95, is_opera_preseven, is_opera, and ie6_bugs.
9816* (bug 48276) MediaWiki will now flash a confirmation message upon successfully
9817  editing a page.
9818* (bug 40785) mediawiki.legacy.ajax has been marked as deprecated. The following
9819  properties now emit mw.log.warn when accessed: sajax_debug, sajax_init_object,
9820  sajax_do_call and wfSupportsAjax.
9821* BREAKING CHANGE: meta keywords are no longer supported. A
9822  <meta name="keywords" will no longer be output and OutputPage::addKeyword no
9823  longer exists.
9824* Methods Title::userCanEditCssSubpage and Title::userCanEditJsSubpage,
9825  deprecated since 1.19, have been removed.
9826* (bug 50134) Hook functions are no longer required to return a value. When a
9827  hook function does not return a value (or when it returns an explicit null),
9828  processing continues. To abort the hook, a hook function must return an
9829  explicit, boolean false or a string error message. Other falsey values are
9830  tantamount to a 'return true' in earlier versions of MediaWiki.
9831* BREAKING CHANGE: The EditSectionLink hook was removed after being
9832  deprecated since MediaWiki 1.14. Use DoEditSectionLink instead.
9833* (bug 48256) The 'editsection-brackets' optional message was removed.
9834  Section edit links' brackets can now be customized using CSS by
9835  styling span.mw-editsection-bracket.
9836* The usePatrol function in ChangesList has been marked as deprecated.
9837* (bug 50785) A "null edit", that is, a save action in which no changes to the
9838  page text are made and no revision recorded, will no longer send refreshLinks
9839  jobs to the job table to update pages which use the edited page as a template.
9840* The LivePreviewPrepare and LivePreviewDone events triggered on "jQuery( mw )"
9841  have been deprecated in favour of using mw.hook.
9842* The 'showjumplinks' user preference has been removed, jump links are now
9843  always included.
9844* Methods RecentChange::notifyRC2UDP, RecentChange::sendToUDP, and
9845  RecentChange::cleanupForIRC have been deprecated, as it is now the
9846  responsibility of classes implementing the RCFeedFormatter and RCFeedEngine
9847  interfaces to implement the formatting and delivery for recent change
9848  notifications.
9849* SpecialPrefixindex methods namespacePrefixForm() and showPrefixChunk() have
9850  been made protected. They were accepting form variance arguments, this is now
9851  using properties in the SpecialPrefixindex class.
9852* (bug 50310) BREAKING CHANGE: wikibits: Drop support for mwCustomEditButtons.
9853  It defaults to an empty array and emits mw.log.warn when accessed.
9854* BREAKING CHANGE: Special:Disambiguations has been removed from MediaWiki core.
9855  Functions related to disambiguation pages are now handled by the Disambiguator
9856  extension (https://www.mediawiki.org/wiki/Extension:Disambiguator) (bug
9857  35981).
9858* BREAKING CHANGE: The 'mediawiki.legacy.wikiprintable' module has been removed.
9859  The skins/common/wikiprintable.css file no longer exists. Return value of
9860  Skin#commonPrintStylesheet is ignored. Please use the
9861  'mediawiki.legacy.commonPrint' module instead or base your skin on
9862  SkinTemplate.
9863* (bug 49629) The hook ExtractThumbParameters has been deprecated in favour
9864  of media handler overriding MediaHandler::parseParamString.
9865* (bug 46512) The collapsibleNav feature from the Vector extension has been
9866  moved to the Vector skin in core.
9867* SpecialRecentChanges::addRecentChangesJS() function has been renamed
9868  to addModules() and made protected.
9869* Methods WatchAction::doWatch and WatchAction::doUnwatch now return a Status
9870  object instead of a boolean.
9871* Information boxes (CSS classes errorbox, warningbox, successbox) have been
9872  made more subtle.
9873* BREAKING CHANGE: The module 'mediawiki.legacy.IEFixes' has been removed as it
9874  was unused. The file skins/common/IEFixes.js remains but is only used by
9875  wikibits. The file never contained any re-usable components. To use it in a
9876  skin, load 'mediawiki.legacy.wikibits' (which IEFixes depends on) and that
9877  will import IEFixes automatically if user agent conditions are met.
9878* Code specific to the Math extension was marked as deprecated.
9879* mediawiki.util: mw.util.wikiGetlink has been renamed to getUrl. (The old name
9880  still works, but is deprecated.)
9881
9882= MediaWiki 1.21 =
9883
9884== MediaWiki 1.21.11 ==
9885This is a security and maintenance release of the MediaWiki 1.21 branch.
9886
9887=== Changes since 1.21.10 ===
9888* (bug 65839) SECURITY: Prevent external resources in SVG files.
9889* (bug 66428) MimeMagic: Don't seek before BOF. This has weird side effects like
9890  only extracting the tail of the file partially or not at all.
9891
9892== MediaWiki 1.21.10 ==
9893This is a security and maintenance release of the MediaWiki 1.21 branch.
9894
9895=== Changes since 1.21.9 ===
9896* (bug 65501) SECURITY: Don't parse usernames as wikitext on
9897  Special:PasswordReset.
9898* (bug 36356) Add space between two feed links.
9899
9900== MediaWiki 1.21.9 ==
9901This is a security and maintenance release of the MediaWiki 1.21 branch.
9902
9903=== Changes since 1.21.8 ===
9904* (bug 63251) SECURITY: Escape sortKey in pageInfo.
9905* (bug 58640) Fixed a compatibility issue with PCRE 8.34 that caused pages to
9906  appear blank or with missing text.
9907
9908== MediaWiki 1.21.8 ==
9909This is a security and maintenance release of the MediaWiki 1.21 branch.
9910
9911=== Changes since 1.21.7 ===
9912* (bug 62497) SECURITY: Add CSRF token on Special:ChangePassword.
9913* (bug 62467) Set a title for the context during import on the cli.
9914
9915== MediaWiki 1.21.7 ==
9916This is a maintenance release of the MediaWiki 1.21 branch.
9917
9918=== Changes since 1.21.6 ===
9919* Use the correct branch of the extensions' git repositories.
9920
9921== MediaWiki 1.21.6 ==
9922This is a security release of the MediaWiki 1.21 branch.
9923
9924=== Changes since 1.21.5 ===
9925* (bug 60771) SECURITY: Disallow uploading SVG files using non-whitelisted
9926  namespaces. Also disallow iframe elements.
9927* User will get an error including the namespace name if they use a
9928  non-whitelisted namespace.
9929* (bug 61346) SECURITY: Make token comparison use constant time. It seems like
9930  our token comparison would be vulnerable to timing attacks. This will take
9931  constant time.
9932* (bug 61362) SECURITY: API: Don't find links in the middle of api.php links.
9933
9934== MediaWiki 1.21.5 ==
9935This is a security release of the MediaWiki 1.21 branch.
9936
9937=== Changes since 1.21.4 ===
9938* (bug 60339) SECURITY: Sanitize shell arguments to DjVu files, and other media
9939  formats
9940
9941== MediaWiki 1.21.4 ==
9942This is a security release of the MediaWiki 1.21 branch.
9943
9944=== Changes since 1.21.3 ===
9945* (bug 57550) SECURITY: Disallow stylesheets in SVG Uploads
9946* (bug 58088) SECURITY: Don't normalize U+FF3C to \ in CSS Checks
9947* (bug 58472) SECURITY: Disallow -o-link in styles
9948* (bug 58553) SECURITY: Return error on invalid XML for SVG Uploads
9949* (bug 58699) SECURITY: Fix RevDel log entry information leaks
9950
9951== MediaWiki 1.21.3 ==
9952This is a security and maintenance release of the MediaWiki 1.21 branch.
9953
9954=== Changes since 1.21.2 ===
9955* (bug 53032) SECURITY: Don't cache when a call could autocreate
9956* (bug 55332) SECURITY: Improve css javascript detection
9957* (bug 49717) Fix behaviour $wgVerifyMimeType = false; in Upload
9958* Fix comma errors in various js files
9959* Translations
9960
9961== MediaWiki 1.21.2 ==
9962This is a security and maintenance release of the MediaWiki 1.21 branch.
9963
9964=== Changes since 1.21.1 ===
9965* SECURITY: Fix extension detection with 2 .'s
9966* SECURITY: Support for the 'gettoken' parameter to action=block and
9967  action=unblock, deprecated since 1.20, has been removed.
9968* SECURITY: Sanitize ResourceLoader exception messages
9969* Purge upstream caches when deleting file assets.
9970* Unit test suite now runs the AutoLoader tests. Also fixed the autoloading
9971  entry for the PageORMTableForTesting class though it had no impact.
9972
9973== MediaWiki 1.21.1 ==
9974This is a maintenance release of the MediaWiki 1.21 branch.
9975
9976=== Changes since 1.21.0 ===
9977* An incorrect version number was used for 1.21.0. 1.21.1 has the correct
9978  number.
9979* A problem with the Oracle SQL table creation was fixed.
9980* (PdfHandler extension) Fix warning if pdfinfo fails but pdftext succeeds.
9981
9982== MediaWiki 1.21.0 ==
9983
9984=== Configuration changes in 1.21 ===
9985* (bug 29374) $wgVectorUseSimpleSearch is now enabled by default.
9986* Deprecated $wgAllowRealName is removed. Use $wgHiddenPrefs[] = 'realname'
9987  instead.
9988* (bug 39957) Added $wgUnwatchedPageThreshold, specifying minimum count
9989  of page watchers required for the number to be accessible to users
9990  without the unwatchedpages permission.
9991* $wgBug34832TransitionalRollback has been removed.
9992* (bug 29472) $wgUseDynamicDates has been removed and its functionality
9993  disabled.
9994
9995=== New features in 1.21 ===
9996* (bug 38110) Schema changes (adding or dropping tables, indices and
9997  fields) can be now be done separately from other changes that
9998  update.php makes.  This is useful in environments that use database
9999  permissions to restrict schema changes but allow the DB user that
10000  MediaWiki normally runs as to perform other changes that update.php
10001  makes.  Schema changes can be run separately.  See the file UPGRADE
10002  for more information.
10003* (bug 34876) jquery.makeCollapsible has been improved in performance.
10004* Added ContentHandler facility to allow extensions to support other content
10005  than wikitext. See docs/contenthandler.txt for details.
10006* New feature was developed for showing high-DPI thumbnails for high-DPI mobile
10007  and desktop displays (configurable with $wgResponsiveImages).
10008* Added new backend to represent and store information about sites and site
10009  specific configuration.
10010* jQuery upgraded from 1.8.2 to 1.8.3.
10011* jQuery UI upgraded from 1.8.23 to 1.8.24.
10012* Added separate fa_sha1 field to filearchive table. This allows sha1
10013  searches with the api in miser mode for deleted files.
10014* Add initial and programmatic sorting for tablesorter.
10015* Add the event "sortEnd.tablesorter", triggered after sorting has completed.
10016* The Job system was refactored to allow for different backing stores for
10017  queues as well as cross-wiki access to queues, among other things. The schema
10018  for the DB queue was changed to support better concurrency and reduce
10019  deadlock errors.
10020* Added ApiQueryORM class to facilitate creation of query API modules based on
10021  tables that have a corresponding ORMTable class.
10022* (bug 40876) Icon for PSD (Adobe Photoshop) file types.
10023* (bug 40641) Implemented Special:Version/Credits with a list of contributors.
10024* (bug 7851) Implemented one-click AJAX patrolling.
10025* The <data>, <time>, <meta>, and <link> elements are allowed within WikiText
10026  for use with Microdata.
10027* The HTML5 <mark> tag has been whitelisted.
10028* Added ParserCloned hook for when the Parser object is cloned.
10029* Added AlternateEditPreview hook to allow extensions to replace the page
10030  preview from the edit page.
10031* Added EditPage::showStandardInputs:options hook to allow extensions to add
10032  new fields to the "editOptions" area of the edit form.
10033* Upload stash DB schema altered to improve upload performance.
10034* The following global functions are now reporting deprecated warnings in
10035  debug mode: wfMsg, wfMsgNoTrans, wfMsgForContent, wfMsgForContentNoTrans,
10036  wfMsgReal, wfMsgGetKey, wfMsgHtml, wfMsgWikiHtml, wfMsgExt, wfEmptyMsg. Use
10037  the Message class, or the global method wfMessage.
10038* Added $wgEnableCanonicalServerLink, off by default. If enabled, a
10039  <link rel=canonical> tag is added to every page indicating the correct server
10040  to use.
10041* Debug message emitted by wfDebugLog() will now be prefixed with the group
10042  name when its logged to the default log file. That is the case whenever the
10043  group has no key in wgDebugLogGroups, that will help triage the default log.
10044* (bug 24620) Add types to LogFormatter.
10045* jQuery JSON upgraded from 2.3 to 2.4.0.
10046* Added GetDoubleUnderscoreIDs hook, for modifying the list of magic words.
10047* DatabaseUpdater class has two new methods to ease extensions schema changes:
10048  dropExtensionIndex and renameExtensionIndex.
10049* New preference type - 'api'. Preferences of this type are not shown on
10050  Special:Preferences, but are still available via the action=options API.
10051* (bug 39397) Hide rollback link if a user is the only contributor of the page.
10052* $wgPageInfoTransclusionLimit limits the list size of transcluded articles
10053  on the info action. Default is 50.
10054* Added action=createaccount to allow user account creation.
10055* (bug 40124) action=options API also allows for setting of arbitrary
10056  preferences, provided that their names are prefixed with 'userjs-'. This
10057  officially reenables the feature that was undocumented and defective
10058  in MW 1.20 (saving preferences using Special:Preferences cleared any
10059  additional fields) and which has been disabled in 1.20.1 as a part of
10060  a security fix (bug 42202).
10061* Added option to specify "others" as author in extension credits using
10062  "..." as author name.
10063* Added the ability to limit the wall clock time used by shell processes,
10064  as well as the CPU time. Configurable with $wgMaxShellWallClockTime.
10065* Allow memory of shell subprocesses to be limited using Linux cgroups
10066  instead of ulimit -v, which tends to cause deadlocks in recent versions
10067  of ImageMagick. Configurable with $wgShellCgroup.
10068* Added $wgWhitelistReadRegexp for regex whitelisting.
10069* (bug 5346) Categories that are redirects will be displayed italic in
10070  the category links section at the bottom of a page.
10071* (bug 43915) New maintenance script deleteEqualMessages.php.
10072* You can now create checkbox option matrices through the HTMLCheckMatrix
10073  subclass in HTMLForm.
10074* WikiText now permits the use of WAI-ARIA's role="presentation" inside of
10075  html elements and tables. This allows presentational markup, especially
10076  tables. To be marked up as such.
10077* maintenance/sql.php learned the --cluster option. Let you run the script
10078  on some external cluster instead of the primary cluster for a given wiki.
10079* (bug 20281) test the parsing of inline URLs.
10080* Added Special:PagesWithProp, which lists pages using a particular page
10081  property.
10082* Implemented language-specific collations for category sorting for 67 languages
10083  based in latin, greek and cyrillic alphabets. This allows one to *finally* get
10084  articles to be correctly sorted on category pages. They are named
10085  'uca-<langcode>', where <langcode> is one of: af, ast, az, be, bg, br, bs, ca,
10086  co, cs, cy, da, de, dsb, el, en, eo, es, et, eu, fi, fo, fr, fur, fy, ga, gd,
10087  gl, hr, hsb, hu, is, it, kk, kl, ku, ky, la, lb, lt, lv, mk, mo, mt, nl, no,
10088  oc, pl, pt, rm, ro, ru, rup, sco, sk, sl, smn, sq, sr, sv, tk, tl, tr, tt, uk,
10089  uz, vi.
10090* Added 'CategoryAfterPageAdded' and 'CategoryAfterPageRemoved' hooks.
10091* Added 'HistoryRevisionTools' and 'DiffRevisionTools' hooks.
10092* Added 'SpecialSearchResultsPrepend' and 'SpecialSearchResultsAppend' hooks.
10093* (bug 33186) Add image rotation api "imagerotate"
10094* (bug 34040) Add "User rights management" link on user page toolbox.
10095* (bug 45526) Add QUnit assertion helper "QUnit.assert.htmlEqual" for asserting
10096  structual equality of HTML (ignoring insignificant differences like
10097  quotmarks, order and whitespace in the attribute list).
10098* (bug 23393) HTML <hN> headings containing line breaks are now handled
10099  correctly.
10100* (bug 45803) Whitespace within == Headline == syntax and within <hN> headings
10101  is now non-significant and not preserved in the HTML output.
10102
10103=== Bug fixes in 1.21 ===
10104* (bug 40353) SpecialDoubleRedirect should support interwiki redirects.
10105* (bug 40352) fixDoubleRedirects.php should support interwiki redirects.
10106* (bug 9237) SpecialBrokenRedirect should not list interwiki redirects.
10107* (bug 34960) Drop unused fields rc_moved_to_ns and rc_moved_to_title from
10108  recentchanges table.
10109* (bug 32951) Do not register internal externals with absolute protocol,
10110  when server has relative protocol.
10111* (bug 39005) When purging proxies listed in $wgSquidServers using HTTP PURGE
10112  method requests, we now send a Host header by default, for Varnish
10113  compatibility. This also works with Squid in reverse-proxy mode. If you wish
10114  to support Squid configured in forward-proxy mode, set
10115  $wgSquidPurgeUseHostHeader to false.
10116* (bug 37020) sql.php with readline eats semicolon.
10117* (bug 11748) Properly handle optionally-closed HTML tags when Tidy is
10118  disabled, and don't wrap HTML-syntax definition lists in paragraphs.
10119* (bug 41409) Diffs while editing an old revision should again diff against the
10120  current revision.
10121* (bug 41494) Honor $wgLogExceptionBacktrace when logging non-API exceptions
10122  caught during API execution.
10123* (bug 37963) Fixed loading process for user options.
10124* (bug 26995) Update filename field on Upload page after having sanitized it.
10125* (bug 41793) Contribution links to users with 0 edits on Special:ListUsers
10126  didn't show up red.
10127* (bug 41899) A PHP notice no longer occurs when using the "rvcontinue" API
10128  parameter.
10129* (bug 42036) Account creation emails now contain canonical (not
10130  protocol-relative) URLs.
10131* (bug 41990) Fix regression: API edit with redirect=true and lacking
10132  starttimestamp and basetimestamp should not cause an edit conflict.
10133* (bug 41706) EditPage: Preloaded page should be converted if possible and
10134  needed.
10135* (bug 41886) Rowspans are no longer exploded by tablesorter until the table is
10136  actually sorted.
10137* (bug 2865)  User interface HTML elements don't use lang attribute.
10138  (completed the fix by adding the lang attribute to firstHeading).
10139* (bug 42173) Removed namespace prefixes on Special:UncategorizedCategories.
10140* (bug 36053) Log in "returnto" feature forgets query parameters if no
10141  title parameter was specified.
10142* (bug 42410) API action=edit now returns correct timestamp for the new edit.
10143* (bug 14901) Email notification mistakes log action for new page creation.
10144  Enotif no longer sends "page has been created" notifications for some log
10145  actions. The following events now have a correct message: page creation,
10146  deletion, move, restore (undeletion), change (edit). Parameter
10147  $CHANGEDORCREATED is deprecated in 'enotif_body' and scheduled for removal in
10148  MediaWiki 1.23.
10149* (bug 457) In the sidebar of Vector, CologneBlue, Monobook, and Monobook-based
10150  skins, the heading levels have been changed from (variously per skin)
10151  <h4>, <h5> or <h6> to only <h3>s, with a <h2> hidden heading above them.
10152  If you are styling or scripting the headings in a custom way, this change
10153  will require updates to your site's CSS or JS.
10154* (bug 41342) jquery.suggestions should cancel any active (async) fetches
10155  before it triggers another fetch.
10156* (bug 42184) $wgUploadSizeWarning missing second variable.
10157* (bug 34581) removeUnusedAccounts.php maintenance script now ignores newuser
10158  log when determining whether an account is used.
10159* (bug 43379) Gracefully fail if rev_len is unavailable for a revision on the
10160  History page.
10161* (bug 42949) API no longer assumes all exceptions are MWException.
10162* (bug 41733) Hide "New user message" (.usermessage) element from printable
10163  view.
10164* (bug 39062) Special:Contributions will display changes that don't have
10165  a parent id instead of just an empty bullet item.
10166* (bug 37209) "LinkCache doesn't currently know about this title" error fixed.
10167* wfMerge() now works if $wgDiff3 contains spaces
10168* (bug 43052) mediawiki.action.view.dblClickEdit.dblClickEdit should trigger
10169  ca-edit click instead opening URL directly.
10170* (bug 43964) Invalid value of "link" parameter in <gallery> no longer produces
10171  a fatal error.
10172* (bug 44775) The username field is not pre-filled when creating an account.
10173* (bug 45069) wfParseUrl() no longer produces a PHP notice if passed a "mailto:"
10174  URL without address
10175* (bug 45012) Creating an account by e-mail can no longer show a
10176  "password mismatch" error.
10177* (bug 44599) On Special:Version, HEADs for submodule checkouts (e.g. for
10178  extensions) performed using Git 1.7.8+ should now appear.
10179* (bug 42184) $wgUploadSizeWarning missing second variable
10180* (bug 40326) Check if files exist with a different extension during uploading
10181* (bug 34798) Updated CSS for Atom/RSS recent changes feeds to match on-wiki
10182  diffs.
10183* (bug 42430) Calling numRows on MySQL no longer propagates unrelated errors.
10184* (bug 44719) Removed mention of non-existing maintenance/migrateCurStubs.php
10185  script in includes/DefaultSettings.php
10186* (bug 45143) jquery.badge: Treat non-Latin variants of zero as zero as well.
10187* (bug 46151) mwdocgen.php should not ignore exit code of doxygen command.
10188* (bug 41889) Fix $.tablesorter rowspan exploding for complex cases.
10189
10190=== API changes in 1.21 ===
10191* prop=revisions can now report the contentmodel and contentformat.
10192  See docs/contenthandler.txt.
10193* action=edit and action=parse now support contentmodel and contentformat
10194  parameters to control the interpretation of page content.
10195  See docs/contenthandler.txt for details.
10196* (bug 35693) ApiQueryImageInfo now suppresses errors when unserializing
10197  metadata.
10198* (bug 40111) Disable minor edit for page/section creation by API.
10199* (bug 41042) Revert change to action=parse&page=... behavior when the page
10200  does not exist.
10201* (bug 27202) Add timestamp sort to list=allimages.
10202* (bug 43137) Don't return the sha1 of revisions through the API if the content
10203  is revision-deleted.
10204* ApiQueryImageInfo now also returns imageinfo for redirects.
10205* list=alltransclusions added to enumerate every instance of page embedding
10206* list=alllinks & alltransclusions now allow both 'from' and 'continue' in
10207  the same query. When both are present, 'from' is simply ignored.
10208* list=alllinks & alltransclusions now allow 'unique' in generators, to yield
10209  a list of all link/template target pages instead of source pages.
10210* BREAKING CHANGE: list=logevents output format changed for details of some log
10211  types. Specifically, details that were formerly reported under a key like
10212  "4::foo" will now be reported under a key of simply "foo".
10213* BREAKING CHANGE: '??_badcontinue' error code was changed to '??badcontinue'
10214  for all query modules.
10215* ApiQueryBase adds 'badcontinue' error code if module has 'continue' parameter.
10216* (bug 35885) Removed version parameter and all getVersion() methods.
10217* action=options now takes a "resetkinds" option, which allows only resetting
10218  certain types of preferences when the "reset" option is set.
10219* (bug 36751) ApiQueryImageInfo now returns imageinfo for the redirect target
10220  when queried with &redirects=.
10221* (bug 31849) ApiQueryImageInfo no longer gets confused when asked for info on
10222  a redirect and its target.
10223* (bug 43849) ApiQueryImageInfo no longer throws exceptions with ForeignDBRepo
10224  redirects.
10225* On error, any warnings generated before that error will be shown in the
10226  result.
10227* action=help supports generalized submodules (modules=query+value),
10228  querymodules obsolete
10229* ApiQueryImageInfo continuation is more reliable. The only major change is
10230  that the imagerepository property will no longer be set on page objects not
10231  processed in the current query (i.e. non-images or those skipped due to
10232  iicontinue).
10233* Add supports for all pageset capabilities - generators, redirects,
10234  converttitles to action=purge and action=setnotificationtimestamp.
10235* (bug 43251) prop=pageprops&ppprop= now accepts multiple props to query.
10236* ApiQueryImageInfo will now limit the number of calls to File::transform made
10237  in any one query. If there are too many, iicontinue will be returned.
10238* action=query&meta=siteinfo&siprop=general will now return the regexes used for
10239  link trails and link prefixes. Added for Parsoid support.
10240* Added an API query module list=pageswithprop, which lists pages using a
10241  particular page property.
10242* Added an API query module list=pagepropnames, which lists all page prop names
10243  currently in use on the wiki.
10244* (bug 44921) ApiMain::execute() will now return after the CORS check for an
10245  HTTP OPTIONS request.
10246* (bug 44923) action=upload works correctly if the entire file is uploaded in
10247  the first chunk.
10248* Added 'continue=' parameter to streamline client iteration over complex query
10249  results
10250* (bug 44909) API parameters may now be marked as type "upload", which is now
10251  used for action=upload's 'file' and 'chunk' parameters. This type will raise
10252  an error during parameter validation if the parameter is given but not
10253  recognized as an uploaded file.
10254* (bug 44244) prop=info may now return the number of people watching each page.
10255* (bug 33304) list=allpages will no longer return duplicate entries when
10256  querying protection.
10257* (bug 33304) list=allpages will now find really old indefinite protections.
10258* (bug 45937) meta=allmessages will report a syntactically invalid lang as a
10259  proper error instead of as an uncaught exception.
10260* (bug 25325) added support for wlshow filtering (bots/anon/minor/patrolled)
10261  to action=feedwatchlist
10262* WDDX formatted output will actually be formatted (and normal output will no
10263  longer be), and will no longer choke on booleans.
10264
10265=== API internal changes in 1.21 ===
10266* For debugging only, a new global $wgDebugAPI removes many API restrictions
10267  when true.
10268  Never use on the production servers, as this flag introduces security holes.
10269  Whenever enabled, a warning will also be added to all output.
10270* ApiModuleManager now handles all submodules (actions,props,lists) and
10271  instantiation
10272* Query stores prop/list/meta as submodules
10273* ApiPageSet can now be used in any action to process titles/pageids/revids or
10274  any generator.
10275* BREAKING CHANGE: ApiPageSet constructor now has two params instead of three,
10276  with only the first one keeping its meaning. ApiPageSet is now derived from
10277  ApiBase.
10278* BREAKING CHANGE: ApiQuery::newGenerator() and executeGeneratorModule() were
10279  deleted.
10280* ApiQueryGeneratorBase::setGeneratorMode() now requires a pageset param.
10281* $wgAPIGeneratorModules is now obsolete and will be ignored.
10282* Added flags ApiResult::OVERRIDE and ADD_ON_TOP to setElement() and addValue()
10283* Internal API calls will now include <warnings> in case of unused parameters
10284
10285=== Languages updated in 1.21 ===
10286
10287MediaWiki supports over 350 languages. Many localisations are updated
10288regularly. Below only new and removed languages are listed, as well as
10289changes to languages because of Bugzilla reports.
10290
10291* South Azerbaijani (azb) added.
10292* (bug 30040) Autonym for nds-nl is now 'Nedersaksies' (was 'Nedersaksisch').
10293* (bug 45436) Autonym for pi (Pali) is now 'पालि' (was ''पाळि').
10294* (bug 34977) Now formatted numbers in Spanish use space as separator
10295  for thousands, as mandated by the Real Academia Española.
10296* (bug 35031) Kurdish formatted numbers now use period and comma
10297  as separators for thousands and decimals respectively.
10298
10299=== Other changes in 1.21 ===
10300* BREAKING CHANGE: (bug 44385) Removed the jquery.collapsibleTabs module and
10301  moved it to the Vector extension. It was entirely Vector-extension-specific,
10302  deeply interconnected with the extension, and this functionality really
10303  belongs to the extension instead of the skin anyway. In the unlikely case you
10304  were using it, you have to either copy it to your extension, or install the
10305  Vector extension (and possibly disable its features using config settings if
10306  you don't want them).
10307* Experimental IBM DB2 support was removed due to lack of interest and
10308  maintainership
10309* BREAKING CHANGE: Filenames of maintenance scripts were standardized into
10310  lowerCamelCase format, and made more explicit:
10311  - clear_stats.php -> clearCacheStats.php
10312  - clear_interwiki_cache.php -> clearInterwikiCache.php
10313  - initStats.php -> initSiteStats.php
10314  - proxy_check.php -> proxyCheck.php
10315  - stats.php -> showCacheStats.php
10316  - showStats.php -> showSiteStats.php.
10317  Class names were renamed accordingly:
10318  - clear_stats -> ClearCacheStats
10319  - InitStats -> InitSiteStats
10320  - CacheStats -> ShowCacheStats
10321  - ShowStats -> ShowSiteStats.
10322* BREAKING CHANGE: (bug 38244) Removed the mediawiki.api.titleblacklist module
10323  and moved it to the TitleBlacklist extension.
10324
10325= MediaWiki 1.20 =
10326
10327== MediaWiki 1.20.8 ==
10328This is a security release of the MediaWiki 1.20 branch.
10329
10330=== Changes since 1.20.7 ===
10331* (bug 53032) SECURITY: Don't cache when a call could autocreate
10332* (bug 55332) SECURITY: Improve css javascript detection
10333* (bug 49717) Fix behaviour $wgVerifyMimeType = false; in Upload
10334* Fix comma errors in various js files
10335* Translations
10336
10337== MediaWiki 1.20.7 ==
10338This is a security release of the MediaWiki 1.20 branch.
10339
10340=== Changes since 1.20.6 ===
10341* SECURITY: Fix extension detection with 2 .'s
10342* SECURITY: Token-getting functions will fail when using jsonp callbacks.
10343* SECURITY: Sanitize ResourceLoader exception messages
10344* Purge upstream caches when deleting file assets.
10345
10346== MediaWiki 1.20.6 ==
10347This is a security and maintenance release of the MediaWiki 1.20 branch.
10348
10349=== Changes since 1.20.5 ===
10350* (bug 48306) SECURITY: Run file validation checks on chunked uploads, and
10351  chunks of upload, during the upload process.
10352* (bug 44327) mediawiki.user: Use session ID instead of 1-year cross-session
10353  cookies
10354* (bug 47202) wikibits: FF2Fixes.css should not be loaded in Firefox 20.
10355* (bug 31044) Make ResourceLoader behave in read-only mode
10356
10357== MediaWiki 1.20.5 ==
10358This is a security and maintenance release of the MediaWiki 1.20 branch.
10359
10360=== Changes since 1.20.4 ===
10361* (bug 46590) Add hook AbortChangePassword to Special:ChangePassword
10362* (bug 47304) SECURITY: Check SVG xml encoding against whitelist
10363* Localisation updates from http://translatewiki.net.
10364* mwdocgen.php: Implement --version option.
10365* Remove svnstat stuff used in Doxygen generation
10366* (bug 43594) Correctly suppress warnings that were missed after the upstream
10367* PHP change to E_STRICT being included in E_ALL.
10368
10369== MediaWiki 1.20.4 ==
10370This is a security release of the MediaWiki 1.20 branch.
10371
10372=== Changes since 1.20.3 ===
10373* (bug 47251) SECURITY: Disable external entities in Import
10374* (bug 46859) SECURITY: Disable external entities in XMLReader
10375* (bug 46084) SECURITY: Sanitize $limitReport before outputting
10376
10377== MediaWiki 1.20.3 ==
10378This is a security and maintenance release of the MediaWiki 1.20 branch.
10379
10380=== Changes since MediaWiki 1.20.2 ===
10381* New preference type - 'api'. Preferences of this type are not shown on
10382  Special:Preferences, but are still available via the action=options API.
10383  (Unbreaks MLEB.)
10384* (bug 44010) Context is passed to UserGetLanguageObject.
10385* The recursion guard on RequestContext::getLanguage() was weakened.
10386* (bug 40585) Don't drop 'step="any"' in HTML input fields.
10387* (bug 44024) Fixed problems in ObjectCache when using XCache.
10388* (bug 44010) FauxRequest leaked cookie data from primary request.
10389* (bug 44135/bug 42441) Pass '2' instead of 'true' to CURLOPT_SSL_VERIFYHOST
10390* (bug 43518) API action=unblock should return the user name, not the full user
10391  object
10392* (bug 45355) Prevent read of arbitrary files through mwdoc-filter.php
10393
10394== MediaWiki 1.20.2 ==
10395This is a maintenance release of the MediaWiki 1.20 branch
10396
10397=== Changes since MediaWiki 1.20.1 ===
10398* (bug 42638) Fix API action=options&reset=1 & unit tests.
10399* (bug 42370) Fixed backport of 60cc060 to use mDoneWrites — caused
10400* (bug 42592) User rights, preferences and other things are not saving in
10401  1.20.1.
10402
10403== MediaWiki 1.20.1 ==
10404This is a security release of the MediaWiki 1.20 branch
10405
10406=== Changes since 1.20.0 ===
10407* (bug 42202) Validate options to prevent html injection
10408* (bug 40995) Prevent session fixation in Special:UserLogin (CVE-2012-5391)
10409* (bug 41400) Prevent linker regex from exceeding PCRE backtrack limit
10410* Javscript Lint fixes
10411* (bug 40632) Remove CleanupPresentationalAttributes feature
10412* [Database] Fixed case where trx idle callbacks might be lost.
10413
10414== MediaWiki 1.20.0 ==
10415
10416=== PHP 5.3 now required ===
10417Since 1.20, the lowest supported version of PHP is now 5.3.2. Please
10418upgrade PHP if you have not done so prior to upgrading MediaWiki.
10419
10420=== Configuration changes in 1.20 ===
10421* $wgGitRepositoryViewers defines a mapping from Git remote repository to the
10422  Gitweb instance URL used in Special:Version.
10423* `$wgUsePathInfo = true;` is no longer needed to make $wgArticlePath work on
10424  servers using like nginx, lighttpd, and apache over fastcgi. MediaWiki now
10425  always extracts path info from REQUEST_URI if it's available.
10426* The user right 'upload_by_url' is no longer given to sysops by default.
10427  This only affects installations which have $wgAllowCopyUploads set to true.
10428* Removed f-prot support from $wgAntivirusSetup.
10429* New variable $wgDBerrorLogTZ to provide dates in the error log in a
10430  different timezone than the wiki timezone set by $wgLocaltimezone.
10431* New variables $wgDBssl and $wgDBcompress to enable SSL and compression for
10432  database connections, if either are available for the selected DB type.
10433* $wgUseCombinedLoginLink now defaults to false, making MediaWiki output
10434  separate login and create account links by default.
10435
10436=== New features in 1.20 ===
10437* Added TitleIsAlwaysKnown hook which gets called when determining if a page
10438  exists.
10439* Added NamespaceIsMovable hook which gets called when determining if pages in a
10440  certain namespace can be moved.
10441* Added SpecialPageBeforeExecute hook which gets called before
10442  SpecialPage::execute.
10443* Added SpecialPageAfterExecute hook which gets called after
10444  SpecialPage::execute.
10445* Added ORMTable, ORMRow and ORMResult classes for additional abstraction of
10446  database interaction.
10447* Added CacheHelper and associated SpecialCachedPage and CachedAction helper
10448  classes.
10449* (bug 32341) Add upload by URL domain limitation.
10450* &useskin=default will now always display the default skin. Useful for users
10451  with a preference for the non-default skin to look at something using the
10452  default skin.
10453* (bug 27619) Remove preference option to display broken links as link?
10454* (bug 34896) jQuery JSON plugin upgraded to v2.3 (2011-09-17).
10455* (bug 34302) Add CSS classes to email fields in user preferences.
10456* Introduced $wgDebugDBTransactions to trace transaction status (currently
10457  PostgreSQL only).
10458* (bug 23795) Add parser itself to ParserMakeImageParams hook.
10459* Introduce a cryptographic random number generator source api for use when
10460  generating various tokens.
10461* (bug 30963) Option on Special:Prefixindex and Special:Allpages to not show
10462  redirects.
10463* (bug 18062) New message when edit or create the local page of a shared file.
10464* (bug 22870) Separate interface message when creating a page.
10465* (bug 17615) nosummary option should be reassigned on preview/captcha.
10466* (bug 34355) Add a variable and parser function for the namespace number.
10467* (bug 35649) Special:Version now shows hashes of extensions checked out from
10468  git.
10469* (bug 35728) Git revisions are now linked on Special:Version.
10470* "Show Changes" on default messages shows now diff against default message text
10471* (bug 23006) create #speciale parser function.
10472* generateSitemap can now optionally skip redirect pages.
10473* (bug 27757) New API command just for retrieving tokens (not page-based).
10474* Added GitViewers hook for extensions using external git repositories to have a
10475  web-based repository viewer linked to from Special:Version.
10476* Memcached debug logs can now be sent to their own file logs by setting
10477  $wgDebugLogFile['memcached'] to some filepath.
10478* (bug 35685) api.php URL and other entry point URLs are now listed on
10479  Special:Version
10480* Edit notices can now be translated.
10481* jQuery upgraded to 1.8.2.
10482* jQuery UI upgraded to 1.8.23.
10483* QUnit upgraded from v1.2.0 to v1.10.0.
10484* (bug 37604) jquery.cookie upgraded to 2011 version.
10485* (bug 22887) Add warning and tracking category for preprocessor errors
10486* (bug 31704) Allow selection of associated namespace on the watchlist
10487* (bug 5445) Now remove autoblocks when a user is unblocked.
10488* Added $wgLogExceptionBacktrace, on by default, to allow logging of exception
10489  backtraces.
10490* Added device detection for determining device capabilities.
10491* QUnit.newMwEnvironment now supports passing a custom setup and/or teardown
10492  function. Arguments signature has changed. First arguments is now an options
10493  object of which 'config' can be a property. Previously 'config' itself was the
10494  first and only argument.
10495* New getCreator and getOldestRevision methods added to WikiPage class
10496* (bug 4220) the XML dump format schema now have unique identity constraints
10497  for page and revision identifiers. Patch by Elvis Stansvik.
10498* cleanupSpam.php now can delete spam pages if --delete was specified instead of
10499  blanking them.
10500* Added new hook ChangePasswordForm to allow adding of additional fields in
10501  Special:ChangePassword
10502* Added new function getDomain to AuthPlugin for getting a user's domain
10503* (bug 23427) New magic word {{PAGEID}} which gives the current page ID.
10504  Will be null on previewing a page being created.
10505* (bug 37627) UserNotLoggedIn() exception to show a generic error page whenever
10506  a user is not logged in.
10507* Watched status in changes lists are no longer indicated by <strong></strong>
10508  tags with class "mw-watched". Instead, each line now has a class
10509  "mw-changeslist-line-watched" or "mw-changeslist-line-not-watched", and the
10510  title itself is surrounded by <span></span> tags with class "mw-title".
10511* Added ContribsPager::reallyDoQuery hook allowing extensions to data to
10512  MyContribs
10513* Added new hook ParserAfterParse to allow extensions to affect parsed output
10514  after the parse is complete but before block level processing, link holder
10515  replacement, and so on.
10516* (bug 34678) Added InternalParseBeforeSanitize hook which gets called during
10517  Parser's internalParse method just before the parser removes
10518  unwanted/dangerous HTML tags.
10519* Added new hook AfterFinalPageOutput to allow modifications to buffered page
10520  output before sent to the client.
10521* (bug 36783) Implement jQuery Promise interface in mediawiki.api module.
10522* Make dates in sortable tables sort according to the page content language
10523  instead of the site content language
10524* (bug 37926) Deleterevision will no longer allow users to delete log entries,
10525  the new deletelogentry permission is required for this.
10526* (bug 14237) Allow PAGESINCATEGORY to distinguish between 'all', 'pages',
10527  'files' and 'subcats'
10528* (bug 38362) Make Special:Listuser includeable on wiki pages.
10529* Added support in jquery.localize for placeholder attributes.
10530* (bug 38151) Implemented mw.user.getRights for getting and caching the current
10531  user's user rights.
10532* Session storage can now configured independently of general object cache
10533  storage, by using $wgSessionCacheType. $wgSessionsInMemcached has been
10534  renamed to $wgSessionsInObjectCache, with the old name retained for backwards
10535  compatibility. When this feature is enabled, the expiry time can now be
10536  configured with $wgObjectCacheSessionExpiry.
10537* Added a Redis client for object caching.
10538* Implemented mw.user.getGroups for getting and caching user groups.
10539* (bug 37830) Added $wgRequirePasswordforEmailChange to control whether password
10540  confirmation is required for changing an email address or not.
10541* HTMLForm mutators can now be chained (they return $this)
10542* A new message, "api-error-filetype-banned-type", is available for formatting
10543  API upload errors due to the file extension blacklist.
10544* New hook 'ParserTestGlobals' allows to set globals before running parser
10545  tests.
10546* Allow importing pages as subpage.
10547* Add lang and hreflang attributes to language links on Login page.
10548* (bug 22749) Create Special:MostInterwikis.
10549* Show change tags when transclude Special:Recentchanges(linked) or
10550  Special:Newpages.
10551* (bug 23226) Add |class= parameter to image links in order to add class(es) to
10552  HTML img tag.
10553* (bug 39431) SVG animated status is now shown in long description.
10554* (bug 39376) jquery.form upgraded to 3.14.
10555* SVG files will now show the actual width in the SVG's specified units
10556  in the metadata box.
10557* Added ResourceLoader module "jquery.jStorage" (v0.3.0, http://jStorage.info/).
10558* (bug 39273) Added AJAX support for "Show changes" (diff) in LivePreview.
10559* Added ResourceLoader module "jquery.badge".
10560* mw.util.$content now points to the overall content area in the skin rather
10561  than just page text content area. If you need the old behavior please use
10562  $( '#mw-content-text').
10563* jsMessage has been replaced with a floating bubble notification system
10564  complete with auto-hide, multi-message support, and message replacement tags.
10565* jquery.messageBox which appears to be unused by both core and extensions has
10566  been removed.
10567* (bug 34939) Made link parsing insensitive ([HttP://]).
10568* (bug 40072) Add CSS classes to items in output of ChangesList pages.
10569* Added $wgCopyUploadProxy global to define which proxy to use for copy
10570  uploads.
10571* (bug 40448) mediawiki.legacy.mwsuggest has been replaced with a new module,
10572  mediawiki.searchSuggest, based on SimpleSearch from Extension:Vector.
10573
10574=== Known issues in 1.20.0 ===
10575These are issues that we're targeting to be fixed in a later release
10576in the 1.20 series.  Issues may be added or removed from this list as
10577we see fit.  For now, it is comprised of those bugs on the 1.20.0
10578milestone in Bugzilla.
10579
10580* (bug 35894): Reports of secret key generation "hanging" on windows
10581    This is probably a bug that has been fixed in PHP.  If you run
10582    into this, try upgrading your PHP.
10583* (bug 38334): PHP Notice:  Undefined index: href in /www/w/skins/Vector.php on
10584  line 416
10585    We think this is a problem in some extension.  If you see this,
10586    try disabling your extensions and check out the logging patch on
10587    this bug.  Or try this patch:
10588    <https://gerrit.wikimedia.org/r/#/c/27937/1/skins/Vector.php>
10589* (bug 39268): [Regression] Toolbar inserts in main textarea only (instead of
10590  the focussed textarea)
10591    This should only be an issue if you are using the ProofreadPage
10592    extension.
10593* (bug 40641): Clicking "others" in Special:Version asks to download a file
10594    If you encounter this, you can tell your webserver to serve the
10595    CREDITS file with text/plain MIME type to fix it.
10596
10597=== Bug fixes in 1.20 ===
10598* (bug 40939): [Regression] InfoAction: Call to a member function getUserText()
10599  on a non-object
10600* (bug 40780): searchsuggest-containing line ("containing...") doesn't include
10601  the entered text
10602* (bug 37714): [Regression] Incomplete log entries
10603* (bug 27202): API: Add timestamp sort to list=allimages
10604* (bug 30245) Use the correct way to construct a log page title.
10605* (bug 34237) Regenerate an empty user_token and save to the database
10606  when we try to set the user's cookies for login.
10607* (bug 32210) New edit emails for watched pages always provide a link to the
10608  edit which triggered the mail.
10609* (bug 12021) Added user talk link on Special:Listusers.
10610* (bug 34445) section edit and TOC hide/show links are excluded from selection
10611  and copy/paste on supporting browsers.
10612* (bug 34428) Fixed incorrect hash mismatch errors in the DiffHistoryBlob
10613  history compression method.
10614* (bug 34702) Localised parentheses are now used in more special pages.
10615* (bug 34723) When editing a script page on a RTL wiki the textbox should be
10616  LTR.
10617* (bug 34762) Calling close() on a DatabaseBase object now clears the
10618  connection.
10619* (bug 34863) Show deletion log extract on non-existent file pages if
10620  applicable.
10621* (bug 28019) Let ?preloadtitle=foo be passed on to target of
10622  Special:MyPage and Special:MyTalk.
10623* (bug 34929) Show the correct diff when a section edit is rejected by the spam
10624  filter.
10625* (bug 15816) Add a switch for SETting the search_path (Postgres).
10626* (bug 34521) Returning to the previous page after logging in loses any array-
10627  valued parameters in the query string.
10628* (bug 34735) Updated compressOld.php documentation to mention the different
10629  usages of -s and -n parameters depending on compression type.
10630* (bug 13896) Rendering of devanagari numbers in automatic '#' number lists.
10631* (bug 33689) Upgrade to 1.19 on Postgres fails due to incomplete query when
10632  trying to defer foreign key for externallinks.
10633* (bug 32748) Printer friendly version of article decode Unicode chars as a
10634  pretty IRI in footer.
10635* Removed white border around thumbnails in galleries.
10636* (bug 31236) "Next" and "Previous" buttons are shown incorrectly in
10637  an RTL environment.
10638* (bug 35749) Updated maintenance/checkSyntax.php to use Git instead of
10639  Subversion when invoked with the --modified option.
10640* (bug 35069) On history pages, the " . . " separator after the number of
10641  characters changed in a revision is now suppressed if no text would follow.
10642* (bug 18704) Add a unique CSS class or ID to the tagfilter table row at
10643  RecentChanges
10644* (bug 33564) transwiki import sometimes result in invalid title.
10645* (bug 35572) Blocks appear to succeed even if query fails due to wrong DB
10646  structure
10647* (bug 31757) Add a word-separator between help-messages in HTMLForm
10648* (bug 30410) Removed deprecated $wgFilterCallback and the 'filtered' API error.
10649* (bug 32604) Some messages needs escaping of wikitext inside username.
10650* (bug 36537) Rename wfArrayToCGI to wfArrayToCgi for consistency with
10651  wfCgiToArray.
10652* (bug 25946) The message on the top of Special:RecentChanges is now displayed
10653  in user language instead of content language.
10654* (bug 35264) Wrong type used for <ns> in export.xsd
10655* (bug 24985) Use $wgTmpDirectory as the default temp directory so that people
10656  who don't have access to /tmp can specify an alternative.
10657* (bug 27283) SqlBagOStuff breaks PostgreSQL transactions.
10658* (bug 35727) mw.Api ajax() should put token parameter last.
10659* (bug 37708) mw.Uri.clone() should make a deep copy.
10660* (bug 38024) ResourceLoader should not create empty stylesheets for modules
10661  that don't have stylesheets.
10662* (bug 36812) Special:ActiveUsers "Hide bots" should hide users from any group
10663  having the "bot" user right, instead of just the default "bot" user group.
10664* (bug 35082) mw.util.addPortletLink incorrectly adds link to mutiple <ul> tags.
10665* (bug 36991) jquery.tablesorter should extract date sort format from date
10666  string instead of global config. Dates like "April 1 2012" and "1 April 2012"
10667  now sort correctly regardless of the content language's DefaultDateFormat.
10668* (bug 31895) mw.loader mode now correct when triggered from a $.fn.ready
10669  handler that is bound before mediawiki.js's handler (e.g. browser-userscripts
10670  like greasemonkey).
10671* (bug 38152) jquery.tablesorter: Use .data() instead of .attr(), so that live
10672  values are used instead of just the fixed values from when the tablesorter
10673  was initialized.
10674* (bug 38093) Gender of changed user groups missing in Special:Log/rights
10675* (bug 35893) Special:Block needs to load mediawiki.special.block.js.
10676* (bug 37331) ResourceLoader modules sometimes execute twice in Firefox
10677* (bug 31644) GlobalUsage, CentralAuth and AbuseLog extensions should not use
10678  insecure links to foreign wikis in the WikiMap.
10679* (bug 36073) Avoid duplicate element IDs on File pages.
10680* (bug 25095) Special:Categories should also include the first relevant item
10681  when "from" is filled.
10682* (bug 35526) jquery.tablesorter now uses a stable sort.
10683* (bug 38953) --memory-limit switch not working for runJobs.php.
10684* (bug 33037) Make subpage of Special:newfiles control how many files
10685  are returned, like in previous versions.
10686* (bug 36524) "Show" options on Special:RecentChanges and
10687  Special:RecentChangesLinked are now remembered between successive clicks.
10688* (bug 26069) Page title is no longer "Error" for all error pages.
10689* (bug 39297) Show warning if thumbnail of animated image will not be animated.
10690* (bug 38249) Parser will throw an exception instead of outputting gibberish if
10691  PCRE is compiled without support for unicode properties.
10692* (bug 30390) Suggested file name on Special:Upload should not contain
10693  illegal characters.
10694* EXIF below sea level GPS altitude data is now shown correctly.
10695* (bug 39284) jquery.tablesorter should not consider "."" or "?"" to be a
10696  currency.
10697* (bug 39273) "Show changes" should not be incorrectly displayed in the Live
10698  Preview state.
10699* Made body-content lang attribute honor the variant language when it is set.
10700* (bug 36761) "Mark pages as visited" now submits previously established filter
10701  options.
10702* (bug 39635) PostgreSQL LOCK IN SHARE MODE option is a syntax error.
10703* (bug 36329) Accesskey tooltips for Firefox 14 on Mac should use "ctrl-option-"
10704  prefix.
10705* (bug 32552) Drop unused database field cat_hidden from table category.
10706* (bug 24502) Do not allow multiple language links to the same language.
10707* (bug 40214) Category pages no longer use deprecated "width" HTML attribute.
10708* (bug 39941) Add missing stylesheets to the installer pages
10709* In HTML5 mode, allow new input element types values (such as color, range..)
10710* (bug 36151) mw.Title: Don't limit extension in title parsing.
10711* (bug 38158) jquery.byteLimit sometimes causes an unexpected 0 maxLength being
10712  enforced.
10713* (bug 38163) jquery.byteLimit incorrectly limits input when using methods other
10714  than basic per-char typing.
10715* (bug 34495) patrol log now credit the user patrolling (instead of patrolled
10716  user).
10717* (bug 31676) ResourceLoader should work around IE stylesheet limit.
10718* (bug 40498) ResourceLoader should not output an empty "@media print { }"
10719  block.
10720* (bug 40500) ResourceLoader should not ignore media-type for urls in debug
10721  mode.
10722* (bug 40660) ResourceLoaderWikiModule should not convert "&nbsp;" to a space
10723  for pages from the MediaWiki-namespace.
10724* (bug 40329) (bug 40632) Removed CleanupPresentationalAttributes feature.
10725
10726=== API changes in 1.20 ===
10727* (bug 34316) Add ability to retrieve maximum upload size from MediaWiki API.
10728* (bug 34313) MediaWiki API intro message about "HTML format" should mention
10729  the format parameter.
10730* (bug 32384) Allow descending order for list=watchlistraw.
10731* (bug 31883) Limit of bkusers of list=blocks and titles of action=query is
10732  not documented in API help.
10733* (bug 32492) API now allows editing using pageid.
10734* (bug 32497) API now allows changing of protection level using pageid.
10735* (bug 32498) API now allows comparing pages using pageids.
10736* (bug 30975) API import of pages with invalid characters in this wiki leads to
10737  Fatal Error.
10738* (bug 30488) API now allows listing of backlinks/embeddedin/imageusage per
10739  pageid.
10740* (bug 34927) Output media_type for list=filearchive.
10741* (bug 28814) add properties to output of action=parse.
10742* (bug 33224) add variants of content language to meta=siteinfo.
10743* (bug 32643) action=purge with forcelinkupdate no longer crashes when ratelimit
10744  is reached.
10745* The paraminfo module now also contains result properties for most modules.
10746* (bug 32348) Allow descending order for list=alllinks.
10747* (bug 31777) Upload unknown error ``fileexists-forbidden''.
10748* (bug 32382) Allow descending order for list=iwbacklinks.
10749* (bug 32381) Allow descending order for list=backlinks, list=embeddedin and
10750  list=imageusage.
10751* (bug 32383) Allow descending order for list=langbacklinks.
10752* API meta=siteinfo can now return the list of known variable IDs.
10753* (bug 35980) list=deletedrevs now honors drdir correctly in "all" mode
10754  (mode #3).
10755* (bug 29290) API avoids mangling fields in continuation parameters
10756* (bug 36987) API avoids mangling fields in continuation parameters
10757* (bug 30836) siteinfo prop=specialpagealiases will no longer return nonexistent
10758  special pages
10759* (bug 38190) Add "required" flag to some token params for hint in api docs.
10760* (bug 27567) Add file repo support to prop=duplicatefiles.
10761* (bug 27610) Add archivename for non-latest image version to list=filearchive
10762* (bug 38231) Add xml parse tree to action=parse.
10763* Watchlist notification timestamp may be queried by page and may be updated via
10764  the API.
10765* (bug 38904) prop=revisions&rvstart=... no longer blows up when continuing.
10766* (bug 39032) ApiQuery generates help in constructor.
10767* (bug 11142) Improve file extension blacklist error reporting in API upload.
10768* (bug 39665) List of query generators is now not built using reflection,
10769  instead it is defined in code.
10770* (bug 35993) Deprecated gettoken parameter - support will be removed in 1.22.
10771
10772=== Languages updated in 1.20 ===
10773
10774MediaWiki supports over 350 languages. Many localisations are updated
10775regularly. Below only new and removed languages are listed, as well as
10776changes to languages because of Bugzilla reports.
10777
10778* Emilian (egl) added.
10779* Tornedalen Finnish (fit) added.
10780* Mizo (lus) added.
10781* Santali (sat) added.
10782* (bug 34192) Namespace gender aliases for Albanian languages (sq & aln).
10783* (bug 35541) Namespace gender aliases for Croatian (hr).
10784* (bug 36012) Space in $separatorTransformTable should be non-breaking in
10785  Portuguese, Esperanto and Udmurt.
10786* Turoyo (tru) added.
10787* Cyrillic-Latin language converter added for Uzbek (uz).
10788
10789=== Other changes in 1.20 ===
10790* The user_token field is now left empty until a user attempts to login and
10791  cookies need to be set. It is also now possible to reset every user's
10792  user_token simply by clearing the values in the user_token column.
10793* Removed ./tests/qunit/index.html from core. It wasn't actively maintained and
10794  has been made obsolete when [[Special:JavaScriptTest/qunit]] was introduced,
10795  which actually uses ResourceLoader, LocalSettings and the Skin.
10796* Removed $wgDBtransactions global. This was only checked in one class
10797  and only applies to MyISAM or similar DBs. Those should only be used
10798  for archived sites anyway. We can't get edit conflicts on such sites,
10799  so the WikiPage code wasn't useful there either.
10800* Deprecated mw.user.name in favour of mw.user.getName.
10801* Deprecated mw.user.anonymous in favour of mw.user.isAnon.
10802* Deprecated DatabaseBase functions newFromParams(), newFromType(), set(),
10803  quote_ident(), and escapeLike() were removed.
10804* Use of __DIR__ instead of dirname( __FILE__ ).
10805* OutputPage::wrapWikiMsg() no longer supports the 'options' parameter. It was
10806  not used and complicated migration to Message class.
10807* Live preview functionality has been improved and moved into the
10808 'mediawiki.action.edit.preview' module. The old 'mediawiki.legacy.preview'
10809  module has been removed.
10810* (bug 40448) Removed mediawiki.legacy.mwsuggest module, and removed the
10811  following that has become obsolete:
10812  - globals $wgEnableMWSuggest and $wgMWSuggestTemplate.
10813  - mw.config.values wgMWSuggestTemplate and wgSearchNamespaces.
10814  - method SearchEngine::getMWSuggestTemplate().
10815
10816== MediaWiki 1.19 ==
10817
10818== MediaWiki 1.19.24 ==
10819
10820This is a security and maintenance release of the MediaWiki 1.19 branch.
10821
10822=== Changes since 1.19.23 ===
10823
10824* ({{bug|T85848}}, {{bug|T71210}}) SECURITY: Don't parse XMP blocks that
10825contain XML entities, to prevent various DoS attacks.
10826* ({{bug|T88310}}) SECURITY: Always expand xml entities when checking SVG's.
10827* ({{bug|T73394}}) SECURITY: Escape > in Html::expandAttributes to prevent XSS.
10828* ({{bug|T85855}}) SECURITY: Don't execute another user's CSS or JS on preview.
10829* ({{bug|T85349}}, {{bug|T85850}}, {{bug|T86711}}) SECURITY: Multiple issues
10830fixed in SVG filtering to prevent XSS and protect viewer's privacy.
10831
10832== MediaWiki 1.19.23 ==
10833
10834This is a security and maintenance release of the MediaWiki 1.19 branch.
10835
10836=== Changes since 1.19.22 ===
10837
10838* (bug T76686) [SECURITY] thumb.php outputs wikitext message as raw HTML, which
10839could lead to xss. Permission to edit MediaWiki namespace is required to
10840exploit this.
10841* (bug T74222) The original patch for T74222 was reverted as unnecessary.
10842* Add missing $ in front of variable in OutputPage.php
10843
10844== MediaWiki 1.19.22 ==
10845
10846This is a security and maintenance release of the MediaWiki 1.19 branch.
10847
10848=== Changes since 1.19.21 ===
10849
10850* ({{bug|66776}}, {{bug|71478}}) SECURITY:  User PleaseStand reported a way to
10851inject code into API clients that used format=php to process pages that
10852underwent flash policy mangling. This was fixed along with improving how the
10853mangling was done for format=json, and allowing sites to disable the mangling
10854using $wgMangleFlashPolicy.
10855* ({{bug|72222}}) SECURITY: Do not show log action when the entry is revdeleted
10856with DELETED_ACTION. NOTICE: this may be reverted in a future release pending a
10857public RFC about the desired functionality. This issue was reported by user
10858Bawolff.
10859* ({{bug|71621}}) Make allowing site-wide styles on restricted special pages a
10860config option.
10861* $wgMangleFlashPolicy was added to make MediaWiki's mangling of anything that
10862might be a flash policy directive configurable.
10863
10864== MediaWiki 1.19.21 ==
10865This is a maintenance release of the MediaWiki 1.19 branch.
10866
10867=== Changes since 1.19.20 ===
10868* (bug 67440) Allow classes to be registered properly from installer.
10869* (bug 47281) Fixed a dumpBackup.php error with --uploads
10870 --include-filesoptions: Unable to find the wrapper "mwstore".
10871* System administrators are encouraged to upgrade to this release or 1.22+ and
10872  produce a full data dump.
10873  https://www.mediawiki.org/wiki/Special:MyLanguage/Manual:Backing_up_a_wiki
10874* (bug 63049) Removed anonymous functions from ApiFormatBase, added in1.19.13 as
10875  part of the fix for bug 61362, for PHP 5.2 compatibility.
10876
10877== MediaWiki 1.19.20 ==
10878This is a security release of the MediaWiki 1.19 branch.
10879
10880=== Changes since 1.19.19 ===
10881* (bug 70672) SECURITY: OutputPage: Remove separation of css and js module
10882  allowance.
10883
10884== MediaWiki 1.19.19 ==
10885This is a security release of the MediaWiki 1.19 branch.
10886
10887=== Changes since 1.19.18 ===
10888* (bug 69008) SECURITY: Enhance CSS filtering in SVG files. Filter <style>
10889  elements; normalize style elements and attributes before filtering; add checks
10890  for attributes that contain css; add unit tests for html5sec and reported
10891  bugs.
10892
10893== MediaWiki 1.19.18 ==
10894This is a security release of the MediaWiki 1.19 branch.
10895
10896=== Changes since 1.19.17 ===
10897* (bug 68187) SECURITY: Prepend jsonp callback with comment.
10898* (bug 65778) SECURITY: Copy prevent-clickjacking between OutputPage and
10899  ParserOutput.
10900
10901== MediaWiki 1.19.17 ==
10902This is a security and maintenance release of the MediaWiki 1.19 branch.
10903
10904=== Changes since 1.19.16 ===
10905* (bug 65839) SECURITY: Prevent external resources in SVG files.
10906* (bug 66428) MimeMagic: Don't seek before BOF. This has weird side effects like
10907  only extracting the tail of the file partially or not at all.
10908
10909== MediaWiki 1.19.16 ==
10910This is a security release of the MediaWiki 1.19 branch.
10911
10912=== Changes since 1.19.15 ===
10913* (bug 65501) SECURITY: Don't parse usernames as wikitext on
10914  Special:PasswordReset.
10915
10916== MediaWiki 1.19.15 ==
10917This is a security and maintenance release of the MediaWiki 1.19 branch.
10918
10919=== Changes since 1.19.14 ===
10920Fixed resetting passwords.
10921* (bug 58640) Fixed a compatibility issue with PCRE 8.34 that caused pages to
10922  appear blank or with missing text.
10923
10924== MediaWiki 1.19.14 ==
10925This is a security and maintenance release of the MediaWiki 1.19 branch.
10926
10927=== Changes since 1.19.13 ===
10928* (bug 62497) SECURITY: Add CSRF token on Special:ChangePassword.
10929* (bug 62467) Set a title for the context during import on the cli.
10930
10931== MediaWiki 1.19.13 ==
10932This is a security and maintenance release of the MediaWiki 1.19 branch.
10933
10934=== Changes since 1.19.12 ===
10935* (bug 61362) SECURITY: API: Don't find links in the middle of api.php links.
10936* Use the correct branch of the extensions' git repositories.
10937
10938== MediaWiki 1.19.12 ==
10939This is a security release of the MediaWiki 1.19 branch.
10940
10941=== Changes since 1.19.11 ===
10942* (bug 60771) SECURITY: Disallow uploading SVG files using non-whitelisted
10943  namespaces. Also disallow iframe elements. * User will get an error including
10944  the namespace name if they use a non- whitelisted namespace.
10945* (bug 61346) SECURITY: Make token comparison use constant time. It seems like
10946  our token comparison would be vulnerable to timing attacks. This will take
10947  constant time.
10948
10949== MediaWiki 1.19.11 ==
10950This is a security release of the MediaWiki 1.19 branch.
10951
10952=== Changes since 1.19.10 ===
10953* (bug 60339) SECURITY: Sanitize shell arguments to DjVu files, and other media
10954  formats
10955
10956== MediaWiki 1.19.10 ==
10957This is a security release of the MediaWiki 1.19 branch.
10958
10959=== Changes since 1.19.9 ===
10960* (bug 57550) SECURITY: Disallow stylesheets in SVG Uploads
10961* (bug 58088) SECURITY: Don't normalize U+FF3C to \ in CSS Checks
10962* (bug 58472) SECURITY: Disallow -o-link in styles
10963* (bug 58553) SECURITY: Return error on invalid XML for SVG Uploads
10964* (bug 58699) SECURITY: Fix RevDel log entry information leaks
10965
10966== MediaWiki 1.19.9 ==
10967This is a security and maintenance release of the MediaWiki 1.19 branch.
10968
10969=== Changes since 1.19.8 ===
10970* (bug 53032) SECURITY: Don't cache when a call could autocreate
10971* (bug 55332) SECURITY: Improve css javascript detection
10972* (bug 49717) Fix behaviour $wgVerifyMimeType = false; in Upload
10973* Translations
10974
10975== MediaWiki 1.19.8 ==
109762013-09-03
10977
10978This is a security and maintenance release of the MediaWiki 1.19 branch.
10979
10980=== Changes since 1.19.7 ===
10981* SECURITY: Sanitize ResourceLoader exception messages
10982* SECURITY: Token-getting functions will fail when using jsonp callbacks.
10983* SECURITY: Fix extension detection with 2 .'s
10984* Allow a string other than '*' as condition for DatabaseBase::delete()
10985* Purge upstream caches when deleting file assets.
10986* jquery.tablesorter: Add missing dependency on jquery.mwExtension
10987
10988== MediaWiki 1.19.7 ==
109892013-05-21
10990
10991This is a security release of the MediaWiki 1.19 branch
10992
10993=== Changes since 1.19.6 ===
10994* (bug 48306) SECURITY: Run file validation checks on chunked uploads, and
10995  chunks of upload, during the upload process.
10996
10997== MediaWiki 1.19.6 ==
109982013-04-30
10999
11000This is a security and maintenance release of the MediaWiki 1.19 branch
11001
11002=== Changes since 1.19.5 ===
11003* (bug 47304) SECURITY: Check SVG xml encoding against whitelist
11004* (bug 46590) Added AbortChangePassword hook to allow extensions to abort
11005  password changes from Special:ChangePassword
11006* Localisation updates from http://translatewiki.net.
11007* mwdocgen.php: Implement --version option.
11008* Remove svnstat stuff used in Doxygen generation
11009* E_USER_DEPRECATED undefined prior to php 5.3
11010
11011== MediaWiki 1.19.5 ==
110122013-04-15
11013
11014This is a security and maintenance release of the MediaWiki 1.19 branch
11015
11016=== Changes since 1.19.4 ===
11017* (bug 47251) SECURITY: Disable external entities in Import
11018* (bug 46859) SECURITY: Disable external entities in XMLReader
11019* (bug 46084) SECURITY: Sanitize $limitReport before outputting
11020* (bug 43594) Fix notices displayed on PHP 5.4
11021* (bug 40585) Don't drop 'step="any"' in HTML input fields.
11022
11023== MediaWiki 1.19.4 ==
110242013-03-04
11025
11026This is a security release of the MediaWiki 1.19 branch
11027
11028=== Changes since 1.19.3 ===
11029* New preference type - 'api'. Preferences of this type are not shown on
11030  Special:Preferences, but are still available via the action=options API.
11031* (bug 44010) Context is passed to UserGetLanguageObject.
11032* The recursion guard on RequestContext::getLanguage() was weakened.
11033* (bug 44135/bug 42441) Pass '2' instead of 'true' to CURLOPT_SSL_VERIFYHOST
11034* (bug 43518) API action=unblock should return the user name, not the full user
11035  object
11036
11037== MediaWiki 1.19.3 ==
110382012-11-30
11039
11040This is a security release of the MediaWiki 1.19 branch
11041
11042=== Changes since 1.19.2 ===
11043* (bug 40995) Prevent session fixation in Special:UserLogin (CVE-2012-5391)
11044* (bug 41400) Prevent linker regex from exceeding PCRE backtrack limit
11045* Increase permitted runtime for testParserTest (only used for continuous
11046  integration).
11047* Updated messages translations from http://translatewiki.net/
11048
11049== MediaWiki 1.19.2 ==
11050
11051This is a security release of the MediaWiki 1.19 branch
11052
11053=== Changes since 1.19.1 ===
11054* (bug 39700) File: link to non-existing file can inject html
11055* (bug 39823) Hidden block text leaking to admins
11056* (bug 39184) LDAP password leakage
11057* (bug 39180) Disallow framing of api results
11058* (bug 37587) Enforce language codes to be html safe
11059* (bug 39824) Check global blocks on account creation
11060
11061== MediaWiki 1.19 ==
11062
11063MediaWiki 1.19 is a large release that contains many new features and bug
11064fixes. This is a summary of the major changes of interest to users.
11065You can consult the RELEASE-NOTES-1.19 file for the full list of changes in
11066this version.
11067
11068Our thanks go to everyone who helped to improve MediaWiki by testing the beta
11069release and submitting bug reports.
11070
11071=== Changes since 1.19.1 ===
11072* (bug 38406) Properly quote table names in DatabaseBase::tableName()
11073* (bug 38249) Parser will throw an exception instead of outputting gibberish if
11074  PCRE is compiled without support for unicode properties.
11075
11076=== Changes since 1.19.0 ===
11077* (bug 36568) Fixed "Illegal string offset 'LIMIT'" warnings in updater
11078* (bug 36938) Correctly escape uselang attribute to prevent xss
11079* Expanded Blacklist for SVG Files
11080
11081=== Changes since 1.19 beta 2 ===
11082* Special:Watchlist no longer sets links to feed when the user is anonymous.
11083* (bug 35961) Hash comparison should always be strict.
11084* Fix broken email confirmation expiration caused by MWCryptRand changes.
11085* (bug 35671) PHP Notice: Undefined index: gettoken in includes/api/ApiMain.php
11086  on line 598.
11087* (bug 36042) 'show' causes a fatal in blocks API.
11088
11089=== Changes since 1.19 beta 1 ===
11090* (bug 35014) Including a special page no longer sets the page's title to the
11091  included page
11092* (bug 35019) Edit summaries are no longer transformed in notification e-mails
11093* (bug 35152) Help message for e-mail is shown again in user preferences
11094* (bug 34887) $3 and $4 parameters are now substituted correctly in message
11095  "movepage-moved"
11096* (bug 34841) Edit links are no longer displayed when display old page versions
11097* (bug 34889) User name should be normalized on Special:Contributions
11098* (bug 35051) If heading has a trailing space after == then its name is not
11099  preloaded into edit summary on section edit
11100* (bug 31417) New ID mw-content-text around the actual page text, without
11101  categories, contentSub, ... The same div often also contains the class
11102  mw-content-ltr/rtl.
11103* (bug 35303) Proxy and DNS blacklist blocking works again
11104* (bug 22555) Remove or skip strip markers from tag hooks like &lt;nowiki&gt; in
11105  core parser functions which operate on strings, such as padleft.
11106* (bug 18295) Don't expose strip markers when a tag appears inside a link
11107  inside a heading.
11108* (bug 34212) ApiBlock/ApiUnblock allow action to take place without a token
11109  parameter present.
11110* (bug 34907) Fixed exposure of tokens through load.php that could have
11111  facilitated CSRF attacks.
11112* (bug 35317) CSRF in Special:Upload.
11113
11114=== Configuration changes in 1.19 ===
11115* Removed SkinTemplateSetupPageCss hook; use BeforePageDisplay instead.
11116* (bug 27132) movefile right granted by default to registered users.
11117* Default cookie lifetime ($wgCookieExpiration) is increased to 180 days.
11118* (bug 31204) Removed old user.user_options.
11119* $wgMaxImageArea now applies to jpeg files if they are not scaled with
11120  ImageMagick.
11121* Introduced $wgQueryPageDefaultLimit (defaults to 50) for the number of
11122  items to show by default on query pages (special pages such as Whatlinkshere).
11123* (bug 32470) Increase the length of ug_group.
11124* (bug 32239) Removed $wgEnableTooltipsAndAccesskeys.
11125* Removed $wgVectorShowVariantName.
11126* Removed $wgExtensionAliasesFiles. Use $wgExtensionMessagesFiles.
11127* Removed $wgResourceLoaderInlinePrivateModules , now always enabled.
11128
11129=== New features in 1.19 ===
11130* (bug 19838) Add ability to get all interwiki prefixes also if the interwiki
11131  cache is used.
11132* $wgDnsBlacklistUrls now accepts an array with url and key as the
11133  elements to work with DNSBLs that require keys, such as
11134  Project Honeypot.
11135* (bug 30022) Add support for custom loadScript sources to ResourceLoader.
11136* (bug 19052) Unicode space separator characters (Zs) now terminates external
11137  links and images links.
11138* (bug 30160) Add public method to mw.loader to get module names from registry.
11139* (bug 15558) Parameters to special pages included in wikitext can now be passed
11140  as with templates.
11141* Installer now issues a warning if mod_security is present.
11142* (bug 29455) Add support for a filter callback function in jQuery byteLimit
11143  plugin.
11144* Added two new GetLocalURL hooks to better serve extensions working on a
11145  limited type of titles.
11146* Added a --no-updates flag to importDump.php that skips updating the links
11147  tables.
11148* Most presentational html attributes like valign are now converted to inline
11149  css style rules. These attributes were removed from html5 and so we clean
11150  them up when $wgHtml5 is enabled. This can be disabled using
11151  $wgCleanupPresentationalAttributes.
11152* Magic words (time and number-formatting ones, plus DIRECTIONMARK, but not
11153  NAMESPACE) now depend on the page content language instead of the site
11154  language. In theory this sets the right magic words in system messages,
11155  although they are not used there.
11156* (bug 30451) Add page_props to RefreshLinks::deleteLinksFromNonexistent.
11157* (bug 30450) Clear page_props table on page deletion.
11158* Hook added to check for exempt from account creation throttle.
11159* (bug 30344) Add configuration variable for setting custom priorities when
11160  generating sitemaps.
11161* (bug 96170) Add array support for space-separated list attributes (like
11162  'class') in the Html helper class.
11163* (bug 26470) Add checkered background image on hover on files pages.
11164* (bug 30774) mediawiki.html: Add support for numbers and booleans in the
11165  attribute values and element contents.
11166* Conversion script between Tifinagh and Latin for the Tachelhit language.
11167* (bug 16755) Add options 'noreplace' and 'noerror' to {{DEFAULTSORT:...}}
11168  to stop it from replace an already existing default sort, and suppress error.
11169* (bug 18578) Rewrote revision delete related messages to allow better
11170  localisation.
11171* (bug 30364) LanguageConverter now depends on the page content language
11172  instead of the wiki content language.
11173* Jump links will now be usable in CSS-capable browsers instead of only
11174  in outdated text browsers.
11175* New common*.css files usable by skins instead of having to copy piles
11176  of generic styles from MonoBook or Vector's css.
11177* Some deprecated presentational html attributes will now be automatically
11178  converted to css.
11179* (bug 31297) Add support for namespaces in Special:RecentChanges subpage filter
11180  syntax.
11181* The default user signature now contains a talk link in addition to the user
11182  link.
11183* (bug 25306) Add link of old page title to MediaWiki:Delete_and_move_reason.
11184* Added hook BitmapHandlerCheckImageArea.
11185* (bug 30062) Add $wgDBprefix option to cli installer.
11186* getUserPermissionsErrors and getUserPermissionsErrorsExpensive hooks are now
11187  also called when checking for 'read' permission.
11188* Introduce $wgEnableSearchContributorsByIP which controls whether searching
11189  for an IP address redirects to the contributions list for that IP.
11190* (bug 8859) Database::update should take array of tables too.
11191* (bug 19698) Add "Inverse namespaces" option to Special:Contributions.
11192* (bug 24037) Add byte length of revision to Special:Contributions.
11193* (bug 1672) Added $wgDisableUploadScriptChecks to allow uploading of files
11194  containing HTML or JS. DISABLING THESE CHECKS IS VERY DANGEROUS.
11195* New path mappings can be added using the WebRequestPathInfoRouter hook
11196  and adding paths to the PathRouter.
11197* (bug 32666) Special:ActiveUsers now allows a subpage to be used as value for
11198  the "target" query parameter (eg. Special:ActiveUsers/Username).
11199* New JavaScript variable wgPageContentLanguage.
11200* Added new debugging toolbar, enabled with $wgDebugToolbar.
11201* Differences in the history page now uses slightly better colors for people
11202  perceiving colors differently.
11203* (bug 32879) Upgrade jQuery to 1.7.1.
11204* jQuery UI upgraded to 1.8.17.
11205* Extensions can use the 'Language::getMessagesFileName' hook to define new
11206  languages using messages files outside of core.
11207* (bug 32512) Add 'Associated namespace' checkbox to Special:Contributions.
11208* Added $wgSend404Code, true by default, which can be set to false to send a
11209  200 status code instead of 404 for nonexistent articles.
11210* (bug 33447) Link to the broken image tracking category from
11211  Special:Wantedfiles.
11212* (bug 27724) Add timestamp to job queue.
11213* (bug 30339) Implement SpecialPage for running javascript tests. Disabled by
11214  default, due to tests potentially being harmful, not to be run on a production
11215  wiki. Enable by setting $wgEnableJavaScriptTest to true.
11216* Extensions can use the RequestContextCreateSkin hook to override what skin is
11217  loaded in some contexts.
11218* (bug 33456) Show $wgQueryCacheLimit on cached query pages.
11219* (bug 10574) Add an option to allow all pages to be exported by Special:Export.
11220* mediawiki.js Message object constructor is now publicly available as
11221  mw.Message.
11222* (bug 29309) Allow CSS class per tooltip (tipsy).
11223* (bug 33565) Add accesskey/tooltip to submit buttons on Special:EditWatchlist.
11224* (bug 17959) Inline rendering/thumbnailing for Gimp XCF images.
11225* (bug 27775) Namespace has it's own XML tag in the XML dump file.
11226* (bug 30513) Redirect tag is now resolved in XML dump file.
11227* sha1 xml tag added to XML dump file.
11228* (bug 33646) Badtitle error page now emits a 400 HTTP status.
11229* Special:MovePage now has a dropdown menu for namespaces.
11230* (bug 34420) Special:Version now shows git HEAD sha1 when available.
11231* (bug 33952) Refactor mw.toolbar to allow dynamic additions at any time.
11232
11233=== Bug fixes in 1.19 ===
11234* $wgUploadNavigationUrl should be used for file redlinks if.
11235  $wgUploadMissingFileUrl is not set. The first was used for this
11236  until the second was introduced in 1.17.
11237* BREAKING CHANGE:  Style rules for wikitable are now more specific and prevent
11238  inheritance to nested tables which caused various issues (bug 30485 and bug
11239  33434). If your wiki has overridden rules for ".wikitable", please revise them
11240  and adjust where necessary. For comparison, use the "table.wikitable" section
11241  in skins/common/shared.css as base.
11242* $wgUploadNavigationUrl is now used for file redlinks if
11243  $wgUploadMissingFileUrl is not set. The former was used for this until the
11244  second was introduced in 1.17.
11245* (bug 27894) Move 'editondblclick' event listener down from body to
11246  div#bodyContent.
11247* (bug 30172) The check for posix_isatty() in maintenance scripts did not detect
11248  when the function exists but is disabled. Introduced
11249  Maintenance::posix_isatty().
11250* (bug 30264) Changed installer-generated LocalSettings.php to use
11251  require_once() instead require() for included extensions.
11252* Do not convert text in the user interface language to another script.
11253* (bug 26283) Previewing user JS/CSS pages didn't load other user JS/CSS pages.
11254* (bug 26486) ResourceLoader modules with paths to nonexistent files cause PHP
11255  warnings/notices to be thrown.
11256* (bug 30335) Fix for HTMLForms using GET that were breaking when non-friendly
11257  URLs are used.
11258* (bug 28649) Preventing half truncated multi-byte unicode characters when
11259  truncating log comments.
11260* Show --batch-size option in help of maintenance scripts that support it.
11261* (bug 4381) Magic quotes cleaning was not comprehensive, key strings were not
11262  unescaped.
11263* (bug 23057) Importers no longer can 'edit' or 'create' a fully-protected page
11264  by importing a new revision into it.
11265* Allow moving the associated talk pages of subpages even if the base page
11266  has no subpage.
11267* Per page edit-notices now work in namespaces without subpages enabled.
11268* (bug 31081) $wgEnotifUseJobQ is no longer unconditionally enqueueing jobs.
11269* (bug 30202) File names are now restricted on upload to 240 bytes, because of
11270  restrictions on some of the database fields.
11271* Timezones are now recognised in user preferences when offset is different
11272  due to DST.
11273* (bug 31692) "summary" parameter now also works when undoing revisions.
11274* (bug 18823) "move succeeded" text displayed bluelinks even when redirect was
11275  suppressed.
11276* (bug 19186) Special:UserLogin's title on Special:SpecialPages now says
11277  "create account" when the user cannot create an account.
11278* (bug 31818) 'usercreated' message now supports GENDER.
11279* (bug 32022) Our phpunit.php script can now be executed from another directory.
11280* (bug 26020) Setting $wgEmailConfirmToEdit to true no longer removes diffs
11281  from recent changes feeds.
11282* (bug 30232) add current time to message wlnote on Special:Watchlist.
11283* (bug 29110) $wgFeedDiffCutoff did not affect new pages.
11284* (bug 32168) Add wfRemoveDotSegments for use in wfExpandUrl.
11285* (bug 32358) Do not display "No higher resolution available" for dimensionless
11286  files (like audio files).
11287* (bug 32168) Add wfAssembleUrl for use in wfExpandUrl.
11288* (bug 32168) fixed - wfExpandUrl expands dot segments now.
11289* (bug 31535) Upload comments now truncated properly, and don't have brackets.
11290* (bug 32086) Special:PermanentLink now shows an error message when no subpage
11291  was specified.
11292* (bug 30368) Special:Newpages now shows the new page name for moved pages.
11293* (bug 1697) The way to search blocked usernames in block log should be clearer.
11294* (bug 29747) eAccelerator shared memory caching has been removed since it is
11295  now disabled by default and is buggy. APC, XCache and WinCache are not
11296  affected.
11297* Installer now refuses to install if php was not compiled with Ctype support.
11298* (bug 29475) Remove "trackback" feature entirely from core.
11299* (bug 32665) Special:BlockList prefills the username in the input field if
11300  using the Special:BlockList/username URL.
11301* (bug 27721) Make JavaScript variables wgSeparatorTransformTable and
11302  wgDigitTransformTable depend on page content language so the sort script
11303  sorts correctly more often.
11304* (bug 32230) Expose wgRedirectedFrom in JavaScript.
11305* (bug 31212) History tab not collapsed when the screen is narrow.
11306* (bug 15521) Use new section summary when the action of adding a new section
11307  also happens to create the page.
11308* (bug 32960) Remove EmailAuthenticationTimestamp from database when a
11309  email address is removed.
11310* (bug 32414) Empty page get a empty bytes attribute in Export/Dump.
11311* (bug 33101) Viewing a User or User talk of username resembling IP ending
11312  with .xxx causes Internal error.
11313* Warning about undefined index in certain situations when $wgLogRestrictions
11314  causes the first log type requested to be removed but not the others.
11315* Use separate message ('prefixindex-namespace') for title of
11316  Special:PrefixIndex rather then re-using Special:AllPages's allinnamespace.
11317* (bug 33156) Special:Block now allows you to confirm you want to block yourself
11318  when using non-normalized username.
11319* (bug 33246) News icon shown for news:// URLs but not for news: URLs.
11320* (bug 33305) Make mw.util.addCSS resistant to IE's @font-face bug by setting
11321  cssText after DOM insertion.
11322* (bug 30711) When adding a new section to a page with section=new, the text is
11323  now always added to the current version of the page.
11324* (bug 31719) Fix uploads of SVGs exported by Adobe Illustrator by expanding
11325  XML entities correctly.
11326* (bug 30914) Embeddable ResourceLoader modules (user.options, user.tokens)
11327  should be loaded in <head> for proper dependency resolution.
11328* (bug 32702) Removed method Skin::makeGlobalVariablesScript() has been readded
11329  for backward compatibility.
11330* (bug 31469) Make sure tracking category messages expand variables like
11331  {{NAMESPACE}} relative to correct title.
11332* (bug 33454) ISO-8601 week-based year number (format character 'o') is now
11333  calculated correctly with respect to timezone.
11334* (bug 32219) InstantCommons now fetches content from Wikimedia Commons using
11335  HTTPS when the local wiki is served over HTTPS.
11336* (bug 33525) clearTagHooks doesn't clear function hooks.
11337* (bug 33523) Function tag hooks don't appear on Special:Version.
11338* Files with IPTC blocks we can't read no longer prevent extraction of exif
11339  or other metadata.
11340* (bug 33587) Remove action "historysubmit" from history pages.
11341* (bug 25800) mw.config wgAction should contain the actually performed action
11342  instead of whatever the query value contains.
11343* (bug 4438) Add CSS hook for current WikiPage action.
11344* (bug 33703) Common border-bottom color for <abbr> should inherit default
11345  (text) color.
11346* (bug 33819) Display file sizes in appropriate units.
11347* (bug 32948) {{REVISIONID}} and related variables are no longer blank after
11348  doing a null edit.
11349* (bug 33880) $wgUsersNotifiedOnAllChanges should not send e-mail to user who
11350  made the edit.
11351* (bug 33902) Decoding %2B with mw.Uri.decode results in ' ' instead of +.
11352* (bug 33762) QueryPage-based special pages no longer misses *-summary message.
11353* Other sizes links are no longer generated for wikis without a 404 thumbnail
11354  handler.
11355* (bug 29454) Enforce byteLimit for page title input on Special:MovePage.
11356* (bug 34114) CSSMin::remap() doesn't respect its $embed parameter.
11357* Special:Contributions/newbies now shows the contributions for the user
11358  "newbies". New user contributions are obtained using the form or using
11359  ?contribs=newbie in URL.
11360* It is now possible to delete images that have no corresponding description
11361  pages.
11362* (bug 33165) GlobalFunctions.php line 1312: Call to a member function
11363  getText() on a non-object.
11364* (bug 31676) Group dynamically inserted CSS into a single <style> tag, to work
11365  around a bug where not all styles were applied in Internet Explorer.
11366* (bug 28936, bug 5280) Broken or invalid titles can't be removed from
11367  watchlist.
11368* (bug 34600) Older skins using useHeadElement=false were broken in 1.18.
11369* (bug 34604) [mw.config] wgActionPaths should be an object instead of a numeral
11370  array.
11371* (bug 12262) Indents and lists are now aligned
11372* (bug 29753) mw.util.tooltipAccessKeyPrefix should be alt-shift for Chrome
11373   on Windows
11374* (bug 25095) Special:Categories should also include the first relevant item
11375   when "from" is filled.
11376* (bug 34972) An error occurred while changing your watchlist settings for
11377  [[Special:WhatLinksHere/Example]]
11378
11379=== API changes in 1.19 ===
11380* Made action=edit less likely to return "unknownerror", by returning the actual
11381  error message (which may have come from a hook call or similar).
11382* (bug 19838) siprop=interwikimap can now use the interwiki cache.
11383* (bug 29748) Add API search prefix support.
11384* (bug 29684) Set forgotten parameter types in ApiQueryIWLinks.
11385* (bug 29685) do not output NULL parentid with list=deletedrevs&drprop=parentid.
11386* siprop=interwikimap and siprop=languages can use silanguagecode to have
11387  a best effort language name translation. Use CLDR extension for best result.
11388* (bug 30230) action=expandtemplates should not silently override invalid title
11389  inputs.
11390* (bug 18634) Create API to fetch MediaWiki's language fallback tree structure.
11391* (bug 26885) Allow show/hide of account blocks, temporary blocks and single IP
11392  address blocks for list=blocks.
11393* (bug 30591) Add support to only return keys in ApiAllMessages.
11394* The API now respects $wgShowHostnames and won't share the hostname in
11395  servedby if it's set to false.
11396* wlexcludeuser parameter added to ApiFeedWatchlist.
11397* (bug 7304) Links on redirect pages no longer cause the redirect page to show
11398  up as a redirect to the linked page on Special:Whatlinkshere.
11399* (bug 32609) API: Move captchaid/captchaword of action=edit from core
11400  to Captcha extension(s).
11401* Added 'APIGetDescription' hook.
11402* (bug 32688) Paraminfo for parameter "generator" of the query module shows too
11403  many types.
11404* (bug 32415) Empty page get no size attribute in API output.
11405* (bug 31759) Undefined property notice in querypages API.
11406* (bug 32495) API should allow purge by pageids.
11407* (bug 33147) API examples should explain what they do.
11408* (bug 33482) Api incorrectly calls ApiBase::parseMultiValue if allowed
11409  values is given as an array.
11410* (bug 32948) {{REVISIONID}} and related variables are no longer blank after
11411  calling action=purge&forcelinkupdate.
11412* (bug 34377) action=watch now parses messages using the correct title instead
11413  of "API".
11414* (bug 35036) WikiLove messages were not automatically updated in JavaScript
11415  after having been changed on-wiki due to a bug in core
11416
11417=== Languages updated in 1.19 ===
11418
11419MediaWiki supports over 350 languages. Many localisations are updated
11420regularly. Below only new and removed languages are listed, as well as
11421changes to languages because of Bugzilla reports.
11422
11423* Canadian English (en-ca) (new).
11424* Norwegian (bokmål) (nb) (renamed from no).
11425* Uighur (Latin) (ug-latn) was incorrectly marked as right-to-left language.
11426* (bug 30217) Make pt-br a fallback of pt.
11427* (bug 31193) Set fallback language of Assamese from Bengali to English.
11428* Update date format for dsb and hsb: month names need the genitive.
11429* (bug 28643) Serbian variant conversion improvements (Nikola Smolenski).
11430* (bug 29405, bug 30809) Lower diacritics are invisible in titles in Indic
11431  languages Assamese, Bengali, Hindi, Malyalam and Odiya.
11432* (bug 32826) Titles in indic languages are partially cut.
11433* (bug 33367) Gendered namespaces for Czech.
11434* (bug 33014) Language::formatSize()/formatBitrate() should be able to deal
11435  with larger numbers (tera-yotta).
11436
11437=== Other changes in 1.19 ===
11438* BREAKING CHANGE: Legacy global array 'ta' and global function 'akeytt' have
11439  been removed from wikibits.js.
11440* jquery.mwPrototypes module was renamed to jquery.mwExtension.
11441* The maintenance script populateSha1.php was renamed to the more concise
11442  populateImageSha1.php.
11443* The Client-IP header is no longer checked for when trying to resolve a
11444  client's real IP address.
11445* (bug 22096) Although IE5.x and below was already unsupported officially,
11446  stylesheets existing exclusively for IE5.0 and IE5.5 have now been removed
11447  (which were in skins 'chick' and 'monobook').
11448* The constructor for CategoryView has changed, the second parameter is now a
11449  Context source and is required.
11450* The Title::escape{Local,Full,Canonical}URL methods are deprecated, please use
11451  proper html building methods to escape the normal get{...}URL methods instead.
11452* The $variant arguments in the Title::get{Local,Full,Link,Canonical}URL methods
11453  have been replaced with a secondary query argument.
11454* The $variant argument in the hooks for the
11455  Title::get{Local,Full,Link,Canonical}URL methods have been removed, the
11456  variant is now part of the $query argument.
11457* Removed Title::isValidCssJsSubpage(), deprecated since 1.17 in favor of
11458  using Title::isCssJsSubpage() or checking Title::isWrongCaseCssJsPage().
11459* Support for the deprecated hook MagicWordMagicWords was removed.
11460* The Xml::namespaceSelector method has been deprecated, please use
11461  Html::namespaceSelector instead (note that the parameters have changed also).
11462* (bug 33746) Preload popular ResourceLoader modules (mediawiki.util) as
11463  stop-gap for scripts missing dependencies.
11464  New configuration variable $wgPreloadJavaScriptMwUtil has been introduced for
11465  this (set to false by default for new installations). Set to true if your wiki
11466  has a large amount of user/site scripts that are lacking dependency
11467  information. In the short to medium term these user/site scripts should be
11468  fixed by adding the used modules to the dependencies in the module registry
11469  and/or wrapping them in a callback to mw.loader.using.
11470
11471== MediaWiki 1.18 ==
11472
11473== MediaWiki 1.18.6 ==
114742012-11-29
11475
11476This is a maintenance and security release of the MediaWiki 1.18 branch
11477
11478=== Changes since 1.18.5 ===
11479* ([[bugzilla:40995|bug 40995]]) Prevent session fixation in Special:UserLogin
11480(CVE-2012-5391)
11481* ([[bugzilla:41400|bug 41400]]) Prevent linker regex from exceeding PCRE
11482backtrack limit
11483* Localisation updates
11484* Increase permitted runtime for testParserTest
11485* ([[bugzilla:36179|bug 36179]]) Unquote 'null' for PostgreSQL.
11486
11487== MediaWiki 1.18.5 ==
114882012-08-30
11489
11490This is a security release of the MediaWiki 1.18 branch
11491
11492=== Changes since 1.18.4 ===
11493* (bug 39700) File: link to non-existing file can inject html
11494* (bug 39823) Hidden block text leaking to admins
11495* (bug 39184) LDAP password leakage
11496* (bug 39180) Disallow framing of api results
11497* (bug 37587) Enforce language codes to be html safe
11498* (bug 39824) Check global blocks on account creation
11499
11500== MediaWiki 1.18.4 ==
115012012-06-12
11502
11503This is a security release of the MediaWiki 1.18 branch.
11504
11505=== Changes since 1.18.3 ===
11506* (bug 36938) Correctly escape uselang attribute to prevent xss
11507* Expanded Blacklist for SVG Files
11508
11509== MediaWiki 1.18.3 ==
115102012-04-25
11511
11512This is a maintenance release of the MediaWiki 1.18 branch.
11513
11514=== Changes since 1.18.2 ===
11515* (bug 35446) Using "{{nse:}}" with an invalid namespace name no longer throws
11516  a PHP warning.
11517* (bug 35567) The whole password reminder e-mail is now sent in the same
11518  language.
11519* (bug 35961) Hash comparison should always be strict.
11520* (bug 35671) PHP Notice: Undefined index: gettoken in includes/api/ApiMain.php
11521  on line 598.
11522* Fix broken email confirmation expiration caused by MWCryptRand changes.
11523
11524== MediaWiki 1.18.2 ==
115252012-03-21
11526
11527This is a maintenance and security release of the MediaWiki 1.18 branch.
11528
11529=== Changes since 1.18.1 ===
11530* (bug 33686) could not get a list of contributors for an article when using
11531  a SQLite database.
11532* (Bug 33865) Exception thrown in action=parse when attempting to use the title
11533  parameter without setting the text parameter.
11534* UserMailer could potentially throw a fatal error when a MailAddress object had
11535  an empty email address.
11536* (Bug 33087) Exchange server rejected mail sent by MediaWiki
11537* (bug 34528) Edit section tooltips show correction section name again
11538* (bug 34246) MediaWiki:Whatlinkshere-summary message is displayed again in
11539  Special:Whatlinkshere
11540* (bug 22555) Remove or skip strip markers from tag hooks like &lt;nowiki&gt; in
11541  core parser functions which operate on strings, such as formatnum.
11542* (bug 34212) ApiBlock/ApiUnblock allow action to take place without a token
11543  parameter present.
11544* (bug 34907) Fixed exposure of tokens through load.php that could have
11545  facilitated CSRF attacks.
11546* (bug 35317) CSRF in Special:Upload.
11547
11548== MediaWiki 1.18.1 ==
115492012-01-11
11550
11551This a maintenance and security release of the MediaWiki 1.18 branch.
11552
11553=== Changes since 1.18.0 ===
11554* (bug 32712) Fix for search indexing of pages with certain unicode chars
11555  following URL.
11556* (bug 3901) Lang, hreflang attribs added to sidebar interlanguage links for
11557  screen readers.
11558* (bug 30774) mediawiki.html: Add support for numbers and booleans in the
11559  attribute values and element contents.
11560* (bug 32473) [[Special:PasswordReset]] can not be used on private wiki.
11561* (bug 32853) Fixed CACHE_DBA object cache type.
11562* (bug 32786) Backward compatibility for extension using 1.17's
11563  Database::newFromType().
11564* Fixed exception when using Special:WhatLinksHere on a Media: file.
11565* (bug 32709) Private Wiki users were always taken to Special:Badtitle on login.
11566* (bug 33240) Sort images are missing but referenced in css.
11567* (bug 31921) Magic words REVISIONDAY, REVISIONMONTH and REVISIONYEAR were
11568  not showing their values on preview.
11569* (bug 32702) Removed method Skin::makeGlobalVariablesScript() has been readded
11570  for backward compatibility.
11571* (bug 30172) The check for posix_isatty() in maintenance scripts did not detect
11572  when the function exists but is disabled. Introduced
11573  Maintenance::posix_isatty().
11574* (bug 33305) Make mw.util.addCSS resistant to IE's @font-face bug by setting
11575  cssText after DOM insertion.
11576* (bug 29102) Upgrades no longer fail with the error "Unknown character set:
11577  'mysql4'.
11578* (bug 25355) Parser generates edit section links for special pages.
11579* (bug 33321) Adding a line to MediaWiki:Sidebar that contains a pipe, but
11580  doesn't have any pipes after being transformed by MessageCache, causes
11581  exception on all pages.
11582* Fixed recentchanges FK violation on page delete and cache purge error in
11583  updater for Oracle DB.
11584* (bug 33117) prop=revisions allows deleted text to be exposed through cache
11585  pollution.
11586
11587== MediaWiki 1.18.0 ==
115882011-11-24
11589
11590This is the first stable release of the MediaWiki 1.18 branch.
11591
11592=== Summary of selected changes in 1.18 ===
11593
11594Selected changes since MediaWiki 1.17 that may be of interest:
11595
11596* Some of the more commonly used MediaWiki extensions are now included in the
11597  release tarball. These extensions are ConfirmEdit, Gadgets, Nuke,
11598  ParserFunctions, Renameuser, Vector and WikiEditor.
11599
11600* Gender support has been improved, meaning user pages can display the correct
11601  gender variant of "User" can now be used.
11602
11603* MediaWiki can now detect the camera orientation of an image from the Exif
11604  metadata, and can rotate the image thumbnail appropriately. Metadata support
11605  has been generally improved, and can now extract IPTC and XMP metadata.
11606
11607* Improved directionality support in 1.18 means that MediaWiki is better to use
11608  for RTL users.
11609
11610* MediaWiki now supports protocol - relative URLs in links, interwiki targets
11611  and $wgServer
11612
11613* Math support has been removed from core
11614
11615=== Changes since 1.18.0rc1 ===
11616* (bug 32228) regression in Special:Search which did not conserve profile on
11617  new search
11618* (bug 32460) Categories were improperly aligned in Simple and CologneBlue
11619* (bug 32412) TOC links on [[Special:EditWatchlist]] points to the fieldsets
11620* (bug 32582) Fix TOC show/hide link regression on IE 8
11621
11622=== Changes since 1.18 beta 1 ===
11623* (bug 31886) Wrong titles redirecting to Special:Badtitle in the 1.18
11624  deployment.
11625* (bug 32051) Fix description for wlprop=sizes.
11626* (bug 31913) Special:MostLinkedTemplates had an incorrect GROUP BY clause
11627  under Microsoft SQL.
11628* (bug 32100) installer complains about suhosin GET limit.
11629* (bug 31933) fix 1.18 regression in Monobook sidebar: huge spacing between
11630  portlets on IE 7 and IE 8/9 in compatibility view.
11631* (bug 32126) Fix 1.18 regression in watchlist editor when items already removed
11632  from watchlist.
11633* (bug 32183) remove the client-* classes added from user-agent-sniffing onto
11634  the <html> element.
11635* (bug 29912) Unit tests break if parsertest tables are still present.
11636* (bug 31694) During installation, tabbing order (cursor focus) goes to logo
11637  instead of 'continue'.
11638* (bug 29102) Upgrade fails "Unknown character set: 'mysql4".
11639* (bug 31990) justify paragraphs pref adds extra space to category listing.
11640* (bug 20148) Better title for [[Special:Disambiguations]] page.
11641* (bug 31502) TOC is missing on Special:EditWatchlist.
11642* (bug 32256) API list=search stops at first invalid result.
11643* (bug 32047) jquery.tablesorter.js: thead is before caption.
11644* (bug 29854) Store protocol-relative links twice in the externallinks table,
11645  one with http: in el_index and once with https.
11646* (bug 31822) Error during upgrade due to output buffer reset in stdout.
11647
11648=== Configuration changes in 1.18 ===
11649* The WantedPages::getSQL hook has been removed and replaced with
11650  WantedPages::getQueryInfo. This may break older extensions.
11651* The SkinTemplateBuildContentActionUrlsAfterSpecialPage,
11652  SkinTemplateContentActions and SkinTemplateTabs hooks have been removed in
11653  favor of SkinTemplateNavigation and SkinTemplateNavigation::SpecialPage.
11654* $wgUseCombinedLoginLink controls whether to output a combined
11655  login / create account link in the personal bar, or to output separate login
11656  and create account links.
11657* Skin names are no longer created based on a ucfirst version of the key in
11658  $wgValidSkinNames but now the value. This means for
11659  $wgValidSkinNames["monobook"] = "MonoBook"; the skin loader will no longer try
11660  loading SkinMonobook and will instead load SkinMonoBook.
11661* $wgMaxUploadSize may now be set to an array to specify the upload size limit
11662  per upload type.
11663* $wgAPICacheHelp added in 1.16 is now removed. To disable API help caching, set
11664  $wgAPICacheHelpTimeout = 0;
11665* OutputPage::isUserJsAllowed() no longer returns false when scripts are allowed
11666  by the page, but $wgAllowUserJs is set to false.
11667* Pure "Skin" class based custom skins are no longer supported, all custom skins
11668  should be put together using SkinTemplate and BaseTemplate or QuickTemplate.
11669* The transliteration for passwords in case they were migrated from an old
11670  Latin-1 install (previous to MediaWiki 1.5) is now only done for wikis with
11671  $wgLegacyEncoding set.
11672* (bug 27508) Add $wgSVGMetadataCutoff to limit the maximum amount of an SVG we
11673  look at when finding metadata to prevent excessive resource usage.
11674* $wgSysopUserBans and $wgSysopRangeBans (deprecated in 1.17) are now removed.
11675  Use $wgBlockCIDRLimit = array( 'IPv4' => 43, 'IPv6' => 128 ) to achieve the
11676  same functionality as $wgSysopRangeBans; you can use the BlockIp hook to
11677  replicate $wgSysopUserBans functionality.
11678* The options on the block form have been standardised such that checking a box
11679  makes the block 'more serious'; so while "check to prevent account creation"
11680  and "check to enable autoblock" remain the same, "check to allow user-talk
11681  edit" is reversed to "check to *disable* user-talk edit", and "check to block
11682  anon-only" becomes "check to block logged-in users too".  The default settings
11683  remain the same.
11684* Most of the field names on the Special:Block form have been changed, which
11685  will probably break screen-scraping bots.
11686* (bug 26866) The 'trackback' right is no longer granted to sysops by default.
11687  $wgUseTrackbacks is already false by default.
11688* (bug 17009) the hiddenStructure CSS class, a highly hackish way of at least
11689  *appearing* to hide article elements, has been removed.  Use the
11690  ParserFunctions extension to actually remove unwanted elements from the
11691  output.
11692* (bug 14202) $wgUseTeX has been superseded by the Math extension. To re-enable
11693  math conversion after upgrading, obtain the Math extension from SVN or from
11694  https://www.mediawiki.org/wiki/Extension:Math and add to LocalSettings.php:
11695  require_once "$IP/extensions/Math/Math.php";
11696* $wgProfiler is now a configuration array, see StartProfiler.sample for
11697  details.
11698* $wgProfiling has been removed.
11699* The spyc library is now no longer included in phase3.
11700* (bug 28343) Unused preferences contextlines/contextchars have been removed
11701* $wgSkinExtensionFunctions has been removed. Use $wgExtensionFunctions instead.
11702* $wgProto has been removed. You now only need to set $wgServer to change the
11703  URL protocol.
11704* $wgRateLimitsExcludedGroups (deprecated in 1.13) has been removed.
11705* $wgInputEncoding and $wgOutputEncoding (deprecated in 1.5) have now been
11706  removed.
11707* $wgAllowUserSkin (deprecated in 1.16) has now been removed.
11708* $wgExtraRandompageSQL (deprecated in 1.16) has now been removed.
11709* LogReader and LogViewer classes (deprecated in 1.14) have now been removed.
11710* (bug 26033) Added $wgArticleCountMethod to select the method to use to say
11711  whether a page is an article or not. $wgUseCommaCount is now deprecated.
11712* $wgEnableDublinCoreRdf and $wgEnableCreativeCommonsRdf no longer work in core,
11713  and the functionality has been moved to the relevant extensions. See
11714  https://www.mediawiki.org/wiki/Extension:DublinCoreRdf and
11715  https://www.mediawiki.org/wiki/Extension:CreativeCommonsRdf as appropriate.
11716* (bug 21107) Split error "customcssjsprotected" into separate messages for JS
11717  and CSS
11718* Removed $wgCheckCopyrightUpload from DefaultSettings, since the relevant
11719  feature was removed in about 1.5.
11720* LogPageValidTypes, LogPageLogName, LogPageLogHeader and LogPageActionText
11721  hooks have been removed.
11722* New hook "Collation::factory" to allow extensions to create custom
11723  category collations.
11724* $wgGroupPermissions now supports per namespace permissions.
11725* $wgEnableAutoRotation enables or disables auto-rotation. Leaving it set to
11726  null will cause MediaWiki to determine if auto-rotation is available.
11727
11728=== New features in 1.18 ===
11729* BREAKING CHANGE: action=watch / action=unwatch now requires a token.
11730* BREAKING CHANGE: Article class hierarchy split into WikiPage (backend)
11731  and Article (frontend) hierarchies. Several hooks now pass a WikiPage object
11732  instead of an Article object. These hooks all use an $article parameter as
11733  documented in hooks.txt. Extensions should be updated to account for this,
11734  though most won't require any changes.
11735* (bug 27860) Minor edit after clicking 'new section' tab
11736  Now the "This is a minor edit" checkbox is not available when you
11737  create a page or new section.
11738* (bug 8130) Query pages should limit to content namespaces, not just main
11739  namespace.
11740* Special:Contribs now redirects to Special:Contributions.
11741* (bug 6672) Images are now autorotated according to their EXIF orientation.
11742  This only affects thumbnails; the source remains unrotated.
11743* (bug 25708) Update case mappings and normalization to Unicode 6.0.0.
11744* New hook ArticlePrepareTextForEdit added, called when preparing text to be
11745  saved.
11746* New parser option PreSaveTransform added, allows the pre-save transformation
11747  to be selectively disabled.
11748* Alternative to $wgHooks implemented, using the new Hooks class.
11749* Add width parameter to Special:Filepath to allow getting the file path of a
11750  thumbnail.
11751* (bug 26870) Add size to {{filepath:}}.
11752* Upload warnings now show a thumbnail of the uploaded file.
11753* Introduced the edittools-upload message, which will be inserted under the
11754  upload form instead of edittools if available.
11755* (bug 26285) Extensions will be automatically generated on upload if the user
11756  specified a filename without extension.
11757* (bug 26851) Special:UserRights now allows to prefill the reason field
11758* New maintenance script to fix double redirects
11759  (maintenance/fixDoubleRedirects.php).
11760* (bug 23315) New body classes to allow easier styling of special pages.
11761* (bug 27159) Make email confirmation code expiration time configurable.
11762* (bug 29047) CSS/JS for each user group is imported from
11763  MediaWiki:Group-sysop.js, MediaWiki:Group-autoconfirmed.css, etc.
11764* (bug 24230) Uploads of ZIP types, such as MS Office or OpenOffice can now be
11765  safely enabled. A ZIP file reader was added which can scan a ZIP file for
11766  potentially dangerous Java applets. This allows applets to be blocked
11767  specifically, rather than all ZIP files being blocked.
11768* (bug 2429) Allow selection of associated namespace in recent changes.
11769* (bug 26217) File size is now checked before uploading in HTML5 browsers.
11770* CSS stylesheet MediaWiki:Noscript.css is now loaded for users with JavaScript
11771  disabled (enclosed in the head in a <noscript> tag).
11772* Added UserGetLanguageObject hook to change the language used in $wgLang.
11773* (bug 14645) When $wgMiserMode is on, expensive special pages are styled
11774  differently (italicized by default) on Special:SpecialPages.
11775* Added $wgAggregateStatsID, which allows UDP stats to be aggregated over
11776  several wikis.
11777* When $wgAllowMicrodataAttributes is true, all itemtypes are allowed, not just
11778  the three that were defined in the original specification.
11779* (bug 14706) Added support for the Imagick PHP extension.
11780* (bug 18691) Added support for SVG rasterization using the Imagick PHP
11781  extension.
11782* (bug 2581, bug 6834) Added links to thumbnail in several resolutions to the
11783  file description page. The sizes are set by $wgImageLimits.
11784* (bug 28031) Add pageCount support to ArchivedFile.
11785* (bug 27924) PhpHttpRequest doesn't return response body if HTTP != 200.
11786* Added hook BitmapHandlerTransform to allow extension to transform a file
11787  without overriding the entire handler.
11788* The parser now attempts to output markers for editsection tokens and defer the
11789  rendering of them post-cache to reduce parser cache fragmentation and ensure
11790  skin customizability of edit section links.
11791* (bug 24755) AuthPlugin auto-creation of local accounts can now be aborted by
11792  other extensions by handling the 'AbortAutoAccount' hook, similar to the
11793  'AbortNewAccount' triggered by explicit account creations. (They are separate
11794  to avoid loops and confusion; auth plugins like CentralAuth need to handle
11795  AbortNewAccount separately.
11796* Special:ListFiles is now transcludable.
11797* (bug 13879) Special:Emailuser asks for suitable target user if called without.
11798* (bug 16956) IPTC and XMP metadata now extracted from images.
11799* (bug 23816) A tracking category is now added for any pages with broken images.
11800* (bug 23495) Allow createAndPromote.php to create non-sysop users.
11801* (bug 28916) A way to to toggle mw.config legacy globals settings from
11802  LocalSettings.php has been created by introducing $wgLegacyJavaScriptGlobals.
11803* (bug 28503) Support for ircs:// URL protocols.
11804* (bug 26033) It is now possible to count all non-redirect pages in content
11805  namespaces as articles.
11806* Images can now be embedded in an XML dump stream using backupDump.php
11807  --include-files and can be imported using importDump.php --uploads;
11808  furthermore, it can import files from the filesystem using --image-base-path.
11809* Three new hooks in Special:Undelete, 'UndeleteForm::showHistory',
11810  'UndeleteForm::showRevision' and 'UndeleteForm::undelete', so that extensions
11811  may override the usage of PageArchive class and replace it with their own
11812  class that extends PageArchive.
11813* (bug 28915) Implement QUnit test suite for MediaWiki JavaScript.
11814  Also built-in support for distribution through a TestSwarm instance.
11815* (bug 29036) For cascade-protected pages, the mw-textarea-cprotected class is
11816  added to the textarea on the edit form.
11817* mw.util.wikiScript has been implemented (like wfScript in GlobalFunctions.php)
11818* (bug 29067) Expose user.tokens (like we do user.options) in ResourceLoader.
11819* New 'Debug' hook used by wfDebug() and wfDebugLog().
11820* (bug 27655) Require token for watching/unwatching pages)
11821* (bug 28904) (bug 29773) Update jQuery version from 1.4.4 to 1.6.2 (the latest
11822  version)
11823* (bug 29441) Expose CapitalLinks config in JS to allow modules to properly
11824  handle titles on case-sensitive wikis.
11825* (bug 29397) Implement mw.Title module in core.
11826* In MySQL 4.1.9+ with replication enabled, fetch the slave lag from SHOW SLAVE
11827  STATUS instead of SHOW PROCESSLIST. This ensures that lag is reported
11828  correctly in the case where there are no write events occurring. Note that
11829  the DB user now needs to have the REPLICATION CLIENT privilege if you are
11830  using replication.
11831* Language codes in $wgDummyLanguageCodes are now excluded on localization
11832  statistics (maintenance/language/transstat.php).
11833* (bug 29586) Make the (next 200) links on categories link directly to
11834  the relevant section of the category.
11835* (bug 29109) Allow the automatic edit summary for redirect creation
11836  show the first bit of the new redirect page.
11837* (bug 29723) mw.util.wikiGetlink() now defaults to wgPageName.
11838* (bug 29680) Add GetDefaultSortkey hook to override the default sortkey.
11839* (bug 16699) {{#language:}} accepts second parameter to specify the language in
11840  which the language name is wanted. Coverage depends on the cldr extension.
11841* (bug 15802) An easy way to look up messages: language qqx which returns
11842  the message keys.
11843* (bug 29868) Add support for passing parameters to mw.msg in jquery.localize.
11844* (bug 29558) $wgMiserMode now disables update.php by default.
11845* AjaxCategories: Easily add, edit or delete categories on article pages.
11846  Suggests possible categories when typing, all saves are done via AJAX.
11847  Supports editing of multiple categories and then saving them in one batch.
11848* $wgAutopromoteOnce was added, allowing for users to be automatically promoted
11849  to explicit usergroups. If a group is removed from a user via
11850  Special:UserRights, it will not automatically be re-added. Configuration is
11851  similar to $wgAutopromote (see DefaultSettings.php).
11852* The PerformRetroactiveAutoblock hook was added to allow overriding or
11853  complementing retroactive autoblock handling. This runs when blocking a user
11854  with the 'autoblock' option.
11855* MediaWiki now supports using protocol-relative URLs in links, interwiki
11856  targets and $wgServer.
11857* Introduced $wgVaryOnXFPForAPI which will cause the API to send
11858  Vary: X-Forwarded-Proto headers.
11859* New maintenance script to refresh image metadata
11860  (maintenance/refreshImageMetadata.php).
11861* (bug 16428) Include permalink in printable version.
11862* (bug 30722) Add an identity collation that sorts things based on what the
11863  unicode code point is (aka pre-1.17 behavior).
11864* (bug 30940) Add a hook in User:getDefaultOptions.
11865  To give extensions a better and more flexible way of providing default
11866  values for preferences a hook has been introduced in User:getDefaultOptions().
11867  Setting preferences in $wgDefaultUserOptions still work fine, but when reading
11868  them (i.e. with array_keys) to get a list of all preferences, then
11869  $wgDefaultUserOptions should no longer be used as it will contain those set
11870  via User:getDefaultOptions().
11871* (bug 30497) Add client-nojs and client-js classes on document element
11872  to let styles easily hide or show things based on general JS availability.
11873* (bug 31293) If Special:Userlogin is loaded over HTTPS, display
11874  MediaWiki:loginend-https instead of MediaWiki:loginend, if it's not empty.
11875  Same for signupend on the account creation page.
11876* (bug 31233) New OutputPage::addJsConfigVars() method to make the output page
11877  specific mw.config map extendable.
11878* mw.util.wikiScript has been implemented (like wfScript in
11879  GlobalFunctions.php).
11880
11881=== Bug fixes in 1.18 ===
11882* (bug 27860) Minor edit after clicking 'new section' tab.
11883* (bug 23119) WikiError class and subclasses are now marked as deprecated.
11884* (bug 10871) Javascript and CSS pages in MediaWiki namespace are no longer
11885  treated as wikitext on preview.
11886* (bug 22753) Output from update.php is more clear when things changed, entries
11887  indicating nothing changed are now all prefixed by "...".
11888* Page existence is now not revealed (in the colour of the tabs) to users who
11889  cannot read the page in question.
11890* (bug 19006) {{REVISIONUSER}} no longer acts like {{CURRENTUSER}} in some
11891  cases.
11892* (bug 16019) $wgArticlePath = "/$1" no longer breaks API edit/watch actions.
11893* (bug 18372) File types blacklisted by $wgFileBlacklist will no longer be shown
11894  as "Permitted file types" on the upload form.
11895* (bug 26379) importImages.php gives more descriptive error message on failure.
11896* (bug 26410) + signs are no longer treated as spaces in internal links if
11897  link has a % sign in it.
11898* (bug 26412) Search results headers no longer show a bogus edit link.
11899* (bug 26540) Fixed wrong call to applyPatch in MysqlUpdater.
11900* (bug 26574) Added 'upload' to $wgRestrictionTypes, allowing upload protected
11901  pages to be queried via the API and Special:ProtectedPages, and allowing
11902  disabling upload protection by removing it from $wgRestrictionTypes.
11903* If an edit summary exceeds 250 bytes and is truncated, add an ellipse.
11904* (bug 26638) Database error pages display correctly in RTL languages.
11905* (bug 26187) Confirmrecreate no longer parses the edit summary.
11906* (bug 26208) Mark directionality of some interlanguage links.
11907* (bug 26034) Make the "View / Read" tab in content_navigation style tabs remain
11908  selected when the action is "purge".
11909* (bug 14267) Support a MediaWiki:Mainpage-nstab override for the subject
11910  namespace tab on the mainpage of a wiki.
11911* (bug 10158) Do not mention allowing others to contact you when the feature
11912  is disabled ($wgEnableUserEmail=false).
11913* (bug 26733) Wrap initial table creation in transaction.
11914* (bug 26729) Category pages should return 404 if they do not exist and have no
11915  members.
11916* (bug 2585) Image pages should send 404 if no image, no shared image and no
11917  description page.
11918* Custom editintro's using the editintro url parameter will no longer show
11919  <noinclude> sections on pages they are included on.
11920* (bug 26449) Keep underlines from headings outside of tables and thumbs by
11921  adding overflow:hidden to h1,h2,h3,h4,h5,h6 (also fixes editsection bunching).
11922* (bug 26708) Remove background-color:white from tables in Monobook and Vector.
11923* (bug 28422) Remove color:black from tables in Monobook and Vector. And add it
11924  to table.wikitable instead.
11925* (bug 26781) {{PAGENAME}} and related parser functions escape their output
11926  better.
11927* (bug 26716) Provide link to instructions for external editor related
11928  preferences and add a comment to the ini control file explaining what is
11929  going on.
11930* Trying to upload a file with no extension or with a disallowed MIME type now
11931  gives the right message instead of complaining about a MIME/extension
11932  mismatch.
11933* (bug 26809) Uploading files with multiple extensions where one of the
11934  extensions is blacklisted now gives the proper extension in the error message.
11935* (bug 26961) Hide anon edits in watchlist preference now actually works.
11936* (bug 19751) Filesystem is now checked during image undeletion.
11937* Send last modified headers for Special:Recentchanges when RC patrol is
11938  enabled, but user cannot see rc patrol links.
11939* (bug 26548) ForeignAPIRepo (InstantCommons) now works with PDF files
11940  and other multi-paged file formats.
11941* Files with a mime type that does not match the extension are now properly
11942  thumbnailed.
11943* (bug 27201) Special:WhatLinksHere output no longer contains duplicate IDs.
11944* (bug 15905) Nostalgia skin could become more usable by including a Talk:
11945  link at the top of the page.
11946* (bug 27560) Search queries no longer fail in Walloon language.
11947* (bug 27679) Broken embedded files with special characters are no longer
11948  double HTML escaped.
11949* (bug 27700) The upload protection can now also be set for files that do not
11950  exist.
11951* (bug 27763) Article::getParserOutput() no longer throws a fatal given when an
11952  incorrect revision ID is passed.
11953* Trim the form field for uploading by url to remove extra spaces which could
11954  cause confusing error messages.
11955* (bug 27854) Http::isValidURI is way too lax.
11956* Do not show enotifminoredits preference, if disabled by $wgEnotifMinorEdits.
11957* AbortLogin returning "ABORTED" now handled.  Also allows message identifier
11958  for "ABORTED" reason to be returned and displayed to user.
11959* (bug 28034) uploading file to local wiki when file exists on shared repository
11960  (commons) gives spurious info in the warning message.
11961* Usernames get lost when selecting different sorts on Special:listfiles.
11962* (bug 14005) editing section 0 of an existing but empty page gives no such
11963  section error.
11964* (bug 26939) Installer does not set $wgMetaNamespace.
11965* (bug 28166) UploadBase assumes that 'edit' and 'upload' rights are not per
11966  page restrictions.
11967* Make truncate function automatically consider length of '...' string,
11968  since length can vary by localization.
11969* (bug 28242) Make redirects generated by urls containing a local interwiki
11970  prefix be a 301 instead of a 302.
11971* (bug 15641) blocked administrators are now prevented from deleting or
11972  protecting their own talk page; and all blocked users are more
11973  comprehensively prevented from performing other actions.
11974* (bug 27893) Edit-on-doubleclick now applies only on view and purge actions;
11975  no longer triggers unexpectedly on delete, history etc.
11976* (bug 28417) Fix PHP notice when importing revision without a listed id.
11977* (bug 28430) Make html and TeX output of <math> always be left-to-right.
11978* (bug 28306) Fix exposure of suppressed usernames in ForeignDBRepo.
11979* (bug 28372) Fix bogus link to suppressed file versions in ForeignDBRepo.
11980* (bug 27473) Fix regression: bold, italic no longer interfere with linktrail
11981  for ca, kaa.
11982* (bug 28444) Fix regression: edit-on-doubleclick retains revision id again.
11983* &apos; character entity is now allowed in wikitext.
11984* UtfNormal::cleanUp on an invalid utf-8 sequence no longer returns false if
11985  intl installed.
11986* (bug 28561) The css class small will no longer make nested elements even
11987  smaller.
11988* (bug 13172) Array type exif data (like GPS) was not being extracted from
11989  images.
11990* (bug 28532) wfMsgExt() and wfMsgWikiHtml() use $wgOut->parse().
11991* (bug 16129) Transcluded special pages expose strip markers when they output
11992  parsed messages.
11993* (bug 27249) "Installed software" table in Special:Version should always be
11994  left-to-right.
11995* (bug 28719) Do not call mLinkHolders __destruct explicitly.
11996* (bug 21196) Article::getContributors() no longer fails on PostgreSQL.
11997* (bug 28752) XCache doesn't work in CLI mode.
11998* (bug 28076) Thumbnail height limited to 360 pixels on Special:Listfiles.
11999* (bug 22227) Special:Listfiles no longer throws an error on bogus file entries.
12000* (bug 19408) user_properties.up_property: 32 bytes is not enough.
12001* (bug 25262) Fix for minification of hardcoded data: URIs in CSS.
12002* (bug 29263) Add LTR class to the shared CSS to be used for left-to-right text
12003  such as SQL queries shown in dberrortext and similar messages in RTL
12004  environments.
12005* (bug 14977) Fixed $wgServer detection in cases where an IPv6 address is used
12006  as the server name.
12007* The View X deleted revisions is now shown again on Special:Upload.
12008* (bug 29071) mediawiki.action.watch.ajax.js should pass uselang to API.
12009* (bug 28868) Show total pages in the subtitle of an image on the
12010  file description page for multi-paged documents.
12011* (bug 28883) Message names for different compression types commonly
12012  used in Tiff files.
12013* When transcluding a special page, do not let it interpret url parameters.
12014* (bug 28887) Special page classes are no longer re-used during 1 request.
12015* (bug 28888) Searching for something starting with a # sign no longer tells
12016  the user a page named [[:]] already exists.
12017* (bug 23002) Imagelinks table not updated after imagemove.
12018* (bug 27864) Transcluding {{Special:Prefix}} with empty prefix now lists all
12019  pages.
12020* (bug 18803) JPEG2000 images should not be uploadable as .jpg files.
12021* (bug 11868) If using links to count articles, the checking will now be based
12022  on the real presence of an internal link instead of the "[[" string.
12023* (bug 28287) The "your changes" box for edit conflicts is now read-only.
12024* (bug 28940) When making a thumb of an SVG, and only specifying the height
12025  make the width be the max SVG size, not the natrual width of the SVG.
12026* (bug 1780) Uploading files with non-ascii characters are now forbidden on
12027  Windows.
12028* (bug 23464) File: prefixes are now chopped off during uploading.
12029* (bug 28174) Message config-logo-help amended to not explicitly assume any
12030  LTR/RTL screen layout.
12031* (bug 28992) Revision numbers in the patrol log are transformed in the user
12032  language.
12033* (bug 27073) ResourceLoaderDynamicStyles marker should be dynamically appended
12034  to the document head if it doesn't exist.
12035* (bug 27023) After the document is ready, mw.loader is broken (calls callback
12036  before module is parsed).
12037* (bug 4330) External URLs without a custom title should be treated as LTR,
12038  even in RTL text.
12039* (bug 29055) Make "don't send email on minor edits" preference apply to
12040  changes to talk page in addition to watchlist edits.
12041* (bug 28272) Special:AllMessages should have only one "Go" button.
12042* (bug 29101) Special:FileDuplicateSearch no longer shows silly message.
12043* (bug 29048) jQuery.tabIndex: firstTabIndex() should not output the same
12044  as lastTabIndex().
12045* (bug 29332) Warn if user requests mediawiki-announce subscription but does not
12046  enter an e-mail address.
12047* (bug 25375) Add canonical namespaces to "wgNamespaceIds" in mw.config.
12048* The class JpegOrTiffHandler was renamed ExifBitmapHandler.
12049* (bug 29443) Special:Undelete should use JavaScript to invert all checkboxes
12050  instead of reloading the page.
12051* (bug 29325) Setting $wgStrictFileExtensions to false no longer gives incorrect
12052  warning.
12053* (bug 29437) Multiple apostrophes in deleted article title cause odd rendering.
12054* (bug 29485) RSS feed of Special:RecentChange grouped together multiple
12055  consecutive edits by same user in included diff, but then linked to
12056  a single ungrouped diff.
12057* Do not try to group together a page creation and edit in the RSS feed of RC.
12058* (bug 29342) Patrol preferences shouldn't be visible to users who don't have
12059  patrol permissions.
12060* (bug 29471) Exception no longer thrown for files with invalid date in
12061  metadata.
12062* (bug 29492) Long-running steps in the installer (such as Upgrade and Install)
12063  no longer cause timeouts.
12064* (bug 29507) Change 'image link' to 'file link' in Special:Whatlinkshere.
12065* If the db is really screwed up, and doesn't have a recentchanges table,
12066  make the updater throw an exception instead of a fatal.
12067* wfArrayToCGI() and wfCgiToArray() now handle nested and associative arrays
12068  correctly.
12069* (bug 29567) mw.util.addPortletLink should only wrap link in <span> for
12070  "vectorTabs" portlets.
12071* (bug 8556) Incorrect session failure warning on preview-on-open
12072  namespaces (categories) when combined with $wgRawHtml.
12073* Use content language in formatting of dates in revertpage message
12074  (rollback revert edit summary) and do not adjust for user timezone.
12075* (bug 29277) MediaWiki:Filepage.css is also shown on the local wiki
12076* Make sure Backlink cache does not retrieve interwiki redirects when looking
12077  for redirects to a local page.
12078* (bug 6100) Allow different directionality (LTR/RTL) for user interface
12079  and wiki content, along with many other RTL and directionality improvements
12080  (such as bugs 28030, 12406, 28349).
12081* (bug 29712) Removed broken defaultUserOptionOverrides in MessagesXx files and
12082  unneeded CSS flipping of quickbar. Instead, introduce option 5 which sets
12083  left/right according to the directionality of your interface language.
12084* (bug 19514) Unordered list list-style-image should be IE6-compatible (8-bit).
12085* (bug 27410) The tag filter on a history page is now within a <label> element.
12086* (bug 29779) DairikiDiff/WikiDiff <ins> and <del> should undo browser default
12087  styling (strike/underline).
12088* (bug 28630) Add iwlinks, langlinks, redirect to
12089  RefreshLinks::deleteLinksFromNonexistent.
12090* (bug 29797) Error: "Tried to load block with invalid type" when subpages
12091  are disabled for user pages.
12092* (bug 12205) Bidirectional names in action=credits are split and displayed
12093  incorrectly when wrapped to the next line.
12094* (bug 20781) Move 'mainpagetext' messages to installer's .i18n file.
12095* (bug 29737) "MediaWiki:Qbsettings-directionality" should refer to script,
12096  not language.
12097* (bug 26360) $wgSessionHandler was overriding system settings unconditionally.
12098* Removed AjaxFunctions.php. The last remaining function js_unescape() was moved
12099  to the FCKEditor extension.
12100* (bug 28762) Resizing to specified height broken for very thin images.
12101* (bug 29959) Installer fatal when cURL and allow_url_fopen is disabled and user
12102  tries to subscribe to mediawiki-announce.
12103* (bug 27427) mw.util.getParamValue shouldn't return value from hash even if
12104  param is only present in hash.
12105* Installer checked for magic_quotes_runtime instead of register_globals.
12106* (bug 30131) XCache with variable caching disabled no longer used for variable
12107  caching (CACHE_ACCEL)
12108* $wgSVGMaxSize is now applied to the smaller of width or height, making very
12109  wide pano/timeline/diagram SVGs renderable at saner sizes.
12110* (bug 30219) The page shown when LocalSettings.php does not exist was broken on
12111  Windows servers.
12112* (bug 30074) Moving user JS subpages resulted in JS errors because
12113  #REDIRECT [[Foo]] is invalid JS.
12114* (bug 30335) Fix for HTMLForms using GET breaking when non-friendly URLs
12115  are used.
12116* (bug 30264) Changed installer-generated LocalSettings.php to use
12117  require_once() instead of require() for included extensions.
12118* Tracking categories are no longer shown in footer for special pages.
12119* (bug 30684) Fix bad escaping in mw.message for inexistent messages (i.e.
12120  <key>).
12121* $wgOverrideSiteFeed no longer double escapes urls.
12122* The preprocessor no longer fails with a PHP warning about XML_PARSE_HUGE when
12123  processing complex pages using newer versions of libxml2.
12124* (bug 30907) Special:Unusedcategories should sort ascendingly.
12125* (bug 28545) When using the uca-default collation, sortkey's starting with a
12126  space (U+20) will sort under an invisible header like in 1.16 rather than a
12127  U+6DE.
12128* (bug 30192) Thumbnails of archived files are now deleted.
12129* (bug 30843) mediawiki.Title should not convert extensions (anything after the
12130  last full stop) to lower case).
12131* (bug 31213) Exception thrown when trying to move file cross-namespace.
12132* (bug 18424) Special:Prefixindex and Special:Allpages paging links are
12133  really small, and somewhat inconsistent with each other.
12134* (bug 30466) Entries in iwlinks table are now cleared when moving a page over
12135  redirect.
12136* (bug 31674) Can't edit watchlist if it contains special pages.
12137* (bug 32100) Installer complains about Suhosin GET limit even if it is
12138  already set above 1024 bytes.
12139
12140=== API changes in 1.18 ===
12141* BREAKING CHANGE: action=watch now requires POST and token.
12142* (bug 26339) Throw warning when truncating an overlarge API result.
12143* (bug 14869) Add API module for accessing QueryPage-based special pages.
12144* (bug 14020) API for Special:Unwatchedpages.
12145* (bug 24287) Wrap API Help output at 100 characters.
12146* Add a realname uiprop option to query=userinfo so a user's realname can be
12147  extracted.
12148* Add a &watchuser option to ApiBlock.
12149* (bug 26541) Generator-ise ApiQueryRecentChanges.
12150* action=parse now correctly returns an error for nonexistent pages.
12151* (bug 25767) Add userrights properties to allusers and users query lists.
12152* (bug 26558) list=allusers auprop=groups does not list groups a user is
12153  automatically a member of.
12154* (bug 26559) list=allusers auprop=rights does not match
12155  list=users usprop=rights.
12156* (bug 26560) On allusers if limit < total number of users, last user gets
12157  duplicate.
12158* (bug 25135) add "normalized" to action=parse.
12159* (bug 26460) Add support for listing category members by category pageid.
12160* (bug 26482) add a imimages param to prop=images.
12161* (bug 26498) allow LinksUpdate with API.
12162* (bug 26485) add a elextlinks param to prop=extlinks.
12163* (bug 26483) add a iwtitles param to prop=iwlinks.
12164* (bug 26484) add a lltitles param to prop=langlinks.
12165* (bug 26480) add a pppageprops param to prop=pageprops.
12166* (bug 26650) Remove $wgAPICacheHelp in favour of $wgAPICacheHelpTimeout.
12167* (bug 24650) Fix API to work with categorylinks changes.
12168* Expose list of skins in meta=siteinfo.
12169* (bug 26548) Add iiurlparam param to query=imageinfo and query=stashimageinfo.
12170* (bug 27205) aiprop=metadata and aiprop=parsedcomment need help text.
12171* Add a amtitle param to meta=allmessages.
12172* (bug 25832) query=allimages now outputs ns/title as well.
12173* (bug 27199) Thumbnail urls can be fetched for old files as well.
12174* (bug 27376) when using ApiBase::PARAM_TYPE => 'integer' without a min or
12175  max value, API doesn't validate the input is actually an integer.
12176* (bug 27479) API error when using both prop=pageprops and
12177  prop=info&inprop=displaytitle.
12178* (bug 27554) Update API information text to reflect change in bug 26125.
12179* (bug 27611) list=blocks: Use ipb_by_text instead of join with user table.
12180* (bug 27616) Add userid of blocked user and blocker to list=blocks.
12181* (bug 27688) Simplify queries to list user block information.
12182* (bug 27708) list=users does not have a property to return user id.
12183* (bug 27715) imageinfo didn't respect revdelete.
12184* (bug 27862) Useremail module didn't properly return success on success.
12185* (bug 27590) prop=imageinfo now allows querying the media type.
12186* (bug 27587) list=filearchive now outputs full title info.
12187* (bug 27018) Added action=filerevert to revert files to an old version.
12188* (bug 27897) list=allusers and list=users list hidden users.
12189* (bug 27717) API's exturlusage module does not respect $wgMiserMode.
12190* (bug 27588) list=filearchive&faprop=sha1 returns empty attribute.
12191* (bug 28010) Passing a non existent user to list=users gives internal error.
12192* (bug 27549) action=query&list=users&usprop=groups doesn't show implicit
12193  groups if a user doesn't have explicit groups.
12194* (bug 27670) Ordering by timestamp (and usage of start and end) isn't as clear
12195  in auto generated document, as it is on mediawiki.org.
12196* (bug 27182) API: Add filter by prefix for meta=allmessages.
12197* (bug 27183) API: Add filter by customisation state for meta=allmessages.
12198* (bug 27340) API: Allow listing of "small" categories.
12199* (bug 27342) Add audir param to list=allusers.
12200* (bug 27203) add fato param to list=filearchive.
12201* (bug 27341) Add drto param to list=deletedrevs.
12202* (bug 26630) Add API for Special:ActiveUsers.
12203* (bug 27020) API: Allow title prefix search of logevents (only when not in
12204  miser mode).
12205* (bug 26629) add Special:MIMESearch to API.
12206* (bug 27585) add pagecount to list=filearchive.
12207* (bug 28104) Namespace for local pages in interwiki backlinks (iwbacklinks)
12208  is missing.
12209* (bug 27343) Add parseddescription to list=filearchive.
12210* (bug 27469) label implicit groups in list=allusers&auprop=groups/
12211  list=users&usprop=groups.
12212* Addition of APIQuerySiteInfoGeneralInfo hook to add extra information to
12213  the general site info results.
12214* (bug 16288) API: consider making closure status of wikis more clear
12215  with meta=siteinfo.
12216* (bug 27589) list=allimages&aiprop=archivename is useless.
12217* (bug 27586) Remove duplication of props in ApiQueryStashImageInfo
12218  by using ApiQueryImageInfo.
12219* (bug 28226) prop=extlinks&eloffset should be an integer.
12220* (bug 28070) Fix watchlist RSS for databases that store timestamps in a
12221  real timestamp field.
12222* API upload errors may now return the parameter that needs to be changed and
12223  a sessionkey to fix the error.
12224* (bug 28249) allow dupes in meta=allmessages&amargs.
12225* (bug 28263) cannot import xml with the API, when have not "import" user
12226  right, but "importupload".
12227* (bug 28365) Added description for uiprop=preferencestoken in meta=userinfo.
12228* (bug 28394) Set forgotten parameters types in ApiUnblock.
12229* (bug 28395) Set forgotten parameters types in ApiParse.
12230* (bug 28368) add hint for multipart/form-data to API information of
12231  action=import&xml=.
12232* (bug 28391) action=feedwatchlist&allrev should be a bool.
12233* (bug 28364) add registration date to meta=userinfo.
12234* (bug 28254) action=paraminfo: Extract type from PARAM_DFLT if
12235  PARAM_TYPE is not set.
12236* (bug 27712) add parent_id to list=deletedrevs.
12237* (bug 28455) Add 'toponly' to recentchanges API module.
12238* (bug 26873) API: Add 'toponly' filter in usercontribs module.
12239* (bug 28586) YAML: strings that are the same as boolean literals.
12240* (bug 28591) Update/replace/supplement spyc (YAML parsing library).
12241* YAML API output is now 1.2 compliant, using JSON as the formatter.
12242* (bug 28672) give information about misermode on API.
12243* (bug 28558) Add iw_api and iw_wikiid to meta=siteinfo&siprop=interwikimap
12244* (bug 26882) Allow listing of indefinite protections with the API.
12245* (bug 27344) add drprefix param to list=deletedrevs.
12246* (bug 28560) list=deletedrevs should die, if combination of param is invalid.
12247* (bug 28238) paraminfo: output both limits for multi param.
12248* (bug 27179) API: List of extension tags through meta=siteinfo.
12249* Get a list of function hooks through meta=siteinfo.
12250* Get a list of all subscribed hooks, and those subscribers.
12251* (bug 28225) Allow hiding of user groups in list=allusers.
12252* (bug 27185) API: Add Special:ComparePages.
12253* (bug 28265) allow outputting of comments for action=expandtemplates.
12254* (bug 27790) Add query type for querymodules to output of ApiParamInfo.
12255* (bug 28963) Add langbacklinks query module to the api.
12256* (bug 27593) API should return error message when sha1/sha1base36 is invalid.
12257* (bug 28578) API's parse module should not silently override invalid
12258  title inputs.
12259* (bug 20699) Watchlist API should list log-events.
12260* (bug 29070) Require a token in API action=watch.
12261* (bug 29221) Expose oldrevid in ApiQueryWatchlist output.
12262* (bug 29267) Always give the servername for meta=siteinfo&siprop=dbrepllag.
12263* (bug 28897) rvparse now respects rvsection for action=query&prop=revisions.
12264* (bug 25734) API: Possible issue with revids validation.
12265* (bug 28002) Internal error in ApiFormatRaw::getMimeType.
12266* (bug 29237) ApiQuery now has an option to output the "iwurl" attribute.
12267* (bug 28392) Mark action=undelete&timestamps as type "timestamp".
12268* (bug 21346) Make deleted images searchable by hash (disabled in Miser Mode).
12269* (bug 27595) sha1 search of list=filearchive does not work.
12270* (bug 26763) Make RSS/Atom of user contributions more visible.
12271* (bug 25133) Allow redirects also for action=parse&pageid.
12272* (bug 29745) Fatal error in API search.
12273* (bug 29476) API returns page title instead of sectiontitle for
12274  srprop=sectiontitle.
12275* Correct the documentation of srprop properties.
12276* (bug 28817) Add reference help page link to API Modules.
12277* (bug 29935) Improve formatting of examples in ApiParamInfo.
12278* (bug 29938) list=users&usprop=rights shows rights the user doesn't have.
12279* (bug 24781) The API will include an XML namespace if the includexmlnamespace
12280  parameter is set.
12281* (bug 29392) Setting the start or end parameter now works with lists blocks,
12282  categorymembers, deletedrevs, logevents, protectedtitles, usercontributions
12283  and watchlist in Postgres.
12284
12285=== Languages updated in 1.18 ===
12286
12287MediaWiki supports over 330 languages. Many localisations are updated
12288regularly. Below only new and removed languages are listed, as well as
12289changes to languages because of Bugzilla reports.
12290
12291* Angika (anp) (new).
12292* Brahui (brh) (new).
12293* Central Dusun (dtp) (new).
12294* Jamaican Creole English (jam) (new).
12295* Khowar (khw) (new).
12296* Liv (liv) (new).
12297* Kichwa (qug) (new).
12298* Tokipona (tp) (removed) 'tokipona' is still  valid.
12299* (bug 17160) Gender specific display text for User namespace.
12300* Link trail added for sl and sh.
12301* (bug 27633) Add characters to linkTrail for Portuguese (pt and pt-br).
12302* (bug 27426) Set $namespaceGenderAliases for Arabic (ar).
12303* (bug 27385) Set Polish $namespaceGenderAliases.
12304* (bug 27681) Set $namespaceGenderAliases for Portuguese (pt and pt-br).
12305* (bug 27785) Fallback language for Kabardian (kbd) is English now.
12306* (bug 27825) Raw watchlist edit message now uses formatted numbers.
12307* (bug 28040) Turkish: properly lower case 'I' to 'i' (dotless i) and
12308  uppercase 'i' to 'I' (dotted i).
12309* Conversion script between Syllabics and Latin for the Inuktitut language.
12310* Date formats for Indonesian (id) updated.
12311* Bhojpuri (bho) (renamed from "bh").
12312* (bug 29031) When translating block log entries, indefinite, infinite, and
12313  infinity are now considered the same.
12314* Aromanian (rup) (renamed from "rua-rup").
12315* Kashmiri (ks) split into Kashmiri (Perso-Arabic) (ks-arab) and Kashmiri
12316  (Devanagari) (ks-deva). Defaults to ks-arab.
12317* (bug 30864) Use bengali numerals for <ol> for Assamese.
12318* (bug 30817) Restored linktrail for kk (Kazakh).
12319* (bug 27398) Add $wgExtraGenderNamespaces for configured gendered namespaces.
12320* (bug 30846) New LanguageOs class.
12321
12322=== Other changes in 1.18 ===
12323* Removed legacy wgAjaxWatch javascript global object, no longer in use.
12324* (bug 28556) Upload support for MacBinary files has been removed (Used by
12325  Internet Explorer 5 for Mac OS 9).
12326* On wiki farm setups using $wgConf, 'wgCanonicalServer' is now expected to be
12327  set for all wikis. This was already the case for 'wgServer'.
12328
12329== MediaWiki 1.17 ==
12330
12331== MediaWiki 1.17.5 ==
123322012-06-12
12333
12334This is a security release of the MediaWiki 1.17 branch.
12335
12336=== Summary of selected changes in 1.17 ===
12337
12338Selected changes since MediaWiki 1.16 that may be of interest:
12339
12340* A new installer has been introduced. It has a wizard-style interface which is
12341  translated into many languages. Many shortcomings in the old installer were
12342  addressed with this rewrite. Note that it is no longer required for the config
12343  directory to be made writable by the webserver. Instead the generated
12344  LocalSettings.php file is offered as a download, which you must then upload
12345  to the wiki's base directory.
12346
12347* ResourceLoader, a new framework for delivering client-side resources such as
12348  JavaScript and CSS, has been introduced. These resources are now delivered
12349  through the new entry point script "load.php", instead of as static files
12350  served directly by the web server. This allows minification, compression and
12351  client-side caching to be used more effectively, which should provide a net
12352  performance improvement for most users.
12353
12354* Category sorting has been improved.
12355** Sorting is now case insensitive.
12356** Sub-categories, pages and files can now be paged separately.
12357** When several pages are given the same sort key, they sort by their
12358   names instead of randomly.
12359
12360* The lowest supported version of PHP is now 5.2.3. If necessary, please
12361  upgrade PHP prior to upgrading MediaWiki.
12362
12363=== Changes since 1.17.4 ===
12364
12365* (bug 36938) Correctly escape uselang attribute to prevent xss
12366* Expanded Blacklist for SVG Files
12367
12368=== Changes since 1.17.3 ===
12369
12370* (bug 35961) Hash comparison should always be strict.
12371* Fix broken email confirmation expiration caused by MWCryptRand changes.
12372* (bug 35671) PHP Notice: Undefined index: gettoken in includes/api/ApiMain.php
12373  on line 598.
12374
12375=== Changes since 1.17.2 ===
12376
12377* (bug 22555) Remove or skip strip markers from tag hooks like &lt;nowiki&gt; in
12378  core parser functions which operate on strings, such as padleft.
12379* (bug 34212) ApiBlock/ApiUnblock allow action to take place without a token
12380  parameter present.
12381* (bug 34907) Fixed exposure of tokens through load.php that could have
12382  facilitated CSRF attacks.
12383* (bug 35317) CSRF in Special:Upload.
12384
12385=== Changes since 1.17.1 ===
12386* (bug 33117) prop=revisions allows deleted text to be exposed through cache
12387  pollution.
12388* (bug 32709) Private Wiki users were always taken to Special:Badtitle on login.
12389
12390=== Changes since 1.17.0 ===
12391
12392* (bug 29535) Added missing Creative Commons CC0 icon.
12393* (bug 29726) Fixed failure to load internationalization messages in
12394  client-side scripts on WebKit-based browsers.
12395* Fixed a bug in message transformation where the previous language could leak
12396  into later transformations in the UI language.
12397* (bug 29091) Fixed form of native name for Ossetic language (Иронау -> Ирон)
12398* Fixed maintenance scripts upgrade1_5.php and rebuildImages.php, they did not
12399  work at all since 1.17 beta 1.
12400* (bug 29531) Fixed img_auth.php for thumbnails and other filenames with
12401  multiple dots, was broken by the fix for bug 28840.
12402* In the maintenance script purgeList.php, fixed a fatal error when a page
12403  title is given, instead of a URL.
12404* (bug 19514) Unordered list list-style-image should be IE6-compatible (8-bit).
12405* Installer checked for magic_quotes_runtime instead of register_globals.
12406* $wgSVGMaxSize is now applied to the smaller of width or height, making very
12407  wide pano/timeline/diagram SVGs renderable at saner sizes.
12408* (bug 29959) Installer fatal when cURL and allow_url_fopen is disabled and user
12409  tries to subscribe to mediawiki-announce.
12410* Installer checked for magic_quotes_runtime instead of register_globals
12411* (bug 30131) XCache with variable caching disabled no longer used for variable
12412  caching (CACHE_ACCEL)
12413* (bug 30264) Changed installer-generated LocalSettings.php to use
12414  require_once() instead require() for included extensions.
12415* (bug 26486) ResourceLoader modules with paths to nonexistent files cause PHP
12416  warnings/notices to be thrown
12417* (bug 30907) Special:Unusedcategories should sort ascendingly.
12418* (bug 30219) The page shown when LocalSettings.php does not exist was broken on
12419  Windows servers.
12420* Hardcoded NLS_NUMERIC_CHARACTERS for Oracle DB to prevent type conversion
12421  errors.
12422* Fixed recentchanges FK violation on page delete and cache purge error in
12423  updater for Oracle DB.
12424* (bug 32276) Skins were generating output using the internal page title which
12425  would allow anonymous users to determine whether a page exists, potentially
12426  leaking private data. In fact, the curid and oldid request parameters would
12427  allow page titles to be enumerated even when they are not guessable.
12428* (bug 32616) action=ajax requests were dispatched to the relevant internal
12429  functions without any read permission checks being done. This could lead to
12430  data leakage on private wikis.
12431
12432=== Changes since 1.17.0rc1 ===
12433
12434* Fixed syntax error in generated LocalSettings.php when a non-default user
12435  rights profile is chosen.
12436* (bug 29399) Fixed PostgreSQL installation when the DB user for installation
12437  is the same as the one for web access.
12438* (bug 29233) Fixed failover for DB slave servers. When a DB slave went down,
12439  an error was immediately shown to the user, instead of trying another slave.
12440  Was broken since 1.17 beta 1.
12441* (bug 29278) Fixed PHP fatal error when attempting to add text to a page via a
12442  redirect.
12443* (bug 29408) Fixed uploads of files with MIME types that aren't detected by
12444  MediaWiki.
12445* Removed DEFAULT '' NOT NULL field definitions from Oracle DB schema because
12446  using the DEFAULT value ('') in DML broke Oracle backend as it treats an
12447  empty VARCHAR2 value as NULL. Indexes on Oracle do not require NOT NULL
12448  fields.
12449
12450=== Changes since 1.17 beta 1 ===
12451
12452* Fixed warning about missing file "password.js".
12453* When installing on MySQL, don't attempt to create a new database user if the
12454  same user is used for installation and web access.
12455* Fixed SQL query errors in queries with table aliases.
12456* (bug 27891) Fixed the "chronology protector", broken since 1.17beta1, which
12457  ensures that when database replication is used, the new version is seen by
12458  the user immediately after they create or edit an article.
12459* (bug 28845) Allow PostgreSQL installation using a non-root user account which
12460  has role creation abilities.
12461* When installing on PostgreSQL and the install account is the same as the web
12462  account, check to make sure that the account has suitable privileges in the
12463  mediawiki schema.
12464* (bug 28172) Fixed error in PostgreSQL installation when creating the wiki
12465  sysop account.
12466* Fixed an issue with the Oracle installer in cases where the user is different
12467  to the database name.
12468* Added "unblockself" to the list of available rights.
12469* In the installer, fixed the "user rights profile" option, it never worked.
12470* (bug 29117) Fixed Hebrew localisation of the installer.
12471* (bug 28840) Reduce the collateral damage caused by the fix for bug 28235 (XSS
12472  on Internet Explorer 6 due to a file extension in the query string) by
12473  reducing the number of URLs that are blocked, and by redirecting the request
12474  to a safer URL where possible instead of blocking it.
12475* (bug 28812) Fixed documentation of API action=parse.
12476* (bug 28979) Fixed styling of <abbr> and <acronym>.
12477* Fixed the error message displayed when you try to create an account by email,
12478  but an email address is not given.
12479* Fixed JS error due to missing dependency for jquery.suggestions.
12480* Exposed $wgExtensionAssetsPath in JavaScript.
12481* (bug 28738) Made ResourceLoader support environments with small URL length
12482  limits. The length limit can be configured via
12483  $wgResourceLoaderMaxQueryLength, and this is set automatically in the
12484  generated LocalSettings.php when the php.ini variable
12485  "suhosin.get.max_value_length" is set. When a URL exceeds this limit, the
12486  request is split up. Also, reduced the average length of load.php URLs by
12487  using a more compact parameter format.
12488* (bug 25262) Fix for minification of hardcoded data: URIs in CSS.
12489* (bug 25124) Respect $wgStyleDirectory in ResourceLoader.
12490* Allow installation when no HTTP client is available, don't throw an exception.
12491* (bug 27465) Fix metadata extraction for SVG files using unusual namespace
12492  names.
12493* (bug 29174) Fix regression in upload-by-URL: uploading files larger than the
12494  PHP memory limit should work again.
12495* Fixed the display of comments in the new user log.
12496* (bug 28237) When installing extensions using the web-based installer, create
12497  any necessary database tables.
12498* (bug 28983) Fixed automated installation of extensions that overwrite $path.
12499* Fixed error caused by missing magic words.
12500* Fixed breakage of article editing in PostgreSQL due to text search
12501  configuration errors.
12502* Fixed the HTTPS client used when Curl is not available. This avoids an error
12503  during install about failure of the mediawiki-announce subscription.
12504* (bug 28162) When installing to PostgreSQL, respect the "database port" input,
12505  it was ignored.
12506
12507=== Configuration changes in 1.17 ===
12508
12509* $wgLogAutocreatedAccounts controls whether autocreation of accounts is logged
12510  to new users log.
12511* (bug 22858) $wgLocalStylePath is by default set to the same value as
12512  $wgStylePath but should never point to a different domain than the site is
12513  on, allowing skins to use .htc files which are not cross-domain friendly.
12514* $wgFileStore has been deprecated. The only usage $wgFileStore['deleted'] has
12515  been turned into $wgDeletedDirectory.
12516* $wgDeletedDirectory has been added to specify what directory to place deleted
12517  uploads in.
12518* IBM DB2 database no longer uses the db specific $wgDBport_db2 variable but the
12519  normal $wgDBport.
12520* $wgCategoryPrefixedDefaultSortkey was removed and is now always false.  This
12521  provides more sensible sorting behavior for categories.
12522* Removed unused globals: $wgEnableSerializedMessages, $wgCheckSerialized,
12523  $wgUseMemCached, $wgDisableSearchContext, $wgColorErrors, $wgUseZhdaemon,
12524  $wgZhdaemonHost and $wgZhdaemonPort.
12525* (bug 24408) The include_path is not modified in the default LocalSettings.php
12526* $wgVectorExtraStyles was removed, and is no longer in use.
12527* Removed $wgUpdates for database updates; extensions should use
12528  DatabaseUpdater::addExtensionUpdate() via the LoadExtensionSchemaUpdates hook.
12529* Removed $wgServerName. It doesn't need to be set anymore and is no longer
12530  available as input for other configuration items, either.
12531* It's no longer necessary for LocalSettings.php to include DefaultSettings.php.
12532* It's no longer necessary to set $wgCacheEpoch to the file modification time
12533  of LocalSettings.php, in LocalSettings.php itself. Instead, this is done
12534  automatically if $wgInvalidateCacheOnLocalSettingsChange is true (which is
12535  the default).
12536* $wgCopyrightIcon is deprecated and $wgFooterIcons['copyright']['copyright']
12537  should be used instead.
12538* $wgSysopUserBans is deprecated, and will be made permanently true in 1.18.
12539  If you need this functionality, you should use the BlockIp hook to filter and
12540  reject such blocks.
12541* $wgSysopRangeBans is deprecated, you should set $wgBlockCIDRLimit to maximum
12542  (32 for IPv4, 128 for IPv6), equivalent to allowing rangeblocks of only 1
12543  address at a time.
12544
12545=== New features in 1.17 ===
12546
12547* (bug 10183) Users can now add personal styles and scripts to all skins via
12548  User:<name>/common.css and /common.js (if user css/js is enabled).
12549* (bug 22748) Add anchors on Special:ListGroupRights.
12550* (bug 21981) Add parameter 'showfilename' to <gallery> to automatically
12551  apply the names of the individual files within the gallery.
12552* Future-proof redirection to fragments in Gecko, so things work a little nicer
12553  if they fix <https://bugzilla.mozilla.org/show_bug.cgi?id=516293>.
12554* Support git:// and mms:// protocols by default for external links.
12555* (bug 15810) Blocked admins can no longer unblock themselves without the
12556  'unblockself' permission (which they have by default).
12557* (bug 18499) Added "enhanced" URL parameter to switch between old and enhanced
12558  changes list.
12559* (bug 22925) "sp-contributions-blocked-notice-anon" message now displayed when
12560  viewing contributions of a blocked IP address.
12561* (bug 22474) {{urlencode:}} now takes an optional second parameter for type of
12562  escaping.
12563* Special:Listfiles now supports a username parameter.
12564* Special:Random carries over query string parameters.
12565* (bug 23206) Add Special::Search hook for detecting successful "Go".
12566* When visiting a "red link" of a deleted file, a deletion and move log excerpt
12567  is provided on the Upload form.
12568* (bug 22647) Add category details in search results.
12569* (bug 23276) Add hook to Special:NewPages to modify query.
12570* Add accesskey 's' and tooltip to 'Save' button at Special:Preferences.
12571* Add accesskey 'b' and tooltip to the summary field of edit mode.
12572* (bug 20186) Allow filtering Special:Contributions for RevisionDeleted edits.
12573* ajaxwatch now uses the API and JQuery, and can be used to animate arbitrary
12574  watch links, not just to watch the page the link is on.
12575* (bug 20976) "searchmenu-new-nocreate" message now displayed when there
12576  is no title match in search and the user has no rights to create pages.
12577* (bug 23429) Added new hook WatchlistEditorBuildRemoveLine.
12578* (bug 22844) Added support for WinCache object caching (for IIS).
12579* (bug 23580) Add two new events to LivePreview so that scripts can be notified
12580  about the beginning and finishing of LivePreview actions.
12581* (bug 21278) Now the sidebar allows inclusion of wiki markup.
12582* (bug 23733) Add IDs to messages used on CSS/JS pages.
12583* Show validity period of the login cookie in Special:UserLogin and
12584  Special:Preferences.
12585* Interlanguage links display the page title in their tooltip.
12586* (bug 23621) New Special:ComparePages to compare (diff) two articles.
12587* (bug 4597) Provide support in Special:Contributions to show only "current"
12588  contributions
12589* (bug 17857) {{anchorencode}} acts more like how the parser creates section ids
12590* (bug 21477) \& can now be used in <math>
12591* (bug 11641) \dotsc \dotsm \dotsi \dotso can now be used in <math>
12592* (bug 21475) \mathtt and \textsf can now be used in <math>
12593* texvc is now run via ulimit4.sh, to limit execution time.
12594* SQLite now supports $wgSharedDB.
12595* (bug 8507) Group file links by namespace:title on image pages.
12596* Stop emitting named entities, so we can use <!DOCTYPE html> while still being
12597  well-formed XML.
12598* texvc now supports \bcancel and \xcancel in addition to \cancel and \cancelto
12599* Added scriptExtension setting to $wgForeignFileRepos.
12600* ForeignApiRepo uses scriptDirUrl if apiBase not set.
12601* (bug 24212) Added MediaWiki:Filepage.css which is also included on foreign
12602  client wikis.
12603* (bug 14685) Double underscore magic word usage is now tracked in the
12604  page_props table, as well as the behavioral magic words {{DEFAULTSORT}} and
12605  {{DISPLAYTITLE}}
12606* (bug 24045) MediaWiki:Ipb-needreblock is now wrapped in a div with class
12607  "mw-ipb-needreblock"
12608* Non-file pages can no longer be moved to the file namespace, nor vice versa.
12609* (bug 671) The <dfn>, <kbd> and <samp> elements have been whitelisted in user
12610  input.
12611* (bug 21503) There's now a "reason" field when creating account for other
12612  users.
12613* (bug 24418) action=markpatrolled now requires a token.
12614* A variety of category sort-related fixes, including:
12615** (bug 164) In English, lowercase and uppercase letters now sort the same.
12616** (bug 1211) Subcategories, ordinary pages, and files now page separately.
12617** When several pages are given the same sort key, they sort by their names
12618   instead of randomly.
12619* (bug 23848) Add {{ARTICLEPATH}} Magic Word.
12620* (bug 8140) Add dedicated CSS classes to Special:Newpages elements.
12621* (bug 11005) Add CSS class to empty pages in Special:Newpages.
12622* The parser cache is now shared amongst users whose different settings aren't
12623  used in the page.
12624* Any attribute beginning with "data-" can now be used in wikitext, per HTML5.
12625* (bug 24007) Diff pages now mention the number of users having edited
12626  intermediate revisions.
12627* Added new hook GetIP.
12628* Special:Version now displays whether a SQLite database supports full-text
12629  search.
12630* TS_ISO_8691_BASIC was added as a time format, which is used by ResourceLoader
12631  for versioning.
12632* Maintenance scripts get a --memory-limit option to override defaults (which
12633  is usually to set it to -1 to disable the limit).
12634* (bug 25397) Allow uploading (not displaying) of WebP images, disabled
12635  by default.
12636* (bug 23194) Special:ListFiles now has thumbnails.
12637* Use hreflang to specify canonical and alternate links, search engine friendly
12638  when a wiki has multiple variant languages.
12639* (bug 19593) Specifying --server in now works for all maintenance scripts.
12640* Now rebuildtextindex.php warns if SQLite doesn't support full-text search.
12641* (bug 10541) Front/backend separation of installation/upgrade code.
12642* (bug 10596) Allow installer to enable extensions already in extensions folder.
12643* (bug 20627) Installer should be in languages other than English.
12644* Support for metadata in SVG files (title, description).
12645* Special:Search: Add CSS classes to 'none found' and 'create link' messages.
12646* Add CSS classes (including namespace and pagename) to the enhanced recent
12647  changes/watchlist entries.
12648* (bug 22463) Add hook 'SkinGetPoweredBy' to make 'powered by' icon/text
12649  customizable.
12650* Added CSS print pagination to the print stylesheets.
12651* (bug 25960) Add <link rel=canonical"> for File pages of shared/foreign
12652  file repositories.
12653* When viewing a redirect, the redirect arrow and redirection target are both
12654  wrapped in a div that has the class "redirectMsg" so that the redirection
12655  arrow can be customized with CSS.
12656* (bug 21911) Hard coded limit for long page warning removed. New message
12657  [[MediaWiki:Longpage-hint]] (empty per default) can be used instead.
12658  Parameters: $1 shows the formatted textsize in Byte/KB/MB, $2 is the raw
12659  number of the textsize in Byte.
12660* (bug 3276) Give image <gallery>s fluid width.
12661* Added uploads link to page subtitle in Special:Contributions.
12662* Added Special:Myuploads special page that redirects to Special:Listfiles.
12663* The footerlinks used in Monobook/Vector/Modern are now part of common skin
12664  code, SkinTemplateOutputPageBeforeExec can be used to customize the list.
12665* Special wrapping setups can now define MW_CONFIG_FILE to load a config file
12666  other than LocalSettings.php. This is like MW_CONFIG_CALLBACK but works in
12667  some cases where MW_CONFIG_CALLBACK will not work.
12668* (bug 26574) Added 'upload' to $wgRestrictionTypes, allowing upload protected
12669  pages to be queried via the API and Special:ProtectedPages, and allowing
12670  disabling upload protection by removing it from $wgRestrictionTypes.
12671* The name attribute of HTMLForm fields can now be overridden by passing a
12672  'name' key in the descriptor array.  Hidden field names are now treated
12673  consistently with other fields and, by default, prefixed with 'wp'.
12674* (bug 27402) Add support for disabling MWSuggest.
12675* (bug 26563) Add bytes changed per revision for stub and full article dumps.
12676* (bug 27508) Add $wgSVGMetadataCutoff to limit the maximum amount of an svg we
12677  look at when finding metadata to prevent excessive resource usage.
12678* (bug 198) $wgUpgradeKey allows unlocking the web installer for upgrades
12679  without having to move LocalSettings.php
12680* Added $wgAllowImageTag, which can be set to true to whitelist the <img> tag
12681  in wikitext.
12682* (bug 12797) Add $wgGalleryOptions for adjusting of default gallery display
12683  options.
12684* Added the $wgAllowUserCssPrefs option which allows disabling CSS-based
12685  preferences; which can improve page loading speed.
12686* Added $wgSQLMode for setting database SQL modes - either performance (null)
12687  or other reasons (such as enabling stricter checks).
12688* (bug 20193) Added $wgVectorShowVariantName global configuration variable
12689  which causes Vector to render the variants drop-down menu with a label
12690  showing the current variant name. This is off by default, pending further
12691  research into its user experience implications.
12692* The upload link for missing files can now be set separately from the
12693  navigation link with $wgUploadMissingFileUrl.
12694* $wgAdditionalMailParams added to allow setting extra options to mail() calls.
12695* Added $wgSecureLogin to optionally login using HTTPS.
12696* (bug 25728) Added $wgPasswordSenderName to make the name associated
12697  with $wgPasswordSender configurable.
12698* (bug 22463) $wgFooterIcons added to allow configuration of the icons shown in
12699  the footers of skins.
12700* $wgFileCacheDepth can be used to set the depth of the subdirectory hierarchy
12701  used for the file cache. Default value is 2, which matches former behavior.
12702
12703=== Bug fixes in 1.17 ===
12704
12705* (bug 17560) Half-broken deletion moved image files to deletion archive
12706  without updating database.
12707* (bug 22666) Submitting user block form with an invalid user name no longer
12708  throws an error.
12709* (bug 22665, bug 22667) User '0' can now be unblocked and have its block
12710  settings changed.
12711* (bug 22606) The body of e-mail address confirmation message is now different
12712  when the address changed.
12713* (bug 22664) Special:Userrights now accepts '0' as a valid user name.
12714* (bug 5210)  Preload parser now parses <noinclude>, <includeonly> and
12715  redirects.
12716* (bug 22709) IIS7 mishandles redirects generated by OutputPage::output() when
12717  the URL contains a colon.
12718* (bug 22353) Categorised recent changes now works again.
12719* (bug 22747) "Reveal my e-mail address in notification e-mails" preference is
12720  now only displayed when relevant.
12721* (bug 22772) {{#special:}} parser function now works with subpages.
12722* (bug 18664) Relative URIs in interwiki links cause failed redirects.
12723* (bug 19270) Relative URIs in interwiki links break interwiki transclusion.
12724* (bug 22903) Revdelete log entries now show in the user preferred language.
12725* (bug 22905) Correctly handle <abbr> followed by ISBN.
12726* (bug 22940) Namespace aliases pointing to main namespace don't work.
12727* (bug 15810) Blocked admins can no longer block/unblock other users.
12728* (bug 22876) Avoid possible PHP Notice if $wgDefaultUserOptions is not
12729  correctly set.
12730* (bug 14952) Page titles are renormalized after html entities are removed so
12731  that links with non-NFC character references work correctly.
12732* (bug 22991) wgUserGroups JavaScript variable now reports * group for
12733  anonymous users instead of null.
12734* (bug 22627) Remove PHP notice when deleting a page only hidden users edited.
12735* (bug 21520) Anonymous previews now also gives a warning about not being
12736  logged in (anonpreviewwarning).
12737* (bug 22935) image/x-ms-bmp mime type added for BMP files.
12738* (bug 23024) Special:ListFiles now escapes file names correctly.
12739* (bug 22867) "View source" tab is now only displayed if there's source text.
12740* (bug 19393) Feeds now format dates in user language rather than content
12741  language.
12742* (bug 22852) "Served in" comment is now the time used to cache a single page
12743  when using rebuildFileCache.php
12744* (bug 22496) Viewing diff of a redirect page without specifying "oldid"
12745  parameter no longer makes the page displayed as being the redirect target.
12746* (bug 22918) Feed cache keys now use $wgRenderHashAppend.
12747* (bug 21916) Last-Modified header is now correct when outputting cached feed.
12748* (bug 20049) Fixed PHP notice in search highlighter that occurs in some cases.
12749* (bug 23017) Special:Disambiguations now list pages in content namespaces
12750  rather than only main namespace.
12751* (bug 23063) $wgMaxAnimatedGifArea is checked against the total size of all
12752  frames, and $wgMaxImageArea against the size of the first frame, rather than
12753  the other way around.  Both now default to 12.5 megapixels.  Also, images
12754  exceeding $wgMaxImageArea can still be embedded at original size.
12755* (bug 23078) "All public logs" option on Special:Log is now always the first
12756  item.
12757* (bug 16817) Group names in user rights log are now singular and in lowercase.
12758* Special:Preferences no longer crashes if the wiki default date formatting
12759  style is not valid for the user's interface language.
12760* (bug 23167) Check the watch checkbox by default if the watchcreations
12761  preference is set.
12762* Maintenance script cleanupTitles is now able to fix titles stored
12763  in a negative namespace (which is invalid).
12764* (bug 19858) Removed obsolete <big> in interface messages.
12765* (bug 21456) "Bad title" error when showing non-local interwiki pages no longer
12766  displays incorrect tabs.
12767* (bug 23190) Improved math representation for text browsers.
12768* (bug 22015) Improved upload-by-url error handling and error display.
12769* (bug 17941) $wgMaxUploadSize is now honored by all upload sources.
12770* (bug 23080) New usernames now limited to 235 bytes so that custom skin files
12771  work.
12772* (bug 23075) Correct MediaTransformError default width in gallery.
12773* (bug 16487) The Anonymous user account used on Postgres is no longer
12774  displayed on Special:Listusers.
12775* (bug 23313) Move watchlisthidepatrolled above token in watchlist preferences
12776  to enhance preference grouping.
12777* (bug 23298) Interwiki links with prefix only in log summaries now link to the
12778  correct link.
12779* (bug 23284) Times are now rounded correctly.
12780* (bug 23375) Added ogv, oga, spx as extensions for ogg files.
12781* (bug 18408) All required permissions for uploading (upload, edit, create)
12782  are now checked when loading Special:Upload. Toolbar link for Special:Upload
12783  is no longer shown if the user does not have the required permissions.
12784* (bug 23397) texvc in html mode renders \sim as &tilde; not &sim;
12785* (bug 23241) License selector should be disabled during upload of a new
12786  version.
12787* (bug 23240) Add ID to namespace selector form on Special:Watchlist.
12788* The pipe | character in urls is now escaped.
12789* (bug 23422) mp3 files can now be moved.
12790* (bug 23448) MediaWiki:Summary-preview is now displayed instead of
12791  MediaWiki:Subject-preview when previewing summary.
12792* (bug 23426) The {{REVISIONMONTH}} variable is now zero-padded and added
12793  new variable {{REVISIONMONTH1}} when unpadded version is needed.
12794* Special:Userrights didn't recognize user as changing his/her own rights if
12795  user did not capitalize first letter of username.
12796* (bug 23507) Add styles for printing wikitables.
12797* (bug 19586) Avoid JS errors in mwsuggest when using old browsers such
12798  as Opera 8.
12799* (bug 23563) Old skins now support $wgUploadNavigationUrl and take into
12800  account upload rights.
12801* (bug 1347) Render \phi in math using images, in order to create consistent
12802  and correct render results.
12803* (bug 16573) Render \epsilon in math using images, in order to create
12804  consistent and correct render results.
12805* (bug 22541) Support image redirects when using ForeignAPIRepo.
12806* (bug 22967) Make edit summary length cut-off behave correctly for multibyte
12807  characters.
12808* (bug 8689) Long numeric lines no longer kill the parser.
12809* (bug 23740) Article::doRedirect() now use $extraQuery parameter correctly if
12810  the $noRedir parameter is set to true.
12811* (bug 23688) Correct mime types for Office 2007 OpenXML documents.
12812* (bug 23787) Corrected $wgDefaultSkin's comment in DefaultSettings.php.
12813* (bug 23797) Xml::input() now allows '0' for the value parameter.
12814* (bug 23747) Make sure that on History pages, the RevDel button is not
12815  accidentally activated when hitting enter.
12816* (bug 23845) Special:ListFiles now uses correct file names without underscores.
12817* Ask for permanent login in Special:Preferences only if $wgCookieExpiration >
12818  0.
12819* (bug 16356) Repair dumpInterwiki.inc to use proper normalization.
12820* (bug 24006) deleteArchivedRevisions.php maintenance script now longer throws
12821  a fatal error.
12822* (bug 23465) Don't ignore the predefined destination filename on
12823  Special:Upload after following a red link.
12824* (bug 23642) Recognize mime types of MS OpenXML documents.
12825* (bug 22784) Normalise underscores and spaces in autocomments.
12826* (bug 19910) Headings of the form ===+\s+ are now displayed as valid headings.
12827* (bug 24022) Only check file extensions on the uploadpage when needed.
12828* (bug 24076) Recognize Office 2003 files with OpenXML trailers.
12829* (bug 24244) Updated comments in DefaultSettings.php to reflect
12830  Image: --> File: namespace rename.
12831* Make wfTimestamp recognize negative unix timestamp values.
12832* (bug 24401) SimpleSearch: No button/text indicating 'Search' if image is
12833  disabled.
12834* (bug 23293) Do not show change tags when Special:RecentChanges(linked) or
12835  Special:Newpages is transcluded into another page as it messes up the page.
12836* (bug 24517) LocalFile::newFromKey() and OldLocalFile::newFromKey() no longer
12837  throw fatal errors.
12838* (bug 23380) Uploaded files that are larger than allowed by PHP now show a
12839  useful error message.
12840* Uploading to a protected title will allow the user to choose a new name
12841  instead of showing an error page.
12842* (bug 24425) Use Database::replace instead of delete/insert in
12843  SqlBagOStuff::set to avoid query errors about duplicate keynames.
12844* (bug 15470) First letters of filenames are always capitalized by upload JS.
12845* (bug 21215) NoLocalSettings.php doesn't tolerate rewrite rules.
12846* (bug 21052) Fix link color for stubs in NewPages.
12847* (bug 24714) Usage of {{#dateformat: }} in wikis without $wgUseDynamicDates no
12848  longer pollutes the parser cache.
12849* (bug 17031) Correct which characters the parser allows in tag attributes (a
12850  letter, colon or underscore followed by 0 or more letters, numbers, colons,
12851  underscores, hyphens, and/or periods).
12852* Save 200 useless queries on each category page view.
12853* Shell commands will now work on Linux in filesystems mounted noexec.
12854* (bug 24804) Corrected commafying in Polish and Ukrainian.
12855* "Difference between pages" is now displayed instead of "Difference between
12856  revisions" on diffs when appropriate.
12857* (bug 23703) ForeignAPIRepo fails on findBySha1() when using a 1.14 install as
12858  a repository due to missing 'name' attribute from the API list=allimages.
12859* (bug 24898) MediaWiki uses /tmp even if a vHost-specific tempdir is set, also
12860  make wfTempDir() return a sane value for Windows on worst-case.
12861* (bug 24824) Support ImageMagick 6.5.6-2+ JPEG decoder size hint, to reduce
12862  memory usage when such an ImageMagick is used for scaling.
12863* Disable multithreaded behavior in recent ImageMagick, to avoid a deadlock
12864  when a resource limit such as $wgMaxShellMemory is hit.
12865* (bug 24981) Allow extensions to access SpecialUpload variables again.
12866* (bug 20744) Wiki forgets about an uploaded file.
12867* (bug 17913) Don't show "older edit" when no older edit available.
12868* (bug 6204) TOC not properly rendered when using $wgMaxTocLevel.
12869* (bug 24977) The accesskey in history page now lead directly to the diff
12870  instead of alternating focus between the two buttons.
12871* (bug 24987) Special:ListUsers does not take external groups into account.
12872* (bug 20633) update.php has mixed language output.
12873* SQLite system table names are now never prefixed.
12874* (bug 25292) SkinSubPageSubtitle hook now passes the Skin object as second
12875  parameter.
12876* (bug 25167) Correctly load JS fixes for IE6 (fixing a regression in 1.16).
12877* (bug 25367) wfShellExec() is more explicit when failing due to disabled
12878  passthru().
12879* (bug 25462) Fix double-escaping for section edit link tooltips.
12880* action=raw was removed for Special:Statistics. This information is still
12881  available via the API.
12882* (bug 23934) Groups defined in $wgRevokePermissions but not in
12883  $wgGroupPermissions now appear on Special:ListGroupRights.
12884* (bug 23923) Special:Prefixindex no longer shows results if nothing was
12885  requested.
12886* (bug 22308) Search now finds text in default main page immediately after
12887  setup.
12888* (bug 25697) Make sure empty lines render in diff view.
12889* Use an actual minus sign in diff views, instead of a hyphen.
12890* (bug 23732) Clarified "n links" message on Special:MostLinkedFiles.
12891* (bug 23731) Clarified "n links" message on Special:MostLinkedTemplates.
12892* (bug 25642) A exception is now thrown instead of a fatal error when using
12893  $wgSMTP without PEAR mail package.
12894* (bug 19633) When possible, Upscale small SVGs when creating thumbnails.
12895* (bug 11013) Database driver detection needs rewriting for robustness.
12896* (bug 13409) Installer prompts could use clarification--now has help boxes.
12897* (bug 16902) Installer spews warnings when exec() and dl() are not available.
12898* (bug 19129) Only show MyISAM/InnoDB when supported.
12899* (bug 17762) Only show other e-mail options when e-mail is globally enabled.
12900* Cache multiple sizes of InstantCommons thumbnails.
12901* (bug 25488) Disallowing anonymous users to read pages no longer throws error
12902  on discussion pages with vector as default skin.
12903* (bug 24833) Files name in includes/diff/ are now less confusing.
12904* (bug 25713) SpecialPage::resolveAlias() now normalise spaces to underscores.
12905* (bug 25829) Special:Mypage and Special:Mytalk now forward oldid, diff and dir
12906  parameters.
12907* (bug 25175) HTML file cache now honor $wgCacheDirectory if
12908  $wgFileCacheDirectory is not set.
12909* (bug 13353) Diff3 version checks were too strict, did not detect working
12910  diff3.
12911* (bug 25843) Links to special pages using link= attribute on images are now
12912  normalised like normal links to special pages.
12913* (bug 21364) External links using link= attribute on images now respect
12914  $wgExternalLinkTarget.
12915* (bug 17789) Added a note to the total views on Special:Statistics saying that
12916  is doesn't count non-existing pages and special pages.
12917* (bug 17996) HTTP redirects are now combined when requesting a special page.
12918* (bug 19944) Link on image thumbnails no longer link to "Media:" namespace in
12919  some cases.
12920* (bug 25670) wfFindFile() now checks the namespace of the given title, only
12921  "File" and "Media" are allowed now.
12922* (bug 25872) Rename the HttpRequest class to MWHttpRequest to avoid conflict
12923  with php extension that defines same class.
12924* (bug 20591) There's now a different message on Special:MovePage when
12925  $wgFixDoubleRedirects is set to false.
12926* Fixed PHP warnings when updating a broken MySQL database.
12927* (bug 26023) Corrected deleteBacth.php's documentation.
12928* (bug 25451) Improved datetime representation in 32 bit php >= 5.2.
12929* Show "skin does not exist error" only when the skin is inputted in the wrong
12930  case.
12931* (bug 26164) Potential html injection when the database server isn't available.
12932* (bug 26160) Upload description set by extensions are not propagated.
12933* (bug 9675) generateSitemap.php now takes an --urlpath parameter to allow
12934  absolute URLs in the sitemap index (as required e.g. by Google).
12935* Partial workaround for bug 6220: at least make files on shared repositories
12936  show up as (struck-out) bluelinks instead of redlinks on Special:WantedFiles.
12937* rebuildFileCache.php no longer creates inappropriate cache files for
12938  redirects.
12939* (bug 25512) Subcategory list should not include category prefix for members.
12940* (bug 10871) Javascript and CSS pages in MediaWiki namespace are no longer
12941  treated as wikitext on preview.
12942* Page existence is now not revealed (in the colour of the tabs) to users who
12943  cannot read the page in question.
12944* (bug 22753) Output from update.php is more clear when things changed, entries
12945  indicating nothing changed are now all prefixed by "..."
12946* (bug 16019) $wgArticlePath = "/$1" no longer breaks API edit/watch actions.
12947* (bug 18372) File types blacklisted by $wgFileBlacklist will no longer be shown
12948  as "Permitted file types" on the upload form.
12949* (bug 26540) Fixed wrong call to applyPatch in MysqlUpdater.
12950* (bug 26034) Make the "View / Read" tab in content_navigation style tabs remain
12951  selected when the action is "purge".
12952* (bug 26733) Wrap initial table creation in transaction.
12953* (bug 26208) Mark directionality of some interlanguage links.
12954* (bug 26716) Provide link to instructions for external editor related
12955  preferences.
12956* (bug 26961) Hide anon edits in watchlist preference now actually works.
12957* (bug 1379) Installer directory conflicts with some hosts' configuration panel.
12958* (bug 27781) Installer does not warn about 5.1.x. Added a compatibility
12959  function for array_key_exists().
12960* Fix XML well-formedness on a few pages when $wgHtml5 is true (the default).
12961* (bug 28069) MediaWiki fails streaming files when mod_deflate and ob_gzhandler
12962  are also set.
12963* (bug 26223) Concurrently moving an article to different titles leaks a
12964  redirect revision with no page.
12965* (bug 15641) Fixed permissions checks in Special:Import which allowed users
12966  without the 'import' permission to import pages from configured import
12967  sources.
12968* (bug 26449) Keep underlines from headings outside of tables and thumbs by
12969  adding overflow:hidden to h1,h2,h3,h4,h5,h6 (also fixes editsection bunching).
12970* (bug 26708) Remove background-color:white from tables in Monobook and Vector.
12971* (bug 26781) {{PAGENAME}} and related parser functions escape their output
12972  better.
12973* (bug 26716) Provide link to instructions for external editor related
12974  preferences and add a comment to the ini control file explaining what is going
12975  on.
12976* (bug 28422) Remove color:black from tables in Monobook and Vector. And add it
12977  to table.wikitable instead.
12978* (bug 27560) Search queries no longer fail in walloon language.
12979* (bug 27700) The upload protection can now also be set for files that do not
12980  exist.
12981* (bug 28034) uploading file to local wiki when file exists on shared repository
12982  (commons) gives spurious info in the warning message.
12983* Usernames get lost when selecting different sorts on Special:listfiles.
12984* (bug 28166) UploadBase assumes that 'edit' and 'upload' rights are not per
12985  page restrictions.
12986* (bug 28242) Make redirects generated by urls containing a local interwiki
12987  prefix be a 301 instead of a 302.
12988* (bug 28568) Entries in the iwlinks table are now removed on page deletion.
12989* (bug 28306) Fix exposure of suppressed usernames in ForeignDBRepo.
12990* (bug 28444) Fix regression: edit-on-doubleclick retains revision id again.
12991* UtfNormal::cleanUp on an invalid utf-8 sequence no longer returns false if
12992  intl installed.
12993* (bug 26729) Category pages should return 404 if they do not exist and have no
12994  members.
12995* (bug 28214) When page not found, sends malformed HTTP/1.x instead of HTTP/1.1
12996  in header of response.
12997* (bug 27634) TOC title appears in wrong language.
12998* (bug 27761) Fix regression: pages with Esperanto titles containing convertible
12999  character sequences became unreachable.
13000* (bug 27508) SVGMetadataExtractor takes too much resources on huge svgs.
13001* (bug 27465) SVG thumbnail generation.
13002* (bug 27467) preload can leave UNIQ.
13003* (bug 27539) Allow attributes beginning with a digit in wikitext tag
13004  parameters.
13005* (bug 27328) using relative paths in CSS imports in MediaWiki:Common.css broken
13006  in 1.17.
13007* (bug 27333) Fix repetitive last-seen time queries on page history.
13008* (bug 26250, bug 23817) Fix wfObjectToArray() to descend into arrays; fixes
13009  processing of JSON return values for ForeignAPIRepo when native json module
13010  not present.
13011* (bug 25675) Fix search suggestions for Special: pages with spaces.
13012* (bug 25571) Xml::encodeJsVar now passes floats natively instead of converting
13013  to strings.
13014* (bug 27338) Gallery in 1.17 breaks for audio/video + ogghandler.
13015* (bug 27302) Don't append the current timestamp for user/site modules when no
13016  user/site JS/CSS is present.
13017* (bug 27016) dumpTextPass.php now consider the "output" parameter.
13018* (bug 22606) don't send the "someone registred an account" message when setting
13019  email address (i.e. old one empty) in user preferences.
13020* (bug 26458) Section edit links appear on pages that user does not have right
13021  to edit.
13022* (bug 28611) Don't die in SqlBagOStuff::incr() if there's a race condition.
13023* (bug 16886) Sister projects box moves down the extract of the first result
13024  in IE 7.
13025* (bug 17398) Fixed "link" parameter in image links with "thumb" or "frame"
13026  parameter.
13027
13028=== API changes in 1.17 ===
13029
13030* BREAKING CHANGE: action=patrol now requires POST.
13031* BREAKING CHANGE: patrol token is no longer the same as edit token.
13032* BREAKING CHANGE: Session keys returned by ApiUpload are now strings instead
13033  of integers.
13034* BREAKING CHANGE: (bug 25303) Fix API parameter integer validation to actually
13035  enforce validation on the input values in addition to giving a warning.
13036  Also add flag to enforce (die) if integer out of range.
13037* (bug 24650) Fix API to work with categorylinks changes.
13038* action=parse now correctly returns an error for nonexistent pages.
13039* (bug 27201) Special:WhatLinksHere output no longer contains duplicate IDs.
13040* (bug 26560) On allusers if limit < total number of users, last user gets
13041  duplicated.
13042* (bug 27715) imageinfo didn't respect revdelete.
13043* (bug 27479) API error when using both prop=pageprops and
13044  prop=info&inprop=displaytitle.
13045* (bug 27862) Useremail module didn't properly return success on success.
13046* (bug 27590) prop=imageinfo now allows querying the media type.
13047* (bug 27587) list=filearchive now outputs full title info.
13048* (bug 27897) list=allusers and list=users list hidden users.
13049* (bug 22738) Allow filtering by action type on query=logevent.
13050* (bug 22764) uselang parameter for action=parse.
13051* (bug 22944) API: watchlist options are inconsistent.
13052* (bug 22868) don't list infinite block expiry date as "now" in API logevents.
13053* (bug 22290) prop=revisions now outputs "comment" field even when comment
13054  is empty, for consistency with list=recentchanges.
13055* (bug 19721) API action=help should have a way to just list for a specific
13056  module.
13057* (bug 23458) Add support for pageid parameter to action=parse requests.
13058* (bug 23460) Parse action should have a section option.
13059* (bug 21346) Make deleted images searchable by hash.
13060* (bug 23461) Normalise usage of parameter names in parameter descriptions.
13061* (bug 23548) Allow access of another users watchlist through watchlistraw
13062  using token and username.
13063* (bug 23524) Api Modules as followup to bug 14473 (Add iwlinks table to
13064  track inline interwiki link usage).
13065* Add pltitles and tltemplates to prop=links and prop=templates respectively,
13066  similar to prop=categories's clcategories.
13067* (bug 23834) Invalid "thumbwidth" and "thumbheight" in "imageinfo" query when
13068  thumbnailing larger than original image.
13069* (bug 23835) Need "thumbmime" result in "imageinfo" query.
13070* (bug 23851) Repair diff for file redirect pages.
13071* (bug 24009) Include implicit groups in action=query&list=users&usprop=groups.
13072* (bug 24016) API: Handle parameters specified in simple string syntax
13073  ( 'paramname' => 'defaultval' ) correctly when outputting help.
13074* (bug 24089) Logevents causes PHP Notice if leprop=title isn't supplied.
13075* (bug 23473) Give description of properties on all modules.
13076* (bug 24136) unknownerror when adding new section without summary, but
13077  forceditsummary.
13078* (bug 22339) Added srwhat=nearmatch to list=search to get a "go" result.
13079* (bug 24303) Added new &servedby parameter to all actions which adds the
13080  hostname that served the request to the result. It is also added
13081  unconditionally on error.
13082* (bug 24185) Titles in the Media and Special namespace are now supported for
13083  title normalization in action=query. Special pages have their name resolved
13084  to the local alias.
13085* (bug 24296) Added converttitles parameter to convert titles to their
13086  canonical language variant.
13087* (bug 23936) Add "displaytitle" to query/info API.
13088* (bug 24485) Make iwbacklinks a generator, optionally display iwprefix and
13089  iwtitle.
13090* (bug 24564) Fix fatal errors when using list=deletedrevs, prop=revisions or
13091  one of the backlinks generators with limit=max.
13092* (bug 24656) API's parse module needs option to disable PP report.
13093* PARAM_REQUIRED parameter flag added. If this flag is set, and the end user
13094  does not set the parameter, the API will automatically throw an error.
13095* (bug 24665) When starttimestamp is not specified, fake it by setting it to
13096  NOW, not to the timestamp of the last edit.
13097* (bug 24677) axto= parameters added to allcategories, allimages, alllinks,
13098  allmessages, allpages, and allusers.
13099* (bug 24236) Add add, remove, add-self, remove-self tags to
13100  meta=siteinfo&siprop=usergroups.
13101* (bug 24484) Add prop=pageprops module.
13102* (bug 24330) Add &redirect parameter to ?action=edit.
13103* (bug 24722) For list=allusers&auprop=blockinfo, only show blockedby and
13104  blockreason if the user is actually blocked.
13105* Add format=dump and format=dumpfm, outputs results in PHP's var_dump() format.
13106* For required string parameters, if '' is provided, this is now classed as
13107  missing.
13108* (bug 24724) list=allusers is out by 1 (shows total users - 1).
13109* (bug 24166) API error when using rvprop=tags.
13110* Introduced "asynchronous download" mode for upload-by-url. Requires
13111  $wgAllowAsyncCopyUploads to be true.
13112* sinumberingroup correctly gives size of 'user' group, and omits size of
13113  implicit groups rather than showing 0.
13114* (bug 25248) API: paraminfo errors with certain modules.
13115* (bug 24792) API help for action=purge sometimes wrongly stated whether a
13116  POST request was needed due to cache pollution.
13117* Added iiprop=parsedcomment to prop=imageinfo, similar to prop=revisions.
13118* Added rvparse to parse revisions. For performance reasons if this option is
13119  used, rvlimit is enforced to 1.
13120* (bug 25748) If a action=parse request provides an oldid that is actually the
13121  current revision id, try the parser cache, and save it to it if necessary.
13122* (bug 25463) Export header should not be shown if no pages were requested, to
13123  reduce confusion.
13124* (bug 25648) API discovery information has been added as RSD link in page
13125  <head> and by providing an API module action=rsd. Added hook
13126  ApiRsdServiceApis for extensions to add their own service to the services
13127  list.
13128* The HTML of diff output markers has changed. Hyphens are now minus signs,
13129  empty markers are now filled with non-breaking-space characters.
13130* (bug 25741) Add more data to list=search's srprop.
13131* (bug 25760) counter property still reported by the API when
13132  $wgDisableCounters enabled.
13133* (bug 25987) prop=info&inprop=watched now also works for missing pages.
13134* (bug 26006) prop=langlinks now allows obtaining full URL.
13135* (bug 26075) ApiDelete.php now calls correctly ArticleDelete hook.
13136* (bug 26089) add block expiration to blockinfo.
13137* (bug 26125) prop=imageinfo&iiprop=size now returns the page count if the
13138  file is a multi-page file.
13139* (bug 10268) Added linktodiffs parameter on action=feedwatchlist.
13140* (bug 26219) Show API limits for multi values in description.
13141* (bug 28070) Fix watchlist RSS for databases that store timestamps in a
13142  real timestamp field.
13143* (bug 27722) list=filearchive now supports revdel.
13144
13145=== Language support changes in 1.17 ===
13146
13147MediaWiki supports over 330 languages. Many localizations are updated regularly.
13148
13149The following languages were added:
13150
13151* Moroccan Spoken Arabic (ary)
13152* Banjar (bjn)
13153* Kabardian (kbd)
13154* Kabardian (Cyrillic) (kbd-cyrl)
13155* Latgalian (ltg)
13156* Minangkabau (min)
13157* Dutch (informal) (nl-informal)
13158* Rusyn (rue)
13159
13160Other significant changes to MediaWiki's language support:
13161
13162* Fiji Hindi (Devangari script) was removed.
13163* Removed deprecated language code "dk" (Danish), use "da" instead.
13164* Link trail added for sl and sh.
13165* (bug 27633) Add characters to linkTrail for Portuguese (pt and pt-br).
13166* (bug 23156) Commafy and search normalization updated for Belarusian
13167  (Taraškievica).
13168* (bug 23283) Native name for Old English -> Ænglisc.
13169* (bug 23364) Native name for Azerbaijani -> Azərbaycanca.
13170* (bug 24593) Native name for Sorani now uses only Arabic script.
13171* (bug 24628) Generic translations for NS_USER/NS_USER_TALK for Esperanto.
13172* (bug 24917) Polish as fallback for Kashubia.
13173* (bug 24794) Tatar link trail updated.
13174* Esperanto date format corrected.
13175* (bug 28159) Change interwiki name of language kbd to Къэбэрдеибзэ /
13176  Qabardjajəbza.
13177* (bug 28184) Namespaces for the Latgalian Wikipedia.
13178* (bug 25010) Bashkir-language interwikis: linktext change from Башҡорт
13179  to Башҡортса.
13180* (bug 26395) Change name of Cornish language to Kernowek.
13181
13182=== Other changes in 1.17 ===
13183
13184* DatabaseFunctions.php that was needed for compatibility with pre-1.3
13185  extensions has been removed.
13186* XmlFunctions.php has been removed. Use the Xml or Html classes as appropriate.
13187* The FailFunction "error handling" method has now been removed
13188* Sysops now have the "suppressredirect" right by default
13189* Removed $wgRemoteUploads. It was not well supported and superseded by
13190  $wgUploadNavigationUrl.
13191* (bug 26253) $wgPostCommitUpdateList has been removed
13192* The PHPUnit test suite has been removed from this release due to serious
13193  issues which should be resolved by the 1.18 release.
13194* Oracle DB now uses the __destruct function to commit/close connection as it
13195  doesn't commit on close if transation is triggered in OCI.
13196
13197== MediaWiki 1.16 ==
13198
13199== MediaWiki 1.16.5 ==
13200=== Changes since 1.16.4 ===
13201
13202* (bug 28534) Fixed XSS vulnerability for IE 6 clients. This is the third
13203  attempt at fixing bug 28235.
13204* (bug 28639) Fixed potential privilege escalation when $wgBlockDisablesLogin
13205  is enabled.
13206
13207== MediaWiki 1.16.4 ==
13208=== Changes since 1.16.3 ===
13209
13210* (bug 28507) The change we made in 1.16.3 to fix bug 28235 (XSS for IE 6
13211  clients) was not actually sufficient to fix that bug. This release contains
13212  a second attempt, hopefully we have fixed it this time.
13213
13214== MediaWiki 1.16.3 ==
13215=== Changes since 1.16.2 ===
13216
13217* (bug 28449) Fixed permissions checks in Special:Import which allowed users
13218  without the 'import' permission to import pages from the configured import
13219  sources.
13220* (bug 28235) Fixed XSS affecting IE 6 and earlier clients only, due to those
13221  browsers looking for a file extension in the query string of the URL, and
13222  ignoring the Content-Type header if one is found.
13223* (bug 28450) Fixed a CSS validation issue involving escaped comments, which
13224  led to XSS for Internet Explorer clients and privacy loss for other clients.
13225
13226== MediaWiki 1.16.2 ==
13227=== Changes since 1.16.1 ===
13228
13229* (bug 26642) Fixed incorrect translated namespace due to a regression in the
13230  language converter.
13231* The interface translations were updated.
13232* (bug 27093, CVE-2011-0047): Fixed CSS injection vulnerability.
13233* (bug 27094) Fixed server-side arbitrary script inclusion vulnerability.
13234  Affects Windows servers only. A malicious file with extension ".php" must
13235  exist on the server for the exploit to be effective.
13236
13237== MediaWiki 1.16.1 ==
13238=== Changes since 1.16.0 ===
13239
13240* (bug 24981) Allow extensions to access SpecialUpload variables again
13241* (bug 24724) list=allusers was out by 1 (shows total users - 1)
13242* (bug 24166) Fixed API error when using rvprop=tags
13243* For wikis using French as a content language, Special:Téléchargement works
13244  again as an alias for Special:Upload.
13245* (bug 25167) Correctly load JS fixes for IE6 (fixing a regression in 1.16.0)
13246* (bug 25248) Fixed paraminfo errors in certain API modules.
13247* The installer now has improved handling for situations where safe_mode is
13248  active or exec() and similar functions are disabled.
13249* (bug 19593) Specifying --server in now works for all maintenance scripts.
13250* Fixed $wgLicenseTerms register globals.
13251* (bug 26561) Fixed clickjacking vulnerabilities by introducing support for
13252  X-Frame-Options. The header value can be configured using $wgBreakFrames and
13253  $wgEditPageFrameOptions.
13254
13255== MediaWiki 1.16.0 ==
13256=== Changes since 1.16 beta 3 ===
13257
13258* (bug 23769) Disabled HTML 5 client-side form validation. Was introduced in
13259  1.16 beta 1, but is currently poorly supported by browsers.
13260* (bug 23175) Re-added window.ta variable for backwards compatibility.
13261* (bug 23264) Fixed breakage of various command line scripts due to extra line
13262  endings being inserted by Maintenance::output().
13263* Fixed HTTP client functionality with safe_mode=On.
13264* Fixed parser tests broken in 1.16 beta 3.
13265* For Oracle DB backend: fixed parser tests and table prefix feature.
13266* (bug 23767) Fixed PHP warning when REQUEST_URI is blank (IIS issue).
13267* Fixed plural function for Northern Sami (se)
13268* (bug 23597) Fixed conflicts between ID attributes in the Vector skin and
13269  parser-generated heading IDs. Renamed head, panel, head-base and page-base.
13270* Disabled $wgHitcounterUpdateFreq>1 feature on SQLite, does not work yet.
13271* (bug 23465) Don't ignore the predefined destination filename on
13272  Special:Upload after following a red link to a file.
13273* In SQLite full-text search feature: fixed "move page" feature, was non-
13274  functional.
13275* (bug 24565) Fixed Cache-Control headers sent from API modules, to protect
13276  user privacy in the case where an attacker can access the wiki through the
13277  same HTTP proxy as a logged-in user.
13278* Fixed an XSS vulnerability in profileinfo.php for installations with
13279  $wgEnableProfileInfo = true (false by default)
13280* Fixed a case where an X-Vary-Options header was sent despite $wgUseXVO being
13281  false. Fixed a minor header parsing issue when $wgUseXVO = true.
13282* Fixed a register_globals arbitrary inclusion vulnerability in
13283  MediaWikiParserTest.php, introduced in 1.16 beta 1.
13284
13285=== Changes since 1.16 beta 2 ===
13286
13287* Fixed bugs in the [[Special:Userlogin]] and [[Special:Emailuser]] handling of
13288  invalid usernames.
13289* Fixed sorting in [[Special:Allmessages]]
13290* (bug 23113) Fixed title in the show/hide links on diff pages
13291* (bug 23117) Fixed API rollback, was returning "badtoken" for valid requests
13292* (bug 23127) Re-added missing $1 parameter to the uploadtext message
13293* Fixed a bug in the Vector skin where personal tools display behind the logo
13294* (bug 23139) Fixed a bug in edit conflict resolution, where both textboxes
13295  showed the same text.
13296* (bug 23115, bug 23124) Fixed various problems with <title> and <h1> elements
13297  in page views and previews when the language converter is enabled.
13298* (bug 23148) Fixed a local path disclosure vulnerability in ImageMagick image
13299  scaling, which was introduced in 1.16 beta 1.
13300* Improved error checking on installer.
13301* (bug 22970) Fixed a JavaScript error in the upload destination conflict
13302  check.
13303* (bug 23167) Check the watch checkbox by default if the watchcreations
13304  preference is set.
13305* (bug 23171) Improve IE6 version check to avoid false positives.
13306* (bug 23176) Fixed upload warning override feature "upload new version",
13307  broken in 1.16 beta 1.
13308* Fixed regression in unwatch links sent out in notification emails. When the
13309  mailing job was deferred via the job queue, the title was incorrect.
13310* (bug 23534) Fixed SQL query error in API list=allusers.
13311* Fixed a bug in uploads for non-JavaScript clients. An empty string was used
13312  as the default destination filename, instead of the source filename as
13313  expected.
13314* (bug 23371) Fixed CSRF vulnerability in "e-mail me my password", "create
13315  account" and "create by e-mail" features of [[Special:Userlogin]]
13316* (bug 23687) Fixed XSS vulnerability affecting IE clients only, due to a CSS
13317  validation issue.
13318* Fixed a DoS vulnerability in ImageMagick image scaling. ImageMagick
13319  expanded wildcard characters "?" and "*" in image filenames, potentially
13320  causing large numbers of images to be scaled in response to a single request.
13321  The fix for this involves breaking the scaling of such image filenames until
13322  ImageMagick 6.6.1-5 or later is deployed, see bug 23361 for more details.
13323* (bug 23608) Fixed invalid HTML in diff pages.
13324
13325=== Changes since 1.16 beta 1 ===
13326
13327* Fixed errors in maintenance/patchSql.php
13328* (bug 19627) Fix regression from r57867 where HTMLForm would output
13329  <element classes="foo bar"> rather than <element class="foo bar">
13330* Fixed broken "-r" option to maintenance/lag.php
13331* (bug 23076) Fixed login CSRF vulnerability. Logins now require a token to
13332  be submitted along with the user name and password.
13333
13334=== Configuration changes in 1.16 ===
13335
13336* (bug 18222) $wgMinimalPasswordLength default is now 1
13337* $wgSessionHandler can be used to configure session.save_handler
13338* $wgLocalFileRepo/$wgForeignFileRepos now have a 'fileMode' parameter to
13339  be used when uploading/moving files
13340* (bug 18761) $wgHiddenPrefs is a new array for specifying preferences not
13341  to be shown to users
13342* $wgAllowRealName and $wgAllowUserSkin were deprecated in favor of
13343  $wgHiddenPrefs[] = 'realname', but the former are still retained
13344  for backwards-compatibility
13345* (bug 9257) $wgRCMaxAge now defaults to three months
13346* $wgDevelopmentWarnings can be set to true to show warnings about deprecated
13347  functions and other potential errors when developing.
13348* Subpages are now enabled in the MediaWiki namespace by default.  This is
13349  mainly a cosmetic change, and does not in any way affect the MessageCache,
13350  which was already effectively treating the namespace as if it had subpages.
13351* Oracle: maintenance/ora/user.sql script for creating DB user on oracle with
13352  appropriate privileges. Creating this user with web-install page requires
13353  oci8.privileged_connect set to On in php.ini.
13354* Removed UserrightsChangeableGroups hook introduced in 1.14
13355* Added $wgCacheDirectory, to replace $wgFileCacheDirectory,
13356  $wgLocalMessageCache, and any other local caches which need a place to put
13357  files.
13358* $wgFileCacheDirectory is no longer set to anything by default, and so either
13359  needs to be set explicitly, or $wgCacheDirectory needs to be set instead.
13360* $wgLocalMessageCache has been removed. Instead, set $wgUseLocalMessageCache
13361  to true
13362* Removed $wgEnableSerializedMessages and $wgCheckSerialized. Similar
13363  functionality is now available via $wgLocalisationCacheConf.
13364* $wgMessageCache->addMessages() is deprecated. Messages added via this
13365  interface will not appear in Special:AllMessages.
13366* $wgRegisterInternalExternals can be used to record external links pointing
13367  to same server
13368* (bug 19907) $wgCrossSiteAJAXdomains and $wgCrossSiteAJAXdomainExceptions added
13369  to control which external domains may access the API via cross-site AJAX.
13370* $wgMaintenanceScripts for extensions to add their scripts to the default list
13371* $wgMemoryLimit has been added, default value '50M'
13372* $wgExtraRandompageSQL is deprecated, the SpecialRandomGetRandomTitle hook
13373  should be used instead
13374* (bug 20489) $wgIllegalFileChars added to override the default list of illegal
13375  characters in file names.
13376* (bug 19646) $wgImgAuthDetails added  to display reason access to uploaded file
13377  was denied to users(img_auth only)
13378* (bug 19646) $wgImgAuthPublicTest added to test to see if img_auth set up
13379  correctly (img_auth only)
13380* $wgUploadMaintenance added to disable file deletions and restorations during
13381  maintenance
13382* $wgCapitalLinkOverrides added to configure per-namespace capitalization
13383* (bug 21172) $wgSorbsUrl can now be an array with multiple DNSBL and renamed
13384  to $wgDnsBlacklistUrls (backward compatibility kept)
13385* $wgEnableHtmlDiff has been removed
13386* (bug 3340) $wgBlockCIDRLimit added (default: 16) to configure the low end of
13387  CIDR ranges for blocking
13388* $wgUseInstantCommons added for quick and easy enabling of Commons as a remote
13389  file repository
13390* $wgDBAhandler added to choose a DBA handler when using CACHE_DBA
13391* $wgPreviewOnOpenNamespaces for extensions that create namespaces that behave
13392  similarly to the category namespace.
13393* $wgEnableSorbs renamed to $wgDnsBlacklistUrls ($wgEnableSorbs kept for
13394  backward compatibility)
13395* $wgUploadNavigationUrl now also affects inline images that do not
13396  exist. In that case the URL will get (?|&)wpDestFile=<filename> appended to
13397  it as appropriate.
13398* If $wgLocaltimezone is null, use the server's timezone as the default for
13399  signatures. This was always the behavior documented in DefaultSettings.php
13400  but has not been the actual behavior for some time: instead, UTC was used
13401  by default.
13402* Added $wgExtensionAssetsPath, to decouple assets serving from $wgScriptPath.
13403  If not specified it will default to $wgScriptPath/extensions
13404* Added $wgCountTotalSearchHits to make search UI display total number of hits
13405  with some search engines.
13406* Added $wgAdvertisedFeedTypes to decide what feed types (RSS, Atom, both, or
13407  neither) MediaWiki advertises.  Default is array( 'atom' ), so RSS is no
13408  longer advertised by default (but it still works).
13409* Added $wgMemCachedTimeout, controls how long to wait for data from the
13410  memcached servers.
13411* New configuration variables $wgDebugTimestamps and $wgDebugPrintHttpHeaders
13412  for controlling debug output.
13413* New $wgBlockDisablesLogin when set to true disallows blocked users from
13414  logging in.
13415* (bug 8790) Metadata edition ($wgUseMetadataEdit) has been moved to a separate
13416  extension "MetadataEdit".
13417
13418=== New features in 1.16 ===
13419
13420* Add CSS defintion of the 'wikitable' class to shared.css
13421* (bug 17163) Added MediaWiki:Talkpageheader which will be displayed when
13422  viewing talk pages
13423* Superfluous border="0" removed from images
13424* Added new hook 'MessageCacheReplace' into MessageCache.php. For instance
13425  to allow extensions to update caches in similar way as MediaWiki invalidates
13426  a cached MonoBook sidebar
13427* Special:AllPages: Move hardcoded styles from code to CSS
13428* (bug 18529) New hook: SoftwareInfo for adding information about the software
13429  to Special:Version
13430* Added $wgExtPGAlteredFields to allow extensions to easily alter the data
13431  type of columns when using the Postgres backend.
13432* (bug 16950) Show move log when viewing/creating a deleted page
13433* (bug 18242) Show the Subversion revision number per extensions in
13434  Special:Version
13435* (bug 18420) Missing file revisions are handled gracefully now
13436* (bug 9219) Auth plugins can control editing RealName/Email/Nick preferences
13437* (bug 18466) Add note or warning when overruling a move (semi-)protection
13438* (bug 18342) insertTags works in edit summary box
13439* (bug 18411) The upload form also checks post_max_size
13440* Watchlist now has a specialized <div> tag that contains a unique class for
13441  each page
13442* Added Minguo calendar support for the Taiwan Chinese language
13443* Database: unionQueries function to be used for UNION sql construction, so
13444  it can be overloaded on DB abstraction level for DB specific functionality
13445* (bug 18849) Implement Japanese and North Korean calendars
13446* (bug 5755) Introduce {{CURRENTMONTH1}} and {{LOCALMONTH1}} to display the
13447  month number without the leading zero
13448* (bug 13456) categoriespagetext supports PLURAL
13449* (bug 18860) Blocks of IPs affecting registered users can now block email
13450* (bug 17093) Date and time are separate parameters in Special:BlockList
13451* (bug 11484) Added ISO speed rating to default collapsed EXIF metadata view
13452* (bug 14866) Messages 'recentchangeslinked-toolbox' and
13453  'recentchangeslinked-toolbox' were added to allow more fine grained
13454  customisation of the user interface
13455* DISPLAYTITLE now accepts a limited amount of wiki markup (the single-quote
13456  items)
13457* Special:Search now could search terms in all variant-forms. ONLY apply on
13458  wikis enabled LanguageConverter.
13459* Add autopromote condition APCOND_BLOCKED to autopromote blocked users to
13460  various user groups.
13461* Add $wgRevokePermissions as a means of restricting a group's rights. The
13462  syntax is identical to $wgGroupPermissions, but users in these groups will
13463  have these rights stripped from them.
13464* Added a PHP port of CDB (constant database), for improved local caching when
13465  the DBA extension is not available.
13466* Introduced a new system for localisation caching. The system is based around
13467  fast fetches of individual messages, minimising memory overhead and startup
13468  time in the typical case. The database backend will be used by default, but
13469  set $wgCacheDirectory to get a faster CDB-based implementation.
13470* Expanded the number of variables which can be set in the extension messages
13471  files.
13472* Added a feature to allow per-article process pool size control for the parsing
13473  task, to limit resource usage when the cache for a heavily-viewed article is
13474  invalidated. Requires an external daemon.
13475* (bug 19576) Moved the id attributes from the anchors accompanying section
13476  headers to the <span class="mw-headline"> elements within the section headers,
13477  removing the redundant anchor elements.
13478* Parser::setFunctionTagHook now can be used to add a new tag which is parsed at
13479  preprocesor level.
13480* Added $wgShowArchiveThumbnails, allowing sysadmins to disable thumbnail
13481  display for old versions of images.
13482* In watchlists and Special:RecentChanges, the difference in page size now
13483  appears in dark green if bytes were added and dark red if bytes were removed.
13484* Added FSRepo configuration properties thumbUrl and thumbDir, to allow the
13485  thumbnails to be stored in a separate location to the source images.
13486* If config/ directory is not executable, the command to make it executable
13487  now asks the user to cd to the correct directory
13488* Add experimental new external authentication framework, ExternalAuth
13489* (bug 18768) Remove AdminSettings requirements. Maintenance environment
13490  will still load it if it exists, but it's not required for anything
13491* (bug 19900) The "listgrouprights-key" message is now wrapped in a div with
13492  class "mw-listgrouprights-key"
13493* (bug 471) Allow RSS feeds for watchlist, using an opt-in security token
13494* (bug 10812) Interwiki links can have names and descriptions, fetched from
13495  message 'interwiki-desc-PREFIX', not really used anywhere yet though
13496* (bug 9691) Add type (signup or login) parameter to
13497  AuthPlugin::ModifyUITemplate()
13498* (bug 14454) "Member of group(s)" in Special:Preferences causes language
13499  difficulties
13500* (bug 16697) Unicode combining characters are difficult to edit in some
13501  browsers
13502* Parser test supports uploading results to remote CodeReview instance
13503* (bug 20013) Added CSS class "mw-version-ext-version" is wrapped on the
13504  extension version in Special:Version
13505* (bug 20014) Added CSS class "mw-listgrouprights-right-name" is wrapped on the
13506  right name in Special:ListGroupRights
13507* (bug 12920) New CoreParserFunction {{nse:...}} as an url-friendly equivalent
13508  to {{ns:...}}
13509* (bug 16322) Allow maintenance scripts to accept DB user/pass over input or
13510  params
13511* (bug 18566) Maintenance script to un/protect pages
13512* (bug 671) The HTML <abbr> tag is now permitted.
13513* RecentChanges now has a legend to explain what the Nmb! flags mean, and the
13514  flags have tooltips.
13515* (bug 15209) New hook BeforeInitialize called after everything has been setup
13516  but before Mediawiki::performRequestForTitle()
13517* wgMainPageTitle variable now available to JavaScript code to identify the main
13518  page link, so it doesn't have to be extracted from the link URLs.
13519* (bug 16836) Display preview of signature in user preferences and describe its
13520  use
13521* The default output format is now HTML 5 instead of XHTML 1.0 Transitional.
13522  This can be disabled by setting $wgHtml5 = false;.  Specific features enabled
13523  if HTML 5 is used:
13524** Some extra inputs will be autofocused, in supporting browsers.
13525** The summary attribute has been removed from tables of contents.  summary is
13526   obsolete in HTML 5 and wasn't useful here anyway.
13527** Unnecessary type="" attribute removed for CSS and JS.
13528** If $wgWellFormedXml is set to false, some bytes will be shaved off of HTML
13529   output by omitting some things like quotation marks where HTML 5 allows.
13530** (bug 16921) maxlength enabled for page move comments
13531* The description message in $wgExtensionCredits can be an array with parameters
13532* New hook SpecialRandomGetRandomTitle allows extensions to modify the selection
13533  criteria used by Special:Random and subclasses, or substitute a custom result,
13534  deprecating the $wgExtraRandompageSQL config variable
13535* (bug 20318) Distinct CSS classes for ISBN/RFC/PMID special links added
13536* (bug 20404) Custom fields in the user creation form template can now have
13537  detail labels in prefsectiontip divs.
13538* MakeSysop and MakeBot are now aliases for Special:UserRights
13539* IndexPager->mLimitsShown can now be an associative array of limit => text-to-
13540  display-in-limit-form.
13541* (bug 18880) LogEventsList::showLogExtract() can now take a string-by-reference
13542  and add its HTML to it, rather than having to go straight to $wgOut.
13543* Added $wgShowDBErrorBacktrace, to allow users to easily gather backtraces for
13544  database connection and query errors.
13545* Show change block / unblock link on Special:Contributions if user is blocked
13546* Display note on Special:Contributions if the user is blocked, and provide an
13547  excerpt from the block log.
13548* (bug 19646) New hook: ImgAuthBeforeStream for tests and functionality before
13549  file is streamed to user, but only when using img_auth
13550* Note on non-existing user and user talk pages if user does not exist
13551* New hook ShowMissingArticle so extensions can modify the output for
13552  non-existent pages.
13553* Admins could disable some variants using $wgDisabledVariants now. ONLY apply
13554  on wikis enabled LanguageConverter.
13555* (bug 16310) Credits page now lists IP addresses rather than saying the number
13556  of anonymous users that edited the page
13557* New permission 'sendemail' added. Default right for all registered users. Can
13558  for example be used to prevent new accounts from sending spam.
13559* (bug 16979) Tracking categories for __INDEX__ and __NOINDEX__
13560* Two new hooks, ConfirmEmailComplete and InvalidateEmailComplete, which are
13561  called after a user's email has been successfully confirmed or invalidated.
13562* (bug 19741) Moved the XCF files out of the main MediaWiki distribution, for
13563  a smaller subversion checkout.
13564* (bug 13750) First letter capitalization can now be a per-namespace setting
13565* (bug 21073) "User does not exist" message no longer displayed on sub-sub-pages
13566  of existing users
13567* (bug 21095) Tracking categories produced by the parser (expensive parser
13568  function limit exceeded, __NOINDEX__ tracking, etc) can now be disabled by
13569  setting the  system message ([[MediaWiki:expensive-parserfunction-category]]
13570   etc) to "-".
13571* Added maintenance script sqlite.php for SQLite-specific maintenance tasks.
13572* Rewrote Special:Upload to allow easier extension.
13573* Upload errors that can be solved by changing the filename now do not require
13574  reuploading.
13575* Added $wgRateLimitsExcludedIPs, to allow specific IPs to be whitelisted from
13576  rate limits.
13577* (bug 21222) When $wgUseTeX is not enabled, <math> is no longer registered with
13578  the parser so extensions are free to implement their own <math> tag
13579* (bug 21047) Wrap 'cannotdelete' into a div with the generic 'error' class and
13580  an own 'mw-error-cannotdelete' class
13581* New hook AbortNewAccountAuto, called before account creation from AuthPlugin-
13582  or ExtUser-driven requests.
13583* (bug 3480) The warning saying that the page has a history when deleting it now
13584  contains the number of revisions in the history
13585* $wgStylePath and $wgLogo are now set in the default LocalSettings.php file.
13586* (bug 20186) Allow filtering history for revision deletion.
13587* New hook OtherBlockLogLink, called in Special:IPBlockList and Special:Block
13588  to show links to block logs of other blocking extensions, i.e. GlobalBlocking
13589* Added search capabilities to SQLite backend
13590* rebuildtextindex.php maintenance script now supports databases other than
13591  MySQL
13592* upgrade1_5.php now requires to be run --update option to prevent confusion
13593* (bug 17662) Customizable default preload/editintro for new sections in the
13594  respective addsection-preload and addsection-editintro messages
13595* Added maintenance script checkSyntax.php that checks for PHP syntax errors
13596  and common coding mistakes
13597* Updated Unicode normalization tables
13598* (bug 21604) Spellcheck attribute for editsummary
13599* New wgCategories JavaScript global variable for userscripts.
13600* (bug 20717) Added checkboxes to hide users with bot and/or sysop group
13601  membership in SpecialActiveusers
13602* Allow \pagecolor and \definecolor in texvc
13603* $wgTexvcBackgroundColor contains background color for texvc call
13604* (bug 21574) Redirects can now have "303 See Other" HTTP status
13605* EditPage refactored to allow extensions to derive new edit modes much easier.
13606* (bug 21826) Subsections of Special:Version now also have anchors
13607* (bug 19791) Add URL of file source as comment to thumbs (for ImageMagick)
13608* (bug 21946) Sorted wikitables do not properly handle minus signs
13609* (bug 18885) Red links for media files do not support shared repositories
13610* Added $wgFixArabicUnicode, to convert deprecated presentation forms in
13611  Arabic text to their modern equivalents, and $wgFixMalayalamUnicode, to
13612  convert ZWJ-based chillu sequences in Malayalam text to their Unicode 5.1
13613  equivalents.
13614* (bug 22051) Returing false in SpecialContributionsBeforeMainOutput hook now
13615  stops normal output
13616* Send new password e-mail in users preference language
13617* LanguageConverter now support nested using of manual convert syntax like
13618  "-{-{}-}-"
13619* Upload license preview now uses the API instead of action=ajax
13620* (bug 7346) Add <guid> to RSS to avoid duplicates
13621* (bug 19996) Added new hooks for Special:Search, which allow to further
13622  restrict/expand it.
13623* (bug 21936) When a revision has been patrolled, there's now a link back to the
13624  article
13625* (bug 22315) SpecialRecentChangesQuery hook now pass $query_options and checks
13626  the return value
13627* Separate unit test suites under t/ and tests/ were merged and moved to
13628  maintenance/tests/.
13629* importImages.php maintenance script can now use the original uploader and
13630comment from another wiki.
13631* Support for Turck MMCache was removed
13632* (bug 14592) Warn users when they try to move their user page that their
13633  account will not be renamed
13634* Show block log on non-existing user (talk) pages of currently blocked users
13635
13636=== Bug fixes in 1.16 ===
13637
13638* (bug 18031) Make namespace selector on Special:Export remember the previous
13639  selection
13640* The svn-version version numbers on Special:Version have been removed
13641* (bug 17374) Special:Export no longer exports two copies of the same page
13642* (bug 18190) Proper parsing in MediaWiki:Sharedupload message
13643* (bug 17617) HTML cleanup for ImagePage
13644* (bug 17964) namespaceDupes.php no longer fails on an empty interwiki table
13645* Improved error handling for image moving
13646* (bug 17974) On Special:SpecialPages, restricted special pages are now marked
13647  with <strong> tags, helps with text-based browsers
13648* (bug 18259) Special:DeletedContributions now also uses
13649  MediaWiki:Sp-contributions-logs for the link to Special:Log
13650* Don't add empty title="" attributes to links to anchors on the current page
13651* (bug 18291) rebuildrecentchanges.php failed to add deletion log entries
13652* (bug 18304) rebuildrecentchanges.php got size changes wrong
13653* (bug 18170) Fixed a PHP warning in Parser::preSaveTransform() in PHP 5.3
13654* (bug 18289) Database connection error page now returns correct HTML
13655* "successbox", "errorbox" and related CSS classes are now available in all
13656  skins
13657* (bug 18316) Removed superfluous name="fulltext" from Special:Search
13658* (bug 18331) MediaWiki:Undelete-revision can now have wikitext
13659* The "noautoblock" flag is no longer displayed in the block log when blocking
13660  an IP address
13661* (bug 18009) $wgHooks and $wgExtensionFunctions now support closures
13662* (bug 17948) Maintenance scripts now exit(0) or exit(1) as appropriate
13663* (bug 18377) Time in Enhanced ChangesList lacking localisation
13664* (bug 12998) Allow <sup>, <sub>, etc. in DISPLAYTITLE
13665* (bug 1553) Lowercase navigation headings in German
13666* (bug 7830) Pending transactions failed to commit on loginToUse() error
13667* (bug 11613) session.save_handler being over-ridden
13668* (bug 11381) session.save_handler being set twice (causes error)
13669* (bug 17835) ForeignAPIRepo throwing error on first page load for file
13670* (bug 18115) ForeignAPIRepo cache isn't working
13671* Fixed a bug caused by LanguageConverter.php, which brings an abnormal '}-'
13672  after some parsed math syntax.
13673* (bug 18441) rebuildrecentchanges.inc no longer ignores $wgLogRestrictions
13674* (bug 18317) Bolded selections in 1 | 3 | etc days on RecentChanges now use
13675  <strong> instead of hardcoded styles
13676* (bug 18449) Fixed items number per column on category pages when the total is
13677  divisible by 3
13678* (bug 18121) maintenance/deleteArchivedRevisions.php no longer deletes
13679  revisions when --delete is not passed
13680* (bug 13172) GPS coordinates in image Exif data are now actually displayed
13681* Overhaul of preferences system, includes the following bug fixes:
13682** (bug 5363) Changes to default preferences now impact registered users.
13683** (bug 14806) Hook to enable putting preferences in existing tabs.
13684** (bug 17191) Registration date now listed on preferences page.
13685** The user_properties table (now used for storing preferences) has been added
13686   to $wgSharedTables.
13687** Note that this change will break some extensions which have not been adapted
13688   for it.
13689* (bug 17020) Adding fallback encodings for Traditional and Simplified Chinese
13690  languages while the text is typed as URLs.
13691* (bug 17614) Prev / Next links are not shown if all results are shown
13692* (bug 18207) Strange spacing before [[irc:...]] links
13693* Removed float from the user login form in RTL interface - caused display
13694  problems in FF2
13695* (bug 15008) Redirect images are now subject to Bad image list rules
13696* (bug 6802) profileinfo.php now also work on other database servers than MySQL
13697* (bug 16925) Diffs no longer fail when $wgExternalDiffEngine is set to
13698  'wikidiff' or 'wikidiff2' but extension is not installed
13699* (bug 18326) Chmod errors in file repos have been hidden
13700* (bug 18718) Comma after a } create a error in IE
13701* (bug 18716) Removed redundant class in Modern skin CSS for category links and
13702  tweaked spacing.
13703* (bug 18656) Use proper directory separators in wfMkdirParents()
13704* (bug 18549) Make Special:Blockip respect $wgEnableUserEmail and
13705  $wgSysopEmailBans
13706* (bug 16912) Tooltips on images with link= disappear
13707* (bug 18389) Localise numbers in EXIF data
13708* (bug 18522) Wrap MediaWiki:Protect-cascadeon in a div for identification
13709* (bug 18438) Tweak HTML for preview bar for consistency and accessibility
13710* (bug 18432) Updated documentation for dumpBackup.php
13711* Fix array logic in Sanitizer::removeHTMLtags so that it doesn't strip good
13712  tags that were redundantly defined.
13713* (bug 14118) SpecialPage::getTitleFor does not return a localised name
13714* (bug 18698) Renaming non entry point maintenance scripts from .inc.php to
13715  .inc
13716* Deprecated methods Title::getInterwikiLink, Title::userCanCreate(),
13717  Title::userCanEdit() and Title::userCanMove() have been removed
13718* Only show upload links on file description if $wgEnableUploads = true
13719  and user can upload
13720* Don't say "You need to log in to upload/move", because it's possible that
13721  uploading/moving is disabled for registered users as well (e.g. only sysops)
13722* (bug 18943) Handle invalid titles gracefully at Special:Mostlinked
13723* (bug 8873) Enable variant conversion in text on 'alt' and 'title' attributes
13724* (bug 10837) Introducing the StubUserVariant class to determine the variant
13725  variable instead of using this to overrule the user language preference.
13726* (bug 19014) If user had deletedhistory right, but not undeleted right, then
13727  show "view" instead of "view/restore" on logs.
13728* (bug 19017) TOC level calculation error in an odd case
13729* (bug 18999) CSS update for RTL interwiki links
13730* (bug 18925) history.js removes class names of list elements on initialization
13731* Multiple whitespace in TOC anchors is now stripped, for consistency with the
13732  link from the edit comment
13733* (bug 19112) Preferences now respects $wgUseExternalEditor
13734* (bug 18173) MediaWiki now fails when unable to determine a client IP
13735* (bug 19170) Special:Version should follow the content language direction
13736* (bug 19160) maintenance/purgeOldText.inc is now compatible with PostgreSQL
13737* Fixed performance regression in "bad image list" feature
13738* Show user preference 'Use live preview' if $wgLivePreview is enabled only
13739* (bug 17014) Blocked users can no longer use Special:UserRights unless they
13740  can add/remove *all* groups (have 'userrights' permission).
13741* (bug 19294) Always show Sp-contributions-footer(-anon)
13742* Attempts to restrict reading of pages while anonymous viewing is allowed
13743  via extensions not using the userCan hook and via $wgRevokePermissions now
13744  work.
13745* (bug 8445) Multiple-character search terms are now handled properly for
13746  Chinese
13747* (bug 19450) Use formatNum for "Number of edits" in Special:Preferences
13748* (bug 11242) Check for MySQL storage engines during installation now checks
13749  whether the engines are actually available
13750* (bug 19390) Omit the "printable version" link on the printable version
13751* (bug 18394) img_auth.php now respects userCan
13752* (bug 19509) Uploading to a file named '0' previously treated it as null input
13753   and attempted to upload with the source name. Now warns about not having an
13754   extension (since 0.ext is perfectly valid)
13755* (bug 19468) Enotif preferences are now only displayed when they are turned on
13756* (bug 19442) Show/hide options on watchlist only work once
13757* (bug 19602) PubMed Magic links now use updated NIH url
13758* (bug 19637) externallinks have links to self
13759* Don't load Opera 9.5 RTL fixes for Opera 9.6
13760* Remove five-year-old KHTMLFixes.css, which is unlikely to be relevant anymore
13761  and was causing problems.
13762* Removed repetition of URIs in the title attributes of external links.
13763* (bug 19693) User name is now escaped in "Contributions for ..." link on
13764  Special:BlockIP
13765* (bug 19571) Override buildConcat for SQLite.
13766* Log in and log out links no longer return to page view when clicked from
13767  history view, edit page, or something similar
13768* (bug 19513) RTL fixes for new Search UI
13769* (bug 16497) Special:Allmessages is paginated
13770* (bug 18708) CSS plainlinks class now available to all skins
13771* (bug 19590) Database error messages no longer have "MySQL" hardcoded as the
13772  database type
13773* (bug 19759) successbox on Special:Preferences now correctly aligned on
13774  standard, nostalgia and cologneblue skin
13775* (bug 19814) interwiki links from file links ([[File:Foo.jpg|link=de:Test]])
13776  are no longer recorded in the pagelinks table
13777* (bug 19784) date option "ISO 8601" produced illegal id
13778* (bug 19761) Removed autogenerated <meta keywords> tag with link data.
13779  Keyword set was not useful, and is ignored by modern search engines anyway.
13780* (bug 19827) Special:SpecialPages title is "Upload file
13781* (bug 19355) Added .xhtml, .xht to upload file extension blacklist
13782* (bug 19287) Workaround for lag on history page in Firefox 3.5
13783* (bug 19564) Updated docs/hooks.txt
13784* (bug 18751) Fix for buggage in profiling setup for some extensions on PHP 5.1
13785* (bug 17139) ts_resortTable inconsistent trimming makes date sorting fragile
13786* (bug 19445) Change oldimage table to use ON UPDATE CASCADE for FK to image
13787  table.
13788* (bug 14080) Short notation links to subpages didn't work in edit summaries
13789* (bug 17374) Special:Export no longer exports multiple copies of pages
13790* (bug 19818) Edits to user CSS/JS subpages can now be marked as patrolled by
13791  users who can't edit them
13792* (bug 19839) Comments in log items are no more double escaped
13793* (bug 18161) Fix inconsistent separators in watchlist link toolbars with
13794  "enhanced recent changes"
13795* (bug 16877) Moving a page over a redirect no longer leaves an orphan entry in
13796  the recentchanges table
13797* (bug 16009) Limit selection forms based on Pager now links to the correct page
13798  when using long urls
13799* The display of the language list on the preferences is more comply with the
13800  BCP 47 standards.
13801* (bug 19849) Custom X-Vary-Options header now disabled unless $wgUseXVO is set
13802* (bug 19301) Duplicate entries in $wgAddGroups, $wgRemoveGroups,
13803  $wgGroupsAddToSelf and $wgGroupsRemoveFromSelf are no more displayed on
13804  Special:ListGroupRights
13805* (bug 18799) Special:Userlogin now handles correctly the returnto parameter
13806  to not link back to Special:Userlogout when user's language isn't the same as
13807  content's language
13808* (bug 19479) Show proper error message when unable to connect to PostgreSQL
13809  database with username/password in MediaWiki's setup
13810* (bugs 18407, 18409) Special:Upload is now listed on Special:Specialpages only
13811  if uploads are enabled and the user can access it
13812* (bug 17988) Spaces before [[Category:]] links are no longer ignored
13813* (bug 19957) All known-failing tests now marked disabled; added --run-disabled
13814  option to parser test suite to run disabled tests if desired.
13815* (bug 16311) Make recent change flags (n/m/b) <abbr>s instead of <span>s
13816* (bug 15680) Split the edit tip message of user CSS/JS subpage into
13817  "usercssyoucanpreview" and "userjsyoucanpreview" respectively.
13818* (bug 12110) Split the rights for editing users' CSS/JS subpage from
13819  "editusercssjs" into "editusercss" and "edituserjs" respectively.
13820* (bug 19394) RecentChanges feed URLs for log items with no revisions
13821  (eg Newuser, Userrights) are no longer broken
13822* (bug 17395) Remote file descriptions use user language ($wgLang), not wiki
13823  language ($wgContLang)
13824* (bug 11867) Lock error on redirect table when running orphans.php
13825* (bug 18930) initStats.php now refreshes active users count
13826* (bug 18699) Using the nosummary URL option no longer triggers the "You have
13827  not provided a summary" warning for those who activated it in their
13828  preferences
13829* (bug 18855) commandLine.inc and Maintenance.php are now properly included
13830  using the full path
13831* (bug 18497) Fixed broken style sheets in Opera fullscreen mode
13832* (bug 16084) Default memory limit has be increased to 50M, see $wgMemoryLimit
13833* (bug 17864/19519) Added proper input normalization in Special:UserRights
13834* (bug 20086) Add Hook to add extra statistics at the end of Special:Statistics
13835* (bug 19289) importDump.php can now handle bzip2 and 7zip
13836* (bug 20131) Fixed a PHP notice for users having the "rollback" right on
13837  Special:RecentChangesLinked
13838* Do not transform EXIF fields with pure text to avoid results like
13839  foo,bar@example,com
13840* (bug 20176) Fix login/logout links in skin CologneBlue
13841* (bug 20203) "Powered by Mediawiki" now has height/width on image tag
13842* (bug 20273) Fix broken output when no pages are found in the content
13843  namespaces
13844* (bug 20265) Make AncientPages and UnusedFiles work on SQLite
13845* Fixed XSS vulnerability for Internet Explorer clients (only pre-release
13846  versions of MediaWiki were affected).
13847* (bug 14817) Moving a page to a subpage of itself moves it twice
13848* (bug 20289) $wgMaximumMovedPages should only count pages actually moved
13849* (bug 15248) Non-breaking spaces and certain other Unicode space characters
13850  are now normalized to ordinary spaces in titles; if your wiki has existing
13851  titles with such characters, run cleanupTitles.php and/or cleanupImages.php
13852* (bug 11143) Links containing invalid UTF-8 percent-code sequences are now
13853  cleanly disabled instead of breaking parsing entirely on PHP 5.2.
13854* (bug 20296) Fixed an PHP warning in Language::getMagic() in PHP 5.3
13855* (bug 20358) Unprotect tab was missing accesskey; now same as protect tab.
13856* (bug 20317) Cleaned up default main page link accesskey settings
13857* (bug 20362) Special:Statistics now produces valid HTML when view counters are
13858  enabled
13859* (bug 19857) maintenance/deleteRevision.php on last revision no longer breaks
13860  target page
13861* (bug 20365) Page name with c/g/h/j/s/u + x are now correctly handled in
13862  Special:MovePage with Esperanto as content language
13863* (bug 20364) Fixed regression in GIF metadata loading
13864* (bug 20299) MediaWiki:Move-subpages and MediaWiki:Move-talk-subpages can now
13865  use wikitext
13866* (bug 15475) DatabaseBase::setFlag(), DatabaseBase::clearFlag() and
13867  DatabaseBase::getFlag() now have documentation
13868* (bug 19966) MediaWiki:License-header is now used for the licensing header in
13869  the file description page instead of MediaWiki:License
13870* (bug 20380) Links to history/deleted edits at the top of
13871  Special:RevisionDelete are no more displayed when doing log suppression
13872* (bug 8143) Localised parser function names are now correctly case insensitive
13873  if they contain non-ASCII characters
13874* (bug 19055) maintenance/rebuildrecentchanges.php now purges
13875  Special:Recentchanges's RSS and Atom feed cache
13876* The installer will now try to bypass PHP's max_execution_time
13877* (bug 20260) SQLite no longer tries to automatically create the database at
13878  execution time, this now happens only at install time; if it is not available
13879  at script execution, it now throws an exception
13880* Fixed EditFilterMerged hook so the hookError parameter serves a purpose
13881  (analogous to EditFilter hook)
13882* (bug 2257) Tag extensions can expand template parameters provided to the tag,
13883  by using a new parameter added to the recursiveTagParse function
13884* (bug 14900) __INDEX__ and __NOINDEX__ no longer override site config set in
13885  $wgArticleRobotPolicies.
13886* (bug 20466) Hidden categories are no more displayed when printing
13887* (bug 20446) When changing user rights with User@remotewiki and remotewiki is
13888  the local wiki, the user is now treated as the local user
13889* (bug 20494) OutputPage::getArticleBodyOnly() no longer requires an useless
13890  argument
13891* (bug 20136) Protection form JavaScript now synchronizes the expiry boxes on
13892  any change, in addition to onkeyup.
13893* Don't link to "edit this page" on MediaWiki:Noarticletext if user is not
13894  allowed to create page. Done via new message
13895  MediaWiki:Noarticletext-nopermission
13896* Improved compatibility between the Vector skin and addPortletLink() from
13897  wikibits.js: empty portlets are now present but hidden, adding an element to a
13898  portlet unhides it
13899* (bug 19531) addPortletLink() now wraps inserted labels in a <span> element to
13900  be compatible with the CSS for the Vector skin
13901* (bug 20578) Wrong localized image metadata - duplicated string?
13902* (bug 20556) Stub threshold's "other" <input> in Special:Preferences now has a
13903  correct type="text" parameter
13904* (bug 482) Don't include TOC in the printable version if it has been hidden
13905* Adjust the time according to the user configuration on Special:Revisiondelete
13906* (bug 20624) Installation no longer allows "qqq" as the chosen language
13907* (bug 20634) The installer-created database user will now have all rights on
13908  the database so that upgrades will go more smoothly.
13909* (bug 18180) Special:Export ignores limit, dir, offset parameters
13910* User::getBlockedStatus() works for all kinds of user objects and doesn't
13911  assume the user object is equal to the current-user object ($wgUser)
13912* (bug 20517) Cancel link from edit page now returns to the old version when
13913  editing an old version
13914* (bug 16902) Installer no longer shows warnings when exec() has been disabled
13915  by disable_functions
13916* (bug 20726) Title::getLatestRevID's documentation now says that the function
13917  returns false if the page doesn't exist
13918* (bug 20751) ForeignApiRepo now urldecodes filenames when saving to local cache
13919* (bug 20730) Fix to Special:Version ViewVC link for branch checkouts
13920* (bug 20353) wfShellExec() was adding extra quotes on Windows Vista, causing
13921  command line scripts to fail
13922* (bug 20702) Parser functions can now be used correctly in
13923  MediaWiki:Missing-article
13924* (bug 14117) "redirected from" is now also shown on foreign file redirects
13925* (bug 17747) Only display thumbnail column in file history if the image can
13926  be rendered.
13927* (bug 3421) Live preview no longer breaks user CSS/JS previews
13928* (bug 11264) The file logo on a file description page for documents (PDF, ...)
13929  now links to the file rather than the file description page
13930* Password fields built with HTMLForm now still have the type="password"
13931  attribute if $wgHtml5=false.
13932* (bug 20836) Preload now works for MediaWiki namespace
13933* (bug 20885) Search box no longer suggests unavailable special pages
13934* (bug 20948) "Create this page" on Special:Search is no longer displayed when
13935  searching for special pages
13936* (bug 20524) Hideuser: Show nice error when trying to block hidden user without
13937  hideuser right
13938* (bug 21026) Fixed file redirects on shared repos on non-English client wikis
13939* (bug 21030) Fixed schema choices from being overwritten by defining unique
13940  field names per driver.
13941* (bug 21115) wgCanonicalSpecialPageName javascript variable is now always
13942  false on non-special pages
13943* (bug 21113) "Other statistics" header on Special:Statistics is no more
13944  displayed when there isn't any entry in it
13945* (bug 21114) Special:Contributions no longer shows diff links for new
13946  revisions
13947* (bug 21116) MediaWiki:Templatesused, MediaWiki:Templatesusedpreview and
13948  MediaWiki:Templatesusedsection now support plural
13949* (bug 21079) There is no more line wrapping between label and field in
13950  Special:Log
13951* (bug 20256) Fixed SQL errors on Special:Recentchanges and
13952  Special:Recentchangeslinked on SQLite backend
13953* (bug 20880) Fixed updater failure on SQLite backend
13954* (bug 21182) Fixed invalid HTML in Special:Listgrouprights
13955* (bug 20242) Installer no longer promts for user credentials for SQLite
13956  databases
13957* (bug 20911) Installer failed to create a SQLite database
13958* (bug 20847) Deprecated deprecated akeytt() removed in wikibits.js leaving
13959  dummy
13960* (bug 21161) Changing $wgCacheEpoch now always invalidates file cache
13961* (bug 20268) Fixed row count estimation on SQLite backend
13962* (bug 20275) Fixed LIKE queries on SQLite backend
13963* (bug 21234) Moving subpages of titles containing \\ now works properly
13964* (bug 21006) maintenance/updateArticleCount.php now works again on PostgreSQL
13965* (bug 19319) Add activeusers-intro message at top of SpecialActiveUsers page
13966* (bug 21255) Fixed hostname construction for DNSBL checking
13967* (bug 18019) Users are now warned when moving a file to a name in use on a
13968  shared repository and only users with the 'reupload-shared' permission can
13969  complete the move.
13970* (bug 18909) Add missing Postgres INSERT SELECT wrapper
13971* User::isValidPassword now only returns boolean results,
13972  User::getPasswordValidity can be used to get an error message string
13973* The error message shown in Special:ChangePassword now parses wiki markup
13974* (bug 19859) Removed experimental HTMLDiff feature
13975* Removed section edit links in edit conflict form
13976* Allow SpecialActiveusers to work on non-MySQL databases
13977* (bug 6579) Fixed protecting images from uploading only
13978* (bug 18609) Search index was empty for some pages
13979* (bug 13453) rebuildrecentchanges maintenance script works on PG again
13980* (bug 16583) Reduce false positives when checking for PHP (on upload, etc.)
13981* (bug 20112) Bitrotted tests in the t/ directory were failing.
13982* (bug 21470) MediaWiki:Sp-contributions-explain is now wrapped in a <p> with
13983  id "mw-sp-contributions-explain"
13984* (bug 19159) Fixed \overleftrightarrow in texvc
13985* (bug 19391) Fix caching for Recent ChangesFeed.
13986* (bug 21455) Fixed "Watch this page" checkbox appearing on some special pages
13987  even to non-logged in users
13988* (bug 21551) Rewrote the Squid purge HTTP client to provide a more robust and
13989  general implementation of HTTP, allowing it to purge non-Squid caches such as
13990  Varnish.
13991* Fixed corruption of long UDP debug log messages by using socket_sendto()
13992  instead of fsockopen() with fwrite().
13993* (bug 16884) Fixed feed links in sidebar not complying with URL parameters
13994  of the displayed page
13995* (bug 21403) memcached class renamed to MWMemecached to avoid conflict with
13996  PHP's memcached extension
13997* (bug 21650) Both calls to SkinTemplateTabs hook are now compatible
13998* (bug 21672) Add missing Accept-Language to both Vary and XVO headers
13999* (bug 21679) "Edit block reasons" link at the bottom of Special:Blockip is now
14000  only displayed to the users that have "editinterface" right
14001* (bug 21740) Attempting to protect a page that doesn't exist (salting) returns
14002  "unknown error"
14003* (bug 18762) both redirects and links get fixed one after another if
14004  redirects-only switch is not present
14005* (bug 20159) thumbnails rerendered if older than $wgThumbnailEpoch
14006* Fixed a bug which in some situations causes the job queue to grow forever,
14007  due to an infinite loop of job requeues.
14008* (bug 21523) File that can have multiple pages (djvu, pdf, ...) no longer have
14009  the page selector when they have only one page
14010* (bug 21559) "logempty" message is now wrapped in a div with class
14011  "mw-warning-logempty" when used in log extract
14012* (bug 20549) Parser tests were broken on SQLite backend
14013* (bug 21776) Interwiki urls like http://en.wikibooks.org/wiki/cs: should give
14014  a redirect instead of a baderror.
14015* (bug 21803) Special:MyContributions now keeps the query string parameters
14016* Redirecting special pages now keep query string parameters set to "0" (e.g.
14017  for namespace)
14018* (bug 20765) Special:ListGroupRights no longer misses addables and removables
14019  groups if there are duplicate entries
14020* (bug 21814) Message shown when rolling back an edit with a deleted username
14021  now shows '(username deleted)' instead of broken user tool links
14022* (bug 21536) Fixed JavaScript error on Special:Search caused by an incorrect ID
14023* (bug 21535) RecentChanges RSS feed now always recognises the namespace filter,
14024  previously it sometimes didn't due to caching.
14025* (bug 20388) ProfilerSimpleText no longer outputs comment on action=raw
14026* refreshLinks.php now purges orphaned redirect table rows
14027* (bug 2971) Swap links of hist & diff location on Special:Contributions for
14028  consistency with RC/WL
14029* (bug 21986) Special page names are now capitalized by content language
14030* If two log types have the same description, they're now both displayed in the
14031  type selector on Special:Log
14032* (bug 20115) Special:Userlogin title says "Log in / create account" even if the
14033  user can't create an account
14034* (bug 2658) Don't attempt to set the TZ environment variable.
14035* (bug 9794) User rights log entries for foreign user now links to the foreign
14036  user's page if possible
14037* (bug 14717) Don't load nonexistent CSS fix files for non-Monobook skins
14038* (bug 22034) Use wfClientAcceptsGzip() in wfGzipHandler instead of
14039  reimplementing it.
14040* (bug 19226) First line renders differently on many UI messages.
14041* (bug 21303) Comments are no longer stripped from MediaWiki:Common.js and
14042  skin-specific JS pages
14043* (bug 5061) Use the more precise thumbcaption thumbimage and thumbinner classes
14044  for image divs.
14045* (bug 22096) IE50Fixes.css and IE55Fixes.css have been dropped from the
14046  Monobook and Chick skins
14047* Fixed bug involving unclosed "-{" markup in the language converter
14048* (bug 21870) No longer include Google logo from an external server on wiki
14049  error.
14050* (bug 22181) Do not truncate if the ellipsis actually make the string longer
14051* (bug 16039) Text disappearing after a bad image
14052* (bug 18784) Internal links like [[File:Foo|caption]] should read 'caption',
14053  not 'File:Foo' when Foo is not an image
14054* (bug 21518) Special:UserRights no longer displays the user name box for users
14055  that can only change their rights
14056* (bug 21593) Special:UserRights now lists automatic groups membership
14057* (bug 22364) Setting $wgUseExternalEditor to false no longer hides the reupload
14058  link from file pages
14059* Fix bug introduced in MediaWiki 1.12: The author field in
14060  $wgExtensionCredits is no longer sorted with sort() but rather used
14061  as it appears in extensions as was the case before r30117 where it
14062  was unintentionally sorted along with other fields.
14063* (bug 19334) Textarea no longer jumps when editing longer articles in IE8
14064* Truncate summary of page moves in revision comment field to avoid broken
14065  multibyte characters
14066* (bug 22540) ForeignApiRepos no longer try to store thumbnails that don't exist
14067* (bug 22551) Special:Resetpass now has a "Cancel" button that sends the user to
14068  the page set in the &returnto parameter.
14069* (bug 19194) Search box in Modern skin doesn't focus with Safari/Chrome
14070* (bug 17790) Users instantly logged off on HughesNet
14071* (bug 21549) Make foreign key constraints DEFERRABLE INITIALLY DEFERRED
14072  when using Postgres as the database backend.
14073
14074== API changes in 1.16 ==
14075
14076* Added uiprop=changeablegroups to meta=userinfo
14077* Added usprop=gender to list=users
14078* (bug 18311) action=purge now works for images too
14079* Add parentid to prop=revisions output
14080* (bug 17832) action=delete returns 'unknownerror' instead of 'permissiondenied'
14081  when the user is blocked
14082* (bug 18546) Added timestamp of new revision to action=edit output
14083* (bug 18554) Also list hidden revisions in list=usercontribs for privileged
14084  users
14085* (bug 13049) "API must be accessed from the primary script entry point" error
14086* (bug 16422) Don't display help for format=jsonfm unless specifically requested
14087* Added PHP and database version to meta=siteinfo output
14088* (bug 18533) Add readonly message to meta=siteinfo output
14089* (bug 18518) Add clprop=hidden to prop=categories
14090* (bug 18710) Fixed internal error with empty parameter in action=paraminfo
14091* (bug 18709) Missing descriptions for some parameters in action=paraminfo
14092  output
14093* (bug 18731) Show correct SVN links for extension modules in api.php?version
14094* (bug 18730) Add version information to action=paraminfo output
14095* (bug 18743) Add ucprop=size to list=usercontribs
14096* (bug 18749) Add generator flag to action=paraminfo output
14097* Make action=block respect $wgEnableUserEmail and $wgSysopEmailBans
14098* Made deleting file description pages without files possible
14099* (bug 18773) Add content flag to siprop=namespaces output
14100* (bug 18785) Add siprop=languages to meta=siteinfo
14101* (bug 14200) Added user and excludeuser parameters to list=watchlist and
14102  list=recentchanges
14103* Added index, fromtitle and byteoffset fields to action=parse&prop=sections
14104  output
14105* (bug 19313) action=rollback returns wrong revid on master/slave setups
14106* (bug 19323) action=parse doesn't return section tree on pages with Cite
14107  warnings
14108* (bug 18720) Add anchor field to action=parse&prop=sections output
14109* (bug 19423) The initial file description page used caption in user lang
14110  rather than UI lang
14111* (bug 17809) Add number of users in user groups to meta=siteinfo
14112* (bug 18533) Add readonly reason to readonly exception
14113* (bug 19528) Added XSLT parameter to API queries in format=xml
14114* (bug 19040) Fix prependtext and appendtext in combination with section
14115  parameter in action=edit
14116* (bug 19090) Added watchlist parameter, deprecated watch and unwatch
14117  parameter in action=edit
14118* Added fields to list=search output: size, wordcount, timestamp, snippet
14119* Where supported by backend, list=search adds a 'searchinfo' element with
14120  optional info: 'totalhits' count and 'suggestion' alternate query term
14121* (bug 19907) $wgCrossSiteAJAXdomains added to allow specified (or all)
14122  external domains to access api.php via AJAX, if the browser supports the
14123  Access-Control-Allow-Origin HTTP header
14124* (bug 19999) Made metadata and properties of search results optional. Added
14125  srprop and srinfo.
14126* (bug 20700) Add amprop=default to meta=allmessages to list default value for
14127  customized messages
14128* Don't parse magic words in meta=allmessages, output messages unparsed
14129* (bug 21105) list=usercontribs can now list contribs for User:0
14130* (bug 21085) list=deletedrevs no longer returns only one revision when
14131  drcontinue param is passed
14132* (bug 21106) Deprecated parameters now tagged in action=paraminfo
14133* (bug 19004) Added support for tags
14134* (bug 21083) list=allusers no longer returns current timestamp for users
14135  without registration date
14136* (bug 20967) action=edit allows creation of invalid titles
14137* (bug 19523) Add inprop=watched to prop=info
14138* (bug 21589) API: Separate summary and initial page text for uploads
14139* (bug 21817) list=usercontribs returns empty result for empty ucuser
14140* (bug 21441) meta=userinfo&uiprop=options no longer returns default options
14141  for logged-in users under certain circumstances
14142* (bug 21945) Add chomp control in YAML
14143* Expand the thumburl to an absolute url to make it consistent with url and
14144  descriptionurl
14145* (bug 20233) ApiLogin::execute() doesn't handle LoginForm :: RESET_PASS
14146* (bug 22061) API: add prop=headitems to action=parse
14147* (bug 22240) API: include time in siteinfo
14148* (bug 22241) Quick edit is still using the deprecated watch parameter (API:
14149  Setting default for watch/unwatch wrongly set)
14150* (bug 22245) blfilterredirect=nonredirects in blredirect mode wrongly filtering
14151* (bug 22248) Output extension URLs in meta=siteinfo&siprop=extensions
14152* Support key-params arrays in 'descriptionmsg' in
14153  meta=siteinfo&siprop=extensions
14154* (bug 21922) YAML output should quote asterisk when used as key
14155* (bug 22297) safesubst: to allow substitution without breaking transclusion
14156* (bug 18758) API read of watchlist's wl_notificationtimestamp
14157* (bug 20809) Expose EditFormPreloadText via the API
14158* (bug 18427) Comment (edit summary) parser option for API
14159* (bug 18608) API should provide list of CSS styles to apply to rendered output
14160* (bug 18771) List possible errors in action=paraminfo
14161
14162=== Languages updated in 1.16 ===
14163
14164MediaWiki supports over 300 languages. Many localisations are updated
14165regularly. Below only new and removed languages are listed, as well as
14166changes to languages because of Bugzilla reports.
14167
14168* Capiznon (cps) (new)
14169* North Frisian (frr) (new)
14170* Kirmanjki (kiu) (new)
14171* Komi-Permyak (koi) (new)
14172* Karachay-Balkar (krc) (new)
14173* Hill Mari (mrj) (new)
14174* Prussian (prg) (new)
14175* Romagnol (rgn) (new)
14176* Lower Silesian (sli) (new)
14177* Picard (pcd) (new)
14178* Uyghur (Arabic script) (ug-arab) (new)
14179* Upper Franconian (vmf) (new)
14180* Votic (vot) (new)
14181* Eastern Yiddish (ydd) (removed)
14182* Iriga Bicolano (bto) (removed)
14183* Ladin (lld) (removed)
14184* Laz (lzz) (removed)
14185* Palembang (plm) (removed)
14186* Megleno-Romanian (Greek script) (ruq-grek) (removed)
14187* Tamazight (tzm) (removed)
14188* Laz (lzz) (new)
14189
14190* (bug 18474) Sorani (ckb - Central Kurdish) (renamed from ku-arab)
14191* Add PLURAL function for Scots Gaelic (gd)
14192* Add Estonian letters äöõšüž to linktrail (et)
14193* (bug 18776) Native name of Burmese language (my)
14194* (bug 18806) Use correct unicode characters in spelling of native Chuvash
14195  (Чӑвашла)
14196* (bug 18864) Updated autonym for Zhuang language
14197* (bug 18308) Updated date formatting in Occitan (oc)
14198* (bug 19080) Added ăâîşţșțĂÂÎŞŢȘȚ to Romanion (ro) linktrail
14199* (bug 19286) Correct commafying function in Polish (pl)
14200* (bug 19441) Updated date formatting for Lithuanian
14201* (bug 19630) Added ÄäÇçĞğŇňÖöŞşÜüÝýŽž to Turkmen (tk) linktrail
14202* (bug 19949) New linktrail for Greek (el)
14203* (bug 19809) Korean (North Korea) (ko-kp) (new)
14204* (bug 19968) Fixed "Project talk" namespace name for Maltese (mt)
14205* (bug 21168) Added áâãàéêçíóôõúü to Portuguese (pt) linktrail
14206* (bug 21596) Change interwiki link for Kurdish (ku)
14207* (bug 23767) PHP warning/error when REQUEST_URI returns blank (IIS issue).
14208
14209== MediaWiki 1.15 ==
14210
14211== MediaWiki 1.15.5 ==
14212=== Changes since 1.15.4 ===
14213
14214* (bug 24565) Fixed Cache-Control headers sent from API modules, to protect
14215  user privacy in the case where an attacker can access the wiki through the
14216  same HTTP proxy as a logged-in user.
14217* Fixed a minor cookie header parsing issue causing incorrect Cache-Control
14218  headers to be sent.
14219* Fixed an XSS vulnerability in profileinfo.php for installations with
14220  $wgEnableProfileInfo = true (false by default)
14221* For backwards compatibility with extensions from 1.14.x or before, restored
14222  the original function ApiMain::requestWriteMode().
14223* In API login "need token" responses, added the cookieprefix and sessionid
14224  fields, as in MediaWiki 1.16.x. This is an improvement to the CSRF fix
14225  introduced in 1.15.3.
14226
14227== MediaWiki 1.15.4 ==
14228=== Changes since 1.15.3 ===
14229
14230* (bug 23534) Fixed SQL query error in API list=allusers.
14231* (bug 23371) Fixed CSRF vulnerability in "e-mail me my password", "create
14232  account" and "create by e-mail" features of [[Special:Userlogin]]
14233* (bug 23687) Fixed XSS vulnerability affecting IE clients only, due to a CSS
14234  validation issue.
14235
14236== MediaWiki 1.15.3 ==
14237=== Changes since 1.15.2 ===
14238
14239* (bug 22828) Fixed deletion on SQLite.
14240* (bug 23076) Fixed login CSRF vulnerability. Logins now require a token to
14241  be submitted along with the user name and password.
14242
14243== MediaWiki 1.15.2 ==
14244=== Changes since 1.15.1 ===
14245
14246* The installer now includes a check for a data corruption issue with certain
14247  versions of libxml2 2.7 and PHP earlier than 5.2.9, and also for a PHP bug
14248  present in the official release of PHP 5.3.1.
14249* (bug 20239) MediaWiki:Imagemaxsize does not contain anymore a <br /> tag which
14250  was displayed to the user
14251* (bug 21150) SQLite no longer raise an error when deleting files
14252* (bug 20880) Fixed updater failure on SQLite backend
14253* upgrade1_5.php now requires to be run --update option to prevent confusion
14254* Fixed a CSS validation issue which allowed external images to be included
14255  into wikis where that is disallowed by configuration.
14256* Fixed a data leakage vulnerability for private wikis using img_auth.php or
14257  similar image access authentication schemes. Check user permissions before
14258  streaming out scaled images from thumb.php.
14259
14260== MediaWiki 1.15.1 ==
14261=== Changes since 1.15.0 ===
14262* Fixed fatal errors for unusual file repository configurations, such as
14263  ForeignAPIRepo.
14264* Fixed the "change password" link on Special:Preferences to have the correct
14265  returnto parameter.
14266* (bug 19693) Fixed cross-site scripting vulnerability in Special:Block
14267
14268== MediaWiki 1.15.0 ==
14269=== Changes since 1.15.0rc1 ===
14270
14271* Removed category redirect feature, implementation was incomplete.
14272* (bug 18846) Remove update_password_format(), unnecessary, destroys all
14273  passwords if a wiki with $wgPasswordSalt=false is upgraded with the web
14274  installer.
14275* (bug 19127) Documentation warning for PostgreSQL users who run update.php:
14276  use the same user in AdminSettings.php as in LocalSettings.php.
14277* Fixed possible web invocation of some maintenance scripts, due to the use of
14278  include() instead of require(). A full exploit would require a very strange
14279  web server configuration.
14280* Localisation updates.
14281
14282=== Configuration changes in 1.15 ===
14283
14284* Added $wgNewPasswordExpiry, to specify an expiry time (in seconds) to
14285  temporary passwords
14286* Added $wgUseTwoButtonsSearchForm to choose the Search form behavior/look
14287* Added $wgNoFollowDomainExceptions to allow exempting particular domain names
14288  from rel="nofollow" on external links
14289* (bug 12970) Brought back $wgUseImageResize.
14290* Added $wgRedirectOnLogin to allow specifying a specific page to redirect users
14291  to upon logging in (ex: "Main Page")
14292* Add $wgExportFromNamespaces for enabling/disabling the "export all from
14293  namespace" option (disabled by default)
14294
14295=== New features in 1.15 ===
14296
14297* (bug 2242) Add an expiry time to temporary passwords
14298* (bug 9947) Add PROTECTIONLEVEL parser function to return the protection level
14299  for the current page for a given action
14300* (bug 17002) Add &minor= and &summary= as parameters in the url when editing,
14301  to automatically add a summary or a minor edit.
14302* (bug 16852) padleft and padright now accept multiletter pad characters
14303* When using 'UserCreateForm' hook to add new checkboxes into
14304  Special:UserLogin/signup, the messages can now contain HTML to allow
14305  hyperlinking to the site's Terms of Service page, for example
14306* Add new hook 'UserLoadFromDatabase' that is called while loading a user
14307  from the database.
14308* (bug 17045) Options on the block form are prefilled with the options of the
14309  existing block when modifying an existing block.
14310* (bug 17055) "(show/hide)" links to Special:RevisionDelete now use a CSS class
14311  rather than hardcoded HTML tags
14312* Added new hook 'WantedPages::getSQL' into SpecialWantedpages.php to allow
14313  extensions to alter the SQL query which is used to get the list of wanted
14314  pages
14315* (bugs 16957/16969) Add show/hide to preferences for RC patrol options on
14316  specialpages
14317* (bug 11443) Auto-noindex user/user talk pages for blocked user
14318* (bug 11644) Add $wgMaxRedirects variable to control how many redirects are
14319  recursed through until the "destination" page is reached.
14320* Add $wgInvalidRedirectTargets variable to prevent redirects to certain
14321  special pages.
14322* Use HTML5 rel attributes for some links, where appropriate
14323* Added optional alternative Search form look - Go button & Advanced search
14324  link instead of Go button & Search button
14325* (bug 2314) Add links to user custom CSS and JS to Special:Preferences
14326* More helpful error message on raw page access if PHP_SELF isn't set
14327* (bug 13040) Gender switch in user preferences
14328* (bug 13040) {{GENDER:}} magic word for interface messages
14329* (bug 3301) Optionally sort user list according to account creation time
14330* Remote description pages for foreign file repos are now fetched in the
14331  content language.
14332* (bug 17180) If $wgUseFileCache is enabled, $wgShowIPinHeader is automatically
14333  set to false.
14334* (bug 16604) Mark non-patrolled edits in feeds with "!"
14335* (bug 16604) Show title/rev in IRC for patrol log
14336* (bug 16854) Whether a page is being parsed as a preview or section preview
14337  can now be determined and set with ParserOptions.
14338* Wrap message 'confirmemail_pending' into a div with CSS classes "error" and
14339  "mw-confirmemail-pending"
14340* (bug 8249) The magic words for namespaces and pagenames can now be used as
14341  parser functions to return the desired namespace or normalized title/title
14342  part for a given title.
14343* (bug 17110) Styled #mw-data-after-content in cologneblue.css to match the
14344  rest of the font
14345* (bug 7556) Time zone names in signatures lack i18n
14346* (bug 3311) Automatic category redirects
14347* (bug 17236) Suppress 'watch user page link' for IP range blocks
14348* Wrap message 'searchresulttext' (Special:Search) into a div with
14349  class "mw-searchresult"
14350* (bug 15283) Interwiki imports can now fetch included templates
14351* Treat svn:// URLs as external links by default
14352* New function to convert namespace text for display (only applies on wiki with
14353  LanguageConverter class)
14354* (bug 17379) Contributions-title is now parsed for magic words.
14355* Preprocessor output now cached in memcached.
14356* (bug 14468) Lines in classic RecentChanges and Watchlist have classes
14357  "mw-line-odd" and "mw-line-even" to make styling using css possible.
14358* (bug 17311) Add a note beside the gender selection menu to tell users that
14359  this information will be public
14360* Localize time zone regions in Special:Preferences
14361* Add NUMBEROFACTIVEUSERS magic word, which is like NUMBEROFUSERS, but uses
14362  the active users data from site_stats.
14363* Add a <link rel="canonical"> tag on redirected page views
14364* Replace hardcoded '...' as indication of a truncation with the
14365  'ellipsis' message
14366* Wrap warning message 'editinginterface' into a div with class
14367  'mw-editinginterface'
14368* (bug 17497) Oasis opendocument added to mime.types
14369* Remove the link to Special:FileDuplicateSearch from the "file history" section
14370  of image description pages as the list of duplicated files is shown in the
14371  next section anyway.
14372* Added $wgRateLimitsExcludedIPs, to allow specific IPs to be whitelisted from
14373  rate limits.
14374* (bug 14981) Shared repositories can now have display names, located at
14375  Mediawiki:Shared-repo-name-REPONAME, where REPONAME is the name in
14376  $wgForeignFileRepos
14377* Special:ListUsers: Sort list of usergroups by alphabet
14378* (bug 16762) Special:Movepage now shows a list of subpages when possible
14379* (bug 17585) Hide legend on Special:Specialpages from non-privileged users
14380* Added $wgUseTagFilter to control enabling of filter-by-change-tag
14381* (bug 17291) MediaWiki:Nocontribs now has an optional $1 parameter for the
14382  username
14383* Wrap special page summary message '$specialPageName-summary' into a div
14384  with class 'mw-specialpage-summary'
14385* $wgSummarySpamRegex added to handle edit summary spam. This is used *instead*
14386  of $wgSpamRegex for edit summary checks. Text checks still use $wgSpamRegex.
14387* New function to convert content text to specified language (only applies on
14388  wiki with LanguageConverter class)
14389* (bug 17844) Redirect users to a specific page when they log in, see
14390  $wgRedirectOnLogin
14391* Added a link to Special:UserRights on Special:Contributions for privileged
14392  users
14393* (bug 10336) Added new magic word {{REVISIONUSER}}, which displays the editor
14394  of the displayed revision
14395* LinkerMakeExternalLink now has an $attribs parameter for link attributes and
14396  a $linkType parameter for the type of external link being made
14397* (bug 17785) Dynamic dates surrounded with a <span> tag, fixing sortable tables
14398  with dynamic dates.
14399* (bug 4582) Provide preference-based autoformatting of unlinked dates with the
14400  dateformat parser function.
14401* (bug 17886) Special:Export now allows you to export a whole namespace (limited
14402  to 5000 pages)
14403* (bug 17714) Limited TIFF upload support now built in if 'tif' extension is
14404  enabled. Image width and height are now recognized, and when using
14405  ImageMagick, optional flattening to PNG or JPEG for inline display can be
14406  enabled by setting $wgTiffThumbnailType
14407* Renamed two input IDs on Special:Log from 'page' and 'user' to 'mw-log-page'
14408  and 'mw-log-user', respectively
14409* Added $wgInvalidUsernameCharacters to disallow certain characters in
14410  usernames during registration (such as "@")
14411* Added $wgUserrightsInterwikiDelimiter to allow changing the delimiter
14412  used in Special:UserRights to denote the user should be searched for
14413  on a different database
14414* Add a class if 'missingsummary' is triggered to allow styling of the summary
14415  line
14416* Title attributes are now always blank on framed and thumbnailed images, and
14417  default to blank on inline images instead of defaulting to the image's
14418  filename. Additionally, the alt attribute now defaults to the filename on
14419  framed and thumbnailed images if no caption or alt attribute is specified.
14420
14421=== Bug fixes in 1.15 ===
14422* (bug 16968) Special:Upload no longer throws useless warnings.
14423* (bug 17000) Special:RevisionDelete now checks if the database is locked
14424  before trying to delete the edit.
14425* (bug 16852) padleft and padright now handle multibyte characters correctly
14426* (bug 17010) maintenance/namespaceDupes.php now add the suffix recursively if
14427  the destination page exists
14428* (bug 17035) Special:Upload now fails gracefully if PHP's file_uploads has
14429  been disabled
14430* Fixing the caching issue by using -{T|xxx}- syntax (only applies on wiki with
14431  LanguageConverter class)
14432* Improving the efficiency by using -{A|xxx}- syntax (only applies on wiki with
14433  LanguageConverter class)
14434* (bug 17054) Added more descriptive errors in Special:RevisionDelete
14435* (bug 11527) Diff on page with one revision shows "Next" link to same diff
14436* (bug 8065) Fix summary forcing for new pages
14437* (bug 10569) redirects to Special:Mypage and Special:Mytalk are no longer
14438  allowed by default. Change $wgInvalidRedirectTargets to re-enable.
14439* (bug 3043) Feed links of given page are now preceded by standard feed icon
14440* (bug 17150) escapeLike now escapes literal \ properly
14441* Inconsistent use of sysop, admin, administrator in system messages changed
14442  to 'administrator'
14443* (bug 14423) Check block flag validity for block logging
14444* DB transaction and slave-lag avoidance tweaks for Email Notifications
14445* (bug 17104) Removed [Mark as patrolled] link for already patrolled revisions
14446* (bug 17106) Added 'redirect=no' and 'mw-redirect' class to redirects at
14447  "user contributions"
14448* Rollback links on new pages removed from "user contributions"
14449* (bug 15811) Re-upload form tweaks: license fields removed, destination locked,
14450  comment label uses better message
14451* Whole HTML validation ($wgValidateAllHtml) now works with external tidy
14452* Parser tests no longer fail when $wgExternalLinkTarget is set in
14453  LocalSettings
14454* (bug 15391) catch DBQueryErrors on external storage insertion. This avoids
14455  error messages on save were the edit in fact is saved.
14456* (bug 17184) Remove duplicate "z" accesskey in MonoBook
14457* Parser tests no longer fail when $wgAlwaysUseTidy is set in LocalSettings.php
14458* Removed redundant dupe warnings on reupload for the same title. Dupe warnings
14459  for identical files at different titles are still given.
14460* Add 'change tagging' facility, where changes can be tagged internally with
14461  certain designations, which are displayed on various summaries of changes,
14462  and the entries can be styled with CSS.
14463* (bug 17207) Fix regression breaking category page display on PHP 5.1
14464* Categoryfinder utility class no longer fails on invalid input or gives wrong
14465  results for category names that include pseudo-namespaces
14466* (bug 17252) Galician numbering format
14467* (bug 17146) Fix for UTF-8 and short word search for some possible MySQL
14468  configs
14469* (bug 7480) Internationalize database error message
14470* (bug 16555) Number of links to mediawiki.org scaled back on post-installation
14471* (bug 14938) Removing a section no longer leaves excess whitespace
14472* (bug 17304) Fixed fatal error when thumbnails couldn't be generated for file
14473  history
14474* (bug 17283) Remove double URL escaping in show/hide links for log entries
14475  and RevisionDeleteForm::__construct
14476* (bug 17105) Numeric table sorting broken
14477* (bug 17231) Transcluding special pages on wikis using language conversion no
14478  longer affects the page title
14479* (bug 6702) Default system messages updated/improved
14480* (bug 17190) User ID on preference page no longer has delimeters
14481* (bug 17341) "Powered by MediaWiki" should be on the left on RTL wikis
14482* (bug 17404) "userrights-interwiki" right was missing in User::$mCoreRights
14483* (bug 7509) Separation strings should be configurable
14484* (bug 17420) Send the correct content type from action=raw when the HTML file
14485  cache is enabled.
14486* (bug 12746) Do not allow new password e-mails when wiki is in read-only mode
14487* (bug 17478) Fixed a PHP Strict standards error in
14488  maintenance/cleanupWatchlist.php
14489* (bug 17488) RSS/Atom links in left toolbar are now localized in classic skin
14490* (bug 17472) use print <<<EOF in maintenance/importTextFile.php
14491* Special:PrefixIndex: Move table styling to shared.css, add CSS IDs to tables
14492  use correct message 'allpagesprefix' for input form label, replace _ with ' '
14493  in next page link
14494* (bug 17506) Exceptions within exceptions now respect $wgShowExceptionDetails
14495* Fixed excessive job queue utilisation
14496* File dupe messages for remote repos are now shown only once.
14497* (bug 14980) Messages 'shareduploadwiki' and 'shareduploadwiki-desc' are now
14498  used as a parameter in 'sharedupload' for easier styling and customization.
14499* (bug 17482) Formatting error in Special:Preferences#Misc (Opera)
14500* (bug 17556) <link> parameters in Special:Contributions feeds (RSS and Atom)
14501  now point to the actual contributors' feed.
14502* ForeignApiRepos now fetch MIME types, rather than trying to figure it locally
14503* Special:Import: Do not show input field for import depth if
14504  $wgExportMaxLinkDepth == 0
14505* (bug 17570) $wgMaxRedirects is now correctly respected when following
14506  redirects (was previously one more than $wgMaxRedirects)
14507* (bug 16335) __NONEWSECTIONLINK__ magic word to suppress new section link.
14508* (bug 17581) Wrong index name in PostgreSQL's updater: was rc_timestamp_nobot,
14509  changed to rc_timestamp_bot
14510* (bug 17437) Fixed incorrect link to web-based installer
14511* (bug 17538) Use shorter URLs in <link> elements
14512* (bug 13778) Hidden input added to the search form so that using the Enter key
14513  on IE will do a fulltext search like clicking the button does
14514* (bug 1061) CSS-added icons next to links display through the text and makes
14515  it unreadable in RTL
14516* Special:Wantedtemplates now works on PostgreSQL
14517* (bug 14414) maintenance/updateSpecialPages.php no longer throws error with
14518  PostgreSQL
14519* (bug 17546) Correct Tongan language native name is "lea faka-Tonga"
14520* (bug 17621) Special:WantedFiles has no link to Special:Whatlinkshere
14521* (bug 17460) Client ecoding is now correctly set for PostgreSQL
14522* (bug 17648) Prevent floats from intruding into edit area in previews if no
14523  toolbar present
14524* (bug 17692) Added (list of members) link to 'user' in Special:Listgrouprights
14525* (bug 17707) Show file destination as plain text if &wpForReUpload=1
14526* (bug 10172) Moved setting of "changed since last visit" flags out of the job
14527  queue
14528* (bug 17761) "show/hide" link in page history in now works for the first
14529  displayed revision if it's not the current one
14530* (bug 17722) Fix regression where users are unable to change temporary
14531  passwords
14532* (bug 17799) Special:Random no longer throws a database error when a non-
14533  namespace is given, silently falls back to NS_MAIN
14534* (bug 17751) The message for bad titles in WantedPages is now localized
14535* (bug 17860) Moving a page in the "MediaWiki" namespace using SuppressRedirect
14536  no longer corrupts the message cache
14537* (bug 17900) Fixed User Groups interface log display after saving groups.
14538* (bug 17897) Fixed string offset error in <pre> tags
14539* (bug 17778) MediaWiki:Catseparator can now have HTML entities
14540* (bug 17676) Error on Special:ListFiles when using Postgres
14541* Special:Export doesn't use raw SQL queries anymore
14542* (bug 14771) Thumbnail links to individual DjVu pages no longer have
14543  two "page" parameters
14544* (bug 17972) Special:FileDuplicateSearch form now works correctly on wikis that
14545  don't use PathInfo or short urls
14546* (bug 17990) trackback.php now has a trackback.php5 alias and works with
14547  $wgScriptExtension
14548* (bug 14990) Parser tests works again with PostgreSQL
14549* (bug 11487) Special:Protectedpages doesn't list protections with pr_expiry
14550  IS NULL
14551* (bug 18018) Deleting a file redirect leaves behind a malfunctioning redirect
14552* (bug 17537) Disable bad zlib.output_compression output on HTTP 304 responses
14553* (bug 11213) [edit] section links in printable version no longer appear when
14554  you cut-and-paste article text
14555* (bug 17405) "Did you mean" to mirror Go/Search behavior of original request
14556* (bug 18116) 'edittools' is now output identically on edit and upload pages
14557* (bug 17241) The diffonly URI parameter should cascade to "Next edit" and
14558  "Previous edit" diff links
14559* (bug 16823) Sidebar search form should not use Special:Search view URL as
14560  target
14561* (bug 16343) Non-existing, but in use, category pages can be "go" match hits
14562* Fixed a CSS validation issue which allowed external images to be included
14563  into wikis where that is disallowed by configuration.
14564* Fixed a data leakage vulnerability for private wikis using img_auth.php or
14565  similar image access authentication schemes. Check user permissions before
14566  streaming out scaled images from thumb.php.
14567
14568== API changes in 1.15 ==
14569* (bug 16858) Revamped list=deletedrevs to make listing deleted contributions
14570  and listing all deleted pages possible
14571* (bug 16844) Added clcategories parameter to prop=categories
14572* (bug 17025) Add "fileextension" parameter to meta=siteinfo&siprop=
14573* (bug 17048) Show the 'new' flag in list=usercontribs for the revision that
14574  created the page, even if it's not the top revision
14575* (bug 17069) Added ucshow=patrolled|!patrolled to list=usercontribs
14576* action=delete respects $wgDeleteRevisionsLimit and the bigdelete user right
14577* (bug 15949) Add undo functionality to action=edit
14578* (bug 16483) Kill filesort in ApiQueryBacklinks caused by missing parentheses.
14579  Building query properly now using makeList()
14580* (bug 17182) Fix pretty printer so URLs with parentheses in them are
14581  autolinked correctly
14582* (bug 17224) Added siprop=rightsinfo to meta=siteinfo
14583* (bug 17239) Added prop=displaytitle to action=parse
14584* (bug 17317) Added watch parameter to action=protect
14585* (bug 17007) Added export and exportnowrap parameters to action=query
14586* (bug 17326) BREAKING CHANGE: Changed output format for iiprop=metadata
14587* (bug 17355) Added auwitheditsonly parameter to list=allusers
14588* (bug 17007) Added action=import
14589* BREAKING CHANGE: Removed rctitles parameter from list=recentchanges because
14590  of performance concerns
14591* Listing (semi-)deleted revisions and log entries as well in prop=revisions
14592  and list=logevents
14593* (bug 11430) BREAKING CHANGE: Modules may return fewer results than the
14594  limit and still set a query-continue in some cases
14595* (bug 17357) Added movesubpages parameter to action=move
14596* (bug 17433) Added bot flag to list=watchlist&wlprop=flags output
14597* (bug 16740) Added list=protectedtitles
14598* Added mainmodule and pagesetmodule parameters to action=paraminfo
14599* (bug 17502) meta=siteinfo&siprop=namespacealiases no longer lists namespace
14600  aliases already listed in siprop=namespaces
14601* (bug 17529) rvend ignored when rvstartid is specified
14602* (bug 17626) Added uiprop=email to list=userinfo
14603* (bug 13209) Added rvdiffto parameter to prop=revisions
14604* Manual language conversion improve: Now we can include both ";" and ":" in
14605  conversion rules
14606* (bug 17795) Don't report views count on meta=siteinfo if $wgDisableCounters
14607  is set
14608* (bug 17774) Don't hide read-restricted modules like action=query from users
14609  without read rights, but throw an error when they try to use them.
14610* Don't hide write modules when $wgEnableWriteAPI is false, but throw an error
14611  when someone tries to use them
14612* BREAKING CHANGE: action=purge requires write rights and, for anonymous users,
14613  a POST request
14614* (bug 18099) Using appendtext to edit a non-existent page causes an interface
14615  message to be included in the page text
14616* Fixed the circular template inclusion check, was broken when the loop
14617  involved redirects. Without this, infinite recursion within the parser is
14618  possible.
14619* (bug 18601) generator=backlinks returns invalid continue parameter
14620* (bug 18597) Internal error with empty generator= parameter
14621* (bug 18617) Add xml:space="preserve" attribute to relevant tags in XML output
14622* (bug 17611) Provide a sensible error message on install when the SQLite data
14623  directory is wrong.
14624
14625=== Languages updated in 1.15 ===
14626
14627MediaWiki supports over 300 languages. Many localisations are updated
14628regularly. Below only new and removed languages are listed, as well as
14629changes to languages because of Bugzilla reports.
14630
14631* Austrian German (de-at) (new)
14632* Swiss Standard German (de-ch) (new)
14633* Simplified Gan Chinese (gan-hans) (new)
14634* Traditional Gan Chinese (gan-hant) (new)
14635* Literary Chinese (lzh) (new)
14636* Uyghur (Latin script) (ug-latn) (renamed from 'ug')
14637* Veps (vep) (new)
14638* Võro (vro) (renamed from fiu-vro)
14639* (bug 17151) Add magic word alias for #redirect for Vietnamese
14640* (bug 17288) Messages improved for default language (English)
14641* (bug 12937) Update native name for Afar
14642* (bug 16909) 'histlegend' now reuses messages instead of copying them
14643* (bug 17832) action=delete returns 'unknownerror' instead of 'permissiondenied'
14644  when the user is blocked
14645* Traditional/Simplified Gan Chinese conversion support
14646
14647== MediaWiki 1.14 ==
14648
14649== MediaWiki 1.14.1 ==
14650=== Changes since 1.14.0 ===
14651
14652* (bug 17737) Fixed russian URLs for Special:BookSources
14653* (bug 17713) Using links with only an anchor no longer add an dummy entry in
14654  the pagelinks table
14655* (bug 17897) Fixed string offset error in <pre> tags
14656* (bug 17832) Fixed action=delete returning 'unknownerror' instead of
14657  'permissiondenied' when the user is blocked
14658* Fixed performance regression when accessing deleted (archived) files
14659* (bug 19693) Fixed cross-site scripting vulnerability in Special:Block
14660
14661== MediaWiki 1.14.0 ==
14662=== Changes since 1.14.0rc1 ===
14663
14664* Fixed the performance of the backlinks API module
14665* (bug 17420) Send the correct content type from action=raw when the HTML file
14666  cache is enabled.
14667* (bug 17437) Fixed incorrect link to web-based installer
14668* (bug 17527) Fixed missing MySQL-specific options in installer
14669
14670=== Configuration changes in 1.14 ===
14671
14672* $wgExemptFromUserRobotsControl is an array of namespaces to be exempt from
14673  the effect of the new __INDEX__/__NOINDEX__ magic words.  (Default: null, ex-
14674  empt all content namespaces.)
14675* $wgForwardSearchUrl has been removed entirely. Documented setting since 1.4
14676  has been $wgSearchForwardUrl.
14677* (bug 15080) $wgOverrideSiteFeed has been added. Setting either
14678  $wgSiteFeed['rss'] or 'atom' to a URL will override the default Recent
14679  Changes feed that appears on all pages.
14680* $wgSQLiteDataDirMode has been introduced as the default directory mode for
14681  SQLite data directories on creation. Note that this setting is separate from
14682  $wgDirectoryMode, which applies to all normal dirs created by MediaWiki.
14683* $wgGroupsAddToSelf and $wgGroupsRemoveFromSelf now work more like
14684  $wgAddGroups and $wgRemoveGroups, where the user must belong to a specified
14685  group in order to add or remove those groups from themselves.
14686  Backwards compatibility is maintained.
14687* $wgRestrictDisplayTitle controls if the use of the {{DISPLAYTITLE}} magic
14688  word is restricted to titles equivalent to the actual page title. This
14689  is true per default, but can be set to false to allow any title.
14690* $wgSpamRegex may now be an array of multiple regular expressions.
14691* $wgAjaxSearch has been removed; use $wgEnableMWSuggest instead.
14692* Editing the MediaWiki namespace is now unconditionally restricted to people
14693  with the editinterface right, configuring this in $wgNamespaceProtection
14694  is not required.
14695* $wgAllowExternalImagesFrom may now be an array of multiple strings.
14696* Introduced $wgEnableImageWhitelist to toggle the on-wiki external image
14697  whitelist on or off.
14698* Added $wgRenderHashAppend to append some string to the parser cache and the
14699  sitenotice cache keys.
14700* $wgRCChangedSizeThreshold is now a positive integer by default,
14701* (bug 16006) $wgEnableWriteAPI is now true by default. Authorized can perform
14702  write actions using the API.
14703* Added $wgRC2UDPInterwikiPrefix which adds an interwiki prefix
14704  ($wgLocalInterwiki) onto the page names in the UDP feed.
14705* Added $wgAllowUserSkin to let the wiki's owner disable user selectable skins
14706  on the wiki. If it's set to false, then the skin used will *always* be
14707  $wgDefaultSkin.
14708* Added $wgEnotifUseRealName, which allows UserMailer to send out e-mails based
14709  on the user's real name if one is set. Defaults to false (use the username)
14710* Removed the 'apiThumbCacheDir' option from $wgForeignFileRepos (only used in
14711  ForeignAPIRepo)
14712* (bug 44) Image namespace and accompanying talk namespace renamed to File.
14713  For backward compatibility purposes, Image still works. External tools may
14714  need to be updated.
14715* The constants NS_FILE and NS_FILE_TALK can now be used instead of NS_IMAGE and
14716  NS_IMAGE_TALK.  The old constants are retained as aliases for compatibility,
14717  and should still be used in code meant to be compatible with v1.13 or older.
14718* MediaWiki can be forced to use private IPs forwarded by a proxy server by
14719  using $wgUsePrivateIPs.
14720* The 'BeforeWatchlist' hook has been removed due to internal changes in
14721  Special:Watchlist. 'SpecialWatchlistQuery' should now be used by extensions
14722  to customize the watchlist database query.
14723
14724=== Migrated extensions ===
14725The following extensions are migrated into MediaWiki 1.14:
14726
14727* Special:DeletedContributions to show deleted user contributions (was
14728  extension DeletedContributions)
14729* Special:Log/newusers recording new users (was extension Newuserlog)
14730* Special:LinkSearch to search for external links (was extension LinkSearch)
14731* RenderHash
14732* NoMoveUserPages
14733* UniversalEditButton
14734
14735=== New features in 1.14 ===
14736
14737* New URL syntaxes for Special:ListUsers - 'Special:ListUsers/USER' and
14738  'Special:ListUsers/GROUP/USER', in addition to the older syntax
14739  'Special:ListUsers/GROUP' where GROUP is a valid group name.
14740* Configurable per-namespace and per-page notices for the edit form,
14741  respectively MediaWiki:Editnotice-# where # is the namespace number, and
14742  MediaWiki:Editnotice-#-PAGENAME where # is the page's namespace number and
14743  PAGENAME is the page name minus the namespace prefix.
14744* (bug 8068) New __INDEX__ and __NOINDEX__ magic words allow user control of
14745  search engine indexing on a per-article basis.
14746* Handheld stylesheet options
14747* Added 'DoEditSectionLink' hook as a cleaner unified version of the old
14748  'EditSectionLink' and 'EditSectionLinkForOther' hooks.  Note that the
14749  'EditSectionLinkForOther' hook has been removed, but 'EditSectionLink' is
14750  run in all cases instead, so extensions using the old hooks should still work
14751  if they ran roughly the same code for both hooks (as is almost certain).
14752* Signature (~~~~) "cleaning", i.e. template removal, can be disabled with
14753  $wgCleanSignatures=false
14754* Extensions can use the SkinBuildSidebar hook to modify the content of the
14755  sidebar and add custom portlets to it
14756* Added 'MakeGlobalVariablesScript' hook for extensions to be able to add vari-
14757  ables into the output of Skin::makeVariablesScript
14758* (bug 13846) Added $wgAddGroups and $wgRemoveGroups display on
14759  Special:ListGroupRights
14760* (bug 14377) Add a date selector to history pages
14761* (bug 15007) New 'pagetitle-view-mainpage' message allows the HTML <title> of
14762  the main page to be customized
14763* Added $wgDisableTitleConversion to disabling the conversion for all pages on
14764  the wiki
14765* Added 'noconvertlink' toggle that can be set per user preferences, also
14766  added 'convertlink=no|yes' on GET requests whether have the link titles
14767  being converted or not
14768* (bug 14921) Special:Contributions/: add user name to <title>
14769  Patch by Emufarmers
14770* Unescape more "safe" characters when producing URLs, for added prettiness
14771* Introduced a new hook 'SkinAfterContent' that allows extensions to add text
14772  after the page content and article metadata. Updated all skins and skin
14773  templates to work with that hook.
14774* (bug 14929) removeUnusedAccounts.php now supports 'ignore-touched' and
14775  'ignore-groups'. Patch by Louperivois
14776* (bug 15127) Work around minor display glitch in Opera.
14777* By default, reject file uploads that look like ZIP files, to avoid the
14778  so-called GIFAR vulnerability.
14779* (bug 15141) Give ability to only list protected pages with the cascading
14780  option enabled on Special:ProtectedPages
14781* (bug 15157) Special:Watchlist has the same options as Special:Watchlist:
14782  Show/Hide logged in users, Show/Hide anonymous, Invert namespace selection
14783* Added hook 'UserrightsChangeableGroups' to allow modification of what
14784  groups may be added or removed via the Special:UserRights interface.
14785* HTML entities like &nbsp; now work (are not escaped) in edit summaries.
14786* (bug 13815) In the comment for page moves, use the colon-separator message
14787  instead of a hardcoded colon.
14788* Allow <gallery> to accept image names without an Image: prefix
14789* Add tooltips to rollback and undo links
14790* BMP images are now displayed as PNG
14791* (bug 13471) Added NUMBERINGROUP magic word
14792* (bug 11884) Now support Flash EXIF attribute
14793* Show thumbnails in the file history list, patch by User:Agbad
14794* Added support of piped wikilinks using double-width brackets
14795* Added an on-wiki external image whitelist. Items in this whitelist are
14796  treated as regular expression fragments to match for when possibly
14797  displaying an external image inline.
14798* (bugs 15405, 15436) Sort more currency types correctly in sortable tables
14799* (bug 15422) Sort more different types of numbers in sortable tables
14800* (bug 2889) MediaWiki:Print.css applies to the printable version
14801* Category counts (e.g. from {{PAGESINCATEGORY:}}) should be more accurate for
14802  small categories
14803* After logging in, automatically redirect to wherever you logged in from
14804* (bug 5619) Break messages used in Special:Statistics down further
14805* (bug 11029) Add link to Special:Listusers?group=sysop etc at
14806  Special:Statistics
14807* (bug 15514) Setting $wgRightsText without $wgRightsUrl now produces a
14808  plaintext copyright notice. Patch by Juliano F. Ravasi.
14809* (bug 15551) Deletion log excerpt is now shown whenever a user vists a
14810  deleted page, even if they are unable to edit it.
14811* Added Wantedfiles special pages, allowing users to find image links with no
14812  image.
14813* (bug 12650) It is now possible to set different expiration times for
14814  different restriction types on the protection form.
14815* (bug 8440) Allow preventing blocked users from editing their talk pages
14816* Improved upload file type detection for OpenDocument formats
14817* Added the ability to set the target attribute on external links with
14818  $wgExternalLinkTarget
14819* api.php now sends "Retry-After" and "X-Database-Lag" HTTP headers if the
14820  maxlag check fails, just like index.php does
14821* Added "link" parameter to image links, to allow images to link to an
14822  arbitrary title or URL. This should replace inaccessible and incomplete
14823  solutions such as CSS-based overlays and ImageMap.
14824* (bug 368) Don't use caption for alt attribute; allow manual specification
14825  using new "alt=" parameter for images
14826* (bug 44) The {{ns:}} core parser function now also accepts localized
14827  namespace names and aliases; also, its output now uses spaces instead of
14828  underscores to match the behavior of the {{NAMESPACE}} magic word
14829* Added the ability to display user edit counts in Special:ListUsers. Off by
14830  default, enabled with $wgEdititis = true (named after the medical condition
14831  marked by unhealthy obsession with edit counts).
14832* Added a file cache to the parser to improve page rendering time on pages with
14833  several uses of the same image.
14834* (bug 1250) Users can still use "show preview" and "show changes" even if the
14835  wiki is set to read-only mode.
14836* Added a call to the 'UnwatchArticleComplete' hook to the watchlist editor.
14837  This should make it so that ALL user-accessible methods of removing a page
14838  from a watchlist lead to this hook being called (it was previously only
14839  called from within Article.php
14840* Maximum execution time for shell processes on linux is now configured with
14841  $wgMaxShellTime (180 seconds by default)
14842* (bug 1306) 'Email user' link no longer shown on user page when emailing
14843  is not available due to lack of confirmed address or disabled preference
14844* Special:Wanted templates special page added to display missing templates
14845  linked from articles
14846* Make search matches bold only, not red as well
14847* (bug 10080) Blocks can be modified without unblocking first
14848* (bug 15820) Special:BlockIP shows a notice if the user being blocked is
14849  already directly blocked
14850* (bug 13710) Allow to force "watch this" checkbox via URL using parameter
14851  "watchthis"
14852* (bug 15125) Add Public Domain to default options when installing. Patch by
14853  Nathan Larson.
14854* Set a special temporary directory for ImageMagick with $wgImageMagickTempDir
14855* (bug 16113) Show/hide for redirects in Special:NewPages
14856* (bug 15903) Upload link was added to Nostalgia skin
14857* (bug 15761) Add user toggle to omit diff after rollback
14858* Added the BitmapHandler_ClientOnly media handler, which allows server-side
14859  image scaling to be completely disabled for specific media types, via the
14860  $wgMediaHandlers configuration variable.
14861* New 'AbortDiffCache' hook can be used to cancel the caching of a diff
14862* (bug 15835) Added Content-Style-Type meta tag
14863* (bug 11027)  Add parameter to MW:Randompage-nopages so that user can see the
14864  namespace.
14865* Add id="mw-user-domain-section" to <tr> tag in Userlogin.php template so that
14866  admins with a single domain can hide the domain section using CSS
14867* Dropped old Paser_OldPP class. Only new parser with preprocessor is used.
14868* Moved password reset form from Special:Preferences to Special:ResetPass
14869* Added Special:ChangePassword as a special page alias for Special:ResetPass
14870* Added complementary function for addHandler() called removeHandler() for
14871  removing events
14872* Improved security of file uploads for IE clients, using a reverse-engineered
14873  algorithm very similar to IE's content detection algorithm.
14874* Cascading protection no longer requires that both edit and move are restricted
14875  to sysop, just edit=sysop is enough
14876* (bug 2391) A warning is now shown for invalid ISBN numbers on
14877  Special:Booksources.
14878* Installer has been updated to reflect the release of the GFDL 1.3. The URL for
14879  1.2 has been updated, and the 1.3 URL has been given. 1.2 is still
14880  Wikipedia-compatible. RightsCode was changed from 'gfdl' to 'gfdl1_2', so we
14881  can now support 1.2 as well as 1.3 (gfdl1_3).
14882* (bug 16293) PD URL was changed to the CreativeCommons site on PD (which
14883  auto-detects your language) instead of Wikipedia.
14884* (bug 16635) The "view and edit watchlist" page (Special:Watchlist/edit) now
14885  includes a table of contents
14886* File objects returned by wfFindFile() are now cached by default
14887* (bug 7492) Rights can now be assigned to specific IP addresses and ranges by
14888  using $wgAutopromote (new defines: APCOND_ISIP and APCOND_IPINRANGE)
14889* Add a 'change block' link to Special:IPBlockList and Special:Log
14890* (bug 16459) Use native getElementsByClassName where possible, for better
14891  performance in modern browsers
14892* Enable \cancel and \cancelto in texvc (recompile required)
14893* Added 'UserCryptPassword' and 'UserComparePasswords' hooks to allow extensions
14894  to implement their own password hashing methods.
14895* (bug 16760) Add CSS-class to action links of Special:Log
14896* (bug 505) Time zones can now be specified by location in user preferences,
14897  avoiding the need to manually update for DST. Patch by Brad Jorsch.
14898* (bug 2585) HTTP 404 return code is now given for a page view if the page
14899  does not exist, allowing spiders and link checkers to detect broken links.
14900* Special:Log: Add 'change protection' link for unprotected pages too
14901* Special:Log: Add log type specific CSS classes 'mw-logline-$logtype' to
14902  'li' elements
14903* (bug 16754) Making arbitrary rows of sortable tables sticky:
14904  |- class="unsortable"
14905* Show subversion too even if a "normal" version number is available
14906* (bug 16121) Add a note that a page move was without creating a redirect in the
14907  move log
14908* Image moving is now enabled for sysops by default
14909* Make "Did you mean" search feature more noticeable
14910* (bug 16720) Transcluded Special:NewPages processes "/username="
14911
14912=== Bug fixes in 1.14 ===
14913
14914* (bug 14907) DatabasePostgres::fieldType now defined.
14915* (bug 14659) Passing the default limit param to Special:Recentchanges no more
14916  falls back to the user option
14917* (bug 14954) Fix regression in Modern and Simple skins
14918* Recursion loop check added to Categoryfinder class
14919* Fixed few performance troubles of large job queue processing
14920* Not setting various parameters in Foreign Repos now fails more gracefully
14921* (bug 2333) Redirects are properly rendered when previewing an edit.
14922* (bug 14972) Use localized alias of Special:Search on all search forms
14923* (bug 11035) Special:Search should have descriptive <title>
14924* Special pages are now not subject to special handling for "self-links"
14925* (bug 15053) Syntactically incorrect redirects with another link in them
14926  no longer redirect to the second link
14927* (bug 15049) Fix for CheckUser extension's log search: usernames containing
14928  a "-" were incorrectly turned into bogus IP range searches.
14929  Patch by Max Semenik.
14930* (bug 15055) Talk page notifications no longer attempt to send mail when
14931  user's e-mail address is invalid or unconfirmed
14932* (bug 12370) Add throttle on password attempts. Defaults to max 5 attempts in
14933  5 minutes.
14934* (bug 15016) 'Templates used on this page' list in view source should be
14935  wrapped in a div with class "templatesUsed"
14936* (bug 14868) Setting $wgFeedDiffCutoff to 0 now disables generation of the
14937  diff entirely, not just the display of it.
14938* (bug 6387) Introduced new setting $wgCategoryPrefixedDefaultSortkey which
14939  allows having the unprefixed page title as the default category sortkey
14940* (bug 15079) Add class="ns-talk" / "ns-subject" to <body>. Also added
14941  ns-special to special pages.
14942* (bug 15052) Skins should add their name as a class in <body>
14943* (bug 14165, bug 14294) Wikimedia specific configuration in convertGrammar()
14944  for several languages was removed. The settings have been put in extension
14945  WikimediaMessages. Patch for Czech by Danny B.
14946* (bug 15101) Displaying only bots edits in Special:Recentchanges now works
14947  again
14948* (bug 13770) Fixed incorrect detection of PHP's DOM module
14949* (bug 14790) Export of category pages when using Category: prefix now actually
14950  gives results
14951* Avoid recursive crazy expansions in section edit comments for pages which
14952  contain '/*' in the title
14953* Fix excessive memory usage when parsing pages with lots of links
14954* $wgSpamRegex now matches the edit summary and page move descriptions in
14955  addition to body text.
14956* Navigation links to images available from a shared repository (like Commons)
14957  from their local talk pages no longer appear as redlinks
14958* Action=purge on ForeignApiFiles now works (purges their thumbnails and
14959  description pages).
14960* (bug 15303) Title conversion for templates wasn't working in some cases.
14961* (bug 15264) Underscores in Special:Search/Foo_bar parameters were taken
14962  literally; now converting them to spaces per expectation.
14963* (bug 15342) "Invert" checkbox now works correctly when selecting main
14964  namespace in Special:Watchlist
14965* (bug 15172) 'Go' button of Special:Recentchanges now on the same line as the
14966  last input element (like Special:Watchlist too)
14967* (bug 15351) Fix fatal error for invalid section fragments in autocomments
14968* Fixed intermittent deadlock errors involving objectcache table queries.
14969  Use a separate database connection for the objectcache table to avoid
14970  long-lasting locks on that table.
14971* Respect file restrictions in the file history list
14972* (bug 15399) Odd/even classes on sortable tables' rows could be slow for large
14973  tables, and have been disabled by default.
14974* (bug 15482) Special:Recentchangeslinked has no longer two submit buttons
14975* (bug 15292) New message notification for unregistred users now works again
14976* (bug 14398) mwsuggest.js: Let width of container be configurable
14977* (bug 15543) Only include user touched timestamp to generated CSS
14978* (bug 15497) Removed encoding attribute from <?xml ?> tag
14979* (bug 12284) Special:Preferences now sets a returnto parameter on the link to
14980  Special:UserLogin. Patch by Marooned.
14981* Fixed the HTTP accept language string detection length in
14982  LanguageConverter.php, instead of the fixed length language codes.
14983* Special:RecentChangesLinked no longer shows outgoing links for nonexistent
14984  pages even if there are broken link records with source article id 0 in the
14985  database
14986* (bug 15598) Special:Newpages default limit uses user preference for
14987  recentchanges limit instead of hardcoded 50.
14988* (bug 15617) $wgFeedClassesOutputPage::getHeadLinks() respects $wgFeedClasses,
14989  instead of hardcoding rss and atom. Patch by Juliano F. Ravasi.
14990* (bug 14638) Special:Blockip now provides a link to the block log if the user
14991  has been blocked more than 10 times. Patch by Matt Johnston.
14992* (bug 12678) Skins don't show Upload link if the user isn't allowed to upload.
14993* Fixed incorrect usage of DB_LAST in Special:Export. Deprecated DB_LAST.
14994* (bug 15642) Blocked sysops can no longer block other users
14995* Http::request() now respects $wgHTTPtimeout when not using cURL
14996* (bug 15158) Userinvalidcssjstitle not shown on preview
14997* (bug 15196) Free external links should be numbered in a localised manner
14998* (bug 15388) Title of Special:PrefixIndex
14999* Links with no title but a curid parameter now use the curid to pick a page
15000* (bug 10323) Special:Undelete should have "inverse selection" button
15001* (bug 15831) Modern skin RTL support is bugous
15002* (bug 15869) Nostalgia skin does not show page title in printable mode
15003* (bug 15795) Special:Userrights is now listed on Special:SpecialPages when the
15004  user can only change his rights
15005* (bug 15846) Categories "leak" from older revisions in certain circumstances
15006* (bug 15928) Special pages dropdown should be inline in non-MonoBook skins
15007* (bug 14178) Some uses of UserLoadFromSession hook cause segfault
15008* (bug 15925) Postitive bytes added on recentchanges and watchlists are now
15009  bolded if above the threshold, previously it only worked for negatives
15010* Specify apple-touch-icon before favicon in HTML head section to make the
15011  Konqueror browser correctly use the latter
15012* (bug 15717) Set $separatorTransformTable for language 'eu'
15013* (bug 15605) Enabled $datePreferences for language 'hr'. Added standard date
15014  preferences.
15015* (bug 13701) {{NUMBEROFVIEWS}} magic word to show number of total views.
15016* (bug 5101) Image from Commons doesn't show up when searched in Wikipedia
15017  search box
15018* (bug 14609) User's namespaces to be searched default not updated after adding
15019  new namespace
15020* Purge form uses valid XHTML
15021* (bug 12764) Special:LonelyPages shows transcluded pages
15022* (bug 16073) Enhanced RecentChanges uses onclick handler with better fallback
15023  if JavaScript is disabled
15024* (bug 4253) Recentchanges IRC messages no longer include title in diff URLs
15025* Allow '0' to be an accesskey.
15026* (bug 8063) Use language-dependent sorting in client-side sortable tables
15027* (bug 16160) Suggestions box should be resized from left for RTL wikis
15028* (bug 11533) Fixed insane slowdown when in read-only mode for long periods
15029  of time with CACHE_NONE (default objectcache table configuration).
15030* Trying to set two different default category sort keys for one page now
15031  produces a warning
15032* (bug 16143) Fix redirect loop on special pages starting with lower case
15033  letters
15034* (bug 15737) Fix notices while expanding using PPCustomFrame
15035* (bug 15544) Non-index entry points cause the "Wiki not set up" message to
15036  have corrupt URLs
15037* (bug 5101) Image from Commons doesn't show up when searched in Wikipedia
15038  search box
15039* (bug 4362) [[MediaWiki:History copyright]] no more used with most recent
15040  revision when passing oldid parameter in the url
15041* (bug 16265) When caching thumbs with the ForeignApiRepo, we now use the same
15042  filename as the remote site.
15043* (bug 8345) Don't autosummarize where a redirect was left unchanged
15044* Made thumb caching in ForeignApiFile objects integrated with normal thumb
15045  path naming (/thumbs/hash/file), retired 'apiThumbCacheDir' as a result.
15046* (bug 5530) Consistency between character encoding in {{PAGENAMEE}},
15047  {{SUBPAGENAMEE}} and {{FULLPAGENAMEE}}
15048* Safer handling of non-MediaWiki exceptions -- now obeys our settings for
15049  formatting and path exposure.
15050* Less verbose errors from profileinfo.php when not configured
15051* Blacklist redirects via Special:Filepath, hard to use.
15052* Improved input validation on Special:Import form
15053* Add a .htaccess to deleted images directory for additional protection
15054  against exposure of deleted files with known SHA-1 hashes on default
15055  installations.
15056* Improved scripting safety heuristics for IE 5/6 content-type detection.
15057* Improved scripting safety heuristics on SVG uploads.
15058* (bug 11728) Unify layout of enhanced watchlist/recent changes
15059* (bug 8702) Properly update stats when running nukePage maintenance script
15060* (bug 7726) Searches for words less than 4 characters now work without
15061  requiring customization of MySQL server settings
15062* Honour unchecked "Leave a redirect behind" for moved subpages
15063* (bug 16440) Broken 0-byte math renderings are now deleted and re-rendered
15064  when page is re-parsed.
15065* (bug 6100) Unicode BiDi embedding/override characters (U+202A - U+202E) are
15066  now automatically removed from titles; these characters can accidentally end
15067  up in copy-and-pasted titles, and, by overriding normal bidirectional text
15068  handling, can lead to annoying behavior such as text rendering backwards
15069* Fixed minor bug where the memcached value for how many accounts an IP had
15070  created that day would be increased even if $wgAccountCreationThrottle was
15071  hit. This meant if an IP hit the throttle and then the throttle was raised
15072  later that day, the IP still couldn't create another account, because it
15073  had marked them as having created another account, when their last account
15074  creation had actually failed.
15075* (bug 12647) Allow autogenerated edit summary messages to be blanked with '-'
15076* (bug 16026) 'Revision-info' and 'revision-info-current' both accept wiki
15077  markup now.
15078* (bug 16529) Fix for search suggestions with some third-party JS libraries
15079* (bug 13342) importScript() generates more consistent URI encoding
15080* (bug 16577) When a blocked user tries to rollback a page, the block message
15081  is now only displayed once
15082* (bug 14268) SVG image sizes now extracted with proper XML parser
15083* (bug 14365) RepoGroup::findFiles() no longer crashes if passed an invalid
15084  title via the API
15085* (bug 4253, bug 16586) Revision ID is now given instead of title in URLs for
15086  new pages in the recent changes IRC feed
15087* Ugly tooltips in Special:Statistics were phased out in favor of more direct
15088  information. Went ahead and rewrote SpecialStatistics to subclass SpecialPage
15089* (bug 5506) Links to files on foreign repositories are now shown consistently
15090  as bluelinks e.g. in logs and edit summaries
15091* (bug 16623) Add missing </p> tag in Special:LockDB
15092* (bug 15849) Special:Movepage now throws a more specific error when trying to
15093  move a title to an interwiki target
15094* (bug 16638) 8-bit URL fallback encoding now set on additional languages using
15095  Arabic script (Persian, Urdu, Sindhi, Punjabi)
15096* (bug 16656) cleanupTitles and friends should now work in load-balanced
15097  DB environments when $wgDBserver isn't set.
15098* (bug 3691) Aspect ratio from viewBox attribute is now preserved for SVG
15099  images which do not specify width and height attributes.
15100* (bug 15027) Internet domain names and IP addresses can now be indexed and
15101  searched sensibly with the default MySQL search backend.
15102* (bug 11733) Fixed parameter validation in importTextFile.php
15103* (bug 16712) Special:NewFiles updated to use "newer"/"older" paging messages
15104  for clarity over "previous/next"
15105* (bug 16612) Fixed "noprint" class for Modern skin print style
15106* Section anchors now have an "id" attribute as well as a "name" attribute,
15107  even when Tidy is not used
15108* (bug 16026) revision-info, revision-info-current, cannotdelete,
15109  redirectedfrom, historywarning and difference messages now use Wiki text
15110  rather than raw HTML markup
15111* (bug 13835) Fix rendering of {{filepath:Wiki.png|nowiki}}
15112* (bug 16772) Special:Upload now correctly rejects files with spaces in the
15113  file extension (e.g. Foo. jpg).
15114* Image moving over an existing file no longer throws a database error
15115* (bug 16786) Restored "redundant" links recently removed from Classic sidebar
15116* (bug 16850) $wgActionPaths can have query strings now, previously, this broke
15117  local URLs
15118* (bug 16376) Mention in deleteBatch.php and moveBatch.php maintenance scripts
15119  that STDIN can be used for page list
15120* (bug 16560) Special:Random returns a page from ContentNamespaces, and no
15121  longer from NS_MAIN
15122
15123=== API changes in 1.14 ===
15124
15125* Registration time of users registered before the DB field was created is now
15126  shown as empty instead of the current time.
15127* API search now falls back to fulltext search by default when using Lucene
15128  or other engine which doesn't support a separate title search function.
15129  This means you can use API search on Wikipedia without explicitly adding
15130  &srwhat=text to the query.
15131* Added iiprop=bitdepth to imageinfo and aiprop=bitdepth to allimages
15132* (bug 14713) API-specific permissions (such as 'writeapi' and 'apihighlimits'
15133  are now listed on action=help
15134* (bug 15044) Added requestid parameter to api.php to facilitate distinguishing
15135  between requests
15136* (bug 15048) Added limit field for multivalue parameters to action=paraminfo
15137  output.
15138* When the limit on multivalue parameters is exceeded, a warning is issued
15139* list=search doesn't list missing pages any more
15140* (bug 15178) Added clshow to prop=categories to allow filtering for hidden/
15141  non-hidden categories
15142* (bug 15228) Combining revids= and redirects now throws a warning instead of
15143  an error, and still resolves redirects generated by the generator.
15144* list={backlinks,embeddedin,imageusage} now return arrays with keys 0, 1, 2,
15145  etc. (AKA lists) instead of arrays with pageIDs as keys (AKA hash tables)
15146  for consistency with other list modules.
15147* Added action=watch
15148* (bug 15275) apprefix and related parameters ignore spaces at the end
15149* action=edit no longer throws unknown error 228  when trying to create an
15150  empty section with section=new
15151* Database replication lag doesn't cause all action=edit requests to return the
15152  nochange flag any more
15153* (bug 15392) ApiFormatBase::formatHTML now uses $wgUrlProtocols.
15154* (bug 15444) action=edit returns "Unknown error: ``AS_END''" where it should
15155  return just "Unknown error"
15156* (bug 15448) YAML output returns empty values instead of 0
15157* (bug 15445) Added action=patrol
15158* (bug 15466) Added action=purge
15159* (bug 15486) action=block ignores autoblock parameter
15160* (bug 15492) added rcprop=loginfo to list=recentchanges
15161* (bug 15527) action=rollback can now revert anonymous editors
15162* (bug 15535) prop=info&inprop=protection doesn't list pre-1.10 protections
15163  if the page is also protected otherwise (1.10+ style or cascading)
15164* list=random now has rnredirect parameter, to get random redirects.
15165* Added APIAfterExecute, APIQueryAfterExecute and APIQueryGeneratorAfterExecute
15166  hooks which allow for extending core modules in a cleaner way
15167* action=protect checks for invalid protection types and levels
15168* (bug 15673) Added indentation to format=wddxfm output and improved built-in
15169  WDDX formatter to resemble PHP's more
15170* (bug 15706) Empty values for apprtype and apprlevel are now silently ignored
15171  rather than causing an exception
15172* Added uiprop=preferencestoken to meta=userinfo
15173* (bug 15609) Add inprop=url and inprop=readable to prop=info
15174* Add ApiDisabled and ApiQueryDisabled classes so individual modules can
15175  be disabled in LocalSettings.php
15176* (bug 15653) Add prop=duplicatefiles
15177* (bug 15768) Add list=watchlistraw
15178* (bug 15647) action=edit with basetimestamp fails if the page has been deleted
15179  and undeleted since the last edit
15180* (bug 15785) Allow for different expiry times for different protections in
15181  action=protect
15182* Added allowsduplicates attribute to action=paraminfo output
15183* (bug 15767) apfilterlanglinks returns duplicate results
15184* (bug 15845) Added pageid/fromid parameter to action=delete/move, making
15185  manipulation of legacy pages with invalid titles possible
15186* (bug 15881) Empty or invalid parameters cause database errors
15187* The maxage and smaxage parameters are now properly validated
15188* (bug 15945) list=recentchanges doesn't check $wgUseRCPatrol, $wgUseNPPatrol
15189  and patrolmarks right
15190* (bug 15985) acfrom and aifrom parameters didn't work when sorting in
15191  descending order.
15192* (bug 15995) Add cmstartsortkey and cmendsortkey parameters to
15193  list=categorymembers
15194* (bug 16017) list=categorymembers sets invalid continue parameters for
15195  sortkeys containing pipes
15196* (bug 16018) Added uccontinue parameter to list=usercontribs so paging
15197  works properly when multiple users are queried or a userprefix is used
15198* (bug 16047) Added activeusers attribute to meta=siteinfo&siprop=statistics
15199  output
15200* Added redirect resolution to action=parse
15201* (bug 16074) rvprop=content combined with a generator with a high limit causes
15202  an error
15203* (bug 16105) Image metadata attributes containing spaces result in invalid XML
15204* (bug 16126) Added siprop=magicwords to meta=siteinfo
15205* (bug 16159) Added wlshow=patrolled|!patrolled to list=watchlist
15206* (bug 16225) Titles like Talk:Talk:Foo broke apfrom and friends
15207* meta=siteinfo&siprop=interwikimap no longer throws an exception for empty
15208  sifilter parameter.
15209* (bug 12760) meta=userinfo&uiprop=ratelimits doesn't list group-specific rate
15210  limits
15211* (bug 16398) meta=userinfo&uiprop=rights lists some rights twice in some cases
15212* (bug 16408) Added rvgeneratexml to prop=revisions
15213* (bug 16421) Made list=logevents's leuser accept user names with underscores
15214  instead of spaces
15215* (bug 16516) Made rvsection=T-2 work
15216* (bug 16526) Added usprop=emailable to list=users
15217* (bug 16548) list=search threw errors with an invalid error code
15218* (bug 16515) Added pst and onlypst parameters to action=parse
15219* (bug 16541) Added block expiry timestamp to list=logevents output
15220* (bug 16613) action=protect doesn't tell when &cascade was set but cascading
15221  protection wasn't allowed
15222* (bug 16626) action=delete now correctly handles empty "reason" param
15223* (bug 15579) clshow considers all categories !hidden
15224* (bug 16647) list=allcategories, prop=categories don't return "hidden"
15225  property for hidden categories
15226* New siprop parameter of 'extensions' to list all installed extensions
15227* (bug 16672) Include canonical namespace name in
15228  meta=siteinfo&siprop=namespaces.
15229* (bug 16726) siprop=namespacealiases should also list localized aliases
15230* (bug 16730) Added apprfiltercascade parameter to list=allpages to filter
15231  cascade-protected pages
15232
15233=== Languages updated in 1.14 ===
15234
15235MediaWiki supports over 300 languages. Many localisations are updated
15236regularly. Below only new and removed languages are listed.
15237
15238* Bakhtiari (bqi) (new)
15239* Fiji Hindi (Devanagari script) (hif-deva) (new)
15240* Krio (kri) (new)
15241* Lezghian (lez) (new)
15242* Laz (lzz) (new)
15243* Eastern Mari (mhr) (new)
15244* Niuean (niu) (new)
15245* Oromo (om) (new)
15246* Plautdietsch (pdt) (new)
15247* Western Punjabi (pnb) (new)
15248* Tarantino (roa-tara) (new)
15249* Serbo-Croatian (sh) (new)
15250* Tulu (tcy) (new)
15251
15252
15253== MediaWiki 1.13 ==
15254
15255== MediaWiki 1.13.5 ==
15256
15257February 22, 2009
15258
15259This is a maintenance update to the Summer 2008 snapshot release of MediaWiki.
15260
15261MediaWiki is now using a "continuous integration" development model with
15262quarterly snapshot releases. The latest development code is always kept
15263"ready to run", and in fact runs our own sites on Wikipedia.
15264
15265Release branches will continue to receive security updates for about a year
15266from first release, but nonessential bugfixes and feature developments
15267will be made on the development trunk and appear in the next quarterly release.
15268
15269Those wishing to use the latest code instead of a branch release can obtain
15270it from source control: http://www.mediawiki.org/wiki/Download_from_SVN
15271
15272== Changes since 1.13.4 ==
15273
15274* (bug 17449) Fixed PostgreSQL installation
15275* (bug 17527) Fixed missing MySQL-specific options in installer
15276
15277== Changes since 1.13.3 ==
15278
15279A number of cross-site scripting (XSS) security vulnerabilities were discovered
15280in the web-based installer (config/index.php). These vulnerabilities all
15281require a live installer -- once the installer has been used to install a wiki,
15282it is deactivated.
15283
15284Note that cross-site scripting vulnerabilities can be used to attack any website
15285in the same cookie domain. So if you have an uninstalled copy of MediaWiki on
15286the same site as an active web service, MediaWiki could be used to attack the
15287active service.
15288
15289If you are hosting an old copy of MediaWiki that you have never installed, you
15290are advised to remove it from the web.
15291
15292== Changes since 1.13.2 ==
15293
15294David Remahl of Apple's Product Security team has identified a number of
15295security issues in previous releases of MediaWiki. Subsequent analysis by the
15296MediaWiki development team expanded the scope of these vulnerabilities. The
15297issues with a significant impact are as follows:
15298
15299* An XSS vulnerability affecting all MediaWiki installations between 1.13.0 and
15300  1.13.2. [CVE-2008-5249]
15301* A local script injection vulnerability affecting Internet Explorer clients for
15302  all MediaWiki installations with uploads enabled. [CVE-2008-5250]
15303* A local script injection vulnerability affecting clients with SVG scripting
15304  capability (such as Firefox 1.5+), for all MediaWiki installations with SVG
15305  uploads enabled. [CVE-2008-5250]
15306* A CSRF vulnerability affecting the Special:Import feature, for all MediaWiki
15307  installations since the feature was introduced in 1.3.0. [CVE-2008-5252]
15308
15309XSS (cross-site scripting) vulnerabilities allow an attacker to steal an
15310authorised user's login session, and to act as that user on the wiki. The
15311authorised user must visit a web page controlled by the attacker in order to
15312activate the attack. Intranet wikis are vulnerable if the attacker can
15313determine the intranet URL.
15314
15315Local script injection vulnerabilities are like XSS vulnerabilities, except
15316that the attacker must have an account on the local wiki, and there is no
15317external site involved. The attacker uploads a script to the wiki, which another
15318user is tricked into executing, with the effect that the attacker is able to act
15319as the privileged user.
15320
15321CSRF vulnerabilities allow an attacker to act as an authorised user on the wiki,
15322but unlike an XSS vulnerability, the attacker can only act as the user in a
15323specific and restricted way. The present CSRF vulnerability allows pages to be
15324edited, with forged revision histories. Like an XSS vulnerability, the
15325authorised user must visit the malicious web page to activate the attack.
15326
15327These four vulnerabilities are all fixed in this release.
15328
15329David Remahl also reminded us of some security-related configuration issues:
15330
15331* By default, MediaWiki stores a backup of deleted images in the images/deleted
15332  directory. If you do not want these images to be publically accessible, make
15333  sure this directory is not accessible from the web. MediaWiki takes some steps
15334  to avoid leaking these images, but these measures are not perfect.
15335* Set display_errors=off in your php.ini to avoid path disclosure via PHP fatal
15336  errors. This is the default on most shared web hosts.
15337* Enabling MediaWiki's debugging features, such as $wgShowExceptionDetails, may
15338  lead to path disclosure.
15339
15340Other changes in this release:
15341
15342* Avoid fatal error in profileinfo.php when not configured.
15343* Add a .htaccess to deleted images directory for additional protection against
15344  exposure of deleted files with known SHA-1 hashes on default installations.
15345* Avoid streaming uploaded files to the user via index.php. This allows
15346  security-conscious users to serve uploaded files via a different domain, and
15347  thus client-side scripts executed from that domain cannot access the login
15348  cookies. Affects Special:Undelete, img_auth.php and thumb.php.
15349* When streaming files via index.php, use the MIME type detected from the
15350  file extension, not from the data. This reduces the XSS attack surface.
15351* Blacklist redirects via Special:Filepath. Such redirects exacerbate any
15352  XSS vulnerabilities involving uploads of files containing scripts.
15353* Internationalisation updates.
15354
15355== Changes since 1.13.1 ==
15356
15357* Security: Work around misconfiguration by requiring strict comparisons for
15358  in_array in User::isAllowed().
15359* (bug 14944) Added $wgShellLocale for configuration of an appropriate locale
15360  to use for LC_CTYPE during shell invocation. For servers that don't have
15361  en_US.utf8. Also added locale detection during install.
15362* Localisation updates
15363* Security: Fixed XSS vulnerability in useskin parameter.
15364
15365== Changes since 1.13.0 ==
15366
15367* (bug 15460) Fixed intermittent deadlock errors and poor concurrent
15368  performance for installations without memcached.
15369* (bug 13770) Fixed DOM module detection for installations with both dom
15370  and domxml.
15371* (bug 15148) Fixed Special:BlockIP for PostgreSQL
15372* Fixed SQLite support for non-memcached installations
15373* Localisation updates, Achinese (ace) added.
15374
15375== Changes since 1.13.0rc2 ==
15376
15377* (bug 13770) Fixed incorrect detection of PHP's DOM module
15378* Fix regression from r37834: accesskey tooltip hint should be given for the
15379  minor edit and watch labels on the edit page.
15380* Updated Chinese simplified/traditional conversion tables
15381
15382== Changes since 1.13.0rc1 ==
15383
15384* $wgForwardSearchUrl has been removed entirely. Documented setting since 1.4
15385  has been $wgSearchForwardUrl.
15386* (bug 14907) DatabasePostgres::fieldType now defined.
15387* (bug 14966) Fix SearchEngineDummy class for silently non-functional search
15388  on Sqlite instead of horribly fatal error breaky one.
15389* (bug 14987) Only fix double redirects on page move when the checkbox is
15390  checked
15391* (bug 13376) Use $wgPasswordSender, not $wgEmergencyContact, as return
15392  address for page update notification mails.
15393* API: Registration time of users registered before the DB field was created is
15394  now shown as empty instead of the current time.
15395* (bug 14904): fragments were lost when redirects were fixed.
15396* Added magic word __STATICREDIRECT__ to suppress the redirect fixer
15397* (bug 15035) Revert English linkTrail to /^([a-z]+)(.*)$/sD, as it was before
15398  r36253. Multiple reports of breakage due to old (pre-5.0) PCRE libraries,
15399  both bundled with PHP and packaged with distros such as RHEL.
15400* (bug 14944) Shell invocation of external programs such as ImageMagick convert
15401  was broken in PHP 5.2.6, if the server had a non-UTF-8 locale.
15402
15403
15404=== Configuration changes in 1.13 ===
15405
15406* New option $wgFeed can be set false to turn off syndication feeds
15407* (bug 5745) Special:Whatlinkshere now shows up to $wgMaxRedirectLinksRetrieved
15408  links through each redirect instead of hardcoded 500
15409* Set $wgUploadSizeWarning to false by default
15410* Added $wgLBFactoryConf, for generic configuration of multi-master wiki farms
15411* Removed $wgAlternateMaster, use $wgLBFactoryConf
15412* (bug 13562) Misspelled option $wgUserNotifedOnAllChanges changed to
15413  $wgUserNotifiedOnAllChanges
15414* (bug 12860) New option $wgSitemapNamespaces allows sitemaps to be generated
15415  for only some namespaces
15416* Removed the emailconfirmed implicit group by default. To re-add it, use:
15417    $wgAutopromote['emailconfirmed'] = APCOND_EMAILCONFIRMED;
15418  in your LocalSettings.php.
15419* (bug 2396) New shared database configuration variables. $wgSharedPrefix allows
15420  you to use a shared database with a different prefix. Or you can now use a
15421  local database and use prefixes to separate wiki and the shared tables. And
15422  the new $wgSharedTables variable allows you to specify a list of tables to
15423  share.
15424* Automatic edit summaries can be disabled with $wgUseAutomaticEditSummaries
15425* Duplicates of images are now shown on the image page
15426* $wgRCFilterByAge allows for the list of dates in recent changes special pages
15427  to be filtered to only those within the range of $wgRCMaxAge
15428* $wgRCLinkLimits and $wgRCLinkDays allow for customization of the list and
15429  limits displayed on the recent changes special pages
15430* The "createpage" permission is no longer required when uploading if the target
15431  image page already exists
15432* $wgMaximumMovedPages restricts the number of pages that can be moved at once
15433  (default 100) with the new subpage-move functionality of Special:Movepage
15434* Hooks display in Special:Version is now disabled by default, use
15435  $wgSpecialVersionShowHooks = true; to enable it.
15436* $wgActiveUserEditCount sets the number of edits that must be performed over
15437  a certain number of days to be considered active
15438* $wgActiveUserDays is that number of days
15439* $wgRateLimitsExcludedGroups has been deprecated in favor of
15440  $wgGroupPermissions[]['noratelimit']. The former still works, however.
15441* New $wgGroupPermissions option 'move-subpages' added to control bulk-moving
15442  subpages along with pages.  Assigned to 'user' and 'sysop' by default.
15443* New $wgRC2UDPOmitBots allows user to omit bot edits from UDP output.
15444  Default: false
15445* Removed $wgEnableCascadingProtection option. Disabling cascading protection
15446  is no longer possible.
15447* $wgMessageCacheType defines now the type of cache used by the MessageCache
15448  class, previously it was choosen based on $wgParserCacheType
15449* $wgExtensionAliasesFiles option to simplify adding aliases to special pages
15450  provided by extensions, in a similar way to $wgExtensionMessagesFiles
15451* Added $wgXMLMimeTypes, an array of XML mimetypes we can check for
15452  with MimeMagic.
15453* Added $wgDirectoryMode, which allows for setting the default CHMOD value when
15454  creating new directories.
15455* (bug 14843) $wgCookiePrefix can be set by LocalSettings now, false defaults
15456  current behavior.
15457
15458=== New features in 1.13 ===
15459
15460* __HIDDENCAT__ on a category page causes the category to be hidden on the
15461  article page
15462* Do not show edit permissions errors on a red link click, just redirect to the
15463  article. This is so that readers who don't know what a red link is are not
15464  confused when they are told they are range-blocked.
15465* Add a new hook ImageBeforeProduceHTML to allow extensions to modify wikitext
15466  image syntax output
15467* (bug 13100) Added 'preloadtitle' parameter to action=edit&section=new that
15468  pre-fills the section title field
15469* (bug 13112) Added Special:RelatedChanges alias to Special:RecentChangesLinked
15470* (bug 13130) Moved edit token and autosummary fields above edit tools to
15471  reduce broken form submissions
15472* Add --old-redirects-only option to maintenance/refreshLinks.php, to add old
15473  redirects to the redirect table
15474* Add links to page and file deletion forms to edit predefined delete reasons
15475* (bug 13269) Added MediaWiki:Uploadfooter to the bottom of Special:Upload
15476* (bug 2815) Search results for media now use thumbnail instead of text extract
15477* When a page doesn't exist, the tab should say "create", not "edit"
15478* (bug 12882) Added a span with class "patrollink" around "Mark as patrolled"
15479  link on diffs
15480* Magic word formatnum can now take raw suffix to undo formatting
15481* Add updatelog table to reliably permit updates that don't change the schema
15482* Add category table to allow better tracking of category membership counts
15483** (bug 1212) Give correct membership counts on the pages of large categories
15484** Use category table for more efficient display of Special:Categories
15485* (bug 1459) Search for duplicate files by hash: Special:FileDuplicateSearch
15486* (bug 9447) Added hooks for search result headings
15487* Image redirects are now enabled by default
15488* (bug 13450) Email confirmation can now be canceled before the expiration
15489* (bug 13490) Show upload/file size limit on upload form
15490* Redesign of Special:UserRights
15491* Make rev_deleted log entries more intelligible
15492* (bug 6943) Added PAGESINCATEGORY: magic word
15493* (bug 13604) Added Special:ListGroupRights
15494* (bug 6332, 8617) Added message 'mainpage-description' as duplicate of
15495  'mainpage' and added it to message 'sidebar'
15496* Automatically add old redirects to the redirect table when needed
15497* (bug 6934) Allow inclusions, links, redirects to be separately toggled on or
15498  off on Special:WhatLinksHere
15499* Cache image redirects
15500* (bug 10457) Organize Special:SpecialPages into sections
15501* Add a new hook EditPageBeforeConflictDiff to allow extensions like FCKeditor
15502  to modify the output for edit conflicts
15503* Add class="nested" for <fieldset>s so fieldsets inside fieldsets get
15504  a slightly less huge margin and padding
15505* (bug 13527) Use sitemaps.org format 0.9 instead of a Google-specific format
15506* Allow \C and \Q as TeX commands to match \R, \N, \Z
15507* On Special:UserRights, when you can add a group you can't remove or remove
15508  one you can't add, a notice is printed to warn you
15509* (bug 12698) Create PAGESIZE parser function, to return the size of a page
15510* Allow the "log in / create account" link in the toolbar to have different
15511  text from Special:UserLogin title (new message 'nav-login-createaccount')
15512* Say "log in / create account" if an anonymous user can create an account,
15513  otherwise just "log in", consistently across skins
15514* Special:Shortpages and Special:Longpages now returns pages in all content
15515  namespaces, not just NS_MAIN.
15516* (bug 889) Improve conflict-handling between shared upload repository
15517  and local one
15518* Update documentation links in auto-generated LocalSettings.php
15519* (bug 13584) The new hook SkinTemplateToolboxEnd was added.
15520* (bug 709) Cannot rename/move images and other media files [EXPERIMENTAL]
15521* Custom rollback summaries now accept the same arguments as the default message
15522* (bug 12542) Added hooks for expansion of Special:Listusers
15523* Drop-down AJAX search suggestions (turn on $wgEnableMWSuggest)
15524* More relevant search snippets (turn on $wgAdvancedSearchHighlighting)
15525* (bug 13950) Allow users to watch the user/talk pages of users they block.
15526* (bug 13970) Allow MonoBook-based skins to specify their own print stylesheet
15527* Show image links on Special:Whatlinkshere
15528* Use rel="start", "prev", "next" appropriately on Pager-based pages
15529* Add support for SQLite
15530* AutoAuthenticate hook renamed to UserLoadFromSession
15531* (bug 13232) importScript(), importStylesheet() funcs available to custom JS
15532* (bug 13095) Search by first letters or digits in [[Special:Categories]]
15533* Users moving a page can now move all subpages automatically as well
15534* (bug 14259) Localisation message for upload button on Special:Import is now
15535  'import-upload' instead of 'upload'
15536* Add information about user group membership to Special:Preferences
15537* (bug 14146) Wrap usage section on imagepages into <div>s.
15538* New layout for Special:Specialpages. Restricted pages are marked but not
15539  separated from other pages in their group.
15540* (bug 14263) Show a diff of the revert on rollback notification page.
15541* (bug 13434) Show a warning when hash identical files exist
15542* Sidebar is now cached for all languages
15543* The User class now contains a public function called isActiveEditor. Figures
15544  out if a user is active based on at least $wgActiveUserEditCount number of
15545  edits in the last $wgActiveUserDays days.
15546* SpecialSearchResults hook now passes results by reference, so they can be
15547  changed by extensions.
15548* Add a new hook LinkerMakeExternalLink to allow extensions to modify the output
15549  of external links.
15550* (bug 14132) Allow user to disable bot edits from being output to UDP.
15551* (bug 14328) jsMsg() within Wikibits now accepts a DOM object, not just a
15552  string
15553* (bug 14558) New system message (emailuserfooter) is now added to the footer of
15554  e-mails sent with Special:Emailuser
15555* Add support for Hijri (Islamic) calendar
15556* Add a new hook LinkerMakeExternalImage to allow extensions to modify the
15557  output of external (hotlinked) images.
15558* (bug 14604) Introduced the following features for the LanguageConverter:
15559  Multi-tag support, single conversion flag, remove conversion flag on a single
15560  page, description flag, variant name, multi-variant fallbacks.
15561* Add zh-mo and zh-my variants for the zh language
15562* (bugs 4832, 9481, 12890) Special:Recentchangeslinked now has all options that
15563  are in Special:Recentchanges
15564* Allow an $error message to be passed to ArticleDelete hook
15565* Allow extensions to modify the user creation form by calling addInputItem();
15566* Add meta generator tag to HTML output
15567* MediawikiPerformAction hook is now passed the Mediawiki object
15568* Added blank special page Special:BlankPage for benchmarking, etc.
15569* Foreign repo file descriptions and thumbnails are now cached.
15570* (bug 11732) Allow localisation of edit button images
15571* Allow the search box, toolbox and languages box in the Monobook sidebar to be
15572  moved around arbitrarily using special sections in [[MediaWiki:Sidebar]]:
15573  SEARCH, TOOLBOX and LANGUAGES
15574* Add a new hook NormalizeMessageKey to allow extensions to replace messages
15575  before the database is potentially queried
15576* (bug 9736) Redirects on Special:Fewestrevisions are now marked as such.
15577* New date/time formats in Cs localization according to ČSN and PČP.
15578* Special:Recentchangeslinked now includes changes to transcluded pages and
15579  displayed images; also, the "Show changes to pages linked" checkbox now works
15580  on category pages too, showing all links that are not categorizations
15581* (bug 4578) Automatically fix redirects broken by a page move
15582
15583=== Bug fixes in 1.13 ===
15584
15585* (bug 10677) Add link to the file description page on the shared repository
15586* (bug 13084) Increase size of source/destination filename fields in upload form
15587* (bug 13115) rebuildrecentchanges should print the current value of $wgRCMaxAge
15588* (bug 13140) Show parent categories in category namespace
15589* (bug 13149) Correctly format 'fileexists' message on Upload page
15590* Make the default filepageexists message accurate
15591* (bug 12988) $wgMinimalPasswordLength no longer breaks create user by email
15592* (bug 13022) Fix upload from URL on PHP 5.0.x
15593* (bug 13132) Unable to unprotect pages protected with earlier versions of
15594  MediaWiki
15595* (bug 12723) OpenSearch description name now uses more compact language code
15596  to avoid passing the length limit as often, is customizable per site via
15597  'opensearch-desc' message.
15598* (bug 13135) Special:Userrights now passes IDs through form submission
15599  to allow functionality on not-quite-right usernames
15600* (bug 12575) Prevent duplicate patrol log entries from being created
15601* (bug 13174) __HIDDENCAT__ now applies only to category pages
15602* (bug 13031) Add links to user pages in e-mail form
15603* (bug 13147) Description for categoriespagetext (used in Special:Categories)
15604  reworded
15605* (bug 11561) Fix fatal error when calling action=revert to non-image page
15606* (bug 12430) Fix call to private method LinkFilter::makeRegex fatal error in
15607  maintenance/cleanupSpam.php
15608* All skins should have the "mediawiki" class on the body element
15609* (bug 13019) Message cache for some extensions not loaded at time of editing
15610* (bug 13247) Prettified ISBN links
15611* maintenance/refreshLinks.php did not fix page_id 1 with the --new-only option
15612* (bug 13110) Don't show "Permission error" page if the edit is already rolled
15613  back when using rollback
15614* (bug 13012) Use content messages for block options when generating the
15615  recentchanges entry
15616* (bug 13274) Change links for messages to ucfirst
15617* (bug 13273) Un-hardcode some punctuation (add new messages colon-separator,
15618  autocomment-prefix)
15619* Parse MediaWiki message translations with a correct language setting on
15620  preview
15621* (bug 13281) Treat X-Forwarded-For, Client-ip and User-Agent headers as
15622  case-insensitive names.
15623* Adding the fix for lists in RTL wikis to more skins, and fixing the image toc
15624* (bug 8157) Remove redirects from Special:Unusedtemplates. Patch by WebBoy.
15625* (bug 10721) Duplicate section anchors with differing case now disambiguated
15626  for Internet Explorer's sake and standards compliance
15627* (bug 13298) Tighter limits on Special:Newpages limits when embedding
15628* Email subject in content language instead of sending user's UI language
15629* (bug 13251) Allow maintenance rebuild scripts to work with Postgres
15630* (bug 2084) Fixed incorrect regex to match redirects
15631* (bug 3131) Manually-specified upload destination filename is no longer
15632  overwritten by browsing for a file after you wrote it.
15633* (bug 7251) Sidebars generated by MediaWiki:Sidebar now have the class
15634  'generated-sidebar'.
15635* (bug 13265) Media handler is missing 'image/x-bmp'
15636* (bug 13407) MediaWiki:Powersearch is used in two places
15637* (bug 13403) Fix cache invalidation of history pages when old revisions change
15638* (bug 11563) Deprecated SearchMySQL4 class; merged code to SearchMySQL
15639* (bug 12801) Fix link in subtitle message in AJAX search
15640* (bug 13428) Fix regression in protection form layout HTML validity
15641* (bug 9403) Sanitize newlines from search term input
15642* (bug 13429) Separate date and time in message sp-newimages-showfrom
15643* (bug 13137) Allow setting 'editprotected' right separately from 'protect',
15644  so groups may optionally edit protected pages without having 'protect' perms
15645* Disallow deletion of big pages by means of moving a page to its title and
15646  using the "delete and move" option.
15647* (bug 13466, 13632) White space differences not shown in diffs
15648* (bug 1953) Search form now honors namespace selections more reliably
15649* (bug 12294) Namespace class renamed to MWNamespace for PHP 5.3 compatibility
15650* PHP 5.3 compatibility fix for wfRunHooks() called with no parameters
15651* (bug 6447) Trackbacks now work with transactional tables, if enabled
15652* (bug 6892, 7147) Trackback error handling, optional fields more robust
15653* (bug 6813) Don't break HTML validator when using trackbacks
15654* Fix for size checks on SVG images with global 'stroke-width' attribute
15655* (bug 11874) Inline CSS with !important no longer borken
15656* (bug 1600) Strip extra == section markup == in new-comment field
15657* (bug 11325) Wrapped page titles in MonoBook skin spaced more nicely
15658* (bug 12077) Fix HTML nesting for TOC
15659* (bug 344) Purge cache for talk/article pages when deleting the other tab
15660* (bug 13436) Treat image captions correctly when they include option keywords
15661  (like ending with "px" or starting with "upright")
15662* Trackback display formatting fixed
15663* Don't die when single-element arrays are passed to SQL query constructors
15664  that have an array index other than 0
15665* (bug 13522) Fix fatal error in Parser::extractTagsAndParams
15666* (bug 13532) Use proper timestamp call when reverting images
15667* (bug 13543) Updated FAQ link in the installer sidebar
15668* (bug 13540) Date format in confirmation e-mail now matches message language
15669* (bug 13554) PHP Notice in old pre-processor when list item is empty.
15670* (bug 13556) Don't show a blank form if no image is attached in Special:Upload
15671* (bug 13576) maintenance/rebuildrecentchanges.php fails
15672* (bug 13441) Allow Special:Recentchanges to show bots only
15673* (bug 13431) Show true message source in Special:Allmessages&ot=php / xml
15674* (bug 13463) Login successful page doesn't use user's preferred interface
15675  language
15676* (bug 13630) Fixed warnings for pass by reference at call time in
15677  Special:Revisiondelete when generating the log entry.
15678* (bug 12064) BeforePageDisplay hook is now called for all skins
15679* (bug 13624) Fix regression with manual thumb= parameter on images
15680* (bug 11039) Add missing labels on protection form
15681* (bug 13458) Preview/edit toolbar spacing now works consistently
15682* (bug 13433) Fix action=render on Image: pages
15683* (bug 13678) Fix CSS validation for Monobook
15684* (bug 13684) Links in Special:ListGroupRights should be in content language
15685* (bug 13690) Fix PHP notice on accessing some URLs
15686* Hide (undo) link if user isn't able to edit page
15687* Invalidate cache of pages that includes images via redirects on upload
15688* (bug 13705) Don't show rollback link in page history on incorrect revisions
15689* (bug 13708) Don't set "Search results" title when loading Special:Search
15690  without query
15691* (bug 13736) Don't show MediaWiki:Anontalkpagetext on non-existent IP addresses
15692* (bug 13728) Don't trim initial whitespace during section edits
15693* (bug 13727) Don't delete log entries from recentchanges on page deletion
15694* (bug 13752) Redirects to sections now work again
15695* (bug 13725) Upload form watch checkbox state set correctly with wpDestFile
15696* (bug 13756) Don't show the form and navigation links of Special:Newpages if
15697  the page is included
15698* When hiding things on WhatLinksHere, generated URLs should hide them too
15699* Properly escape search terms with regex chars so they appear highlighted in
15700  search results
15701* (bug 13768) pt_title field encoding fixed
15702* Do not display empty columns on Special:UserRights if all groups are
15703  changeable or all unchangeable
15704* Fix fatal error on calling PAGESINCATEGORY with invalid category name
15705* (bug 13793) Special:Whatlinkshere filters wrong - after paginating instead of
15706  before
15707* (bug 13796) Show links to parent pages even if some of them are missing
15708* (bug 13816) Filter by main namespace doesn't work on WhatLinksHere
15709* (bug 13822) Fatal error on some pages when calculating subpage subtitle
15710* (bug 13824) AJAX search suggestion now works with non-SkinTemplate skins
15711* Added 'application/x-dia-diagram' MediaWiki's known MIME types
15712* (bug 13866) skins/common/shared.css - invalid attribute fixing
15713* Hide edit section links on Special:Undelete
15714* (bug 13860) Fix "Justify paragraphs" option for Modern skin
15715* (bug 13168) accessibility links in Modern skin link to wrong anchor id
15716* (bug 13185) No line break after 'subpages' class in Modern skin
15717* (bug 13583) No "poweredby" in Modern skin
15718* (bug 13880) "Printable" link in Modern skin now formats as print mode
15719* (bug 13885) Bump default $wgSVGMaxSize from 1024 to 2048 pixels
15720* (bug 13891) Show categories box even if all categories are hidden and user has
15721  "show hidden categories" option on
15722* (bug 13915) Undefined variable $wltsfield in includes/SpecialWatchlist.php
15723* (bug 13913) Special:Whatlinkshere now has correct HTML markup
15724* (bug 13905) Blacklist Mac IE from HttpOnly cookies; it eats them sometimes
15725* (bug 13922) Fix bad HTML on empty Special:Prefixindex and Special:Allpages
15726* (bug 13924) Fix bad HTML on power search form
15727* (bug 13820) Fix updater for rev_parent_id population
15728* (bug 13925) Fix bad HTML on search results list
15729* (bug 13934) Fixing the link to GNU General Public License Version 2
15730* Show correct accesskey prefix for Firefox 3 beta (Alt-Shift-, not Alt-)
15731* (bug 13949) Special:PrefixIndex/AllPages paging links contain invalid XML
15732* (bug 13770) Use Preprocessor_Hash by default to avoid missing DOM module
15733  errors
15734* (bug 13982) Disable ccmeonemails preference when user-to-user mails disabled
15735* (bug 13615) Update case mappings and normalization to Unicode 5.1.0
15736  Note that case mappings will only be used if mbstring extension is not
15737  present.
15738* (bug 14044) Don't increment page view counters on views from bot users
15739* (bug 14042) Calling Database::limitResult() misplaced the comment in the log
15740  file
15741* (bug 14047) Fix regression in installer which hid DB-specific options
15742  Also makes SQLite path configurable in the installer.
15743* (bug 13546) Follow image redirects on image page
15744* (bug 12644) Template list on edit page now sorted on preview
15745* (bug 14058) Support pipe trick for namespaces and interwikis with "-"
15746* Message name filter on Special:Allmessages now case-insensitive
15747* (bug 13943) Fix image redirect behavior on image pages
15748* (bug 14093) Do 'sysop' => 'protect' magic in Title::isValidMoveOperation
15749* (bug 14063) Power search form missing <label> for redirects check
15750* (bug 14111) Similar filename warning links now lead to correct page
15751* (bug 14082) Fix for complex text input vs AJAX suggestions on some browsers
15752* (bug 13693) Categories sometimes claim to have a negative number of members
15753* (bug 1701) Korean Hangul syllables now broken down properly in Category lists
15754  even if the wiki's overall content language is not Korean
15755* (bug 12773) addOnloadHook() now calls functions immediately when scripts are
15756  loaded after the primary page completion, instead of dropping them
15757* (bug 14199) Fix deletion form for image redirect pages
15758* (bug 14220) Disabling $wgCheckFileExtensions now works without also
15759  disabling $wgStrictFileExtensions
15760* (bug 14241) Pages can no longer be protected to levels you are not in
15761* (bug 14296) Fix local name of ang: (Anglo-Saxon)
15762* (bug 4871) Hardcoded superscript in time zone preferences moved to message
15763* (bug 6957) E-mail confirmation links now using English special page name
15764  for better compatibility and keeping the links shorter. Avoids problem
15765  with corrupt links in Gmail on IE 6.
15766* (bug 14273) Fix for HTTP Accept header parsing with spaces as from Konqueror
15767* (bug 14312) Update LanguageKaa.php for handling transform issues with i to İ
15768  and I to ı
15769* (bug 13826) MediaWiki:Defaultns accepts Wikicode
15770* (bug 14324) Creating an account is again possible with $wgEmailConfirmToEdit
15771  set to true
15772* (bug 13034) Interwiki pages can now be reached using Go search button
15773* (bug 14362) Change interwiki names of Erzya and Moksha Wikipedias
15774* (bug 14370) When a grouppage-x message does not exist the entry on the
15775  ListGroupRights special page now links to the project namespace page for it,
15776  not the main namespace page.
15777* (bug 11659) Urldecode image names in galleries
15778* (bug 14258, 14368) Fix for subpage renames in replication environments
15779* (bug 14367) Failed block no longer adds phantom watchlist entry
15780* (bug 14385) "Move subpages" option no longer tries to move to invalid titles
15781* (bug 14386) Fix subpage namespace oddity when moving a talk page
15782* (bug 11771) Signup form now not shown if in read-only mode.
15783* (bug 12859) $wgRateLimitsExcludedGroups has been deprecated in favor of
15784  $wgGroupPermissions[]['noratelimit'].
15785* (Bug 13828) Split parameter $1 of MediaWiki:Missingarticle into $1 (=title)
15786  and $2 (=revision numbers)
15787* (bug 14401) Fix Safari access key tooltips for Windows and >3.1 Mac versions
15788* (bug 14432) Fix notice regression in Special:Newpages feed mode
15789* (bug 11951) EditPage::getEditToolbar() is now static.
15790* (bug 14392) Fix regression breaking table prefix in installer
15791* (bug 11084) $wgDBprefix replacement for updater SQL will now work for
15792  extension tables using uppercase letters or digits in their names.
15793* (bug 12311) Fix regression with lists at start of undeletion preview
15794* (bug 14496) Fix regression with parseinline on Special:Upload.
15795* We no longer just give up on a missing upload base directory; it's now
15796  created automatically if we have sufficient permissions!
15797* (bug 14479) MediaWiki:upload-maxfilesize should have a div id wrapper
15798* (bug 14497) Throw visible errors in installer scripts when SQL files
15799  fail due to database permission or other error
15800* (bug 14500) Site feed (Recentchanges) no longer shows up on the actual
15801  recent changes page.
15802* (bug 14511) MediaWiki:Delete-legend is no longer double escaped
15803* Generate correct section anchors for numeric headers
15804* (bug 14520) Don't load nonexistent CSS files for Chick/Myskin/Simple skins
15805* (bug 14551) Cancel upload no longer automatically suppresses warnings
15806* (bug 13878) Deprecate Article::getDB() in favor of direct wfGetDB() calls
15807* (bug 4977) Fix for possible squid purging errors when using HTTP purges
15808  and multiple servers
15809* (bug 14572) Redirects listed on file links on image pages no longer redirect.
15810* (bug 14537) Change interwiki name for Old Church Slavonic (cu)
15811* (bug 14583) Fix regression in recent changes "limit to certain categories."
15812* (bug 14515) HTML nesting cleanup on edit form
15813* (bug 14647) Removed unused 'townBox' CSS classes
15814* (bug 14687) OutputPage::addStyle() now adds type="text/css" like it should.
15815* OpenSearch cleanup; Firefox now sends you to the search page for empty
15816  searches instead of the domain root (which may not even be a wiki).
15817* (bug 3481) Pages moved shortly after creation are shown at their new title
15818  on Special:Newpages.
15819* (bug 12716) Trying to unprotect a title that isn't protected no longer
15820  generates a log entry.
15821* (bug 14088) Excessively long block expiry times are rejected as invalid,
15822  keeps the log page from being distorted.
15823* (bug 14708) Emulate INSERT...IGNORE with standard SQL for Postgres backend.
15824* (bug 14646) Fix some double-escaping of HTML in feed output
15825* (bug 14709) Fix login success message formatting when using cookie check
15826* (bug 14710) Remove "donate" link from default sidebar
15827* (bug 14745) Image moving works on sites that transform thumbnails via 404
15828* (bug 2186) Document.write() in wikibits caused failures when using
15829  application/xhtml+xml. The calls to this have been removed.
15830* (bug 14764) Fix regression in from Article::lastModified(), failed to work
15831  on non-mySQL schemas.
15832* (bug 14763) Child classes of Database (DatabasePostgres and DatabaseOracle)
15833  had strict standards issues with setFakeSlaveLag() and setFakeMaster().
15834* (bug 451) Improve the phrase mappings of the Chinese converter arrays.
15835* (bug 12487) Rights log is not fully internationalized
15836* (bug 10837) Language variants no longer override other languages than base
15837* (bug 14778) 'limit' parameter now applies to history feeds as well as
15838  history pages
15839* (bug 14845) Bug in prefs javascript: Calling an array item without checking
15840  its existance.
15841* Accesskeys for minor edit/watch checkboxes on edit now work in Firefox 3
15842* (bug 12384) Comments in maintenance/*php
15843* (bug 12441) ./maintenance/generateSitemap.php fix -fspath requiring
15844  a trailing slash.
15845* (bug 12568) configuration script now produce valid XHTML.
15846* The accesskey to edit a page is now disabled when editing the page, to pre-
15847  vent conflicts with Safari shortcuts.
15848
15849=== API changes in 1.13 ===
15850
15851* Fixing main page display in meta=siteinfo
15852* (bug 13128) Added patrolled flag to list=recentchanges
15853* Implemented {bl,ei,iu}redirect (lists links through redirects as well)
15854* (bug 13154) Introduced subpages flag to meta=siteinfo&siprop=namespaces
15855* (bug 13157) Added ucuserprefix parameter to list=usercontribs
15856* (bug 12394) Added rctitles parameter to list=recentchanges, making rcid
15857  retrieval easier
15858* (bug 13218) Fix inclusion of " character in hyperlinks
15859* Added watch and unwatch parameters to action=delete and action=move
15860* Added action=edit
15861* (bug 11401) Added xmldoublequote to xml formatter
15862* Added rvsection parameter to prop=revisions to allow fetching the content of
15863  a certain section only
15864* Introduced list=allimages
15865* (bug 13371) Build page set from image hashes
15866* Mark non-existent messages in meta=allmessages as missing
15867* (bug 13390) One invalid title no longer kills an entire API query
15868* (bug 13419) Fix gblredirect so it actually works
15869* (bug 13418) Disable eiredirect because it's useless
15870* (bug 13395) list=allcategories should use category table
15871* (bug 13442) Missing pages in prop=langlinks and prop=extlinks are now
15872  handled properly.
15873* (bug 13444) Add description to list=watchlist
15874* (bug 13482) Disabled search types handled properly
15875* Added inprop=talkid,subjectid to prop=info
15876* Added help text message that specifies whether a module is POST-only
15877* Added createonly parameter to action=edit
15878* Replaced $wgAPIUCUserPrefixMinLength by the more generic $wgAPIMaxDBRows
15879* (bug 11719) Remove trailing blanks in YAML output.
15880* (bug 13541) Added siprop=specialpagealiases to meta=siteinfo
15881* Added fallback8bitEncoding and readonly fields to
15882  meta=siteinfo&siprop=general output
15883* (bug 13544) Added prop=revid to action=parse
15884* (bug 13603) Added siprop=usergroups to meta=siteinfo
15885* Cleaned up redirect resolution
15886* Added possibility to obtain all external links through list=exturlusage
15887* (bug 13606) Added archivename to iiprop
15888* (bug 11633) Explicitly convert redirect titles to strings due to PHP's
15889  very weak typing on array keys.
15890* (bug 12136) Extend allowed characters in JSON callback to ][.'"_A-Za-z0-9
15891* (bug 11673) Return error 'unknown_action' in specified format
15892* (bug 13618) Added rcprop=redirect and rcshow=redirect to list=recentchanges
15893* (bug 13544) Added oldid parameter to action=parse to allow for parsing of old
15894  revisions
15895* (bug 13718) Return the proper continue parameter for cmsort=timestamp
15896* action=login now returns the correct waiting time in the details property
15897* (bug 13792) Broken titles are now silently skipped in search results.
15898* (bug 13819) exturlusage paging skipped an item
15899* Fixed handling of usernames containing spaces in list=block
15900* (bug 13836) Fixed fatal errors resulting from combining iiprop=metadata with
15901  format=xml
15902* (bug 13735) Added prop=categoryinfo module
15903* (bug 13945) Retrieve cascading protection sources via inprop=protection
15904* (bug 13965) Hardcoded 51 limit on titles is too limiting
15905* (bug 13993) apfrom doesn't work with apdir=descending
15906* (bug 14018) Introduced alcontinue to list=alllinks to improve paging
15907* (bug 14013) Added rcshow=patrolled to list=recentchanges
15908* (bug 14028) Added language attribute to interwiki map in meta=siteinfo
15909* (bug 14022) Added usprop=registration and auprop=blockinfo
15910* (bug 14021) Removed titles= support from list=backlinks (has been obsolete
15911  for ages)
15912* (bug 13829) Expose parse tree via action=expandtemplates
15913* (bug 13606) Allow deletion of images
15914* Added iiprop=mime and aiprop=metadata
15915* Handled unrecognized values for parameters more gracefully
15916* Handled requesting disallowed tokens more gracefully
15917* (bug 14140) URL-encoded page titles are now decoded in edit summaries
15918* (bug 14243) Only accept post requests in action=edit; patch by HardDisk
15919* action=block now returns an ISO8601 timestamp, like all other modules do
15920* Added md5 parameter to action=edit
15921* (bug 14335) Logging in to unified account using API not possible
15922* Added action=emailuser to send an email to a user
15923* (bug 14471) Use HTMLTidy and generate limit report in action=parse
15924* (bug 14459) Added prependtext and appendtext parameters to action=edit
15925* (bug 14526) Unescaped SQL in list=backlinks
15926* Added 'hidden' flag to list=allcategories and prop=categoryinfo output
15927* Added nocreate parameter to action=edit
15928* (bug 14402) Added maxage and smaxage parameters to api.php
15929* Added bkip parameter to list=blocks
15930* (bug 14651) apprefix and similar parameters are now canonicalized
15931* Added clprop=timestamp to prop=categories
15932* (bug 14678) API errors now respects $wgShowExceptionDetails and
15933  $wgShowSQLErrors
15934* (bug 14723) Added time zone and writing direction to meta=siteinfo
15935* Added APIQueryInfoTokens and APIQueryRevisionsTokens hooks so extensions
15936  can add their own tokens
15937* Added block and unblock tokens to prop=info as well
15938* Added paging (limit and continue parameters) to
15939  prop={links,templatelinks,langlinks,extlinks,categories,images}
15940* Added flag "top" to list=usercontribs if the user is the last contributor to
15941  the page
15942* list=exturlusage in "list all links" mode can now filter by protocol
15943
15944== MediaWiki 1.12 ==
15945
15946== MediaWiki 1.12.4 ==
15947
15948February 7, 2009
15949
15950A number of cross-site scripting (XSS) security vulnerabilities were discovered
15951in the web-based installer (config/index.php). These vulnerabilities all
15952require a live installer -- once the installer has been used to install a wiki,
15953it is deactivated.
15954
15955Note that cross-site scripting vulnerabilities can be used to attack any
15956website in the same cookie domain. So if you have an uninstalled copy of
15957MediaWiki on the same site as an active web service, MediaWiki could be used to
15958attack the active service.
15959
15960If you are hosting an old copy of MediaWiki that you have never installed, you
15961are advised to remove it from the web.
15962
15963== MediaWiki 1.12.3 ==
15964
15965* Fixed packaging/distribution error. Many files were missing from the
15966distributed tarball.
15967
15968== MediaWiki 1.12.2 ==
15969
15970David Remahl of Apple's Product Security team has identified a number of
15971security issues in previous releases of MediaWiki. Subsequent analysis by the
15972MediaWiki development team expanded the scope of these vulnerabilities. The
15973issues with a significant impact are as follows:
15974
15975* A local script injection vulnerability affecting Internet Explorer clients
15976for all MediaWiki installations with uploads enabled. [CVE-2008-5250]
15977* A local script injection vulnerability affecting clients with SVG scripting
15978capability (such as Firefox 1.5+), for all MediaWiki installations with SVG
15979uploads enabled. [CVE-2008-5250]
15980* A CSRF vulnerability affecting the Special:Import feature, for all MediaWiki
15981installations since the feature was introduced in 1.3.0. [CVE-2008-5252]
15982
15983A local script injection vulnerability allows an attacker with a wiki account
15984to steal another user's login session, and to act as that user on the wiki. The
15985attacker uploads a malicious script file, and tricks the victim into executing
15986it.
15987
15988CSRF vulnerabilities allow an attacker to act as an authorised user on the
15989wiki, but unlike an XSS vulnerability, the attacker can only act as the user in
15990a specific and restricted way. The present CSRF vulnerability allows pages to
15991be edited, with forged revision histories. Like an XSS vulnerability, the
15992authorised user must visit the malicious web page to activate the attack.
15993
15994These three vulnerabilities are all fixed in this release.
15995
15996David Remahl also reminded us of some security-related configuration issues:
15997
15998* By default, MediaWiki stores a backup of deleted images in the images/deleted
15999directory. If you do not want these images to be publically accessible, make
16000sure this directory is not accessible from the web. MediaWiki takes some steps
16001to avoid leaking these images, but these measures are not perfect.
16002* Set display_errors=off in your php.ini to avoid path disclosure via PHP fatal
16003errors. This is the default on most shared web hosts.
16004* Enabling MediaWiki's debugging features, such as $wgShowExceptionDetails, may
16005lead to path disclosure.
16006
16007Other changes in this release:
16008
16009* Avoid fatal error in profileinfo.php when not configured.
16010* Add a .htaccess to deleted images directory for additional protection against
16011exposure of deleted files with known SHA-1 hashes on default installations.
16012* Avoid streaming uploaded files to the user via index.php. This allows
16013security-conscious users to serve uploaded files via a different domain, and
16014thus client-side scripts executed from that domain cannot access the login
16015cookies. Affects Special:Undelete, img_auth.php and thumb.php.
16016* When streaming files via index.php, use the MIME type detected from the file
16017extension, not from the data. This reduces the XSS attack surface.
16018* Blacklist redirects via Special:Filepath. Such redirects exacerbate any XSS
16019vulnerabilities involving uploads of files containing scripts.
16020* Internationalisation updates.
16021
16022== MediaWiki 1.12.1 ==
16023
16024Changes since 1.12.0:
16025* (bug [[bugzilla:13522|13522]]) Fix fatal error in Parser::extractTagsAndParams
16026* (bug [[bugzilla:12077|12077]]) Fix HTML nesting for TOC
16027* (bug [[bugzilla:13532|13532]]) Use proper timestamp call when reverting images
16028* (bug [[bugzilla:13649|13649]], [[bugzilla:14084|14084]]) Bad call to
16029wfTimestamp()
16030* (bug [[bugzilla:13770|13770]]) Use Preprocessor_Hash by default to avoid
16031missing DOM module errors
16032* (bug [[bugzilla:13442|13442]]) API: Missing pages in prop=langlinks and
16033prop=extlinks are now handled properly.
16034* (bug [[bugzilla:13482|13482]]) API: Disabled search types handled properly
16035* (bug [[bugzilla:13836|13836]]) API: Fixed fatal errors resulting from
16036combining iiprop=metadata  with format=xml
16037* (bug [[bugzilla:11633|11633]]) API: Explicitly convert redirect titles to
16038strings due to PHP's very weak typing on array keys.
16039* API: Fixing main page display in meta=siteinfo
16040* (bug [[bugzilla:11719|11719]]) API: Remove trailing blanks in YAML output.
16041* (bug [[bugzilla:13718|13718]]) API: Return the proper continue parameter for
16042cmsort=timestamp
16043* Security: Work around misconfiguration by requiring strict comparisons for
16044in_array in User::isAllowed().
16045* Security: Fixed XSS vulnerability in useskin parameter.
16046
16047== MediaWiki 1.12.0 ==
16048
16049This is the quarterly branch release of [[MediaWiki]] for Winter 2008.
16050
16051MediaWiki is now using a "continuous integration" development model with
16052quarterly snapshot releases. The latest development code is always kept "ready
16053to run", and in fact runs our own sites on [[wikipedia:|Wikipedia]].
16054
16055Release branches will continue to receive security updates for about a year
16056from first release, but nonessential bugfixes and feature developments will be
16057made on the development trunk and appear in the next quarterly release.
16058
16059Those wishing to use the latest code instead of a branch release can obtain it
16060from source control: [[Download from SVN]].
16061
16062Changes since 1.12.0rc1:
16063*(bug [[bugzilla:13359|13359]]) Double-escaping in [[Special:Allpages]].
16064*Localization updates.
16065
16066== MediaWiki 1.12.0rc1 ==
16067
16068This is a release candidate of the Winter 2008 quarterly snapshot release of
16069[[MediaWiki]].
16070
16071MediaWiki is now using a "continuous integration" development model with
16072quarterly snapshot releases. The latest development code is always kept "ready
16073to run", and in fact runs our own sites on [[wikipedia:|Wikipedia]].
16074
16075Release branches will continue to receive security updates for about a year
16076from first release, but nonessential bugfixes and feature developments will be
16077made on the development trunk and appear in the next quarterly release.
16078
16079Those wishing to use the latest code instead of a branch release can obtain it
16080from source control: [[Download from SVN]].
16081
16082This is the Winter 2007 quarterly release.
16083
16084MediaWiki is now using a "continuous integration" development model with
16085quarterly snapshot releases. The latest development code is always kept
16086"ready to run", and in fact runs our own sites on Wikipedia.
16087
16088Release branches will continue to receive security updates for about a year
16089from first release, but nonessential bugfixes and feature developments
16090will be made on the development trunk and appear in the next quarterly release.
16091
16092Those wishing to use the latest code instead of a branch release can obtain
16093it from source control: https://www.mediawiki.org/wiki/Download_from_SVN
16094
16095=== Configuration changes in 1.12 ===
16096* Marking edits as bot edits with Special:Contributions?bot=1 now requires the
16097  markbotedit permission, rather than the rollback permission previously used.
16098  This permission is assigned by default to the sysop group.
16099* MediaWiki now checks if serialized files are out of date. New configuration
16100  variable $wgCheckSerialized can be set to false to enable old behavior (i.e.
16101  to not check and assume they are always up to date)
16102* The rollback permission can now be rate-limited using the normal mechanism.
16103* New configuration variable $wgExtraLanguageNames
16104* Behavior of $wgAddGroups and $wgRemoveGroups changed. New behavior:
16105* * Granting the userrights privilege allows arbitrary changing of rights.
16106* * Without the userrights privilege, a user will be able to add and/or
16107     remove the groups specified in $wgAddGroups and $wgRemoveGroups for
16108     any groups they are in.
16109* New permission userrights-interwiki for changing user rights on foreign wikis.
16110* $wgImplicitGroups for groups that are hidden from Special:Listusers, etc.
16111* $wgAutopromote: automatically promote users who match specified criteria
16112* $wgGroupsAddToSelf, $wgGroupsRemoveFromSelf: allow users to add or remove
16113  themselves from specified groups via Special:Userrights.
16114* When $wgUseTidy has been enabled, PHP's Tidy module is now used if it is
16115  present, in preference to an external Tidy executable which may or may not
16116  be present. To force use of external Tidy even when the PHP module is
16117  available, set $wgTidyInternal to false.
16118
16119
16120=== New features in 1.12 ===
16121* (bug 10735) Add a warning for non-descriptive filenames at Special:Upload
16122* Add {{filepath:}} parser function to get full path to an uploaded file,
16123  complementing {{fullurl:}} for pages.
16124* (bug 11136) If using Postgres, search path is explicitly set if wgDBmwschema
16125  is not set to 'mediawiki', allowing multiple mediawiki instances per user.
16126* (bug 11151) Add descriptive <title> to revision history page
16127* (bug 5412) Add feed links for the site to all pages
16128* (bug 11353) Add ability to retrieve raw section content via action=raw
16129* (bug 6909) Show relevant deletion log lines when uploading a previously
16130  deleted file
16131* On SkinTemplate based skins (like MonoBook), omit confusing "edit"/"view
16132  source" tab entirely if the page doesn't exist and the user isn't allowed to
16133  create it
16134* Clarify instructions given when an exception is thrown
16135* AuthPlugin added strictUserAuth() method to allow per-user override
16136  of the strict() authentication behavior.
16137* (bug 7872) Deleted revisions can now be viewed as diffs showing changes
16138  against the previous revision, whether currently deleted or live.
16139* Added tooltips for the "Go" and "Search" buttons
16140* (bug 11649) Show input form when Special:Whatlinkshere has no parameters
16141* isValidEmailAddr hook added to User method of that name, to allow, e.g., re-
16142  stricting e-mail addresses to a specific domain
16143* Removed "Clear" link in watchlist editor tools, as people were afraid to
16144  click it. Existing clear links will fall back to the raw editor, which is
16145  very easy to clear your watchlist with.
16146* (bug 1405) Add wgUseNPPatrol option to control patroling for new articles
16147  on Special:Newpages
16148* LogLine hook added to allow formatting custom entries in Special:Log.
16149* Support for Iranian calendar
16150* (bug 1401) Allow hiding logged-in users, bots and patrolled pages on
16151  Special:Newpages
16152* ChangesListInsertArticleLink hook added for adding extra article info to RC.
16153* MediaWikiPerformAction hook added for diverting control after the main
16154  globals have been set up but before any actions have been taken.
16155* BeforeWatchlist hook added for filtering or replacing watchlist.
16156* SkinTemplateTabAction hook added for altering the properties of tab links.
16157* OutputPage::getRedirect public method added.
16158* (bug 11848, 12506) Allow URL parameters 'section', 'editintro' and 'preload'
16159  in Special:Mypage and Special:Mytalk
16160* Add ot=raw to Special:Allmessages
16161* Support for Hebrew calendar
16162* Support for Hebrew numerals in dates and times
16163* (bug 11315) Signatures can be configured in [[MediaWiki:Signature]] and
16164  [[MediaWiki:Signature-anon]]
16165* Signatures for anonymous users link to Special:Contributions page rather than
16166  user page
16167* Added --override switch for disabled pages in updateSpecialPages.php
16168* Provide a unique message (ipb_blocked_as_range) if unblock of a single IP
16169  fails
16170  because it is part of a blocked range.
16171* (bug 3973) Use a separate message for the email content when an account is
16172  created by another user
16173* dumpTextPass.php can spawn fetchText.php as a subprocess, which should restart
16174  cleanly if database connections fail unpleasantly.
16175* (bug 12028) Add Special:Listbots as shortcut for Special:Listusers/bot
16176* (bug 9633) Add a predefined list of delete reasons to the deletion form
16177* Show a warning message when creating/editing a user (talk) page but the user
16178  does not exists
16179* (bug 8396) Ignore out-of-date serialised message caches
16180* (bug 12195) Undeleting pages now requires 'undelete' permission
16181* (bug 11810) Localize displayed semicolons
16182* (bug 11657) Support for Thai solar calendar
16183* (bug 943) RSS feed for Recentchangeslinked
16184* Introduced AbortMove hook
16185* (bug 2919) Protection of nonexistent pages with regular protection interface.
16186* Special:Upload now lists permitted/prohibited file extensions.
16187* Split ambiguous filetype-badtype message into two new messages,
16188  filetype-unwanted-type and filetype-banned-type.
16189* Added link to the old title in Special:Movepage
16190* On Special:Movepage, errors are now more noticeable.
16191* It is now possible to change rights on other local wikis without the MakeSysop
16192  extension
16193* Add HTML ID's mw-read-only-warning and mw-anon-edit-warning to warnings when
16194  editing to allow CSS styling.
16195* Parser now returns list of sections
16196* When a user is prohibited from creating a page, a title of "View source"
16197  makes no sense, and there should be no "Return to [[Page]]" link.
16198* (bug 12486) Protected titles now give a warning for privileged editors.
16199* (bug 9939) Special:Search now sets focus to search input box when no existing
16200  search is active
16201* For Special:Userrights, use GET instead of POST to search for users.
16202* Allow subpage syntax for Special:Userrights, i.e., Special:Userrights/Name.
16203* When submitting changes on Special:Userrights, show the full form again, not
16204  just the search box.
16205* Added exception hooks
16206* (bug 12574) Allow bots to specify whether an edit should be marked as a bot
16207  edit, via the parameter 'bot'. (Default: '1')
16208* (bug 12536) User should be able to get MediaWiki version from any page
16209* (bug 12622) A JavaScript constant to declare whether api.php is available
16210* Add caching to the AJAX search
16211* Add APCOND_INGROUPS
16212* Add DBA caching to installer
16213* (bug 12585) Added a bunch of parameters to the revertpage message
16214* Support redirects in image namespace
16215* (bug 10049) Prefix index search and namespaces in Special:Withoutinterwiki
16216* (bug 12668) Support for custom iPhone bookmark icon via $wgAppleTouchIcon
16217* Add option to include templates in Special:Export.
16218* (bug 12655) Added $wgUserEmailUseReplyTo config option to put sender
16219  address in Reply-To instead of From for user-to-user emails.
16220  This protects against SPF problems and privacy-leaking bounce messages
16221  when using mailers that set the envelope sender to the From header value.
16222* (bug 11897) Add alias [[Special:CreateAccount]] & [[Special:Userlogin/signup]]
16223  for Special:Userlogin?type=signup
16224* (bug 12214) Add a predefined list of delete reasons to the file deletion form
16225* Merged backends for OpenSearch suggestions and AJAX search.
16226  Both now accept namespace prefixes, handle 'Media:' and 'Special:' pages,
16227  and reject interwiki prefixes. PrefixSearch class centralizes this code,
16228  and the backend part can be overridden by the PrefixSearchBackend hook.
16229* (bug 10365) Localization of Special:Version
16230* When installing using Postgres, the Pl/Pgsql language is now checked for
16231  and installed when at the superuser level.
16232* The default robot policy for the entire wiki is now configurable via the
16233  $wgDefaultRobotPolicy setting.
16234* (bug 12239) Use different separators for autocomments
16235* (bug 12857) Patrol link on new pages should clear floats
16236* (bug 12968) Render redirect wikilinks in a redirect class for customization
16237  via user/site CSS.
16238* EditPageBeforeEditButtons hook added for altering the edit buttons below the
16239  edit box
16240
16241=== Bug fixes in 1.12 ===
16242
16243* Subpages are now indexed for searching properly when using PostgreSQL
16244* (bug 3846) Suppress warnings from, e.g. open_basedir when scanning for
16245  ImageMagick, diff3 et al. during installation [patch by Jan Reininghaus]
16246* (bug 7027) Shift handling of deletion permissions-checking to
16247  getUserPermissionsErrors.
16248* Login and signup forms are now more correct for right-to-left languages.
16249* (bug 5387) Block log items on RecentChanges don't make use of possible
16250  translations
16251* (bug 11211) Pass, as a parameter to the protectedpagetext interface
16252  message, the level of protection.
16253* (bug 9611) Supply the blocker and reason for the cantcreateaccounttext
16254  message.
16255* (bug 8759) Fixed bug where rollback was allowed on protected pages for wikis
16256  where rollback is given to non-sysops.
16257* (bug 8834) Split off permission for editing user JavaScript and CSS from
16258  editinterface to a new permission key editusercssjs.
16259* (bug 11266) Set fallback language for Fulfulde (ff) to French
16260* (bug 11179) Include image version deletion comment in public log
16261* Fixed notice when accessing special page without read permission and whitelist
16262  is not defined
16263* (bug 9252) Fix for tidy funkiness when using editintro mode
16264* (bug 4021) Fix for MySQL wildcard search
16265* (bug 10699) Fix for MySQL phrase search
16266* (bug 11321) Fix width of gallerybox when option "width=xxx" is used
16267* (bug 7890) Special:BrokenRedirects links deleted redirects to a non-existent
16268  page
16269* Fix initial statistics when installing: add correct values
16270* (bug 11342) Fix several 'returnto' links in permissions/error pages which
16271  linked to the main page instead of targetted page
16272* Strike the link to the redirect rather than using an asterisk in
16273  Special:Listredirects
16274* (bug 11355) Fix false positives in Safe Mode and other config detection
16275  when boolean settings are disabled with 'Off' via php_admin_value/php_value
16276* (bug 11292) Fixed unserialize errors with Postgres by creating special Blob
16277  object.
16278* (bug 11363) Make all metadata fields bytea when using Postgres.
16279* (bug 11331) Add buildConcat() and use CASE not IF for DB compatibility. Make
16280  oldimage cascade delete via image table for Postgres, change fa_storage_key
16281  TEXT.
16282* (bug 11438) Live Preview chops returned text
16283* Show the right message on account creation when the user is blocked
16284* (bug 11450) Fix creation of objectcache table on upgrade
16285* Fix namespace selection after submit of Special:Newpages
16286* Make input form of Special:Newpages nicer for RTL wikis
16287* (bug 11462) Fix typo in LanguageGetSpecialPageAliases hook name
16288* (bug 11474) Fix unintentional fall-through in math error handling
16289* (bug 11478) Fix undefined method call in file deletion interface
16290* (bug 278) Search results no longer highlight incorrect partial word matches
16291* Compatibility with incorrectly detected old-style DJVU mime types
16292* (bug 11560) Fix broken HTML output from weird link nesting in edit comments.
16293  Nested links (as in image caption text) still don't work _right_ but they're
16294  less wrong
16295* (bug 9718) Remove unnecessary css from main.css causing spacing issues on
16296  some browsers.
16297* (bug 11574) Add an interface message loginstart, which, similarly to loginend,
16298  appears just before the login form. Patch by MinuteElectron.
16299* Do not cache category pages if using 'from' or 'until'
16300* Created new hook getUserPermissionsErrors, to go with userCan changes.
16301* Diff pages did not properly display css/js pages.
16302* (bug 11620) Add call to User::isValidEmailAddr during accout creation.
16303* (bug 11629) If $wgEmailConfirmToEdit is true, require people to supply an
16304  email address when registering.
16305* (bug 11612) Days to show in recent changes cannot be larger than 7
16306* (bug 11131) Change filearchive width/height columns to int for Postgres
16307* Support plural in undeleted{revisions,revisions-files,files}
16308* (bug 11343) If the database is read-only, ensure that undelete fails.
16309* (bug 11690) Show revert link for page moves in Special:Log to allowed users
16310  only
16311* Initial-lowercase prefix checks in namespaceDupes.php now actually work.
16312* Fix regression in LinkBatch.php breaking PHP 5.0
16313* (bug 11452) wfMsgExt uses sometimes wrong language object for parsing magic
16314  words when called with options ''parsemag'' or ''content''.
16315* (bug 11727) Support plural in 'historysize' message
16316* (bug 11744) Incorrect return value from Title::getParentCategories()
16317* (bug 11762) Fix native language name of Akan (ak)
16318* (bug 11722) Fix inconsistent case in unprotect tabs
16319* (bug 11795) Be more paranoid about confirming accept-encoding header is
16320  present
16321* (bug 11809) Use formatNum() for more numbers
16322* (bug 11818) Fix native language name of Inuktitut (iu)
16323* Remove all commas when parsing float numbers in sorted tables
16324* Limit text field of deletion, protection and user rights changes reasons to
16325  255 characters (already restricted in the database)
16326* In the deletion default reasons, calculate how much text to get from the
16327  article text, rather than getting 150 characters (which may be too much)
16328* Add two messages for Special:Blockme which were used but undefined
16329* (bug 11921) Support plural in message number_of_watching_users_pageview
16330* If an IP address is blocked as part of a rangeblock, attempting to unblock
16331  the single IP should not unblock the entire range.
16332* (bug 6695) Fix native language name of Southern Sotho (Sesotho) (st)
16333* Make action=render follow redirects by default
16334* If restricted read access was enabled, whitelist didn't work with special
16335  pages which had spaces in theirs names
16336* If restricted read access was enabled, requests for non-existing special pages
16337  threw an exception
16338* Feeds for recent changes now provide correct URLs for the change, not just
16339  the page
16340* Check for if IP is blocked as part of a range when unblocking (see above bug-
16341  fix) was faulty. Now fixed.
16342* Fixed wpReason URL parameter to action=delete.
16343* Do not force a password for account creation by email
16344* Ensure that rate-limiting is applied to rollbacks.
16345* Make a better rate-limiting error message (i.e. a normal MW error,
16346  rather than an "Internal Server Error").
16347* Do not present an image bigger than the source when 'frameless' option is used
16348  (to be consistent with the 'thumb' option now)
16349* Support {{PLURAL}} for import log
16350* Make sure that the correct log entries are shown on Special:Userrights even
16351  for users with special characters in their names
16352* The number of watching users in watchlists was always reported as 1
16353* namespaceDupes.php no longer dies when coming across an illegal title
16354* (bug 12143) Do not show a link to patrol new pages for non existent pages
16355* (bug 12166) Fix XHTML validity for Special:Emailuser
16356* (bug 11346) Users who cannot edit a page can now no longer unprotect it.
16357* (bug 451) Add a generic Traditional / Simplified Chinese conversion table,
16358  instead of a Traditional conversion with Taiwan variant, and a Simplified
16359  conversion with China variant.
16360* (bug 12178) Fix wpReason parameter to action=delete, again.
16361* Graceful behavior for updateRestrictions.php if a page already has records
16362  in the page_restrictions matching its old page_restrictions field.
16363  May help with odd upgrade issues or race condition.
16364* (bug 11993) Remove contentsub "revision history"
16365* (bug 11952) Ensure we quote_ident() all schema names as needed
16366   inside of the DatabasePostgres.php file.
16367* (bug 12184) Exceptions now sent to stderr instead of stdout for command-line
16368  scripts, making for cleaner reporting during batch jobs. PHP errors will also
16369  be redirected in most cases on PHP 5.2.4 and later, switching 'display_errors'
16370  to 'stderr' at runtime.
16371* (bug 12148) Text highlight wasn't applied to cleanly deleted and added
16372  lines in diff output
16373* (bug 10166) Fix a PHP warning in Language::getMagic
16374* Only mark rollback edits as minor if the user can normally mark edits minor
16375* Escape page names in the move successful page (e.g. for pages with two
16376  apostrophes).
16377* (bug 12145) Add localized names of kk-variants
16378* (bug 12259) Localize the numbers in deleted pages on the sysop view
16379* Set proper page title for successful file deletion
16380* (bug 11221) Do not show 'Compare selected versions' button for a history page
16381  with one revision only
16382* (bug 12267) Set the default date format to Thai solar calender for the Thai
16383  language
16384* (bug 10184) Extensions' stylesheets and scripts should be loaded before
16385  user-customized ones (like Common.css, Common.js)
16386* (bug 12283) Special:Newpages forgets parameters
16387* (bug 12031) All namespaces doesn't work in Special:Newpages
16388* (bug 585) Only create searchindex replica table for parser tests if db is
16389  MySQL
16390* Allow --record option if parserTests.php to work when using Postgres
16391* (bug 12296) Simplify cache epoch in default LocalSettings.php
16392* (bug 12346) XML fix when body double-click and click handlers are present
16393* Fix regression -- missing feed links in sidebar on Special:Recentchanges
16394* (bug 12371) Handle more namespace case variants in namespaceDupes.php
16395* (bug 12380) Bot-friendly EditPage::spamPage
16396* (bug 8066) Spaces can't be entered in special page aliases
16397* Hide undo link if user can't edit article
16398* (bug 12416) Fix password setting for createAndPromote.php
16399* (bug 3097) Inconsistently usable titles containing HTML character entities
16400  are now forbidden. A run of cleanupTitles.php will fix up existing pages.
16401* (bug 12446) Permissions check fix for undelete link
16402* (bug 12451) AJAX title normalization tweaks
16403* When a user creating a page is not allowed to either create the page nor edit
16404  it, all applicable reasons are now shown.
16405* (bug 11428) Allow $wgScript inside $wgArticlePath when emulating PATH_INFO
16406  Fixes 'root'-style rewrite configurations
16407* (bug 12493) Removed hardcoded MAX_FILE_SIZE from Special:Import upload form
16408* (bug 12489) Special:Userrights listed in restricted section again
16409* (bug 12553) Fixed invalid XHTML in edit conflict screen
16410* (bug 12505) Fixed section=0 with action=raw
16411* (bug 12614) Do not log user rights change that didn't change anything
16412* (bug 12584) Don't reset cl_timestamp when auto-updating sort key on move
16413* (bug 12588) Fix selection in namespace selector on Special:Newpages
16414* Use only default options when generating RSS and Atom syndication links.
16415  This should help prevent infinite link loops that some software may follow,
16416  and will generally keep feed behavior cleaner.
16417* (bug 12608) Unifying the spelling of getDBkey() in the code.
16418* (bug 12611) Bot flag ignored in recent changes
16419* (bug 12617) Decimal and thousands separators for Romanian
16420* (bug 12567) Fix for misformatted read-only messages on edit, protect.
16421  Also added proper read-only checks to several special pages.
16422  Have removed read-only checks from the general user permission framework.
16423* Creating a site with a name containing '#' is no longer permitted, since the
16424  name will not work (but $wgSiteName is not checked if manually set).
16425* (bug 12695) Suppress dvips verbiage from web server error log
16426* (bug 12716) Unprotecting a non-protected page leaves a log entry
16427* Log username blocks with canonical form of name instead of input form
16428* (bug 11593, 12719) Fixes for overzealous invocation of thumb.php.
16429  Non-image handlers and full-size images may now decline it, fixing
16430  mystery failures when using $wgThumbnailScriptPath.
16431* (bug 12327) Comma in username no longer disrupts mail headers
16432* (bug 6436) Localization of Special:Import XML parser Error message(s).
16433* Security fix for API on MSIE
16434* (bug 12768) Database query syntax error in maintenance/storage/compressOld.inc
16435* (bug 12753) Empty captions in MediaWiki:Sidebar result in PHP errors
16436* (bug 12790) Page protection is not logged when edit-protection is used
16437  and move-protection is not
16438* (bug 12793) Fix for restricted namespaces/pages in Special:Export
16439* Fix for Special:Export so it doesn't ignore the page named '0'
16440* Don't display rollback link if the user doesn't have all required permissions
16441* The comment of a time-limited protection now contains the date in the default
16442  format
16443* (bug 12880) wfLoadExtensionMessages does not use $fallback from MessagesXx.php
16444* (bug 12885) Correction for Russian convertPlural function
16445* (bug 12768) Make DatabasePostgres->hasContraint() schema aware.
16446* (bug 12735) Truncate usernames in comments using mb_ functions.
16447* (bug 12892) Poor tab indexing on "delete file" form
16448* (bug 12660) When creating an account by e-mail, do not send the creator's IP
16449  address
16450* (bug 12931) Fix wrong global variable in SpecialVersion
16451* (bug 12919) Use 'deletedrevision' message as content when deleting an old file
16452  version
16453* (bug 12952) Using Nosuchusershort instead of Nosuchuser when account creation
16454  is disabled
16455* (bug 12869) Magnify icon alignment should be adjusted using linked CSS
16456* Fixing message cache updates for MediaWiki messages moves
16457* (bug 12815) Signature timestamps were always in UTC, even if the timezone code
16458  in parentheses after them claimed otherwise
16459* (bug 12732) Fix installer and searching to handle built-in tsearch2 for
16460  Postgres.
16461* (bug 12784) Change "bool" types to smallint to handle Postgres 8.3 strictness.
16462* (bug 12301) Allow maintenance/findhooks.php to search hooks in multiple
16463  directories.
16464* (bug 7681, 11559) Cookie values no longer override GET and POST variables.
16465* (bug 5262) Fully-qualified $wgStylePath no longer corrupted on XML feeds
16466* (bug 3269) Inaccessible titles ending in '/.' or '/..' now forbidden.
16467* (bug 12935, 12981) Fully-qualify archive URLs in delete, revert messages
16468* (bug 12938) Fix template expansion and 404 returns for action=raw with section
16469* (bug 11567) Fix error checking for PEAR::Mail. UserMailer::send() now returns
16470  true-or-WikiError, which seems to be the calling convention expected by half
16471  its callers already
16472* (bug 12846) IE rtl.css issue in RTL wikis special:Preferences when selecting
16473  an LTR user language
16474* (bug 13005) DISPLAYTITLE does not work on preview
16475* (bug 13004) Fix error on Postgres searches that return too many results.
16476
16477== Parser changes in 1.12 ==
16478
16479For help with migration to the MediaWiki 1.12 parser, please visit:
16480
16481http://meta.wikimedia.org/wiki/Migration_to_the_new_preprocessor
16482
16483The parser pass order has changed from
16484
16485   * Extension tag strip and render
16486   * HTML normalisation and security
16487   * Template expansion
16488   * Main section...
16489
16490to
16491
16492   * Template and extension tag parse to intermediate representation
16493   * Template expansion and extension rendering
16494   * HTML normalisation and security
16495   * Main section...
16496
16497The main effect of this for the user is that the rules for uncovered syntax
16498have changed.
16499
16500Uncovered main-pass syntax, such as HTML tags, are now generally valid, whereas
16501previously in some cases they were escaped. For example, you could have "<ta" in
16502one template, and "ble>" in another template, and put them together to make a
16503valid <table> tag. Previously the result would have been "&lt;table&gt;".
16504
16505Uncovered preprocessor syntax is generally not recognised. For example, if you
16506have "{{a" in Template:A and "b}}" in Template:B, then "{{a}}{{b}}" will be
16507converted to a literal "{{ab}}" rather than the contents of Template:Ab. This
16508was the case previously in HTML output mode, and is now uniformly the case in
16509the other modes as well. HTML-style comments uncovered by template expansion
16510will not be recognised by the preprocessor and hence will not prevent template
16511expansion within them, but they will be stripped by the following HTML security
16512pass.
16513
16514Bug 5678 has been fixed. This has a number of user-visible effects related to
16515the removal of this double-parse. Please see the wiki page for examples.
16516
16517Message transformation mode has been removed, and replaced with "preprocess"
16518mode. This means that some MediaWiki namespace messages may need to be updated,
16519especially ones which took advantage of the terribly counterintuitive behavior
16520of the former message mode.
16521
16522The header identification routines for section edit and for numbering section
16523edit links have been merged. This removes a significant failure mode and fixes a
16524whole category of bugs (tracked by bug #4899). Wikitext headings uncovered by
16525template expansion will still be rendered into a heading tag, and will get an
16526entry in the TOC, but will not have a section edit link. HTML-style headings
16527will also not have a section edit link. Valid wikitext headings present in the
16528template source text will get a template section edit link. This is a major
16529break from previous behavior, but I believe the effects are almost entirely
16530beneficial.
16531
16532The main motivation for making these changes was performance. The new two-pass
16533preprocessor can skip "dead branches" in template expansion, such as unfollowed
16534#switch cases and unused defaults for template arguments. This provides a
16535significant performance improvement in template-heavy test cases taken from
16536Wikipedia. Parser function hooks can participate in this performance improvement
16537by using the new SFH_OBJECT_ARGS flag during registration.
16538
16539The pre-expand include size limit has been removed, since there's no efficient
16540way to calculate such a figure, and it would now be meaningless for performance
16541anyway. The "preprocessor node count" takes its place, with a generous default
16542limit.
16543
16544The context in which XML-style extension tags are called has changed, so
16545extensions which make use of the parser state may need compatibility changes.
16546
16547The new preprocessor syntax has been documented in Backus-Naur Form at:
16548
16549https://www.mediawiki.org/wiki/Preprocessor_ABNF
16550
16551The ExpandTemplates extension now has the ability to generate an XML parse
16552tree from wikitext source. This parse tree corresponds closely to the grammar
16553documented on that page.
16554
16555=== API changes in 1.12 ===
16556
16557Full API documentation is available at https://www.mediawiki.org/wiki/API
16558
16559* (bug 11275) Enable descending sort in categorymembers
16560* (bug 11308) Allow the API to output the image metadata
16561* (bug 11296) Temporary fix for escaping of ampersands inside links in
16562  pretty-printed
16563  help document.
16564* (bug 11405) Expand templates implementation in the API
16565* (bug 11218) Add option to feedwatchlist to display multiple revisions for each
16566  page.
16567* (bug 11404) Provide name of exception caught in error code field of internal
16568  api error messages.
16569* (bug 11534) rvendid doesn't work
16570* Fixed rvlimit of the revisions query to only enforce the lower query limit if
16571  revision content is requested.
16572* Include svn revision number (if install is checked-out from svn) in siteinfo
16573  query.
16574* (bug 11173) Allow limited wikicode rendering via api.php
16575* (bug 11572) API should provide interface for expanding templates
16576* (bug 11569) Login should return the cookie prefix
16577* (bug 11632) Breaking change: Specify the type of a change in the recentchanges
16578  list as 'edit', 'new', 'log' instead of 0, 1, 2, respectively.
16579* Compatibility fix for PHP 5.0.x.
16580* Add rctype parameter to list=recentchanges that filters by type
16581* Add apprtype and apprlevel parameters to filter list=allpages by protection
16582  types and levels
16583* Add apdir parameter to enable listing all pages from Z to A
16584* (bug 11721) Use a different title for results than for the help page.
16585* (bug 11562) Added a user_registration parameter/field to the list=allusers
16586  query.
16587* (bug 11588) Preserve document structure for empty dataset in backlinks query.
16588* Outputting list of all user preferences rather than having to request them by
16589  name
16590* (bug 11206) api.php should honor maxlag
16591* Make prop=info check for restrictions in the old format too.
16592* Add apihighlimits permission, default for sysops and bots
16593* Add limit=max to use maximal limit
16594* Add action=parse to render parser output. Use it instead of action=render
16595  which has been removed
16596* Add rvtoken=rollback to prop=revisions
16597* Add meta=allmessages to get messages from site's messages cache.
16598* Use bold and italics highlighting only in API help
16599* Added action={block,delete,move,protect,rollback,unblock,undelete} and
16600  list={blocks,deletedrevs}
16601* Fixed sessionid attribute in action=login
16602* Standardized limits. Revisions and Deletedrevisions formerly using
16603  200 / 10000, now 500 / 5000, in line with other modules.
16604* Added list=allcategories module
16605* (bug 12321) API list=blocks reveals private data
16606* Fix output of wfSajaxSearch
16607* (bug 12413) meta=userinfo missing <query> tag
16608* Add list of sections to action=parse output
16609* Added action=logout
16610* Added cascade flag to prop=info&inprop=protections
16611* Added wlshow parameter to list=watchlist, similar to rcshow
16612  (list=recentchanges)
16613* Added support for image thumbnailing to prop=imageinfo
16614* action={login,block,delete,move,protect,rollback,unblock,undelete} now must be
16615  POSTed
16616* prop=imageinfo interface changed: iihistory replaced by iilimit, iistart and
16617  iiend parameters
16618* Added amlang parameter to meta=allmessages
16619* Added apfilterlanglinks parameter to list=allpages, replacing
16620  query.php?what=nolanglinks
16621* (bug 12718) Added action=paraminfo module that provides information about API
16622  modules and their parameters
16623* Added iiurlwidth and iiurlheight parameters to prop=imageinfo
16624* Added format=txt and format=dbg, imported from query.php
16625* Added uiprop=editcount to meta=userinfo
16626* Added list=users which fetches user information
16627* Added list=random which fetches a list of random pages
16628* Added page parameter to action=parse to facilitate parsing of existing pages
16629* Added uiprop=ratelimits to meta=userinfo
16630* Added siprop=namespacealiases to meta=siteinfo
16631* Made multiple values for ucuser possible in list=usercontribs
16632* (bug 12944) Added cmstart and cmend parameters to list=categorymembers
16633* Allow queries to have a where range that does not match the range field
16634
16635== MediaWiki 1.11 ==
16636
16637== MediaWiki 1.11.2 ==
16638
16639March 2, 2008
16640
16641This is a security release of the Fall 2007 snapshot release of MediaWiki.
16642Possible cross-site information leaks using the callback parameter for
16643JSON-formatted results in the API are prevented by dropping user credentials.
16644
16645MediaWiki release versions prior to 1.11 are not vulnerable, as they do not
16646include the callback feature which allows client-side JavaScript on other sites
16647to reach API data.
16648
16649Changes in this release:
16650
16651* User credentials are dropped for API JSON requests using a callback
16652* Edit tokens are not reported for API JSON requests using a callback
16653
16654== MediaWiki 1.11.1 ==
16655
16656January 23, 2008
16657
16658This is a security and bugfix release of the Fall 2007 snapshot release of
16659 MediaWiki. A potential XSS injection vector affecting api.php only for
16660 Microsoft Internet Explorer users has been closed.
16661
16662Changes in this release:
16663* (bug [[bugzilla:11450|11450]]) Fix creation of objectcache table on upgrade
16664* (bug [[bugzilla:11462|11462]]) Fix typo in LanguageGetSpecialPageAliases hook
16665name
16666* Fix regression in LinkBatch.php breaking PHP 5.0
16667* Security fix for API on MSIE
16668
16669To work around the vulnerability without upgrading, you may disable the API if
16670you don't need it:
16671:[[Manual:$wgEnableAPI|$wgEnableAPI]] = false;
16672
16673Not vulnerable versions:
16674* 1.12 or later
16675* 1.11 >= 1.11.1
16676* 1.10 >= 1.10.3
16677* 1.9 >= 1.9.5
16678* 1.8 any version (if $wgEnableAPI has been left off)
16679
16680Vulnerable versions:
16681* 1.11 <= 1.11.0rc1
16682* 1.10 <= 1.10.2
16683* 1.9 <= 1.9.4
16684* 1.8 any version (if $wgEnableAPI has been switched on)
16685
16686MediaWiki 1.7 and below are not affected as they do not include the API
16687functionality, however the BotQuery extension is similarly vulnerable unless
16688updated to the latest SVN version.
16689
16690== MediaWiki 1.11.0 ==
16691
16692September 10, 2007
16693
16694This is the Fall 2007 snapshot release of MediaWiki.
16695
16696MediaWiki is now using a "continuous integration" development model with
16697quarterly snapshot releases. The latest development code is always kept "ready
16698to run", and in fact runs our own sites on Wikipedia.
16699
16700Release branches will continue to receive security updates for about a year
16701from first release, but nonessential bugfixes and feature developments will be
16702made on the development trunk and appear in the next quarterly release.
16703
16704Those wishing to use the latest code instead of a branch release can obtain it
16705from source control: [[Download from SVN]]
16706
16707This is the Summer 2007 branch release of MediaWiki.
16708
16709MediaWiki is now using a "continuous integration" development model with
16710quarterly snapshot releases. The latest development code is always kept
16711"ready to run", and in fact runs our own sites on Wikipedia.
16712
16713Release branches will continue to receive security updates for about a year
16714from first release, but nonessential bugfixes and feature developments
16715will be made on the development trunk and appear in the next quarterly release.
16716
16717Those wishing to use the latest code instead of a branch release can obtain
16718it from source control: https://www.mediawiki.org/wiki/Download_from_SVN
16719
16720== Changes since 1.11.0rc1 ==
16721
16722A possible HTML/XSS injection vector in the API pretty-printing mode has been
16723found and fixed.
16724
16725The vulnerability may be worked around in an unfixed version by simply
16726disabling the API interface if it is not in use, by adding this to
16727[[Manual:LocalSettings.php|LocalSettings.php]]:<br />
16728<code>[[Manual:$wgEnableAPI|$wgEnableAPI]] = false;</code> <br />
16729(This is the default setting in 1.8.x.)
16730
16731Not vulnerable versions:
16732* 1.11 >= 1.11.0
16733* 1.10 >= 1.10.2
16734* 1.9 >= 1.9.4
16735* 1.8 >= 1.8.5
16736
16737Vulnerable versions:
16738* 1.11 <= 1.11.0rc1
16739* 1.10 <= 1.10.1
16740* 1.9 <= 1.9.3
16741* 1.8 <= 1.8.4 (if [[Manual:$wgEnableAPI|$wgEnableAPI]] has been switched on)
16742
16743MediaWiki 1.7 and below are not affected as they do not include the faulty
16744function, however the [[Extension:BotQuery|BotQuery extension]] is similarly
16745vulnerable unless updated to the latest SVN version.
16746
16747== Configuration changes since 1.10 ==
16748
16749* $wgThumbUpright - Adjust width of upright images when parameter 'upright' is
16750  used
16751* $wgAddGroups, $wgRemoveGroups - Finer control over who can assign which
16752  usergroups
16753* $wgEnotifImpersonal, $wgEnotifUseJobQ - Bulk mail options for large sites
16754* $wgShowHostnames - Expose server host names through the API and HTML comments
16755* $wgSaveDeletedFiles has been removed, the feature is now enabled
16756unconditionally
16757
16758== New features since 1.10 ==
16759
16760* (bug 8868) Separate "blocked" message for autoblocks
16761* Adding expiry of block to block messages
16762* Links to redirect pages in categories are wrapped in
16763  <span class="redirect-in-category"></span>
16764* Introduced 'ImageOpenShowImageInlineBefore' hook; see docs/hooks.txt for
16765  more information
16766* (bug 9628) Show warnings about slave lag on Special:Contributions,
16767  Special:Watchlist
16768* (bug 8818) Expose "wpDestFile" as parameter $1 to "uploaddisabledtext"
16769* Introducing new image keyword 'upright' and corresponding variable
16770  $wgThumbUpright. This allows better proportional view of upright images
16771  related to landscape images on a page without nailing the width of upright
16772  images to a fix value which makes views for anon unproportional and user
16773  preferences useless
16774* (bug 6072) Introducing 'border' keyword to the [[Image:]] syntax
16775* Introducing 'frameless' keyword to [[Image:]] syntax which respects the
16776  user preferences for image width like 'thumb' but without a frame.
16777* (bug 7960) Link to "what links here" for each "what links here" entry
16778* Added support for configuration of an arbitrary number of commons-style
16779  file repositories.
16780* Added a Content-Disposition header to thumb.php output
16781* Improved thumb.php error handling
16782* Display file history on local image description pages of shared images
16783* Added $wgArticleRobotPolicies
16784* (bug 10076) Additional parameter $7 added to MediaWiki:Blockedtext
16785  containing, the ip, ip range, or username whose block is affecting the
16786* (bug 7691) Show relevant lines from the deletion log when re-creating a
16787  previously deleted article
16788* Added variables 'wgRestrictionEdit' and 'wgRestrictionMove' for JS to header
16789* (bug 9898) Allow viewing all namespaces in Special:Newpages
16790* (bug 10139) Introduce 'EditSectionLink' and 'EditSectionLinkForOther' hooks;
16791  see docs/hooks.txt for details
16792* (bug 9769) Provide "watch this page" toggle on protection form
16793* (bug 9886) Provide clear example "stub link" in Special:Preferences
16794* (bug 10055) Populate email address and real name properties of User objects
16795  passed to the 'AbortNewAccount' hook
16796* Show result of Special:Booksources in wiki content language always, it's
16797  normally better maintained than the generic list from the standard message
16798  files
16799* (bug 7997) Allow users to be blocked from using Special:Emailuser
16800* (bug 8989) Blacklist 'mhtml' and 'mht' files from upload
16801* (bug 8760) Allow wiki links in "protectexpiry" message
16802* (bug 5908) Add "DEFAULTSORTKEY" and "DEFAULTCATEGORYSORT" aliases for
16803  "DEFAULTSORT" magic word
16804* (bug 10181) Support the XCache object caching mechanism
16805* (bug 9058) Introduce '--aconf' option for all maintenance scripts, to provide
16806  a path to the AdminSettings.php file
16807* (bug 8781) Remind users to check file permissions for LocalSettings.php
16808  post-installation
16809* Use shared.css for all skins and oldshared.css in place of common.css for
16810  pre-Monobook skins.  As always, modifications should go in-wiki to MediaWiki:
16811  Common.css and MediaWiki:Monobook.css.
16812* (bug 8869) Introduce Special:Uncategorizedtemplates
16813* (bug 8734) Different log message when article protection level is changed
16814* (bug 8458, 10338) Limit custom signature length to $wgMaxSigChars Unicode
16815  characters
16816* (bug 10096) Added an ability to query interwiki map table
16817* On reupload, add a null revision to the image description page
16818* Group log output by date
16819* Kurdish interface latin/arabic writing system with transliteration
16820* Support wiki text in all query page headers
16821* Add 'Orphanedpages' as an alias to Special:Lonelypages
16822* (bug 9328) Use "revision-info-current" message in place of "revision-info"
16823  when viewing the current revision of a page, if available
16824* (bug 8890) Enable wiki text for "license" message
16825* Throw a showstopper exception when a hook function fails to return a value.
16826  Forgetting to give a 'true' return value is a very common error which tends
16827  to cause hard-to-track-down interactions between extensions.
16828* Use $wgJobClasses to determine the correct Job to instantiate for a particular
16829  queued task; allows extensions to introduce custom jobs
16830* (bug 10326) AJAX-based page watching and unwatching has been cleaned up and
16831  enabled by default.
16832* Added option to install to MyISAM
16833* (bug 9250) Remove hardcoded minimum image name length of three characters
16834* Fixed DISPLAYTITLE behavior to reject titles which don't normalise to the
16835  same title as the current page, and enabled per default
16836* Wrap site CSS and JavaScript in a <pre> tag, like user JS/CSS
16837* (bug 10196) Add classes and dir="ltr" to the <pre>s on CSS and JS pages (new
16838  classes: mw-code, mw-css, mw-js)
16839* (bug 6711) Add $wgAddGroups and $wgRemoveGroups to allow finer control over
16840  usergroup assignment.
16841* Introduce 'UserEffectiveGroups' hook; see docs/hooks.txt for more information
16842* (bug 10387) Detect and handle '.php5' extension environments at install time
16843* Introduce 'ShowRawCssJs' hook; see docs/hooks.txt for more information
16844* (bug 10404) Show rights log for the selected user in Special:Userrights
16845* New javascript for upload page that will show a warning if a file with the
16846  "destination filename" already exists.
16847* Add 'editsection-brackets' message to allow localization (or removal) of the
16848  brackets in the "[edit]" link for sections
16849* (bug 10437) Move texvc styling to shared.css
16850* Introduce "raw editing" mode for the watchlist, to allow bulk additions,
16851  removals, and convenient exporting of watchlist contents
16852* Show "undo" links in page histories
16853* Option to jump to specified time period in user contributions
16854* Improved feedback on "rollback success" page
16855* Show distinct 'namespaceprotected' message to users when namespace protection
16856  prevents page editing
16857* (bug 9936) Per-edit suppression of preview-on-first edit with "preview=no"
16858* Allow showing a one-off preview on first edit with "preview=yes"
16859* (bug 9151) Remove timed redirects on "Return to X" pages for accessibility.
16860* Link to user logs in toolbox when viewing a user page
16861* (bug 10508) Allow HTML attributes on <gallery>
16862* (bug 1962) Allow HTML attributes on <math>
16863* (bug 10530) Introduce optional "sp-contributions-explain" message for
16864  additional explanation in Special:Contributions
16865* (bug 10520) Preview licences during upload via AJAX (toggle with
16866  $wgAjaxLicensePreview)
16867* New Parser::setTransparentTagHook for parser extension and template
16868  compatibility
16869* Introduced 'ContributionsToolLinks' hook; see docs/hooks.txt for more
16870  information
16871* Add a message if category is empty
16872* Add CSS compatibility for Opera 9.5
16873* Remove largely untested handheld stylesheet, which was causing more trouble
16874  than good.  Proper handheld support will be added at a future date.  For now,
16875  display should be acceptable either with CSS turned off or when using a so-
16876  phisticated handheld browser.
16877* (bug 3173) Option to offer exported pages as a download, rather than
16878  displaying inline, as in most browsers
16879* Pass the user as an argument to 'isValidPassword' hook callbacks; see
16880  docs/hooks.txt for more information
16881* Introduce 'UserGetRights' hook; see docs/hooks.txt for more information
16882* (bug 9595) Pass new Revision to the 'ArticleInsertComplete' and
16883  'ArticleSaveComplete' hooks; see docs/hooks.txt for more information
16884* (bug 9575) Accept upload description from GET parameters
16885* Skip the difference engine cache when 'action=purge' is used while requesting
16886  a difference page, to allow refreshing the cache in case of errors
16887* (bug 10701) Link to Special:Listusers in default Special:Statistics messages
16888* Improved file history presentation
16889* (bug 10739) Users can now enter comments when reverting files
16890* Improved handling of permissions errors
16891* (bug 10793) "Mark patrolled" links will now be shown for users with
16892  patrol permissions on all eligible diff pages
16893* (bug 10655) Show standard tool links for blocked users in block log messages
16894* Show standard tool links for blocked users in Special:Ipblocklist
16895* Miscellaneous aesthetic improvements to Special:Ipblocklist
16896* (bug 10826) Added link trail with Cyrillic characters for Mongolian language
16897* (bug 10859) Introduce 'UserGetImplicitGroups' hook; see docs/hooks.txt for
16898  more information
16899* (bug 10832) Include user information when viewing a deleted revision
16900* (bug 10872) Fall back to sane defaults when generating protection selector
16901  labels for custom restriction levels
16902* Show edit count in user preferences
16903* Improved support for audio/video extensions
16904* (bug 10937) Distinguish overwritten files in upload log
16905* Introduce 'ArticleUpdateBeforeRedirect' hook; see docs/hooks.txt for more
16906  information
16907* Confirmation is now required when deleting old versions of files
16908* (bug 7535) Users can now enter comments when deleting old versions of files
16909* (bug 11001) Submit Special:Newpages as a GET, rather than a POST request
16910* The <strong></strong> around links to watched pages in change lists now
16911  has a class - "mw-watched"
16912* (bug 9002) Provide a "view/restore deleted edits" link on Special:Upload
16913  when a destination filename is provided that corresponds with previous
16914  deleted files
16915* Make the "invalid special page" message clearer
16916* Add accesskey 's' and tooltip to 'upload file' button at Special:Upload
16917* Introduced 'SkinAfterBottomScripts' hook; see docs/hooks.txt for
16918  more information
16919* (bug 11095) Honour "preview on first edit" preference when preloading
16920  text for a non-existent page
16921* (bug 11022) Use a more accurate page title for Special:Whatlinkshere and
16922  Special:Recentchangeslinked
16923* Add link to user contributions in normal watchlist edit mode
16924* (bug 9426) Add 'newsectionheaderdefaultlevel' message to allow
16925  modification of the heading formatting for new sections when section=new
16926  argument is supplied
16927* (bug 10836) Add 'newsectionsummary' message to allow modification of the
16928  text that prefixes a new section link in Recent Changes
16929
16930== Bugfixes since 1.10 ==
16931
16932* (bug 9712) Use Arabic comma in date/time formats for Arabic and Farsi
16933* (bug 9670) Follow redirects when render edit section links to transcluded
16934  templates.
16935* (bug 6204) Fix incorrect unindentation with $wgMaxTocLevel
16936* (bug 3431) Suppress "next page" link in Special:Search at end of results
16937* Don't show unblock form if the user doesn't have permission to use it
16938  (cosmetic change, no vulnerabilities existed)
16939* Subtitle success message when unblocking a block ID instead of a pseudo link
16940  like [[User:#123|#123]]
16941* Use the standard HTTP fetch functions when retrieving remote wiki pages
16942  through transwiki, so we can take advantage of cURL goodies if available
16943* Disable user JavaScript on Special:Userlogin, Special:Resetpass and
16944  Special:Preferences, to avoid a compromised script sniffing passwords, etc.
16945* (bug 9854, 3770) Clip overflow text in gallery boxes for visual cleanliness
16946  instead of letting it flow outside the box or trigger ugly scroll bars.
16947* Tooltips for print version and permalink
16948* Links to the MediaWiki namespace for system messages having their default
16949  values are no longer shown as nonexistent (e.g., in red)
16950* Special:Ipblocklist differentiates between empty list and no search results.
16951* (bug 5375) profiling does not respect read-only mode.
16952* (bug 7070) monobook/user.gif has antialias artifacts
16953* (bug 9123) Safer way when applying $wgLocalTZoffset
16954* (bug 9896) Documentation for $wgSquidServers and X-FORWARDED-FOR
16955* (bug 9417) Uploading new versions of images when using Postgres no longer
16956  throws warnings.
16957* (bug 9908) Using tsearch2 with Postgres 8.1 no longer gives an error.
16958* (bug 1438) Fix for diff table layout on very wide lines.
16959  Diff style rules have been broken out to common/diff.css,
16960  and the dupes removed from the default skin files.
16961  Skins can still override the default rules.
16962* (bug 1229) Balance columns in diff display evenly
16963* Right-align diff line numbers in RTL language display
16964* (bug 9332) Fix instructions in tests/README
16965* (bug 9813) Reject usernames containing '#' to avoid silent truncation
16966  of fragments during the normalisation process
16967* (bug 7989) RSS feeds content now use black text when using white background.
16968* (bug 9971) Typo in a french language message.
16969* (bug 9973) Changed size was shown in advanced recentchanges collapsible items
16970  with $wgRCShowChangedSized = false.
16971* Fix PHP strict standards warning in enhanced recent changes.
16972* (bug 5850) Added hexadecimal html entities comments for $digitTransformTable
16973  entries.
16974* (bug 7432) Change language name for Aromanian (roa-rup)
16975* (bug 908) Unexistent special pages now generate a red link.
16976* (bug 7899) Added \hline and \vline to the list of allowed TeX commands
16977* (bug 7993) support mathematical symbol classes
16978* (bug 10007) Allow Block IP to work with Postgrs again.
16979* Add Google Wireless Transcoder to the Unicode editing blacklist
16980* (bug 10083) Fix for Special:Version breakage on PHP 5.2 with some hooks
16981* (bug 3624) TeX: \ker, \hom, \arg, \dim treated like \sin & \cos
16982* (bug 10132, 10134) Restore back-compatibility Image::imageUrl() function
16983* (bug 10113) Fix double-click for view source on protected pages
16984* (bug 10117) Special:Wantedpages doesn't handle invalid titles in result
16985  set [now prints out a warning]
16986* (bug 10118) Introduced Special:Mostlinkedtemplates, report which lists
16987  templates with a high number of inclusion links
16988* (bug 10104) Fixed Database::getLag() for PostgreSQL and Oracle
16989* (bug 9820) session.save_path check no longer halts installation, but
16990  warns of possible bad values
16991* (bug 9978) Fixed session.save_path validation when using extended
16992  configuration format, e.g. "5;/tmp"
16993* Don't generate a diff link in the patrol log if the page doesn't exist
16994* (bug 10067) Translations for former skins removed from message files
16995* (bug 9993) Force $wgShowExceptionDetails on during installation
16996* (bug 9980) Validate administrator username and password during
16997  installation
16998* (bug 9383) Don't set a default value for BLOB column in rc-deleted
16999  database patch
17000* (bug 10149) Don't show full template list on section-0 edit
17001* (bug 9909) Ensure access to binary fields in the math table use encodeBlob()
17002  and decodeBlob()
17003* (bug 6743) Don't link broken image links to the upload form when uploads
17004  are disabled
17005* (bug 9679) Improve documentation for $wgSiteNotice
17006* (bug 10215) Show custom editing introduction when editing existing pages
17007* (bug 10223) Fix edit link in noarticletext localizations for fr, oc
17008* (bug 10247) Fix IP address regex to avoid false positive IPv6 matches
17009* (bug 9948) Workaround for diff regression with old Mozilla versions
17010* (bug 10265) Fix regression in category image gallery paging
17011* (bug 8577) Fix some weird misapplications of time zones.
17012  {{CURRENT*}} functions now consistently use UTC as intended, while
17013  {{LOCAL*}} functions return local time per server config or $wgLocaltimezone.
17014  Signature dates for Japanese and other languages including weekday now show
17015  the correct day to match the rest of the time in local time.
17016* Escape the output of magic variables that return page name or part of it
17017* (bug 10309) Initialise parser state properly in extractSections(), fixes
17018  some cases where section edits broke because tags were improperly stripped
17019* Avoid PHP notice errors when doing HTTP proxy purges for an empty list
17020* As intended, *skip* the HTTP proxy purges when doing HTCP purges
17021* (bug 9696) Fix handling of brace transformations in "pagemovedtext"
17022* (bug 10325) Fix regression in form action on Special:Listusers
17023* Fixed installation on MyISAM or old InnoDB with charset=utf8, was giving
17024  overlong key errors.
17025* Fixed zero-padding issues with MySQL 5 binary schema
17026* (bug 10344) Don't follow a redirect after changing its protection level
17027* (bug 10333) Correct date format in Slovenian
17028* (bug 10160) Show error message for unknown namespace on Special:Allpages and
17029  Special:Prefixindex; making forms prettier for RTL wikis.
17030* (bug 10334) Replace normal spaces before percent (%) signs with non-breaking
17031  spaces
17032* (bug 10372) namespaceDupes.php no longer ignores namespace aliases
17033* (bug 10198) namespaceDupes.php no longer ignores interwiki prefixes
17034* namespaceDupes.php should work better for initial-lowercase wikis
17035* (bug 10377) "Permanent links" to revisions still work if the page is moved
17036  and the redirect deleted
17037* (bug 7071) Properly handle an 'oldid' passed to view or edit that doesn't
17038  match the given title. Fixes inconsistencies with talk, history, edit links.
17039* (bug 10397) Fix AJAX watch error fallback when we receive a bogus result
17040* (bug 10396) Fix AJAX error when $wgScriptPath/index.php is not valid;
17041  using $wgScript now included in JS info
17042* Use native XMLHttpRequest class in preference to ActiveX on IE 7; this
17043  avoids the "ActiveX "Do you want to allow ActiveX?" prompt when something
17044  security settings are cranked this way and AJAX-y gets used.
17045* Delay AJAX watch initialization until click so IE 6 with ugly security
17046  settings doesn't prompt you until you use the link.
17047* (bug 10401) Provide non-redirecting link to original title in Special:Movepage
17048* Fix broken handling of log views for page titles consisting of one
17049  or more zeros, e.g. "0", "00" etc.
17050* Fix read permission check for special pages with subpage parameters, e.g.
17051  Special:Confirmemail
17052* Fix read permission check for unreadable page titles which are numerically
17053  equivalent to a whitelisted title
17054* '?>' closing tag removed from all files to help avoid problems with extraneous
17055  whitespace (broken XML feeds, etc.)
17056* Don't use garbled parser cache output when viewing custom CSS or JavaScript
17057  pages
17058* (bug 10406) Fix Special:Listusers filter form for non-ASCII localizations
17059* Fix empty message checks for message names containing &
17060  This corrects some odd behavior with sidebar items and custom namespaces
17061  containing ampersands.
17062* (bug 10375) Change thousands separator character to &nbsp; for Latin (la)
17063* (bug 10477) Fix AJAX watch for Farsi on Firefox: JavaScript encoding tweak
17064* (bug 10496) Fix broken DISTINCT option logic in database backend
17065* Fix CSS media declaration for "screen, projection"; was causing some
17066  validation issues
17067* (bug 10495) $wgMemcachedDebug set twice in includes/DefaultSettings.php
17068* (bug 10316) Prevent inconsistent cached skin settings in gen=js by setting
17069  the intended skin directly in the URL.
17070* (bug 9903) Don't mark redirects in categories as stubs
17071* (bug 6965) Cannot include "Template:R" with {{R}} (magic word conflict)
17072* Padding parser functions now work with strings like '0' that evaluate to false
17073* (bug 10332) Title->userCan( 'edit' ) may return false positive
17074* Fix bug with <nowiki> in front of links for wikis where linkPrefixExtension is
17075  true
17076* (bug 10552) Suppress rollback link in history for single-revision pages
17077* (bug 10538) Gracefully handle invalid input on move success page
17078* Fix for Esperanto double-x-encoding in move success page
17079* (bug 10526) Fix toolbar/insertTags behavior for IE 6/7 and Opera (8+)
17080  Now matches the selection behavior on Mozilla / Safari.
17081  Patch by Alex Smotrov.
17082* Don't show non-functional toolbar buttons on Opera 7 anymore
17083* (bug 9151) Fix relative subpage links with section fragments
17084* (bug 10560) Adding a space between category letter heading and "continues"
17085* (bug 4650) Keep impossibly large/small counts off Special:Statistics
17086* (bug 10608) PHP notice when installing with PostgreSQL
17087* (bug 10615) Fix for transwiki import when CURL not available
17088* (bug 8054) Return search page for empty search requests with ugly URLs
17089* (bug 10572) Force refresh after clearing visitation timestamps on watchlist
17090* (bug 10631) Warn when illegal characters are removed from filename at upload
17091* Fix several JavaScript bugs under MSIE 5/Macintosh
17092* (bug 10591) Use Arabic numerals (0,1,2...) for the Malayam language
17093* (bug 10642) Fix shift-click checkbox behavior for Opera 9.0+ and 6.0
17094* Work around Safari bug with pages ending in ".gz" or ".tgz"
17095* Removed obsolete maintenance/changeuser.sql script; use RenameUser extension
17096* (bug 2735) "Preview" shown in title bar for action=submit on special pages
17097* Removed "restore" links from the deletion log embedded in Special:Undelete
17098* Improved error reporting and robustness for file delete/undelete.
17099* Improved speed of file delete by storing the SHA-1 hash in image/oldimage
17100* Fixed leading zero in base 36 SHA-1 hash
17101* Protection form no longer produces JavaScript errors
17102* (bug 10741) File histories show "delete" links for non-sysops
17103* (bug 10744) Treat "noarticletext" and "noarticletextanon" as wiki text when
17104  used on a non-existent page with "action=info"
17105* Fix escaping of raw message text when used on a non-existent page with
17106  "action=info"
17107* (bug 10683) Fix inconsistent handling of URL-encoded titles in links
17108  used in redirects (i.e. they now work)
17109* (bug 8878) Changes to $dateFormats in German localization (removing unused,
17110  nonexistent formats, putting time after date)
17111* (bug 10769) Database::update() should return boolean result
17112* Fix preference checkbox display for right-to-left languages which caused
17113  them to be hidden in IE in some cases
17114* Fix upload form display in right-to-left languages
17115* Fixed regression in blocking of username '0'
17116* (bug 9437) Don't overwrite edit form submission handler when setting up
17117  edit box scroll position preserve/restore behavior
17118* (bug 10805) Fix "undo" link when viewing the diff of the most recent
17119  change to a page using "diff=0"
17120* (bug 10765) img_auth.php will now refuse logged-out requests where
17121  $wgWhitelistRead is undefined, instead of (incorrectly) honouring them
17122* Fixed img_auth.php file name extraction for whitelist checking
17123* Tweak spacing of email preference display
17124* Table sorting JavaScript prefers textContent over innerText to allow hidden
17125  sort keys to work on Safari
17126* (bug 4530) Fix local name of Kurdish language
17127* (bug 10830) Fix local name of Haitian Creole language
17128* Fix invalid XHTML in Special:Protectedpages
17129* Fix comments in contributions and log pages for right-to-left languages
17130* Make installer include_path-independent, so it should work on hosts which
17131  disable user setting of PHP include_path setting
17132* glob() is horribly unreliable and doesn't work on some systems, including
17133  free.fr shared hosting. No longer using it in Language::getLanguageNames()
17134* (bug 10763) Fix multi-insert logic for PostgreSQL
17135* Fix invalid XHTML when viewing a deleted revision
17136* Fix syntax error in translations of magic words in Romanian language
17137* (bug 8737) Fix warnings caused by incorrect use of `/dev/null` when piping
17138  process error output under Windows
17139* (bug 7890) Don't list redirects to special pages in Special:BrokenRedirects
17140* (bug 10783) Resizing PNG-24 images with GD no longer causes all alpha
17141  channel transparency to be lost and transparent pixels to be turned black
17142* (bug 9339) General error pages were transforming messages and their parameters
17143  in the wrong order
17144* (bug 9026) Incorrect heading numbering when viewing Special:Statistics with
17145  "auto-numbered headings" enabled
17146* Fixed invalid XHTML in Special:Upload
17147* (bug 11013) Make sure dl() is available before attempting to use it to check
17148  available databases in installer
17149* Resizing transparent GIF images with GD now retains transparency by skipping
17150  resampling
17151* (bug 11065) Fix regression in handling of wiki-formatted EXIF metadata
17152* Double encoding broke Special:Newpages for some languages
17153* Adding a newline before the statistics footer, to prevent parsing problems
17154* Preventing the TOC from appearing in Special:Statistics
17155* (bug 11082) Fix check for fully-specced table names in Database::tableName
17156* (bug 11067) Fix regression in upload conflict thumbnail display
17157* (bug 10985) Resolved cached entries on Special:DoubleRedirects were being
17158  suppressed, breaking paging - now strikes out "fixed" results
17159* (bug 8393) <sup> and <sub> need to be preserved (without attributes) for
17160  entries in the table of contents
17161* (bug 11114) Fix regression in read-only mode error display during editing
17162* Force non-MySQL databases to use an ORDER BY in SpecialAllpages to ensure
17163  that the first page_title is truly the first page title.
17164* (bug 10836) Change the summary on creating of new section
17165* Inclusion of Special:Wantedpages now works again
17166
17167== API changes since 1.10 ==
17168
17169Full API documentation is available at https://www.mediawiki.org/wiki/API
17170
17171* New properties: links, templates, images, langlinks, categories, external
17172  links
17173* Breaking Change: imagelinks renamed into imageusage (il->iu)
17174* Bug fix: incorrect generator behavior in some cases
17175* JSON format allows an optional callback function to wrap the result.
17176* Login module disabled until a more secure solution can be implemented
17177* (bug 9938) Querying by revision identifier returns the most recent revision
17178  for the corresponding page, rather than the requested revision
17179* (bug 8772) Filter page revision queries by user
17180* (bug 9927) User contributions queries do not accept IP addresses
17181* Watchlist feed now reports a proper feed item when the user is not logged in
17182* Watchlist feed date bug fixed - automatically shows one last day
17183* Watchlist feed now allows to specify number of hours to monitor
17184* list=allpages now returns a list instead of a map in JSON format
17185* Breaking Change: in json, revisions are now returned as a list, not as a map.
17186* Add: prop=info can show page is new flag, current page length, and visit
17187  counter.
17188* Change: Query watchlist now shows flags only when explicitly requested with
17189  wlparam=flags
17190* rc_this_oldid (textid) is no longer accessible from query watchlist
17191* action=usercontribs: additional filtering by ucshow=; selection of needed
17192  fields with ucprop=; the textid (rev_text_id) is no longer being exposed
17193* (bug 9970) Breaking Change: backlinks, embeddedin and imageusage now return
17194  lists in JSON instead of a map, and do not return anything when titles do
17195  not exist
17196* (bug 9121) Introduced indexpageids query parameter to list the page_id
17197  values of all returned page items
17198* (bug 10147) Now interwiki titles are not processed but added to a separate
17199  "interwiki" section of the output.
17200* Added categorymembers list to query for pages in a category.
17201* (bug 10260) Show page protection status
17202* (bug 10392) Include MediaWiki version details in version output
17203* (bug 10411) Site language in meta=siteinfo
17204* (bug 10391) action=help doesn't return help if format is fancy markup
17205* backlinks, embeddedin and imageusage lists should use (bl|ei|iu)title
17206  parameter instead of titles. Titles for these lists is obsolete and might stop
17207  working soon.
17208* Added prop=imageinfo - gets image properties and upload history
17209* (bug 10211) Added db server replication lag information in meta=siteinfo
17210* Added external url search within wiki pages (list=exturlusage)
17211* Added link enumeration (list=alllinks)
17212* Added registered users enumeration (list=allusers)
17213* Added full text search in titles and content (list=search)
17214* (bug 10684) Expanded list=allusers functionality
17215* Possible breaking change: prop=revisions no longer includes pageid for
17216  rvprop=ids
17217* Added rvprop=size to prop=revisions (The size will not be shown if it is NULL
17218  in the database)
17219* list=allpages now allows to filter by article min/max size and protection
17220  status
17221* Added site statistics (siprop=statistics for meta=siteinfo)
17222* (bug 10902) Unable to fetch user contributions from IP addresses
17223* `list=usercontribs` no longer requires that the user exist
17224* (bug 10971) `aufrom` parameter doesn't work with spaces
17225* Fix username handling issue with `auprefix` parameter
17226* Treat underscores as spaces for `aufrom` and `auprefix` parameters
17227* Added edit/delete/... token retrieval to prop=info
17228* Added meta=userinfo - logged-in user information, group membership, rights
17229* (bug 11072) Fix regression in API image history query
17230* (bug 11115) Adding SHA1 hash to imageinfo query
17231* (bug 10898) API does not return an edit token for non-existent pages
17232* (bug 10890) Timestamp support for categorymembers query
17233* (bug 10980) Add exclude redirects on backlinks
17234* IPv6 titles in User namespace are normalized (run cleanupTitles.php to fix any
17235  old stray pages)
17236
17237== Maintenance script changes since 1.10 ==
17238
17239* Add support for wgMaxTocLevel option in parserTests
17240* (bug 6823) Disable article view counter in maintenance/dumpHTML.php
17241* Fix maintenance/importImages.php so it doesn't barf PHP errors when no
17242  suitable files are found, and make the list of extensions an option (defaults
17243  to $wgFileExtensions)
17244* Add option to maintenance/createAndPromote.php to give the user bureaucrat
17245  permissions (--bureaucrat)
17246* Allow overwriting existing files with a conflicting name using
17247  maintenance/importImages.php
17248* (bug 10266) Use native newlines when rebuilding a messages file.
17249
17250== Languages updated since 1.10 ==
17251
17252* Afrikaans (af)
17253* Arabic (ar)
17254* Bikol (bcl)
17255* Bulgarian (bg)
17256* Catalan (ca)
17257* Danish (da)
17258* German (de)
17259* Greek (el)
17260* Esperanto (eo)
17261* Spanish (es)
17262* Estonian (et)
17263* Extremaduran (ext)
17264* Farsi (fa)
17265* Finnish (fi)
17266* Vöro (fiu-vro)
17267* French (fr)
17268* Français Cadien (frc) (new)
17269* Franco-Provençal/Arpetan (frp)
17270* Galician (gl)
17271* Hakka (hak)
17272* Hebrew (he)
17273* Upper Sorbian (hsb)
17274* Haitian (ht)
17275* Indonesian (id)
17276* Icelandic (is)
17277* Italian (it)
17278* Japanese (ja)
17279* Georgian (ka)
17280* Kabyle (kab)
17281* Kazakh (kk)
17282* Korean (ko)
17283* Kinaray-a (krj) (new)
17284* Kurdish (ku)
17285* Latin (la)
17286* Lao (lo)
17287* Lithuanian (lt)
17288* Latviešu (lv)
17289* Malayalam (ml)
17290* Bahasa Melayu (ms)
17291* Burmese (my)
17292* Low German (nds)
17293* Dutch (nl)
17294* Norwegian (no)
17295* Occitan (oc)
17296* Punjabi (Gurmukhi) (pa)
17297* Polish (pl)
17298* Piedmontese (pms)
17299* Portuguese (pt)
17300* Romani (rmy)
17301* Romanian (ro)
17302* Aromanian (roa-rup)
17303* Russian (ru)
17304* Sakha (sah)
17305* Sango (se) (new)
17306* Slovak (sk)
17307* Slovenian (sl)
17308* Shona (sn)
17309* Somali (so)
17310* Albanian (sq)
17311* Sundanese (su)
17312* Swedish (sv)
17313* Tamil (ta)
17314* Thai (th)
17315* Tigrinya (ti)
17316* Setswana (tn)
17317* Tok Pisin (tpi)
17318* Uyghur (ug)
17319* Volapük (vo)
17320* Winaray (war) (new)
17321* Yiddish (yi)
17322* Old Chinese / Late Middle Chinese (zh-classical)
17323* Chinese (PRC) (zh-cn)
17324* Chinese (Taiwan) (zh-tw)
17325* Cantonese (zh-yue)
17326
17327== MediaWiki 1.10 ==
17328
17329== MediaWiki 1.10.4 ==
17330
17331March 2, 2008
17332
17333* Correction for API path fix, broken in 1.10.3
17334
17335== MediaWiki 1.10.3 ==
17336
17337January 23, 2008
17338
17339This is a security update to the Winter 2007 quarterly release. A potential
17340XSS injection vector affecting api.php only for Microsoft Internet Explorer
17341users has been closed.
17342
17343
17344To work around the vulnerability without upgrading, you may disable the API if
17345you don't need it:
17346
17347:[[Manual:$wgEnableAPI|$wgEnableAPI]] = false;
17348
17349Not vulnerable versions:
17350* 1.12 or later
17351* 1.11 >= 1.11.1
17352* 1.10 >= 1.10.3
17353* 1.9 >= 1.9.5
17354* 1.8 any version (if $wgEnableAPI has been left off)
17355
17356Vulnerable versions:
17357* 1.11 <= 1.11.0rc1
17358* 1.10 <= 1.10.2
17359* 1.9 <= 1.9.4
17360* 1.8 any version (if $wgEnableAPI has been switched on)
17361
17362MediaWiki 1.7 and below are not affected as they do not include the API
17363functionality, however the BotQuery extension is similarly vulnerable unless
17364updated to the latest SVN version.
17365
17366== MediaWiki 1.10.2 ==
17367September 10, 2007
17368
17369This is a security fix update to the Spring 2007 quarterly release snapshot. A
17370possible HTML/XSS injection vector in the API pretty-printing mode has been
17371found and fixed.
17372
17373The vulnerability may be worked around in an unfixed version by simply
17374disabling the API interface if it is not in use, by adding this to
17375LocalSettings.php:
17376:[[Manual:$wgEnableAPI|$wgEnableAPI]] = false;
17377
17378Not vulnerable versions:
17379* 1.11 >= 1.11.0
17380* 1.10 >= 1.10.2
17381* 1.9 >= 1.9.4
17382* 1.8 >= 1.8.5
17383
17384Vulnerable versions:
17385* 1.11 <= 1.11.0rc1
17386* 1.10 <= 1.10.1
17387* 1.9 <= 1.9.3
17388* 1.8 <= 1.8.4 (if $wgEnableAPI has been switched on)
17389
17390MediaWiki 1.7 and below are not affected as they do not include the faulty
17391function, however the BotQuery extension is similarly vulnerable unless updated
17392to the latest SVN version.
17393
17394== MediaWiki 1.10.1 ==
17395July 13, 2007
17396
17397This is a bugfix update to the Spring 2007 quarterly release snapshot. A number
17398of fixes to improve compatibility with PostgreSQL, some versions of MySQL, and
17399some PHP configurations are included.
17400
17401Changes since 1.10.0:
17402
17403* (bug [[bugzilla:9417|9417]]) Uploading new versions of images when using
17404Postgres no longer  throws warnings.
17405* (bug [[bugzilla:9908|9908]]) Using tsearch2 with Postgres 8.1 no longer gives
17406an error.
17407* (bug [[bugzilla:9973|9973]]) Changed size was shown in advanced recentchanges
17408collapsible items with $wgRCShowChangedSized = false.
17409* Fixed installation on MyISAM or old InnoDB with charset=utf8, was giving
17410overlong key errors.
17411* Fixed zero-padding issues with MySQL 5 binary schema
17412* (bug [[bugzilla:9820|9820]]) session.save_path check no longer halts
17413installation, but warns of possible bad values
17414* (bug [[bugzilla:9978|9978]]) Fixed session.save_path validation when using
17415extended configuration format, e.g. "5;/tmp"
17416
17417== MediaWiki 1.10.0 ==
17418May 9, 2007
17419
17420This is the quarterly release snapshot for Spring 2007. See below for a full
17421list of changes since the 1.9.x series.
17422
17423Changes since 1.10.0rc2:
17424
17425* (bug [[bugzilla:9808|9808]]) Fix regression that ignored user 'rclimit'
17426option for Special:Contributions
17427
17428== MediaWiki 1.10.0rc2 ==
17429May 4, 2007
17430
17431THIS IS A RELEASE CANDIDATE MADE AVAILABLE FOR TESTING!
17432A FINAL 1.10.0 RELEASE WILL APPEAR WITHIN A FEW DAYS.
17433
17434Changes since 1.10.0rc1:
17435* Various l10n fixes and updates
17436* Fix for upgrade of page_restrictions table
17437* (bug [[bugzilla:9780|9780]]) Fix normalization of titles with initial colon
17438followed by whitespace
17439* Fix for regression in upload: wrong size info saved into image table
17440* Avoid cyclic stub problems when authorization hooks do funny things with the
17441user and the database at load time
17442
17443== MediaWiki 1.10.0rc1 ==
17444This is the Spring 2007 branch release of MediaWiki.
17445
17446MediaWiki is now using a "continuous integration" development model with
17447quarterly snapshot releases. The latest development code is always kept
17448"ready to run", and in fact runs our own sites on Wikipedia.
17449
17450Release branches will continue to receive security updates for about a year
17451from first release, but nonessential bugfixes and feature developments
17452will be made on the development trunk and appear in the next quarterly release.
17453
17454Those wishing to use the latest code instead of a branch release can obtain
17455it from source control: https://www.mediawiki.org/wiki/Download_from_SVN
17456
17457== Configuration changes ==
17458
17459* A new switch $wgCommandLineDarkBg used by maintenance scripts
17460  (parserTests.php). It lets you specify if your terminal use a dark background,
17461  the colorized output will be made lighter making things easier to read.
17462* The minimum permissions needed to edit a page in each namespace can now be
17463  customized via the $wgNamespaceProtection array. By default, editing pages in
17464  the MediaWiki namespace requires "editinterface" permission, as before.
17465* Allow restriction of autoconfirmed permission by edit count. New global
17466  setting $wgAutoConfirmCount (defaulting to zero, naturally).
17467* Added rate limiter for Special:Emailuser
17468* Private logs can now be created using $wgLogRestrictions
17469* (Bug 8590) limited HTML is now always enabled ($wgUserHtml = true).
17470* Deprecated $wgUseImageResize, thumbnailing will be enabled unconditionally.
17471
17472== New features since 1.9 ==
17473
17474* (bug 6937) Introduce "statistics-footer" message, appended to
17475  Special:Statistics
17476* (bug 6638) List block flags in block log entries
17477* (bugs 5051, 5376) Tooltips and accesskeys no longer require JavaScript
17478* Added SkinTemplateOutputPageBeforeExec hook before SkinTemplate::outputPage()
17479  starts page output
17480  (http://lists.wikimedia.org/pipermail/wikitech-l/2007-January/028554.html)
17481* Introduce "cascading protection" -- implicit protection on pages transcluded
17482  into a page protected with this option enabled
17483* (bug 8567) Added hook RawPageViewBeforeOutput just before the text is blown
17484  out in action=raw, so extensions might influence the output.
17485* (bug 3446) Add user preference to hide page content below diffs, can be
17486  overridden by adding diffonly=1 or diffonly=0 to the URL of the diff page
17487* Add 'purge' privilege to replace the hardcoded check for login state in
17488  determining whether action=purge can be done via GET. Switching the
17489  permission on for anons can be helpful for benchmarking.
17490* (bug 7842) Link back to deleted revision list from deleted revision preview
17491* (bug 8619) Add user-aware "unblock" link to Special:Blockip
17492* (bug 8522) Provide a "delete" link on Special:Brokenredirects for users with
17493  the appropriate permission
17494* (bug 8628) Add user-aware block list link to Special:Blockip
17495* (bug 8621) Log revisions marked as patrolled
17496* Introduce "BookInformation" hook; see docs/hooks.txt for more details
17497* Add title prefix search for Special:Undelete
17498* Remove full-archive list from Special:Undelete
17499* (bug 8136) Introduce 'ArticleUndelete' hook; see docs/hooks.txt for more info
17500* (bug 8712) Expose user groups as a JavaScript global
17501* Introduce 'CustomEditor' hook; see docs/hooks.txt for more information
17502* New special page, Special:Protectedpages, which shows all protected pages
17503  and their protection status (full protection status is not pulled out due
17504  to performance considerations, so it just shows "full protected" or
17505  "semi protected".
17506* (bug 4133) Allow page protections to be made with an expiry date, in the same
17507  format as block expiry dates. Existing protections are assumed to be infinite,
17508  as are protections made with the new field left blank.
17509* (bug 8535) Allow certain vertical alignment attributes to be used as image
17510  keywords
17511* (bug 6987) Allow perrow, widths, and heights attributes for <gallery>
17512* (bug 3678) Allow disabling MediaWiki:Aboutsite in the same way as
17513  MediaWiki:Disclaimers; Also means that if any of the footer links are
17514  disabled in the wiki's default language (by setting to "-"), they'll also
17515  be disabled in other languages too (e.g. if the user specifies uselang=fr).
17516* Sort log types in Special:Log
17517* Added a classname ("mw-toolbar-editbutton") and unique IDs to the edit
17518  toolbar buttons
17519* Hide irrelevant block options in Special:Blockip based on whether an
17520  IP address/range or username is listed. (Dynamic using JS.)
17521* (bug 9032) Make quickbarSettings localizable through Special:Allmessages
17522* (bug 7782) Standardisation of file info at image description pages.
17523* (bug 1035) View contributions / recentchanges for an IP range.
17524* (bug 8747) When unwatching pages from Special:Watchlist/edit, put the
17525  confirmation messages in a proper list with a CSS class and id.
17526* (bug 9118) Show relevant log fragments on deletion confirmatio page
17527* (bug 9009) Add username entry field to Special:Contributions
17528* (bug 1723) Article size in history
17529* (bug 9223) Disallow magic tilde sequences in page titles and usernames
17530* (bug 6997) Link from Special:log/block to unblock form
17531* (bug 9117) Link from Special:log/delete to undelete form
17532* Link from Special:log/protect to change protection form
17533* (bug 1196) Add IPv6 support added to blocks, more consistancy for IPv6
17534  contribs
17535* (bug 3984) Searching in logs by title%
17536* Show thumbnail of existing image if image exists already under this filename
17537* (bug 5546) Watchlist reflects logged actions like move, protection, undelete
17538* Support protocols other than HTTP in LinkFilter, use $wgUrlProtocols
17539* (bug 3069) Warning on upload of scaled down images
17540* Warning on upload of images with uppercase extension if image with lowercase
17541  extension exists
17542* (bug 4624) Namespace selection for Special:Whatlinkshere
17543* Introduce PageHistoryBeforeList and PageHistoryLineEnding hooks; see
17544  docs/hooks.txt for more information
17545* (bug 9397) Introduce "sp-contributions-footer" and
17546  "sp-contributions-footer-anon" messages, shown at the end of
17547  Special:Contributions as appropriate for the target
17548* (bug 8421) Expose current action in JavaScript globals (as 'wgAction')
17549* (bug 9069) Use galleries in query pages dedicated to images
17550* (bug 9177) Installer now warns of various conditions affecting
17551  session.save_path which can lead to broken session storage
17552* (bug 9046) Special page to list pages without language links
17553* (bug 9508) Special page to list articles with the fewest revisions
17554* Introduce 'FileUpload' hook; see docs/hooks.txt for more information
17555* Introduce 'SearchUpdate' hook; see docs/hooks.txt for more information
17556* Introduce 'mywatchlist' message; used on personal menu to link to watchlist
17557  page
17558* Introduce magic word {{NUMBEROFEDITS}}
17559* Introduced media handlers for file-type specific operations.
17560* Improved error reporting for image thumbnailing
17561* Added sharpening option for ImageMagick thumbnailing
17562* (bug 9656) Autosummaries will be generated for deletion of pages longer than
17563  500 characters
17564* Predefined block reasons added to Special:Blockip
17565* (bug 9196) Installer now check that zend.ze1_compatibility_mode is off
17566* (bug 9697) Introduce 'InternalParseBeforeLinks' hook; see docs/hooks.txt for
17567  more information
17568* 'contribsub' message changed to 'contribsub2' with two parameters to permit
17569  better localization.  Change is reverse-compatible and can be ignored for
17570  most wikis.
17571* Adding a 'reason' field to Special:Userrights
17572
17573== Bugfixes since 1.9 ==
17574
17575* (bug 7292) Fix site statistics when moving pages in/out of content namespaces
17576* (bug 8531) Correct local name of Lingála
17577* Made the PLURAL: parser function return singular on -1 per default
17578* Fixed up the AjaxSearch
17579* Fix SpecialVersion->formatCredits input. Version and Url parameters should be
17580  null to be treated properly with isset.
17581* Page restrictions moved into a new, dedicated table
17582* Correct tooltip accesskey hint for Opera on the Macintosh
17583  (uses Shift-Esc-, not Ctrl-).
17584* (bug 8002) Math should render left-to-right even in right-to-left wikis
17585* Pass e-mail and real name fields to AuthPlugin::addUser, as additional
17586  optional fields, which may be considered useful at registration time.
17587* PostgreSQL upgrade scripts fixed and updated
17588* (bug 8613) Fix error when viewing "Recent Changes" and using Postgres.
17589* Initialise site_stats table at upgrade time if data was missing
17590* (bug 7250) Updated Unicode normalization tables to Unicode 5.0
17591* Unmaintained Oracle support files have been removed.
17592* Use browser default for printing size, don't force to 11pt
17593* (bug 8632) Fix regression in page protection null edit update
17594* (bug 8407) Disallow indexing of "printable" versions
17595* (bug 8643) Correctly escape the page-specific CSS class for non-Monobook skins
17596* (bug 8629) Document $wgFilterCallback
17597* (bug 1000) Clarify warning about memory_limit in installer
17598* Suppress PHP warning about set_time_limit in installer when safe mode is on
17599* (bug 3000) Fall back to SCRIPT_NAME plus QUERY_STRING when REQUEST_URI is
17600  not available, as on IIS with PHP-CGI
17601* Missing interwiki row for English Wikipedia restored (as "wikipedia:")
17602* use configured cache servers for mctest.php
17603* bucket details in mcc.php
17604* fix input validation and remove debugging code in compressOld
17605* full ID range for moveToExternal
17606* fix resolveStubs.php for compatibility with older serialized data
17607* maximum line length for bar graphs in getLagTimes.php
17608* recognize specieswiki in rebuildInterwiki.inc
17609* profile unicode cleanup in Xml
17610* log slow parses in Article.php
17611* profile wfMsgReal
17612* log mkdir failures
17613* profile AutoLoader
17614* rebuild empty DjVu metadata containing ''
17615* security fix for DjVu metadata retrieval
17616* Undelete page list can use plural marker
17617* (bug 8638) Fix update from 1.4 and earlier
17618* (bug 8641) Fix order of updates to ipblocks table
17619* (bug 8678) Fix detection of self-links for numeric titles in Parser
17620* (bug 6171) Magically close tags in tables when not using Tidy.
17621* Sanitizer now correctly escapes lonely '>' occurring before the first wikitag.
17622* Ignore self closing on closing tags ( '</div />' now gives '</div>')
17623* (bug 8673) Minor fix for web service API content-type header
17624* Fix API revision list on PHP 5.2.1; bad reference assignment
17625* (bug 8688) Handle underscores/spaces in Special:Blockip and
17626  Special:Ipblocklist in a consistent manner
17627* (bug 8701) Check database lock status when blocking/unblocking users
17628* ParserOptions and ParserOutput classes are now in their own files
17629* (bug 8708) Namespace translations for Zealandic language
17630* Renamed constructor methods to PHP 5 __construct reserved name
17631* (bug 8715) Warn users when editing an interface message whether or not the
17632  message page exists
17633* ar: fix the 'create a new page' on search page when no exact match found
17634* (bug 8703) Corrected talk and image namespace name for Limburgish (li)
17635* (bug 8671) Expose "wpDestFile" as a parameter to "uploadtext"
17636* (bug 8403) Respect bad image list exceptions in galleries on wiki pages
17637* Allow sending per-user contribution requests to "contributions" query group
17638* (bug 3717) Update user count for AuthPlugin account autocreation
17639* (bug 8719) Firefox release notes lie! Fix tooltips for Firefox 2 on x11;
17640  accesskeys default settings appear to be same as Windows.
17641* Added an option to make Linker::userToolLinks() show the contribs link
17642  red when the user has no edits. Linker::userToolLinksRedContribs() is an
17643  alias to that which should be used to make it more self documentating.
17644* (bug 8749) Bring MySQL 5 table defs back into sync
17645* (bug 8751) Set session cookies to HTTPS-only to match other cookies
17646* (bug 8652) Catch exceptions generated by malformed XML in multipage media
17647* (bug 8782) Help text in Makefile
17648* (bug 8777) Suppress 'previous' link on Special:Allpages when at first page
17649* (bug 8774) Fix path for GNU FDL rights icon on new installs
17650* Fix multipage selector drop-down for DjVu images to work when title
17651  is passed as a query string parameter; we have to pass the title as
17652  a form parameter or it gets dropped from the form submission URL
17653* (bug 8819) Fix full path disclosure in with skins dependencies
17654* Fixed bug affecting HTML formatting in sortable table column titles
17655* Merged table sorting code into wikibits.js
17656* (bug 8711) Stop floats in previews from spilling into edit area
17657* (bug 8858) Safer handling when $wgImageLimits is changed. Added a note
17658  in DefaultSettings to make it clear.
17659* (bug 4268) Fixed data-loss bug in compressOld batch text compression
17660  affecting pages which had null edits (move, protect, etc) as second
17661  edit in a batch group. Isolated and patched by Travis Derouin.
17662* Fix for paths in 1.4->1.5 special-case updater script
17663* (bug 8789) AJAX search: IE users can now use the return key
17664* (bug 6844) Use <ins> and <del> tags to emphase the differences
17665* (bug 6684) Fix improper javascript array iteration
17666* (bug 4347) use MailAddress object for reply-to
17667* Add AlphabeticPager abstract class
17668* Use faster AlphabeticPager for Special:Categories
17669* (bug 8875) Show printable link in MonoBook sidebar for locally nonexistent
17670  pages; perhaps useful for categories and shared images
17671* Clean up session checks to better handle the case where the session was
17672  opened during the current request. May help with some caching corner
17673  cases.
17674* (bug 8897) Fix whitespace removal for interlanguage links with link prefix
17675* Add 'ParserTestTables' hook to expand the list of temporary tables copied
17676  by the parser test harness; use for extensions which require the presence
17677  of other tables while they work.
17678* Message names changed for AlphabeticPager introduced with r19758
17679  for better localisations.
17680* (bug 8944) The deprecated is_a() function is used in StubObjects.php
17681* (bug 8992) Fix a remaining raw use of REQUEST_URI in history
17682* (bug 8999) User.php gives "undefined user editcount" PHP notice.
17683* (bug 8984) Fix a database error in Special:Recentchangeslinked
17684  when using the Postgres database.
17685* Moved the main ob_start() from the default LocalSettings.php to WebStart.php.
17686  The ob_start() section should preferably be removed from older
17687  LocalSettings.php files.
17688* Give Content-Length header for HTTP/1.0 clients.
17689* Partial support for Flash cross-domain-policy filtering.
17690* Lazy-initialize site_stats row on load when empty. Somewhat kinder to
17691  dump-based installations, avoiding PHP warnings when NUMBEROFARTICLES
17692  and such are used.
17693* Add 'charset' to Content-Type headers on various HTTP error responses
17694  to forestall additional UTF-7-autodetect XSS issues. PHP sends only
17695  'text/html' by default when the script didn't specify more details,
17696  which some inconsiderate browsers consider a license to autodetect
17697  the deadly, hard-to-escape UTF-7.
17698    This fixes an issue with the Ajax interface error message on MSIE when
17699  $wgUseAjax is enabled (not default configuration); this UTF-7 variant
17700  on a previously fixed attack vector was discovered by Moshe BA from BugSec:
17701  http://www.bugsec.com/articles.php?Security=24
17702* Trackback responses now specify XML content type
17703* (bug 9044) Send a comment with action=raw pages in CSS/JS output mode
17704  to work around IE/Mac bug where empty pages time out verrrrryyyyy slowly,
17705  particularly with new keepalive-friendly HTTP on Wikipedia
17706* (bug 8919) Suppress paging links and related messages where there are no
17707  rows to list for query pages
17708* (bug 9057) Standardize MediaWiki: namespace for oc
17709* (bug 8132) Suppress "Pages in this category" heading in categories when
17710  there are none
17711* (bug 8958) Handle search operators better when using tsearch2 (Postgres)
17712* (bug 8799) Use redirect table for Special:BrokenRedirects and
17713  Special:DoubleRedirects
17714* (bug 8918) Enable PLURAL option for MediaWiki:showingresults and
17715  MediaWiki:showingresultsnum
17716* (bug 9122) Fix minor display issue in RTL with section edit link margin
17717* (bug 5805) Enable PLURAL option for some messages of watchlist and statistic
17718* (bug 3953) Work around poor display of parenthesis in the in other
17719  languages section of MonoBook skin
17720* (bug 8539) Enable PLURAL option for another message of recentchanges.
17721* (bug 8728) MediaWiki:Badfiletype split into 3 messages
17722* (bug 9131) Allow SpecialContributions to work with Postgres
17723* (bug 9155) Allow footer info to wrap in Monobook
17724* (bug 8847) Strip spurious #fragments from request URI to fix redirect
17725  loops on some server configurations
17726* (bug 9097) column "pr_pagetype" does not exist
17727* (bug 9217) Balance wfProfile calls in Skin::outputPage
17728* (bug 9222) PostgreSQL updater should not be version-specific
17729* Fix fallback implementation of mb_strlen so it works and isn't insanely
17730  slow for large strings, since it's used for page edit lengths
17731* (bug 8815) Setting password in initUser() breaks LdapAuthentication plugin
17732* (bug 9256) Add a quick note to index.php header comments
17733* Make Special:Listusers caseinsensitive for first letter
17734* Default tidy.conf has been moved from extensions module into includes.
17735* Ignore lonely '''''
17736* (bug 9244) When calling edit page for nonexistent section, generate error
17737  inside of just discarding edits, since edit links sometimes go to the wrong
17738  place.
17739* (bug 9019) No warning during upload if image description page exists, but no
17740  image
17741* (bug 8582) Allow thumbnailing when imagesize has a space.
17742* (bug 8716) Change math_inputhash and math_outputhash to bytea for Postgres
17743* (bug 9343) Correct internal name for Wolof language
17744* (bug 9363) Fix Postgres error on Recentchangeslinked
17745* (bug 5142) Fixed call of hook ArticleViewHeader
17746* (bug 4777) Separate prev/next messages for Special:Whatlinkshere
17747* Merge approx 15 missing Wikipedia language codes into wikipedia-interwiki.sql
17748  based on Jeff Merkey's mediawiki-1.9.3.WG-20070316.tar.gz.bz2 archive.
17749* (bug 9411) Fix for shared image descriptions using query-string titles
17750* (bug 4756) Add user tool links for self created accounts at special:log
17751  instead of sometimes broken block links from newuserlog extension
17752* (bug 5817) Special:Recentchangeslinked now shows red link for nonexistent
17753  target page instead of silently redirecting
17754* (bug 8914) Don't transform colons in {{anchorencode:}}
17755* (bug 9241) Handle edit section links and include size links for cached
17756  templates the same as the first transclusion.
17757* (bug 9466) "Rollback failed" page doesn't format edit comment
17758* (bug 9472) Invalid XHTML on cached special pages
17759* (bug 9472) Invalid XHTML on Special:Newpages
17760* (bug 4764) "My contributions" not bold when viewing own contributions
17761* (bug 9194) Add {{PLURAL:...}} to navigation bar of Special:Whatlinkshere
17762* (bug 9033) Use a more specific error message when users are not able/allowed
17763  to edit page protection levels due to a block, database lock or permissions
17764* Fixed $wgFeedLimit
17765* (bug 9270) Corrected help namespace name for Dutch Lower Saxon (nds-nl)
17766* (bug 929, 4215) Expose "rcdays" user preference in Special:Preferences
17767* (bug 9554) Extension-provided group name messages not used
17768* (bug 9565) Translate template namespace name for Hindi (hi)
17769* (bug 8599) Correct localized names of zh-variants
17770* (bug 3366) Require skins based on SkinTemplate to override the skinname
17771  property.
17772* (bug 9220) Removed obsoletes functions in install-utils.inc.
17773* Removed obsoletes Title::getRelatedCache and Title:touchArray
17774* (bug 7285) Check MySQL username length during install
17775* (bug 6910) Correct date/time formats in Vietnamese (vi)
17776* (bug 9608) Correctly use ORDER BY in dumpLinks.php
17777* (bug 9609) Correctly use ORDER BY in SpecialWhatlinkshere.php
17778* Special:Random and Special:Randomredirect now try harder to send the user to
17779  a random page, and will give an error message if none really can be found
17780  instead of sending the user to the main page like they used to
17781* Fix object variable used for displaying "not-patrolled" CSS class on list
17782* Fixed interaction of page parameter to ImagePage with the HTML file cache
17783* Fixed MIME type for SVG files, will be silently changed from image/svg
17784  to image/svg+xml after loading from the database.
17785* Workaround for djvutoxml bug #1704049 (poor performance). Use djvudump
17786  instead.
17787* Fixed odd behavior in ImagePage on DjVu thumbnailing errors
17788* (bug 5439) "Go" title search will now jump to shared/foreign Image: and
17789  MediaWiki: pages that have not been locally edited.
17790* (bug 9630) Limits links in Whatlinkshere forgot about namespace filter
17791* Fixed upgrade for the non-standard MySQL schemas
17792* Disable MySQL's strict mode at session start for MySQL 4.1+, to avoid the
17793  various problems that occur when it is on.
17794* (bug 9585) Fix regression in tidy usage in Special:Undelete previews
17795* (bug 3826) Normalize some invalid cookie name characters when setting
17796  up $wgCookiePrefix. Completes application of patch by Anders Kaseorg.
17797* (bug 9649) Fix RTL form alignment for Special:Movepage
17798* (bug 9582) Members of bot group now mark edits patrolled by default
17799* (bug 9669) Fix limit ordering for rebuildrecentchanges; broken since
17800  converted from 1.4 to 1.5 schema
17801* (bug 9682) Revert PHP 5.1 dependency on warning suppression for SVN info
17802* (bug 5959) Anchors dropped from stub links
17803* (bug 3348) Some additional weak password checks: password which is same
17804  as username will now be rejected.
17805* (bug 8602) Converted Special:Contributions to use an IndexPager. The
17806  interpretation of the offset parameter has changed, and the go parameter
17807  has been removed.
17808* (bug 6204) Fixes for indentation with $wgMaxTocLevel:
17809  - don't emit too many list close tags after an invisible header
17810  - don't emit too many final list close tags if last header is invisible
17811  - don't emit TOC when there are no visible headers
17812* (bug 7629) Fix $wgBrowserBlackList to avoid false positive on MSIE
17813  when certain plugins are present which alter the user agent
17814
17815
17816== Maintenance ==
17817
17818* New script maintenance/language/checkExtensioni18n.php used to check i18n
17819  progress in the extension repository.
17820* Running maintenance/parserTests.php with '--record' option, will now
17821  automatically attempt to create the required tables
17822* --purge option to do additional parser-cache purging for purgeList.php
17823* Fix hardcoded background color in parserTests.php
17824* parserTests.php : removed the 'light' option for --color argument, replacing
17825  it with a new global switch : $wgCommandLineDarkBg
17826* (bug 8780) Clarify message for command-line scripts if LocalSettings.php
17827  exists but is not readable
17828* dumpBackup / importDump now work with PostgreSQL
17829* (bug 8975) Use "Maintenance script" as the default username for
17830  importImages.php and importTextFile.php scripts
17831* (bug 8933) Fix maintenance/reassignEdits.php script
17832* (bug 9440) Added "mediawikiwiki" interwiki prefix to MediaWiki.org
17833* (bug 2979) Import now gracefully skips invalid titles with a warning
17834* Restore '--norc' option for maintenance/importTextFile.php
17835* Help information for maintenance/importTextFile.php now easier to read on
17836  consoles
17837* Doxygen documentation now show the revision number of each file, generate
17838  graphs using dot and include a search engine.
17839
17840
17841== Languages updated ==
17842
17843* Arabic (ar)
17844* Aramaic (arc)
17845* Aymara (ay)
17846* Belarusian normative (be)
17847* Belarusian alternative (be-x-old)
17848* Bulgarian (bg)
17849* Bihara (bh)
17850* Breton (br)
17851* Catalan (ca)
17852* Czech (cs)
17853* Danish (da)
17854* German (de)
17855* Greek (el)
17856* Esperanto (eo)
17857* Spanish (es)
17858* Estonian (et)
17859* Basque (eu)
17860* Finnish (fi)
17861* Võro (fiu-vro)
17862* French (fr)
17863* Hebrew (he)
17864* Hindi (hi)
17865* Upper Sorbian (hsb)
17866* Hungarian (hu)
17867* Armenian (hy)
17868* Indonesian (id)
17869* Italian (it)
17870* Japanese (ja)
17871* Javanese (jv)
17872* Georgian (ka)
17873* Kabyle (kab)
17874* Kazakh (kk)
17875* Korean (ko)
17876* Kashmiri (ks)
17877* Ripuarian (ksh)
17878* Latin (la)
17879* Luganda (lg)
17880* Limburgish (li)
17881* Lithuanian (lt)
17882* Latvian (lv)
17883* Marathi (mr)
17884* Low Saxon (nds)
17885* Dutch Lower Saxon (nds-nl)
17886* Nepali (ne)
17887* Nepal Bhasa (new)
17888* Dutch (nl)
17889* Occitan (oc)
17890* Pali (pi)
17891* Polish (pl)
17892* Romanian (ro)
17893* Russian (ru)
17894* Sanskrit (sa)
17895* Sicilian (scn)
17896* Slovak (sk)
17897* Sundanese (su)
17898* Swedish (sv)
17899* Tahitian (ty)
17900* Ukrainian (uk)
17901* Urdu (ur)
17902* Uzbek (uz)
17903* Vietnamese (vi)
17904* Zealandic (zea)
17905* Old Chinese / Late Middle Chinese (zh-classical)
17906* Chinese (PRC) (zh-cn)
17907* Chinese (Taiwan) (zh-tw)
17908* Cantonese (zh-yue)
17909
17910== Compatibility ==
17911
17912MediaWiki 1.10 requires PHP 5 (5.1 recommended). PHP 4 is no longer supported.
17913
17914PHP 5.0.x fails on 64-bit systems due to serious bugs with array processing:
17915http://bugs.php.net/bug.php?id=34879
17916Upgrade affected systems to PHP 5.1 or higher.
17917
17918MySQL 3.23.x is no longer supported; some older hosts may need to upgrade.
17919At this time we still recommend 4.0, but 4.1/5.0 will work fine in most cases.
17920
17921
17922== Upgrading ==
17923
179241.10 has several database changes since 1.9, and will not work without schema
17925updates.
17926
17927If upgrading from before 1.7, you may want to run refreshLinks.php to ensure
17928new database fields are filled with data.
17929
17930If you are upgrading from MediaWiki 1.4.x or earlier, some major database
17931changes are made, and there is a slightly higher chance that things could
17932break. Don't forget to always back up your database before upgrading!
17933
17934See the file UPGRADE for more detailed upgrade instructions.
17935
17936= MediaWiki release notes =
17937Security reminder: MediaWiki does not require PHP's register_globals
17938setting since version 1.2.0. If you have it on, turn it *off* if you can.
17939
17940= MediaWiki 1.9 =
17941
17942== MediaWiki 1.9.6 ==
17943
17944March 2, 2008
17945
17946* Correction for API path fix, broken in 1.9.5
17947
17948== MediaWiki 1.9.5 ==
17949
17950January 23, 2008
17951
17952This is a security update to the Winter 2007 quarterly release. A potential XSS
17953injection vector affecting api.php only for Microsoft Internet Explorer users
17954has been closed.
17955
17956
17957To work around the vulnerability without upgrading, you may disable the API if
17958you don't need it:
17959
17960:[[Manual:$wgEnableAPI|$wgEnableAPI]] = false;
17961
17962Not vulnerable versions:
17963* 1.12 or later
17964* 1.11 >= 1.11.1
17965* 1.10 >= 1.10.3
17966* 1.9 >= 1.9.5
17967* 1.8 any version (if $wgEnableAPI has been left off)
17968
17969Vulnerable versions:
17970* 1.11 <= 1.11.0rc1
17971* 1.10 <= 1.10.2
17972* 1.9 <= 1.9.4
17973* 1.8 any version (if $wgEnableAPI has been switched on)
17974
17975MediaWiki 1.7 and below are not affected as they do not include the API
17976functionality, however the BotQuery extension is similarly vulnerable unless
17977updated to the latest SVN version.
17978
17979== MediaWiki 1.9.4 ==
17980
17981September 10, 2007
17982
17983This is a security and bug fix update to the Winter 2007 quarterly release.
17984Minor compatibility fixes for IIS 5 are included.
17985
17986* (bug [[bugzilla:8847|8847]]) Strip spurious #fragments from request URI to
17987fix redirect loops on some server configurations
17988* A possible HTML/XSS injection vector in the API pretty-printing mode has been
17989found and fixed.
17990
17991The vulnerability may be worked around in an unfixed version by simply
17992disabling the API interface if it is not in use, by adding this to
17993LocalSettings.php:
17994
17995:[[Manual:$wgEnableAPI|$wgEnableAPI]] = false;
17996
17997Not vulnerable versions:
17998* 1.11 >= 1.11.0
17999* 1.10 >= 1.10.2
18000* 1.9 >= 1.9.4
18001* 1.8 >= 1.8.5
18002
18003Vulnerable versions:
18004* 1.11 <= 1.11.0rc1
18005* 1.10 <= 1.10.1
18006* 1.9 <= 1.9.3
18007* 1.8 <= 1.8.4 (if $wgEnableAPI has been switched on)
18008
18009MediaWiki 1.7 and below are not affected as they do not include the faulty
18010function, however the BotQuery extension is similarly vulnerable unless updated
18011to the latest SVN version.
18012
18013== MediaWiki 1.9.3 ==
18014
18015February 20, 2007
18016
18017This is a security and bug-fix update to the Winter 2007 quarterly release.
18018Minor compatibility fixes for IIS and PostgreSQL are included.
18019
18020An XSS injection vulnerability based on Microsoft Internet Explorer's UTF-7
18021charset autodetection was located in the AJAX support module, affecting MSIE
18022users on MediaWiki 1.6.x and up when the optional setting $wgUseAjax is enabled.
18023
18024If you are using an extension based on the optional Ajax module, either disable
18025it or upgrade to a version containing the fix:
18026
18027* 1.9: fixed in 1.9.3
18028* 1.8: fixed in 1.8.4
18029* 1.7: fixed in 1.7.3
18030* 1.6: fixed in 1.6.10
18031
18032There is no known danger in the default configuration, with ''$wgUseAjax'' off.
18033
18034* ([[mediazilla:8992|8992]]) Fix a remaining raw use of REQUEST_URI in history
18035* ([[mediazilla:8984|8984]]) Fix a database error in
18036Special:Recentchangeslinked when using the PostgreSQL database.
18037* Add ''charset'' to Content-Type headers on various HTTP error responses to
18038forestall additional UTF-7-autodetect XSS issues. PHP sends only ''text/html''
18039by default when the script didn't specify more details, which some
18040inconsiderate browsers consider a license to autodetect the deadly,
18041hard-to-escape UTF-7. This fixes an issue with the Ajax interface error message
18042on MSIE when ''$wgUseAjax'' is enabled (not default configuration); this UTF-7
18043variant on a previously fixed attack vector was discovered by Moshe BA from
18044BugSec: [http://www.bugsec.com/articles.php?Security=24
18045http://www.bugsec.com/articles.php?Security=24]
18046* Trackback responses now specify XML content type
18047
18048== MediaWiki 1.9.2 ==
18049
18050February 4, 2007
18051
18052This is a bug-fix update that fixes some installation and other minor issues
18053with the 1.9.1 release as well as a security issue which was introduced in the
180541.9 branch.
18055
18056JavaScript code which regenerated the "sortable tables" feature did not
18057properly sanitize input, leading to an HTML injection vulnerability.
18058
18059* ([[mediazilla:8774|8774]]) Fix path for GNU FDL rights icon on new installs
18060* ([[mediazilla:8819|8819]]) Fix full path disclosure with skins dependencies
18061* ([[mediazilla:8819|8819]]) Fixed data-loss bug in compressOld batch text
18062compression affecting pages which had null edits (move, protect, etc) as second
18063edit in a batch group. Isolated and patched by Travis Derouin.
18064* Security fix for sortable tables JavaScript
18065
18066== MediaWiki 1.9.1 ==
18067
18068January 24, 2007
18069
18070This is a bug-fix update that fixes some installation and upgrade issues with
18071the original 1.9.0 release.
18072
18073* ([[mediazilla:3000|3000]]) Fall back to SCRIPT_NAME plus QUERY_STRING when
18074REQUEST_URI is not available, as on IIS with PHP-CGI
18075* Security fix for DjVu images. (Only affects servers where .djvu file  uploads
18076are enabled and ''$wgDjvuToXML'' is set.)
18077* ([[mediazilla:8638|8638]]) Fix update from 1.4 and earlier
18078* ([[mediazilla:8641|8641]]) Fix order of updates to ipblocks table for updates
18079from <=1.7
18080* ([[mediazilla:8673|8673]]) Minor fix for web service API content-type header
18081* Fix API revision list on PHP 5.2.1; bad reference assignment
18082* Fixed up the AjaxSearch
18083* Exclude settings files when generating documentation. That could expose the
18084database user and password to remote users.
18085* ar: fix the 'create a new page' on search page when no exact match found
18086* Correct tooltip accesskey hint for Opera on the Macintosh (uses Shift-Esc-,
18087not Ctrl-).
18088* ([[mediazilla:8719|8719]]) Firefox release notes lie! Fix tooltips for
18089Firefox 2 on x11; accesskeys default settings appear to be same as Windows.
18090
18091== Changes since 1.8 ==
18092
18093* (bug 8200) Make category lists sorted by name when using Postgres.
18094* (bug 7841) Support 'IGNORE' inserts for Postgres, fixes watchlist
18095  adding problem.
18096* (bug 6835) Removing the includes/Parser.php::getTemplateArgs() function,
18097  because it seems to be unused.
18098* (bug 7139) Increasing the visual width of the edit summary field on larger
18099  screen sizes, for the default monobook skin.
18100* Fix PHP notice and estimates for dumpBackup.php and friends
18101* Improved register_globals paranoia checks
18102* (bug 7545) Fix PHP version check on install
18103* Disable PHP exception backtrace printing unless $wgShowExceptionDetails
18104  is set. Backtraces may contain sensitive information in function call
18105  parameters.
18106* (bug 6164) Avoid smashing Cite state if message transformation triggers
18107  during bad image list check, by skipping message transformation.
18108  This isn't a good permanent fix.
18109* (bug 6918) Stopped borders and backgrounds from showing through floated
18110  tables in Monobook
18111* (bug 6868) Un-hardcode section edit link style
18112* (bug 3205) Stop right floats from stacking horizontally in non-Monobook skins
18113* Added global $wgStyleVersion to centralize bumping CSS and JS file versions
18114  for cache-friendly style and script updating
18115* (bug 7562) Fix non-ASCII namespaces on Windows/XAMPP servers
18116* Friendlier check for PHP 5 in command-line scripts; it's common for parallel
18117  PHP 4 and 5 installations to interfere on the command-line.
18118* Fix regression in autoconfirm permission check
18119* (bug 3015) Add CSS ids to subcategory and page sections on category pages
18120* (bug 7587) Fix erroneous id for specialpage tab, enabling informative popup
18121* (bug 7599) Fix thumbnail purging, PHP notices on HTCP image page purge
18122* (bug 7581) Update language name for cbk-zam
18123* (bug 7444) Update namespace translations for Telugu (te), kept old values as
18124  alias for compatibility
18125* (bug 4525) Move section links down visually to same level as headings
18126  (editsection links are now inside the heading elements)
18127* Workaround for http://bugs.php.net/bug.php?id=31892 , PATH_INFO and hence
18128  URLs of the style /index.php/Main_Page were broken on some CGI installations.
18129* (bug 7623) Validate custom HTML id's correctly in Monobook interface
18130* (bug 2241) Fix collision of 'w' and 'd' accesskeys
18131* (bug 5795) CSS class added to body based on page name for page-specific
18132  styling
18133* (bug 6276) Stopped search field from getting too large in Cologne Blue
18134* (bug 7644) User creations that are aborted by hooks shouldn't be counted
18135  against account creations per day limit
18136* (bug 7636) Show Firefox 2 users correct accesskey prefix
18137* (bug 6427) Block blocked IPs from using the mail password function
18138  to allow blocking of flooders
18139* Include common.css from classic-style skins in main HTML with the bump URL
18140* (bug 7607) Add Karakalpak (kaa) to Names.php and stub message file for
18141  linktrail
18142* (bug 7582) Add 'tog-nolangconversion' to MessagesEn.php.
18143  This key is need for languages with variants (zh, sr, kk)
18144* (bug 7606) MediaWiki messages for "rss" and "atom" missing
18145* (bug 7609) Add some more '*-summary' messages to MessagesEn.php with empty
18146  strings to allow better localisation via Special:Allmessages. Mark this new
18147  messages as optional for localisation.
18148* Fix user_newpass upgrade for prefixed tables (reported by Fyren)
18149* (bug 7663) Include language variant switcher links on Nostalgia skin
18150* (bug 6531) Fix PHP fatal error on installation page with bad username input.
18151* (bug 6977) Remove 404 link for autogenerated database documentation.
18152* (bug 7369) Allow "Show Changes" without requiring edit token.
18153* (bug 7687) Fix movetalk box checks itself when confirming a delete and move.
18154* (bug 7684) Obey watchcreated preference for Special:Upload watch checkbox
18155* (bug 7686) Include id attribute on delete form confirmation button
18156* Allow compound interwiki prefixes in $wgImportSources
18157* (bug 7304) Added redirect table to store redirect targets.
18158* Added querycachetwo table (similar to querycache but has two titles)
18159* PageArchive can now return a Revision object for more convenient processing
18160  of deleted revision data
18161* Added 'UndeleteShowRevision' hook in Special:Undelete
18162* Error message on attempt to view invalid or missing deleted revisions
18163* Remove unsightly "_" from namespace in Special:Allpages, Special:Prefixindex
18164* (bug 3224) Allow minor edits by bots to skip new message notification on
18165  user talk pages. This can be disabled by adjusting the 'nominornewtalk'
18166  permission. Patch by Werdna.
18167* (bug 7741) MATH: fixed broken syntax of underbrace etc. Fixed arrays
18168* Fix purging for updated SVG files
18169* (bug 7745) Add id attribute to search button in Monobook
18170* (bug 7749) MATH: added some more LaTeX symbols, e.g. parallel, diamond, ast...
18171* (bug 7304) Added code in Article.php to keep redirect table up to date.
18172* Made special page names case-insensitive and localisable. Care has been taken
18173  to maintain backwards compatibility.
18174* Used special page subpages in a few more places, instead of query parameters.
18175* (bug 7758) Added wrapper span to "templates used" explanation to allow CSS
18176  styling (class="mw-templatesUsedExplanation").
18177* Added {{#special:}} parser function, to give the local default title for
18178  special pages
18179* (bug 7766) Remove redundant / from AJAX requests, can break some servers
18180* Add tab links from extensions to classic-based skins (SkinTemplateTab hook)
18181  Provides better cross-skin compatibility for extensions using the modern
18182  skin hooks, such as Oversight
18183* Moved variant language links on Cologne Blue and Nostalgia to before the
18184  login/logout link
18185* Fix for parser tests with MySQL 5 in strict mode
18186* Added block option "enable autoblocks"
18187* Amend Special:Ipblocklist to note when a block has autoblock DISABLED.
18188* (bug 7780) Fix regression in editing redirects
18189* Add whitespace above "templates included on this page" using CSS, not
18190  hardcoded line break.
18191* Remove entries from redirect table on article deletion
18192* (bug 7788) Force section headers in new section links for users who have
18193  'prompt for blank edit summaries' on.
18194* (bug 1133) Special:Emailuser: add an option to send yourself a copy of your
18195  mail.
18196* (bug 461) Allow "Categories:" link at bottom of pages to be customized via
18197  pagecategorieslink message.
18198* Sort the list of skins in "My Preferences" -> Skins by alphabetical order.
18199* (bug 7785) Postgres compatibility for timestamps in RC feeds
18200* (bug 7550) Normalize user parameter normally on Special:Log
18201* (bug 7294) Fix PATH search for diff3 on install
18202* Various fixes related to the blocking change re: autoblocks. On inserting
18203  an IP block, the ipb_enable_autoblock field is now automagically blanked,
18204  because it doesn't make any sense for an IP. Additionally, IP blocks
18205  without the ipb_enable_autoblock option no longer show up as "autoblock
18206  disabled" on Special:Ipblocklist.
18207* (bug 7774) MATH: aded more amstex functions
18208* (bug 1182) MATH: fixed inconsistent rendering of upper case Greek letters in
18209  TeX
18210* Fix regression in streaming page dump generation
18211* (bug 7801) Add support for parser function hooks in parser tests
18212* checkUsernames.php now uses wfDebugLog instead of hardcoded path to log
18213* (bug 7810) Update talk namespaces for Occitan
18214* Allow case-sensitive URLs to be used for uploading from URLs.
18215* (bug 1109) Correct fix for compressed 304 responses when additional output
18216  buffers have been installed within the compression handler
18217* (bug 7819) Move automatic redirect edit summary after pre-save transform
18218  to work properly with subst: fun
18219* (bug 7826) Fix typos in two English messages.
18220* (bug 5365) Stop users being prompted to enter an edit summary for null edits,
18221  if they have selected that option in preferences.
18222* (bug 5936) Show an 'm' to the left of the edit summary on diff pages for minor
18223  edits.
18224* (bug 7820) Improve error reporting for uploads via URL.
18225* (bug 5149) When autoblocks are enabled, retroactively apply an autoblock to
18226  the most recently used IP of a user when they are blocked.
18227* Add an index on (rc_user_text,rc_timestamp) on the recentchanges table. This
18228  will make CheckUser.php and the new retroactive autoblock functionality
18229  faster.
18230* Fix regression in Special:Undelete for revisions deleted under MediaWiki 1.4
18231  with compression or legacy encoding
18232* (bug 6737) Fixes for MySQL 5 schema in strict mode
18233* Approximate height for client-side scaling fallback instead of passing -1
18234  into the HTML output.
18235* Make the DNSBL to check for proxy blocking configurable via $wgSorbsUrl
18236* Add experimental recording/reporting mode to parser tests runner, to
18237  compare changes against the previous run.
18238  Additional tables 'testrun' and 'testitem' are in maintenance/testRunner.sql,
18239  source this and pass --record option to parserTests.php
18240* Make the set of default parser test input files extensible via
18241  $wgParserTestFiles. This can now be appended to by extensions or local
18242  configuration files so that extension or custom tests can be automatically
18243  run along with the main batch.
18244* Run PHP install version checks on update.php so command-line updaters see
18245  new version requirements
18246* Do a check for the PHP 5.0.x 64-bit bug, since this is much more disruptive
18247  as of MW 1.8 than it used to be. Install or upgrade now aborts with a
18248  warning and a request to upgrade.
18249* (bug 6440) Updated indexes to improve backlinking queries (links, templates,
18250  images)
18251* Switched 'anon-only' block mode to default for IP blocks
18252* (bug 3687, 7892) Add distinct heading for media files in category display,
18253  with count.
18254* (bug 1578) Add different icons for external links to audio, video, or PDF in
18255  Monobook.
18256* Made autoblocks block account creation if the user block has that option
18257  enabled.
18258* Add auto-summaries to blankings and large removals without summaries.
18259* (bug 7811) Allow preview of edit summaries.
18260* (bug 6839) Wikibits.js minor changes to make JS-lint happier.
18261* (bug 7932) Make sure that edit toolbar clears floats so it appears correctly.
18262* (bug 6873) When viewing old revisions, add link to diff to current version.
18263* (bug 3315) Provide rollback link directly on history page.
18264* Replace 'old-revision-navigation' message with 'revision-info' and
18265  'revision-nav' messages, wrapped in divs with appropriate id's.
18266* (bug 4178) MediaWiki:Common.js will now be included for all users if
18267  $wgUseSiteJs is enabled, in addition to (if applicable) MediaWiki:Monobook.js
18268  and user JS subpages.
18269* (bug 7918) "Templates used on this page" changes during preview to reflect
18270  any added or removed templates, and works as expected for section edits.
18271* (bug 7919) "Templates used on this page" is now shown for read-only pages.
18272* (bug 7688) When viewing diff, section anchors in autosummary jump to section
18273  on current page instead of loading the latest version.
18274* (bug 7970) Use current connection explicitly on Database::getServerVersion
18275* (bug 2001) Tables with class="sortable" can now be dynamically sorted via
18276  JavaScript.
18277* Added autosummary for new pages with 500 or less characters, and refactor
18278   the autosummary code so it's all done in one function. doEdit is getting too
18279   big!
18280* (bug 7554) The correct MIME type for SVG images is now displayed on the
18281  image page (image/svg+xml, not image/svg).
18282* (bug 7883) Added autoblock whitelisting feature, using which specific ranges
18283   can be protected from autoblocking. These ranges are specified, in list
18284  format, in the autoblock_whitelist system message.
18285* Added placeholders for text injection by hooks to EditPage.php
18286* (bug 8009) Automatic edit summary for redirects is not filled for edits in
18287  existing pages
18288* Installer support for experimental MySQL 4.1/5.0 binary-safe schema
18289* Use INSERT IGNORE for db-based BagOStuff add/insert, for more memcache-like
18290  behavior when keys already exist on add (instead of dying with an error...)
18291* Add a hook 'UploadForm:initial' before the upload form is generated, and two
18292  member variable for text injection into the form, which can be filled by the
18293  hooks.
18294* (bug 6295) Add a "revision patching" functionality, where an edit can be
18295  undone
18296  (with a functionality similar to diff rev1 rev2 | patch -R rev3 -o rev3).
18297  This is triggered by including &undo=revid in an edit URL. A link to a URL
18298  that will undo a given edit is shown on NEW revision headers on diff pages.
18299  The link leads to a "Show Changes" page showing what will be done to undo the
18300  edit.
18301* Fix display of link in "already rolled back" message for image/category pages
18302* (bug 6016) Left-aligned images should stack vertically, like right-aligned
18303  images, not horizontally.
18304* Patch from LeonWP: added UploadForm:BeforeProcessing hook in SpecialUpload.php
18305* Add AuthPluginSetup hook to override $wgAuth after configuration
18306* Fix regression in authentication hook auto-creation on login
18307* (bug 8110) Allow spaces in ISBNs
18308* (bug 8024) Introduce "send me copies of emails I send to others" preference
18309* Added 'EditPage::attemptSave' hook before an article is saved.
18310* (bug 8083) Applied patch for sk localisation
18311* Add a backslash character to the edit token, to prevent edits via certain
18312  broken proxies that mangle such characters in form submissions
18313* (bug 7461) Allow overwriting pages using importTextFile.php
18314* (bug 7946) importTextFile.php doesn't perform pre-save transform
18315* (bug 8117) {{REVISIONTIMESTAMP}} showed weird default if $wgLocalTZoffset set;
18316  now uses current time for previews and if timestamp can't be loaded from DB
18317* {{REVISIONTIMESTAMP}} now uses site local timezone instead of user timezone
18318  to ensure consistent behavior
18319* {{REVISIONTIMESTAMP}} and friends should now work on non-MySQL backends
18320* (bug 7671) Observe canonical media namespace prefix in Linker::formatComment
18321* Added js variable wgCurRevisionId to the output
18322* (bug 8141) Cleanup of Parser::doTableStuff, patch by AzaTht
18323* (bug 8042) Make miser mode caching limits settable via $wgQueryCacheLimit
18324  instead of hardcoding to 1000
18325* Enable QueryPage classes to override list formatting
18326* (bug 5485) Show number of intervening revisions in diff view
18327* (bug 8100) Fix XHTML validity in Taiwanese localization
18328* Added redirect to section feature. Use it wisely.
18329* Added a configuration variable allowing the "break out of framesets" feature
18330  to be switched on and off ($wgBreakFrames). Off by default.
18331* Allow Xml::check() $attribs parameter to override 'value' attribute
18332* DB schema change: added two columns (rc_old_len and rc_new_len) to the
18333  recentchanges table to store the text lengths before and after the edit
18334* (bug 1085) Made Special:Recentchanges show the character difference between
18335  the changed revisions
18336* Removed a redundant <strong> tag from diff pages that was causing display
18337  issues for some users
18338* (bug 8203) The keyboard shortcut for "log out" was removed, because users
18339  were pressing it when they intended to press the shortcut for "preview".
18340* (bug 8148) Handle non-removable output buffers gracefully when cleaning
18341  buffers for HTTP 304 responses, StreamFile, and Special:Export.
18342  Duplicated code merged into wfResetOutputBuffers() and wfClearOutputBuffers()
18343* Special:AllPages : 'next page' link now point to the first title of the next
18344  chunk instead of pointing to the last title of current chunk.
18345* (bug 4673) Special:AllPages : add a 'previous' link (new message 'prevpage')
18346* (bug 8121) wfRandom() was not between 0 and 1
18347* Add static method Parser::createAssocArgs($args), so parser functions can
18348  use the same code to parse arguments as the templates do.
18349* Change behavior of logins using the temporary e-mailed password (as stored
18350  in user_newpassword hash field). Instead of just logging in silently and
18351  leaving the previous user_password field in place indefinitely, the user
18352  is now prompted to set a new password.
18353
18354  The password-changing form is at Special:Resetpass; currently it's only
18355  usable for changing from the temporary password during login, but it
18356  could perhaps be generalized, replacing the subform in preferences.
18357
18358  Once the new password is set successfully, the temporary password is wiped
18359  so it cannot be used to login a second time, and the login process
18360  is completed.
18361* Suppress 'mail new password' button on login form if $wgAuth forbids
18362  changing user passwords; it wouldn't work very well...
18363* Consolidate password length checks and $wgAuth manipulation into
18364  User::setPassword() to avoid duplicate code in different places
18365  that set passwords.
18366* User::setPassword() now throws PasswordError exceptions if the password
18367  is illegal or cannot be set via $wgAuth. These can be caught and a human-
18368  readable error message displayed by UI code.
18369* Added Title::isSubpage()
18370* (bug 8241) Don't consider user pages of User:Foo.css to be CSS subpages
18371* Set an explicit class on framed thumbnail inner divs and images, changed some
18372  CSS to use these instead of using descendent selectors.
18373* Accept null parameter to User::setPassword() as indicating the password
18374  field should be cleared to an unusable state. Login will only be possible
18375  after the password is reset, for instance by e-mail.
18376* (bug 6394) Invalidate the password set for "by e-mail" account creations
18377  to avoid accidental empty password creations.
18378* Made the show change size function work on page moves, page creations, and
18379  log entries. Also fixed it in the javascript recentchanges.
18380* (bug 8239) correctly get 50 new contributions when clicking '(50 next)'
18381* (bug 2259) Fix old regression where e-mail addresses were no longer
18382  confirmed on login with mailed password.
18383* Add a notification about the confirmation mail sent during account
18384  creation, so people don't immediately go off to request a second one.
18385* Add a warning on Special:Confirmemail if a code was already sent and has
18386  not yet expired.
18387* Add user_editcount field to provide data for heuristics on account use.
18388  Incremented on edit, with lazy initialization from past revision data.
18389  Can batch-initialize with maintenance/initEditCount.php (not yet friendly
18390  to replication environments, this will do all accounts in one query).
18391* Allow raw SQL subsections in Database::update() SET portion as well as
18392  for WHERE portion. Handy for increments and such.
18393* User::getOption now accept a default value to override default user values
18394  this makes it consistent with WebRequest::get* methods. Corrected code in
18395  various places accordingly.
18396* (bug 8264) Fix JavaScript global vars for XHTML mode
18397* Make $wgSiteNotice value wikitext again, for consistency with editable
18398  MediaWiki:Sitenotice and MediaWiki:Anonnotice.
18399* (bug 8044) When redirecting from the canonical name of the special page
18400  to the localised one, parameters/subpages are omitted
18401* (bug 8164) Special:Booksources should use GET for form submission
18402* Rewrite Special:Booksources to clean up interface and remove redundant code
18403* (bug 7925) Change Special:Allmessages message name filter javascript to be
18404  a bit more responsive and easier on the CPU
18405* (bug 4488) Support watching pages on deletion; introduces new user preference
18406* Minor restructuring of Special:Preferences; "watch pages I edit" and "watch
18407  pages I create" options now accessible under "Watchlist" options
18408* (bug 8153) <nowiki> doesn't work in site notice
18409* (bug 6690) wfMsgNoTrans() transforms messages
18410* (bug 8274) Wrap edit tools in a <div> with a specified class
18411* Detect PHP 5.0.x 64-bit bug and abort in WebStart.php; too many things break
18412  mysteriously otherwise (detection code copied from install-utils.inc)
18413* (bug 8295) Change handling of <center> tags in doBlockLevels() to match that
18414  of <div>
18415* (bug 8110) Make magic ISBN linking stricter: only match ten-digit sequences
18416  (plus optional ISBN-13 prefix) with no immediately following alphanumeric
18417  character, disallow multiple consecutive internal redirects
18418* (bug 2785) Accept optional colon prefix in links when formatting comments
18419* Don't show "you can view and copy the source of this page" message for
18420  pages which don't exist
18421* (bug 8310) Blank line added to top of 'post' when page is blank
18422* (bug 8109) Template parameters ignored in "recentchangestext"
18423* Gracefully skip redirect-to-fragment on WebKit versions less than 420;
18424  it messes up on current versions of Safari but is ok in the latest
18425  nightlies. Checking the version number will allow it to automatically
18426  work when new releases of Safari appear.
18427* Fix regression in thumb styles; size and padding didn't match with
18428  new arrangement.
18429* (bug 8333) Fix quick user data update on login password change on
18430  replication database setups. User data is now pulled from master
18431  instead of slave in User::loadFromDatabase, ensuring that it is
18432  fresh and accurate when read and then saved back into cache.
18433  This was breaking with the Special:Rename operation which
18434  automatically logs the user in with the new password after changing
18435  it; pulling from slave meant the record was often not the updated
18436  one.
18437* (bug 8335) Set image width to the first valid parameter found.
18438* (bug 8350) Fix watchlist viewing bug when using Postgres.
18439* (bug 6603) When warning about invalid file extensions, output the bit
18440  of the extension we actually checked
18441* (bug 7669) Drop defaults on BLOB/TEXT columns for better compatibility
18442  with MySQL's strict mode, often enabled by the Windows installer.
18443  The defaults are ignored anyway when strict mode is off...
18444* (bug 7685) Use explicit values for ar_text and ar_flags when deleting,
18445  for better compatibility with MySQL's strict mode
18446* Update default interwiki values to reflect changed location of ursine:
18447* (bug 5411) Remove autopatrol preference
18448* Users who have the "autopatrol" permission will have their edits marked as
18449  patrolled automatically
18450* Users who do not have the "autopatrol" permission will no longer be able
18451  to mark their own edits as patrolled
18452* Introduce 'PingLimiter' hook; see docs/hooks.txt for more information
18453* (bug 532) Tweaked alt text for some interface messages
18454* (bug 8231) Gave useful alt text to the main <img> on image pages
18455* (bug 371) Remove alt text for "Enlarge" icon on thumbnails
18456* Initialize user_editcount to 0 instead of NULL for newly created accounts
18457* (bug 3696) Strip LRM and RLM characters from titles to work around the
18458  problem some people have where titles cut-and-pasted from lists include
18459  the bidi override characters appended to the lists.
18460  A more thorough blacklist for forbidden and translatable characters would
18461  be wise, though, as might a cleaner method for the lists in the first place.
18462* Fix regression in email password resets on read-restricted sites
18463* Set tabindex on fields in deletion form so you don't have to tab through
18464  the links in the sitenotice
18465* (bug 8271) Show full time and date on viewer for individual deleted
18466  revisions
18467* (bug 8214) Output file size limit and actual file size in appropriate units
18468  on Special:Upload
18469* (bug 8016) Purge objectcache table during upgrade processes - use the
18470  --nopurge option to prevent this when running maintenance/update.php
18471* (bug 7612) Remove superfluous link to Special:Categories from result items
18472  on Special:Mostcategories
18473* {{PLURAL:}} now handles formatted numbers correctly
18474* (bug 8331) Added the change size value to watchlists; therefore made
18475  watchlists use RecentChange::newFromRow() instead of newFromCurRow()
18476* (bug 8351) Fix undo for simple reverts
18477* (bug 6856) User::clearNotification() does not respect read-only mode
18478* (bug 6853) Use a checkbox on the installer form to indicate that a superuser
18479  account should be used; this is clearer than the old check which relied on
18480  the password never being an obscure value
18481* Remove old unused watchlist cache, which was a leftover from the old schema
18482  where watchlists were more expensive to generate
18483* Minor cosmetic changes to Special:Userrights
18484* Added wgCanonicalSpecialPageName to JavaScript variables
18485* Fix image deleting when using Postgres.
18486* Output both source and destination titles in maintenance/moveBatch.php
18487* Added basic parser tests for language variants
18488* Enable selflinks and categories to be written in some of the language variants
18489* Prevent conversion of JavaScript code in language variants
18490* Output software version number in maintenance/parserTests.php
18491* (bug 7169) Use Ajax to watch/unwatch articles if enabled
18492* Make variant table caching a little more robust, using main language code
18493  in cache key. Probably this is still a bit wonky, though. Was breaking
18494  parser tests when Chinese tables were getting loaded into Serbian code.
18495* (bug 8380) Be nicer about blank lines in deleteBatch.php
18496* (bug 8401) Fix regression in SORBS lookup for some DNS setups
18497* Use raw file descriptor in posix_isatty() check to avoid warning on
18498  Linux systems with at least some versions of PHP
18499* (bug 5908) Allow overriding the default category sort key for all items on
18500  a page using {{DEFAULTSORT}}
18501* (bug 6449) Throw a more definitive error message when installation fails
18502  due to an invalid database name
18503* (bug 5827) Use full text for option link labels on Special:Watchlist
18504* (bug 8018) Allow hiding minor edits from the watchlist
18505* (bug 8427) MonoBook RTL IE 7.0 tweaks failed when sidebar's navigation
18506  section is renamed; no longer relies on first section name
18507* Stabilize client-side table sorting even if the underlying Javascript sort()
18508  implementation is unstable
18509* Add hook for extensions to add user information to the panel in preferences,
18510  next to the user name and ID.
18511* (bug 8392) Display protection status of transcluded pages in the edit page
18512  template list. Patch by Fyren, with i18n naming tweak.
18513* Fix for interwiki transclusion where target wiki uses query string for title
18514* Resolve namespaces on interwiki Title objects using canonical namespace names
18515  if possible (should not happen, though, outside interwiki transclusion... and
18516  maybe not even then, but it does)
18517* (bug 8447) Fix SQL typo breaking non-default $wgHitcounterUpdateFreq
18518* Do not allow previews of deleted images to be cached
18519* Add global variable $wgDefaultLanguageVariant used to set the default language
18520  variant of a wiki to something different than the main language code
18521* Add 'variant' option to parserTests - runs test with the given variant as
18522  preferred, utilize it for more parser tests of language variants code
18523* (bug 6503) Fix bug that stopped certain irrelevant links from being hidden
18524  for printing
18525* Avoid PHP warning in Creative Commons metadata when a creative commons
18526  license is not actually set up
18527* (bug 8463) Don't print external link icons for Monobook
18528* (bug 8461) Support watching pages on move
18529* (bug 8041) Work around bug with debug_backtrace when Zend Optimizer is
18530  loaded by skipping the function. Use wfDebugBacktrace() wrapper function.
18531* Reduce config file clutter by setting various script and upload paths
18532  based on $IP or $wgScriptPath in Setup.php. They can still be explicitly
18533  overridden in LocalSettings.php if desired...
18534* Attempt to detect redirect loops for the canonical title redirect, and
18535  give some hints to the poor confused administrator.
18536* Introduce new flag 'R' - raw output for language variant escape tags
18537* Advise users when updates for a query page have been disabled using
18538  $wgDisableQueryPageUpdate
18539* (bug 8413) Improve comments for $wgNamespaceRobotPolicies
18540* (bug 8330) Show "bytes" suffix on recent changes diff counter
18541  optionally... if set in rc-changes-size message (default empty for now)
18542* (bug 8489) Support basic links in <gallery> caption attribute
18543* (bug 8485) Correct Lingala number formatting
18544* The MediaWiki namespace is no longer pre-filled with default messages on
18545  install. All default messages will be removed from the MediaWiki namespace
18546  on upgrade.
18547* Recentchanges RSS/Atom feeds now use a separate message for the description
18548  to avoid cluttering it with useless wiki formatting
18549* (bug 8417) Handle EXIF unknown dates
18550* (bug 8372) Return nothing on empty <math> tags.
18551* New maintenance script to show the cached statistics : showStats.php.
18552* Count deleted edits when regenerating total edits in maintenance/initStats.php
18553* (bug 3706) Allow users to be exempted from IP blocks. The ipblock-exempt
18554  permission key has been added to enable this behavior, by default assigned to
18555  sysops.
18556* (bug 7948) importDump.php now warn that Recentchanges need to be rebuild.
18557* (bug 7667) allow XHTML namespaces customization
18558* (bug 8531) Correct local name of Lingála (patch by Raymond)
18559* Fix regression with default lock file and cache directories; threw visible
18560  warning with open_basedir
18561
18562
18563== 1.8 Compatibility changes ==
18564
18565=== Zend Optimizer ===
18566
18567A bug in some versions of PHP 5 and Zend Optimizer which was triggered under
18568MediaWiki 1.8.x has been worked around by disabling some internal debugging
18569features when Zend Optimizer is loaded. This should solve some common
18570"blank page" problems.
18571
18572=== PHP 5.0 64-bit ===
18573
18574MediaWiki now checks for a condition where PHP 5.0.x corrupts array data
18575on 64-bit systems and warns you to upgrade PHP to solve the problem. This
18576bug causes Special: pages to fail on affected systems under MediaWiki 1.8
18577and higher, and subtler data corruption on earlier versions.
18578
18579The only known workaround is to upgrade PHP to 5.1 or later, which you
18580probably should do anyway for security reasons!
18581
18582=== MySQL 5 ===
18583
18584MediaWiki should now install and run correctly on MySQL 5.0 and higher when
18585MySQL's "strict mode" is enabled. (This is now the default for many Windows
18586installations, though it seems to remain off by default on Unix.)
18587
18588This fixes errors about "cannot default default value for BLOB/TEXT fields".
18589
18590=== ImageMagick ===
18591
18592Note that ImageMagick older than 6.x may no longer work for image resizing
18593due to use of the -thumbnail option.
18594
18595
18596== 1.8 Behavior changes ==
18597
18598=== Localized special pages ===
18599
18600The names of Special: pages can now be localized, so links and URLs to them
18601are more legible in languages that aren't English.
18602
18603Not all languages have included localized names yet.
18604
18605=== E-mail password ===
18606
18607Users are now required to set a new password for themselves when they first
18608log in with a newly generated e-mailed password.
18609
18610Requesting passwords frequently is prevented to reduce abusive mailbombing.
18611
18612=== Undo revision ===
18613
18614An "undo" link now appears in diff view for easier reverting of older edits.
18615When GNU diff3 is available for edit conflict merging, this can make it much
18616easier to "undo" the changes of an older edit when there are surrounding
18617changes elsewhere in the page.
18618
18619The changes must be manually reviewed and approved, as with conventional
18620full-revision reverts.
18621
18622=== Blocking ===
18623
18624User blocks can be set to disable the automatic blocking of IP addresses the
18625account logs in with.
18626
18627
18628== 1.8 Database changes ==
18629
18630* new 'redirect' table stores data on page redirects
18631* new 'querycachetwo' table used for some cached special pages
18632* 'ipblocks' table adds 'ipb_enable_autoblock'
18633* 'recentchanges' table adds 'rc_old_len', 'rc_new_len' for size tracking
18634* 'user' table has added 'user_newpass_time' and 'user_editcount' fields
18635* some indexes have been updated on 'recentchanges'
18636
18637== 1.8 Configuration changes ==
18638
18639Several configuration options have changed since 1.8:
18640
18641=== $wgEnableAPI ===
18642
18643The experimental machine API interface is now enabled by default, read-only.
18644You can disable it by setting $wgEnableAPI = false; in LocalSettings.php.
18645
18646=== $wgPathInfo ===
18647
18648The use of PATH_INFO (the text after the script name in 'index.php/Blah')
18649is controlled by the $wgUsePathInfo setting. This is now explicitly disabled
18650for CGI, apache2filter, and ISAPI configurations of PHP, for more consistency
18651with the autodetection from the installer.
18652
18653In some rarer configurations you may have to switch $wgUsePathInfo from false
18654to true or, perhaps, from true to false to make things work properly if bad
18655PATH_INFO data comes through the server.
18656
18657The wiki now tries to detect this condition and should show you an error
18658message describing what to change instead of sending the browser into an
18659infinite redirect loop.
18660
18661=== $wgScript and other path settings ===
18662
18663The following configuration variables are now automatically set in Setup.php
18664if they are not overridden in LocalSettings.php:
18665
18666from $wgScriptPath:
18667 + $wgScript
18668 |  \- $wgArticlePath
18669 + $wgRedirectScript
18670 + $wgStylePath
18671 + $wgUploadPath
18672    \- $wgLogo
18673     + $wgMathPath
18674
18675from $IP:
18676 - $wgStyleDirectory
18677 + $wgUploadDirectory
18678   \- $wgMathDirectory
18679    + $wgTmpDirectory
18680
18681Newly generated configuration files will by default include only $wgScriptPath
18682(hardcoded from the installer) and $IP (detected at runtime).
18683
18684Old configuration files which specify all these values explicitly should
18685continue to work just fine, but if you use the defaults you can remove them
18686to reduce clutter.
18687
18688=== $wgGroupPermissions ===
18689
18690The sysop group now holds the "autopatrol" and "ipblock-exempt" rights by
18691default.
18692
18693"autopatrol" replaces the preference for marking ones own edits patrolled
18694by default; users holding this permission will automatically have their
18695edits patrolled, while others cannot mark their own edits as patrolled
18696even if they have patrolling rights.
18697
18698"ipblock-exempt" excludes the user from IP blocks; accounts which are blocked
18699explicitly by name will still be blocked, however. This is given to sysops
18700to minimize annoyance from accidental "collateral damage"; remember that a
18701sysop will be able to lift the block if they desire.
18702
18703The bot group now holds the "nominornewtalk" right. A user with this right
18704will not trigger new message notifications when making minor edits to user
18705talk pages. This is meant to minimize annoyance from maintenance bot
18706processes.
18707
18708=== $wgUseWatchlistCache ===
18709
18710Watchlist caching has been removed. The feature was not maintained, and has
18711been unnecessary since switching to the 'recentchanges' database table
18712reduced server pressure for Wikipedia's watchlists.
18713
18714=== $wgBreakFrames ===
18715
18716MediaWiki in the past attempted to detect when it was embedded in a frameset
18717and "break out" of it, assuming it to be hostile.
18718
18719This behavior is now disabled by default, but can be reenabled by setting
18720$wgBreakFrames to true in LocalSettings.php.
18721
18722
18723== 1.8 New settings ==
18724
18725=== $wgVariantArticlePath ===
18726
18727For languages with script variant support (Chinese, Serbian, and others),
18728it's possible to use alternate URL paths to select the variant for article
18729display, setting $wgVariantArticlePath.
18730
18731Documentation for this setting would be useful.
18732
18733=== $wgMaxMsgCacheEntrySize ===
18734
18735The message cache can now skip items larger than a given size; this allows
18736it to better handle the primary caching case when large CSS and JS blobs are
18737present.
18738
18739=== $wgStyleVersion ===
18740
18741When making significant changes to skin stylesheets and JavaScript files,
18742you can append a string to this variable to tweak the generated URLs,
18743forcing newly rendered pages to bring in a fresh version despite server-
18744or browser-side caching.
18745
18746Normally this will be set in the course of MediaWiki development, but
18747if doing development on a custom skin you may wish to poke it as well.
18748
18749=== $wgRCShowChangedSize ===
18750
18751Special:Recentchanges and Special:Watchlist now show the number of bytes
18752added or removed to an article to give an idea of the size of the edit.
18753This information was previously available only in the IRC update feeds.
18754
18755To disable this site-wide, set $wgRCShowChangedSize to false.
18756(Individual users can suppress the data in custom CSS.)
18757
18758Adjust $wgRCChangedSizeThreshold to trigger highlighting of particularly
18759large changes.
18760
18761The formatting of the size figure can be adjusted through the
18762[[MediaWiki:Rc-change-size]] message.
18763
18764=== $wgQueryCacheLimit ===
18765
18766The number of rows stored for "expensive" special pages in miser mode
18767can now be adjusted up or down from the default 1000.
18768
18769=== $wgDisableQueryPageUpdate ===
18770
18771Individual "expensive" special pages can be skipped in processing by
18772updateSpecialPages if added to this list.
18773
18774=== $wgSorbsUrl ===
18775
18776The base hostname for the DNS-based proxy blacklist can now be overridden
18777when $wgEnableSorbs is set, to use a different blacklist instead of SORBS.
18778The blacklist would need to respond the same was as SORBS; any positive
18779response will be taken as a proxy.
18780
18781=== $wgAjaxWatch ===
18782
18783Experimental AJAX mode for the watch/unwatch tabs to execute inline.
18784Does not include the UI messages describing how to reach the watchlist,
18785so you may not want it on a general-audience site just yet.
18786
18787=== $wgParserTestFiles ===
18788
18789MediaWiki's parser test suite can now be expanded with additional test
18790files. Custom extensions can add their test files to this array, and
18791they will be run along with the main tests by maintenance/parserTests.php
18792
18793= MediaWiki 1.8=
18794
18795== MediaWiki 1.8.5 ==
18796
18797September 10, 2007
18798
18799This is a security fix update to the Fall 2006 quarterly release snapshot. A
18800possible HTML/XSS injection vector in the API pretty-printing mode has been
18801found and fixed.
18802
18803The vulnerability may be worked around in an unfixed version by simply
18804disabling the API interface if it is not in use, by adding this to
18805LocalSettings.php:
18806
18807:[[Manual:$wgEnableAPI|$wgEnableAPI]] = false;
18808
18809(This is the default setting in 1.8.x.)
18810
18811Not vulnerable versions:
18812* 1.11 >= 1.11.0
18813* 1.10 >= 1.10.2
18814* 1.9 >= 1.9.4
18815* 1.8 >= 1.8.5
18816
18817Vulnerable versions:
18818* 1.11 <= 1.11.0rc1
18819* 1.10 <= 1.10.1
18820* 1.9 <= 1.9.3
18821* 1.8 <= 1.8.4 (if $wgEnableAPI has been switched on)
18822
18823MediaWiki 1.7 and below are not affected as they do not include the faulty
18824function, however the BotQuery extension is similarly vulnerable unless updated
18825to the latest SVN version.
18826
18827== MediaWiki 1.8.4 ==
18828
18829February 20, 2007
18830
18831This is a security and bug-fix update to the Fall 2006 quarterly release.
18832
18833An XSS injection vulnerability based on Microsoft Internet Explorer's UTF-7
18834charset autodetection was located in the AJAX support module, affecting MSIE
18835users on MediaWiki 1.6.x and up when the optional setting
18836[[Manual:$wgUseAjax|$wgUseAjax]] is enabled.
18837
18838If you are using an extension based on the optional Ajax module, either disable
18839it or upgrade to a version containing the fix:
18840* 1.9: fixed in 1.9.3
18841* 1.8: fixed in 1.8.4
18842* 1.7: fixed in 1.7.3
18843* 1.6: fixed in 1.6.10
18844
18845There is no known danger in the default configuration, with $wgUseAjax off.
18846
18847* (bug [[bugzilla:8819|8819]]) Fix full path disclosure with skins dependencies
18848* Add 'charset' to Content-Type headers on various HTTP error responses to
18849forestall additional UTF-7-autodetect XSS issues. PHP sends only 'text/html' by
18850default when the script didn't specify more details, which some inconsiderate
18851browsers consider a license to autodetect the deadly, hard-to-escape UTF-7.
18852This fixes an issue with the Ajax interface error message on MSIE when
18853[[Manual:$wgUseAjax|$wgUseAjax]] is enabled (not default configuration); this
18854UTF-7 variant on a previously fixed attack vector was discovered by Moshe BA
18855from BugSec: http://www.bugsec.com/articles.php?Security=24
18856* Trackback responses now specify XML content type
18857
18858== MediaWiki 1.8.3 ==
18859
18860January 9, 2007
18861
18862MediaWiki 1.8.3 fixes several issues in the Fall 2006 snapshot release:
18863
18864* ([[mediazilla:7831|7831]]) Regression in AutoAuthenticate hook
18865* Run PHP install version checks on update.php so command-line updaters see new
18866version requirements
18867* Do a check for the PHP 5.0.x 64-bit bug, since this is much more disruptive
18868as of MW 1.8 than it used to be. Install or upgrade now aborts with a warning
18869and a request to upgrade.
18870* XSS fix in AJAX module
18871
18872An XSS injection vulnerability was located in the AJAX support module,
18873affecting MediaWiki 1.6.x and up when the optional setting $wgUseAjax is
18874enabled.
18875
18876There is no danger in the default configuration, with $wgUseAjax off.
18877
18878If you are using an extension based on the optional AJAX module, either disable
18879it or upgrade to a version containing the fix:
18880
18881== MediaWiki 1.8.2 ==
18882
18883October 13, 2006
18884
18885MediaWiki 1.8.2 fixes several issues in the Fall 2006 snapshot release:
18886
18887* ([[mediazilla:7565|7565]]) Fixed typos in German localisation
18888* ([[mediazilla:7562|7562]]) Fix non-ASCII namespaces on Windows/XAMPP servers
18889
18890== MediaWiki 1.8.1 ==
18891
18892October 11, 2006
18893
18894MediaWiki 1.8.1 fixes several issues in the Fall 2006 snapshot release:
18895
18896* Fix PHP notice and estimates for dumpBackup.php and friends
18897* Improved register_globals paranoia checks
18898* ([[mediazilla:7545|7545]]) Fix PHP version check on install
18899* Experimental web API disabled by default
18900* Disable PHP exception backtrace printing unless $wgShowExceptionDetails is
18901set. Backtraces may contain sensitive information in function call parameters.
18902
18903== MediaWiki 1.8.0 ==
18904
18905October 10, 2006
18906
18907This is the quarterly release snapshot for Fall 2006. While the code has been
18908running on Wikipedia for some time, installation and upgrade bits may be less
18909well tested. Bug fix releases may follow in the coming days or weeks.
18910
18911MediaWiki is now using a "continuous integration" development model with
18912quarterly snapshot releases. The latest development code is always kept "ready
18913to run", and in fact runs our own sites on Wikipedia.
18914
18915Release branches will continue to receive security updates for about a year
18916from first release, but nonessential bugfixes and feature development happen
18917will be made on the development trunk and appear in the next quarterly release.
18918
18919Those wishing to use the latest code instead of a branch release can obtain it
18920from source control: [[Download from SVN]]
18921
18922== Configuration changes ==
18923* $wgUseETag, to enable/disable sending of HTTP ETag headers (default: disabled)
18924* $wgLegalTitleChars now includes '+' by default for better compatibility with
18925importing data dumps from Wikipedia
18926* $wgDefaultUserOptions now includes all default option settings instead of
18927only overrides.
18928
18929== Major new features ==
18930* ([[mediazilla:7098|7098]]) Add an option to disable/enable sending of HTTP
18931ETag headers, as it seems to result in broken behaviour in combination with
18932Squid 2.6 (disabled by default).
18933* ([[mediazilla:550|550]]) Allow blocks on anonymous users only.
18934* ([[mediazilla:6420|6420]]) Render thumbnails for DJVU images, support
18935multipage DJVU display on image pages. Added new 'page=' thumbnail option to
18936select a page from a multipage djvu for thumbnail generation.
18937* Full Postgres support is now enabled. It requires version 8.1 or better, and
18938needs to have both plpgsql and tsearch2 already installed.
18939* ([[mediazilla:6386|6386]]) fix grammatical errors in danish naming of talk
18940namespaces.
18941
18942== Changes since 1.7 ==
18943
18944* Introduced AjaxResponse object, superceding AjaxCachePolicy
18945* Changes to sajax_do_call: optionally accept an element to fill instead of a
18946  callback function; take the target function or element as a third parameter;
18947  pass the full XMLHttpRequest object to the handler function, instead of just
18948  the resultText value; use HTTP response codes to report errors.
18949* (bug 6562) Removed unmaintained ParserXml.php for now
18950* History paging overlap bug fixed
18951* (bug 6586) Regression in "unblocked" subtitle
18952* Don't put empty-page message into view-source when page text is blank
18953* (bug 6587) Remove redundant "allnonarticles" message
18954* Block improvements: Allow blocks on anonymous users only. Optionally allow
18955  or disallow account creation from blocked IP addresses. Prevent duplicate
18956  blocks. Fixed the problem of expiry and unblocking erroneously affecting
18957  multiple blocks. Fixed confusing lack of error message when a blocked user
18958  attempts to create an account. Fixed inefficiency of Special:Ipblocklist in
18959  the presence of large numbers of blocks; added indexes and implemented an
18960  indexed pager.
18961* (bug 6448) Allow filtering of Special:Newpages according to username
18962* (bug 6618) Improve permissions/error detection in Special:Lockdb
18963* Quick hack for extension testing: parser test doesn't create new message
18964  cache object.
18965* (bug 6299) Maintain parser's revision ID across recursive calls to fix
18966  {{REVISIONID}} when Cite extension is used
18967* (bug 6622) Removed deprecated function Image::newFromTitle
18968* (bug 6627) Fix regression in Special:Ipblocklist with table prefix
18969* Removed forced dereferencements (new() returns a reference in PHP5)
18970* Note about $wgUploadSizeWarning using byte
18971* (bug 6592) Add most viewed pages summary to Special:Statistics
18972* Pre-strip characters ignored in IDNs from URLs so they can't be used
18973  to break the blacklists for regular URLs
18974* Fix regression in blocking of user accounts
18975* (bug 6635) Fix regression searching for range blocks on Ipblocklist
18976* Fix regression searching Ipblocklist with ugly URLs
18977* (bug 6639) Use a consistent default for upload directories
18978* Preserve entered reason when reporting unconfirmed lock on Special:Lockdb
18979* (bug 6642) Don't offer to unlock the database when it isn't locked
18980* cleanupTitles.php changed from --dry-run option to --fix, so default
18981  behavior is now a non-invasive check as with namespaceDupes.php
18982* (bug 6660) Fix behavior of EditPage::blockedPage() when the article does
18983  not exist; now doesn't show the source box if the user hasn't provided it
18984  (blocked mid-edit) and the page doesn't exist
18985* Improve default value of "blockedtext"
18986* (bug 6680) Added localisation for Dutch bookstore list (nl)
18987* Renamed maintainace script redundanttrans.php to unusedMessages.php - clearer
18988  usage
18989* Fix regression which allowed some blocked users to create additional accounts
18990* (bug 6657) Fix Hungarian linktrail
18991* (bug 6751) Fix preview of blanked section with edit on first preview option
18992* (bug 5456) Separate MediaWiki:Search into messages for both noun and verb,
18993  introduced 'MediaWiki:Searchbutton'
18994* Made lines from initialiseMessages() appear as list items during installation
18995* Moved the bulk of the localisation data from the Language*.php files to the
18996  Messages*.php files. Deleted most of the Languages*.php files.
18997* Introduced "stub global" framework to provide deferred initialisation of core
18998  modules.
18999* Removed placeholder values for $wgTitle and $wgArticle, these variables will
19000  now be null during the initialisation process, until they are set by index.php
19001  or another entry point.
19002* Added DBA cache type, for BDB-style caches.
19003* Removed custom date format functions, replacing them with a format string in
19004  the style of PHP's date(). Used string identifiers instead of integer
19005  identifiers, in both the language files and user preferences. Migration should
19006  be transparent in most cases.
19007* Simplified the initialisation API for LoadBalancer objects.
19008* Removed the broken altencoding feature.
19009* Moved default user options and toggles from Language to User. Language objects
19010  are still able to define default preference overrides and extra user toggles,
19011  via a slightly different interface.
19012* Don't include the date option in the parser cache rendering hash unless
19013  $wgUseDynamicDates is enabled.
19014* Merged LanguageUtf8 with Language. Removed LanguageUtf8.php.
19015* Removed inclusion of language files from the bottom of Language.php. This is
19016  now consistently done from Language::factory().
19017* Add the name of the executing maintenance script to the debug log. Start the
19018  profiler during maintenance scripts.
19019* Added "serialized" directory, for storing precompiled data in serialized form.
19020* Fix regression in auto-set NS_PROJECT_TALK namespace
19021* Fix regression in ordering of namespaces
19022* (bug 6806, 6030) Added several global JS variables for article path, user
19023  name, page title, etc.
19024* hooks registered with addOnloadHook are now called at the one of the html body
19025  by all skins.
19026* Split ajax aided search from core ajax framework. Use wgUseAjax to enable the
19027  framework and wgAjaxSearch to enable the suggest feature for the search box.
19028* Added experimental installer for extensions.
19029  See maintenance/installExtension.php
19030* Added Tajic (tg) language file.
19031* (bug 6903) Added Cantonese localisation (zh-yue)
19032* Fix regression in Korean and Japanese date formatting (day of week)
19033* (bug 6919) Add English alias magic words for Tatar (tt) language file.
19034* (bug 6753) Fixed broken Kazakh linktrail (kk)
19035* (bug 6700) Added Kazakh language variants to Names.php
19036* (bug 6827) some i18n specific maintenance scripts fails after merge of
19037  localisation-work branch
19038* Throwed an exception for the deprecated functions OutputPage::sysopRequired
19039  and OutputPage::developerRequired - use OutputPage::permissionRequired
19040  instead.
19041* Removed the deprecated functions User::isSysop, User::isBureaucrat and
19042  User::isDeveloper - use User::isAllowed instead.
19043* (bug 769) OutputPage::permissionRequired() should suggest groups with the
19044  needed permission
19045* (bug 6971) Fix regression in Special:Export history view
19046* Revamped Special:Imagelist
19047* (bug 7000) updated MessagesPl.php
19048* (bug 6946) Fix unexpected behavior change with GET hits to Special:Export
19049* (bug 1866) Improve navigation on Special:Listusers; user now a starting
19050  point as with Special:Allpages, rather than a pure limit.
19051* Clean up tab order on Special:Blockip
19052* (bug 5969) Clean up tab order on Special:Userlogin forms
19053* (bug 3512) namespaceDupes now handles spaces and initial caps properly
19054* (bug 7037) Fix regression in login tab order
19055* (bug 7031) Report missing email on 'email password' instead of false success
19056* (bug 7010) Don't send email notifications for watched talk pages when user
19057  has selected to receive only updates for their own talk page
19058* Added {{CURRENTHOUR}}
19059* Added [[:Image:Foo.png]] style links to the pagelinks table
19060* Avoid duplicate revision imports with Special:Import
19061* (bug 7054) Validate email address before sending email confirmation message
19062* (bug 7061) Format title on "from (page)" links on Special:Allpages
19063* (bug 7044) Introduce "padleft" and "padright" colon functions
19064* Pass page title as parameters to "linkshere" and "nolinkshere" and update
19065  default message text
19066* Allows to upload from publicy accessible URL. Set $wgAllowCopyUploads = true;
19067  in LocalSettings.php
19068  Limited to $wgMaxUploadSize (default:100MB); URL upload is limited to sysops
19069  by default, and displayed as a second line if appropriate
19070* (bug 832) Return to user page after emailing a user
19071* (bug 366) Add local-system-timezone equivalents for date/time variables
19072* (bug 7109) Fix Atom feed version number in header links
19073* (bug 7075) List registered parser function hooks on Special:Version
19074* (bug 7059) Introduce "anchorencode" colon function
19075* Include SVN revision number in {{CURRENTVERSION}} output, where applicable
19076* Fix bug in wfRunHooks which caused corruption of objects in the hook list
19077* (bug 4979) Use simplified email addresses when running on Windows
19078* (bug 4434) Show block log fragment on Special:Blockip
19079* [[MediaWiki:Disambiguationspage]] may optionally contain wiki links to any
19080  number of disambiguation templates.
19081* [[Special:Disambiguations]] now shows pages in NS:0 that link to any pages
19082  that embed any of the templates listed at [[MediaWiki:Disambiguationspage]].
19083* Fix formatting of titles on Special:Undelete
19084* (bug 7026) Fix action=raw&templates=expand
19085* (bug 6976) Add namespace and direction classes to classic skins
19086* (bug 7144) Don't "return to main" from OutputPage::loginToUse() if the user
19087  can't read the main page in the first place
19088* (bug 7188) Fix minor borkage in HTMLForm
19089* (bug 6675) Replaced message 'watchthis' with new message 'watchthisupload in
19090  Special:Upload
19091* Add a quickie script dumpSisterSites.php for generating a page list in the
19092  format for WSR-1 SisterSites support
19093* (bug 7223) Monobook.js is used for site content, should not be localized
19094* Set default disabled values for DjVu render options
19095* Added Xml::option() for generating <option>s easily
19096* Localized page numbers in drop-down for DjVu page selection
19097* Fixed linktrail for vi
19098* (bug 6893) "Call to a member function exists() on a non-object" on
19099  trackback.php with bad input
19100* (bug 6886) PHP undefined offset on bad input to Special:Revisiondelete
19101* (bug 6887) PHP error for call to getId() on bad input to
19102  Special:Revisiondelete
19103* (bug 6888) PHP error for call to getTimestamp() on bad input to
19104  Special:Revisiondelete
19105* (bug 7252) Use dvipng support in texvc math rastrization. dvipng is required
19106  if texvc is rebuilt.
19107* (bug 7279) Use wfBaseName in place of basename() in more places
19108* Clear newtalk marker on diff links with explicit current revision number
19109* (bug 7064) Replace hard-coded empty message checks with wfEmptyMsg calls
19110* (bug 6777) Remove some PHP 4 compat cruft
19111* Add --user, --comment, and --license options to importImages.php
19112* (bug 6216) The immobile namespace message does not mention the source page
19113* (bug 7299) Normalize username filter on Special:Newpages
19114* (bug 7306) RTL text in an LTR wiki breaks appearance of Special:Recentchanges
19115* (bug 7312) Don't emit SET NAMES utf8 if connection failed
19116* (bug 7305) Proper compare for bot check on RC notify, should fix overrides
19117  that force edits by non-bot users to bot mode
19118* Set Vary: Cookie on action=raw generated CSS and JS, to ensure that user
19119  preferences don't get stuck in proxy caches for other people
19120* (bug 7324) Fix error message for failure of Database::sourceFile()
19121* (bug 7309) Plurals: use singular form for zero in French and Brazilian
19122  Portuguese
19123* Add page_no_title_convert field to support language variant conversion
19124  for page titles which shouldn't be converted on display/linking
19125* Lazy extraction of text chunks in Revision objects, may reduce hits to
19126  external storage when actual text content is not used
19127* Added experimental $wgRevisionCacheExpiry to cache extracted revision text
19128  in $wgMemc, to further reduce hits to external storage.
19129  Set to 0 (disabled) by default.
19130* Minor changes to the installer.
19131* Remove ":" for 'youremail' and 'yourrealname' in
19132  includes/templates/Userlogin.php so that ":" could be used in i18n for
19133  Special:Preferences (like 'username' and 'uid').
19134* Fix layout for Special:Preferences->Date and Time (position for
19135  'timezonetext').
19136* Updates to language variant code for Serbian et al
19137* (bug 6756) Enabling RTL direction for kk-cn
19138* (bug 6701) Kazakh language variants in MessagesEn.php
19139* (bug 7335) SVN revision check in Special:Version fails on SVN 1.4 working copy
19140* (bug 6518) Replaced 'lastmodified' with 'lastmodifiedat' and 'lastmodifiedby'
19141  with 'lastmodifiedatby' with separated parameters for date and time to allow
19142  better localisation. Updated all message files to display the old format for
19143  compatibility.
19144* (bug 7357) Make supposedly static methods of Skin actually static
19145* Added info text to Special:Deadendpages and Special:Lonelypages
19146* Fix regression in cachability of generated CSS and JS for MonoBook skin,
19147  while avoiding clobbering of different users' cached data
19148* (bug 6849) Block @ from usernames; interferes with multi-database tools and
19149  was meant to be banned years ago... For now existing accounts will not be
19150  prevented fromm login.
19151* (bug 6092) Introduce magic words {{REVISIONDAY}}, {{REVISIONDAY2},
19152  {{REVISIONMONTH}}, {{REVISIONYEAR}} and {{REVISIONTIMESTAMP}}
19153* (bug 7425) Preceeding whitespace in [[...]] breaks subpages
19154* Try to reconnect after transitory database errors in dumpTextPass.php
19155* (bug 6023) Fixed mismatch of 0/NULL for wl_notificationtimestamp; now
19156  notification mails are working after 'Mark all pages visited' button on
19157  Special:Watchlist is clicked
19158* Made {{INT:}} a core parser function instead of a special case. The syntax
19159  and behavior is largely unchanged.
19160* (bug 7448) Fixing the native name for Ewe (ee)
19161* (bug 6864) Replace message 'editing' with new message 'editinguser' in
19162  Special:Userrights to allow better localisation
19163* Add '*-summary' for special pages to MessagesEn.php to allow
19164  customizing/translation directly through Special:Allmessages
19165* (bug 6130, bug 5818) Replaced message 'go'  with the new message
19166  'searcharticle' in skins to allow better localisation
19167* Add + to $wgLegalTitleChars by default. Some sites may have occasional
19168  problems with hard-to-reach pages, but it should be less trouble than
19169  "I can't import dumps from Wikipedia" complaints
19170* (bug 7460) Revert broken patch for bug 7226 which slows down
19171  Special:Allmessages by a factor of 16
19172* Committed a bunch of live hacks from Wikimedia servers
19173* (bug 6889) PHP notices in thumb.php with missing params
19174* Cleaner error behavior on thumb.php with invalid page selection
19175* (bug 6617) Validate timestamps on Special:Undelete
19176* Do fewer unnecessary full writes of user rows; only update user_touched
19177  for watch/unwatch, group membership change, and login operations
19178* Restructured the languages directory, to avoid problems when people
19179  untar MW 1.8 over the top of a 1.7 installation.
19180* (bug 6890) SQL query error on bad input to Pager lists
19181  due to negative LIMIT clause, caused by integer wraparound.
19182* Fixed various bugs related to table prefixes, especially the interaction
19183  between table prefixes and memcached, which was formerly completely broken.
19184* (bug 7004) PHP iconv() notice on bad password input to Special:Userlogin.
19185* (bug 6826) Extend pre-save transform context link ("pipe trick")
19186  syntax to pages with commas in title
19187* Use ImageMagick -thumbnail option instead of -resize to avoid including
19188  excessive metadata in thumbs (requires ImageMagick 6.0.0 or newer).
19189* (bug 7499) Corrections to Swedish talk namespace names
19190* (bug 7508) Added option to compress HTML pages by dumpHTML.php
19191* (bug 7519) Add plural in SpecialWatchlist
19192* (bug 7459) Magic word variables are always case sensitive
19193* Replaced {{SERVER}}{{localurl:xxx}} with {{fullurl:xxx}} in localisation files
19194* Fix regression in Special:Watchlist text header
19195* (bug 7510) Update article counts etc on undelete
19196* (bug 7520) Update article counts on XML import
19197* (bug 7526) Make $wgDefaultUserOptions work again
19198* (bug 7472) Localize Help namespace for Basque
19199* (bug 7529) Including a non-existent category in an article places that article
19200  in the category
19201* (bug 4528) Lack of important LaTeX functions stackrel, rightleftharpoon
19202* (bug 6721) missing symbols ulcorner, urcorner, llcorner, lrcorner,
19203  twoheadrightarrow, twoheadleftarrow
19204* (bug 7367) Hyphens sometimes erroneously appended to equations when not
19205  converted to PNG
19206* Add "title" to the opensearch link to allow automatic adding of the search
19207  engine in Firefox 2
19208* (bug 7537) Add php5 to $wgFileBlacklist
19209* (bug 6929) Restore AutoAuthenticate hook
19210
19211== Languages updated ==
19212* Albanian (sq)
19213* Bashkir (ba)
19214* Bavarian (bar) stub file
19215* Belarusian (be)
19216* Bishnupriya (bpy) stub file
19217* Brazilian Portuguese (pt-br)
19218* Cantonese (zh-yue)
19219* Catalan (ca)
19220* Czech (cs)
19221* Dutch (nl)
19222* English (en)
19223* Finnish (fi)
19224* French (fr)
19225* Georgian (ka)
19226* German (de)
19227* Hebrew (he)
19228* Hungarian (hu)
19229* Indonesian (id)
19230* Japanese (ja)
19231* Korean (ko)
19232* Latin (la)
19233* Lojban (jbo)
19234* Macedonian (mk)
19235* Mazandarani (mzn)
19236* Polish (pl)
19237* Portuguese (pt)
19238* Ripuarian (ksh)
19239* Romani (rmy)
19240* Russian (ru)
19241* Slovak (sk)
19242* Spanish (es)
19243* Tajic (tg)
19244* Tatar (tt)
19245* Telugu (te)
19246* Uzbek (uz)
19247* Yiddish (yi)
19248
19249== Compatibility ==
19250MediaWiki 1.8 requires PHP 5 (5.1 recommended). PHP 4 is no longer supported.
19251
19252MySQL 3.23.x is no longer supported; some older hosts may need to upgrade. At
19253this time we still recommend 4.0, but 4.1/5.0 will work fine in most cases.
19254
19255== Upgrading ==
19256Some minor database changes have been made since 1.7:
19257* new fields and indexes on ipblocks
19258* index change on recentchanges
19259
19260Several changes from 1.5 and 1.6 do require updates to be run on upgrade. To
19261ensure that these tables are filled with data, run refreshLinks.php after the
19262upgrade.
19263
19264If you are upgrading from MediaWiki 1.4.x or earlier, some major database
19265changes are made, and there is a slightly higher chance that things could
19266break. Don't forget to always back up your database before upgrading!
19267
19268=== Caveats ===
19269Some output, particularly involving user-supplied inline HTML, may not produce
19270100% valid or well-formed XHTML output. Testers are welcome to set $wgMimeType
19271= "application/xhtml+xml"; to test for remaining problem cases, but this is not
19272recommended on live sites. (This must be set for MathML to display properly in
19273Mozilla.)
19274
19275= MediaWiki 1.7=
19276
19277== MediaWiki 1.7.3 ==
19278
19279February 20, 2007
19280
19281This is a security and bug-fix update to the Summer 2006 quarterly release.
19282
19283An XSS injection vulnerability based on Microsoft Internet Explorer's UTF-7
19284charset autodetection was located in the AJAX support module, affecting MSIE
19285users on MediaWiki 1.6.x and up when the optional setting
19286[[Manual:$wgUseAjax|$wgUseAjax]] is enabled.
19287
19288If you are using an extension based on the optional Ajax module, either disable
19289it or upgrade to a version containing the fix:
19290
19291* 1.9: fixed in 1.9.3
19292* 1.8: fixed in 1.8.4
19293* 1.7: fixed in 1.7.3
19294* 1.6: fixed in 1.6.10
19295
19296There is no known danger in the default configuration, with
19297[[Manual:$wgUseAjax|$wgUseAjax]] off.
19298
19299* Add 'charset' to Content-Type headers on various HTTP error responses to
19300forestall additional UTF-7-autodetect XSS issues. PHP sends only 'text/html' by
19301default when the script didn't specify more details, which some inconsiderate
19302browsers consider a license to autodetect the deadly, hard-to-escape UTF-7.
19303This fixes an issue with the Ajax interface error message on MSIE when
19304[[Manual:$wgUseAjax|$wgUseAjax]] is enabled (not default configuration); this
19305UTF-7 variant on a previously fixed attack vector was discovered by Moshe BA
19306from BugSec: http://www.bugsec.com/articles.php?Security=24
19307* Trackback responses now specify XML content type
19308
19309== MediaWiki 1.7.2 ==
19310
19311January 9, 2007
19312
19313* Note about $wgUploadSizeWarning using byte
19314* Update to German bookstore list (de)
19315* (bug [[bugzilla:6680|6680]]) Added localisation for Dutch bookstore list (nl)
19316* (bug [[bugzilla:6708|6708]]) Minor updates to Russian translation (ru)
19317* (bug [[bugzilla:6730|6730]]) Clearer usage of message 'titlematch' in German
19318translation (de)
19319* Added direction mark to Special:Listredirects
19320* XSS fix in AJAX module
19321
19322An XSS injection vulnerability was located in the AJAX support module,
19323affecting MediaWiki 1.6.x and up when the optional setting
19324[[Manual:$wgUseAjax|$wgUseAjax]] is enabled.
19325
19326There is no danger in the default configuration, with
19327[[Manual:$wgUseAjax|$wgUseAjax]] off.
19328
19329If you are using an extension based on the optional AJAX module, either disable
19330it or upgrade to a version containing the fix:
19331
19332* 1.9: fixed in 1.9.0rc2
19333* 1.8: fixed in 1.8.3
19334* 1.7: fixed in 1.7.2
19335* 1.6: fixed in 1.6.9
19336
19337
19338== MediaWiki 1.7.1 ==
19339
19340July 8, 2006
19341
19342MediaWiki 1.7.1 is a security and bugfix maintenance release of the Summer 2006
19343snapshot:
19344
19345A potential HTML/JavaScript-injection vulnerability in a debugging script has
19346been fixed. Only versions and configurations of PHP vulnerable to the $GLOBALS
19347overwrite vulnerability are affected.
19348
19349As a workaround for existing installs, profileinfo.php may simply be deleted if
19350it's not being used.
19351
19352* Fix for 'emailconfirmed' implicit user group
19353* Fix for upgrades on some versions of MySQL 4.0.x
19354* Fixed potential XSS in profileinfo.php
19355* Installer now shows clear error message about old PHP versions rather than a
19356confusing parse error
19357
19358== MediaWiki 1.7.0 ==
19359July 6, 2006
19360
19361This is the quarterly release snapshot for Summer 2006. While the code
19362has been running on Wikipedia for some time, installation and upgrade
19363bits may be less well tested. Bug fix releases may follow in the coming
19364days or weeks.
19365
19366MediaWiki is now using a "[[w:en:Continuous_integration|continuous
19367integration]]" development model with
19368quarterly snapshot releases. The latest development code is always kept
19369"ready to run", and in fact runs our own sites on Wikipedia.
19370
19371Release branches will continue to receive security updates for about a year
19372from first release, but nonessential bugfixes and feature development happen
19373will be made on the development trunk and appear in the next quarterly release.
19374
19375Those wishing to use the latest code instead of a branch release can obtain
19376it from source control: [[Download from SVN]]
19377
19378== Changes since 1.6 ==
19379
19380* (bug 5458) Fix double-URL encoding in block log link in contribs and contribs
19381  link in block log
19382* (bug 5462) Bogus missing patch warning in updater
19383* (bug 5461) Use of deprecated "showhideminor" in Special:Recentchangeslinked
19384* PHP warning when allow_call_time_pass_reference is off
19385* Update to Finnish localization
19386* (bug 5467) Link to page histories in watchlist edit mode
19387* Further additions to Hebrew localisation
19388* (bug 5476) Invalid xhtml in German localization
19389* (bug 5479) Id translation for preferences tabs caption
19390* (bug 5493) Id translation for special pages
19391* Added skinname and style path parameters to CBT version of MonoBook
19392* Include subversion revision number in Special:Version if available
19393* (bug 5344) Fix regression that broke slashes in extension tag parameters
19394* Improve Special:Log performance on big log sets
19395* (bug 5507) Changed mediawiki:logouttext from plain to wikitext
19396* (bug 4760) Prevent creation of entries in protection log when protection
19397  levels haven't changed
19398* (bug 861) Show page protection/unprotection events in histories
19399* (bug 5499) Don't clear the tag strip state when asked not to clear state.
19400  Fixes regression with use of <ref> in a template breaking <nowiki> etc.
19401* Minor improvements to English language files
19402* Display the anon talk page info message on anon talk pages again
19403  (moved outside the parser cache)
19404* Optional {{DISPLAYTITLE|title with markup}} magic word
19405  Deactivated by default, set "$wgAllowDisplayTitle = true" in LocalSettings.php
19406  to activate
19407* Cleaned SpecialContributions a bit
19408* Added a table to track interlanguage links
19409* (bug 5544) Fix redirect arrow in Special:Listredirects for right-to-left
19410  languages
19411* Replace "doubleredirectsarrow" with a content language check that picks the
19412  appropriate arrow
19413* (bug 5537) Add stub language file for Samogitian (bat-smg); inherits
19414  Lithuanian (lt)
19415* Don't force edit summaries when a user is editing their own user/talk page
19416* (bug 5510) Warning produced when using {{SUBPAGENAME}} in some namespaces
19417* (bug 385) Installer support for PostgreSQL, fixes for PG compatibility
19418* PersistentObject removed; it doesn't do anything and was broken besides.
19419  All extensions using it have been corrected.
19420* Propagate ISBN number for Booksources in LanguageNo.php
19421* (bug 5548) Improvements to Indonesian localisation [patch: Ivan Lanin]
19422* Add TALKSPACE, SUBJECTSPACE, TALKPAGENAME, SUBJECTPAGENAME (and encoded forms
19423  for all) magic words
19424* (bug 5403) Fix Special:Newpages RSS/Atom feeds
19425* Reject malformed addresses in X-Forwarded-For entries
19426* (bug 3359) Add hooks on completion of file upload
19427* (bug 5559) Improve detection of ImageMagick [patch: Greg Turnquist]
19428* (bug 5475) New pages feeds ignore "limit" argument
19429* (bug 5184) CSS misapplied to elements in Special:Allmessages due to
19430  conflicting anchor identifiers
19431* (bug 5519) Allow sidebar cache to be disabled; disable it by default.
19432* Maintenance script to import the contents of a text file into a wiki page
19433* Add $wgReservedUsernames configuration directive to block account creation/use
19434* (bug 5576) Remove debugging hack in session check
19435* (bug 5426) Lowercase treatment of titles in rights log leads to broken links
19436  on Special:Log
19437* Minor improvements to French localisation files
19438* (bug 5181) Update "nogomatch" for Slovak
19439* (bug 5594) Id translation up to # Login and logout pages section
19440* (bug 5536) Use content language for editing help link
19441* Improvements to German localisation files
19442* (bug 5570) Problems using <special page>/parameter link form for long titles
19443* (bug 3884) Add $user parameter to AddNewUser hook, call it for by-email
19444  registrations as well as self-registrations.
19445* (bug 4327) Report age of cached data sets in query pages
19446* (bug 4662) Fix Safari check in wikibits.js
19447* (bug 4663) Edit toolbar enabled in compatible versions of Safari
19448* (bug 5572) Edit toolbar enabled in compatible versions of Konqueror (3.5+)
19449* (bug 5235) Edit toolbar tooltips no longer show JavaScript junk in Opera
19450* Edit toolbar now works in pure XHTML mode (application/xhtml+xml)
19451* Add watchlist clear function to allow quick purging of all items
19452* (bug 5625) Additional namespace translations for Welsh
19453* Add meta tag and JavaScript variables to cached special pages which provides
19454  the timestamp of the last update, in YYYYMMDDHHMMSS format.
19455* (bug 5628) More translations for MessagesHr.php
19456* (bug 5595) Localisation for Bosnian language (bs)
19457* (bug 2910) Default view preferences for watchlists
19458* Add "hide bot edits from the watchlist" user preference
19459* (bug 5250) Introduce Special:Unusedtemplates
19460* Add user preference setting for an extended watchlist, showing all recent
19461  edits up to a certain edit, and not just the latest edit..
19462* Made MessageRo.php more general
19463* (bug 5640) Indonesian localisation improvements
19464* (bug 5592) Actions are logged with the default language for the
19465   wiki, not the language of the user performing the operation.
19466* (bug 5644) Error in LanguageBs.php file
19467* (bug 5646) Compare for identical types in wfElement()
19468* (bug 5472) Language::userAdjust()->minDiff not initialized on else condition
19469* (bug 5386) LanguageMk.php: updated namespaces translations
19470* (bug 5422) Stub for Romani (rmy) language which extends ro
19471* Fix linktrail for LanguageSr
19472* (bug 5664) Fix Bosnian linktrail
19473* (bug 3825) Namespace filtering on Special:Newpages
19474* (bug 1922) When Special:Wantedpages is cached, mark links to pages
19475  which have since been created
19476* (bug 5659) Change grammar hacks for Bosnian Wikimedia namespaces.
19477  This sort of special casing should be removed and fixed properly.
19478* Remove useless whitespace from Special:Brokenredirects header
19479* Treat "allmessagesnotsupporteddb" as wikitext when echoing; change default
19480  text
19481* (bug 5497) Regression in HTML normalization in 1.6 (unclosed <li>,<dd>,<dt>)
19482* (bug 5709) Allow customisation of separator for categories
19483* (bug 5684) Introduce Special:Randomredirect
19484* (bug 5611) Add a name attribute to the text box containing source text in
19485  read-only pages
19486* Indicate when a protected page is an interface message ("protectedinterface")
19487* (bug 4259) Indicate when a protected page being edited is an interface message
19488  ("editinginterface")
19489* (bug 4834) Fix XHTML output when using $wgMaxTocLevel
19490* Pass login link to "whitelistedittext" containing 'returnto' parameter
19491* (bug 5728): mVersion missing from User::__sleep() leading to constant cache
19492  miss
19493* Updated maintenance/transstat.php so it can show duplicate messages
19494* Improvements to update scripts; print out the version, check for superuser
19495  credentials before attempting a connection, and produce a friendlier error if
19496  the connection fails
19497* (bug 5005) Fix XHTML <gallery> output.
19498* (bug 5315) "Expires: -1" HTTP header made strictly valid (using 1970 date).
19499* (bug 4825) note in DefaultSettings.php about 'profiling' table creation
19500* Remove unneeded extra whitespace at top of Special:Categories
19501* (bug 5679) time units are now using local numerals
19502* (bug 5751) Updates to Portuguese localisation files
19503* (bug 5741) Introduce {{NUMBEROFUSERS}} magic word
19504* (bug 93) <nowiki> tags and tildes in templates
19505* The returnto parameter is now actually used by SpecialUserlogin.php
19506* Parser can now know that it is parsing an interface message
19507* (bug 4737) MediaWiki:Viewcount supports {{PLURAL}} now
19508* Fix bug in wfMsgExt under PHP 5.1.2
19509* (bug 5761) Project talk namespace broken in Xal, Os, Udm and Cv
19510* Rewrite reassignEdits script to be more efficient; support optional updates to
19511  recent changes table; add reporting and silent modes
19512* Cleaned up formatNum usage in langfiles
19513* (bug 5716) Warn when a user tries to upload a file which was previously
19514  deleted
19515* (bug 5565) Add a class attribute to the table on Special:Allpages
19516* "lang=xx" option for parser test cases to set content language
19517* (bug 5764) Friulian translation updated
19518* (bug 5757) Fix premature cutoff in LanguageConverter with extra end markers
19519* (bug 5516) Show appropriate "return to" link on blocked page
19520* (bug 5377) Do not auto-login when creating an account as another user
19521* (bug 5284) Special redirect pages should remember parameters
19522* Suppress 7za output on dumpBackup
19523* (bug 5338) Reject extra initial colons in title
19524* (bug 5487) Escape self-closed HTML pair tags
19525* Add "raw suffix" magic word for some magic words, e.g. {{NUMBEROFUSERS|R}}
19526  will produce a count minus formatting
19527* Fix Parser::cleanSig() to use Parser::startExternalParse() and choose an
19528  appropriate output format given the scope of the clean
19529* (bug 5593) Change "bureaucrat log" to "rights log"
19530* Show a boilerplate "(none)" in place of a blank within the log action text for
19531  user rights
19532* (bug 137) Commented out translations for copyrightwarning which mention GNU
19533  FDL
19534* (bug 5723) Don't count pages linked to from the MediaWiki namespace as
19535  "wanted"
19536* (bug 5696) Add a third parameter, $3, to "rcnote", passing the current time
19537  formatted according to the current user's settings
19538* (bug 5780) Thousands and decimal separators for Norwegian
19539* Updated initStats maintenance script
19540* (bug 5767) Fix date formats in Vietnamese locale
19541* (bug 361) URL in URL, they were almost fixed. Now they are.
19542* (bug 4876) Add __NEWSECTIONLINK__ magic word to force the "new section"
19543  link/tab to show up on specific pages on demand
19544* Bidi-aid on list pages
19545* (bug 5782) Allow entries in the bad image list to use canonical namespace
19546  names
19547* (bug 5789) Treat "loginreqpagetext" as wikitext
19548* Sanitizer: now handles nested <li> in <ul> or <ol>
19549* (bug 5796) We require MySQL >=4.0.14
19550* Add 'EmailConfirmed' hook
19551* New findhooks.php script to find undocumented hooks.
19552* Silently ignore errors on profiling table update.
19553* (bug 5801) Correct handling of underscores in Special:Listusers
19554* Clean up Special:Listusers; add an "(all)" label to the group selection box
19555* (bug 5812) Use appropriate link colour in Special:Mostlinked
19556* (bug 5802) {{CURRENTMONTHNAME}} variable broken in Vietnamese locale
19557* (bug 5817) Appropriate handling for Special:Recentchangeslinked where the
19558  target page doesn't exist
19559* Special:Randompage now additionally accepts English namespace name as
19560  parameter
19561* (bug 2981) Really fixed linktrail for Tamil (ta)
19562* Disallow substituting Special pages when included into a page
19563* (bug 5587) Clean up the languages from references to the Groups special page
19564* Added new group-X and group-X-member messages
19565* Rewritten removeUnusedAccounts to be more efficient, print names of inactive
19566  accounts
19567* Redirect Special:Userlist to Special:Listusers
19568* Introduce $wgAllowTitlesInSVG, which allows the <title> attribute in uploaded
19569  files bearing the image/svg MIME type. Disabled by default due to the vast
19570  majority of web servers being hideously misconfigured. See DefaultSettings.php
19571  for more details.
19572* Changed default LocalSettings.php to append the previous include path when
19573  setting it
19574* (bug 5837) Use "members" for the value descriptor in Special:Categories,
19575  Special:Wantedcategories and Special:Mostlinkedcategories.
19576* (bug 3309) Allow comments when undeleting pages
19577* Clean up Special:Undelete a bit
19578* (bug 5805) messages nbytes, ncategories can now use {{plural:}}
19579* Clean up Special:Imagelist a bit
19580* (bug 5838) Namespace names for Nds-NL
19581* (bug 5749) Added Tyvan language files
19582* (bug 5791) Fix SQL syntax in Special:BrokenRedirects, was causing incorrect
19583  data to show
19584* (bug 5839) Prevent access to Special:Confirmemail for logged-out users
19585* (bug 5853) Update for Portuguese messages (pt)
19586* (bug 5851) Use Cyrillic for Kirghiz language name
19587* (bug 5841) Allow the 'EditFilter' hook to return a non-fatal error message
19588* (bug 5846) Link to individual group description pages in Special:Listusers
19589* (bug 5857) Update for German localisation (de)
19590* (bug 5858) Update for Russian language (ru)
19591* (bug 5860) Update for Indonesian language (id)
19592* (bug 1120) Update for Czech language (Cs)
19593* Added many missing formatNum calls
19594* Added grammar function to Belarusian (be)
19595* (bug 5819) Add 'PersonalUrls' hook
19596* (bug 5862) Update of Belarusian language (be)
19597* (bug 5886) Update for Portuguese messages (pt)
19598* (bug 5586) <gallery> treated text as links
19599* (bug 5878) Update for Indonesian language (id)
19600* (bug 5697) Update for Malay language (ms)
19601* (bug 5890) Update for German language (de)
19602* (bug 5889) Name for Sindhi language should appear as سنڌي
19603* --force-normal parameter on dump scripts to force check for ICU extension
19604* (bug 5895) Update for Dutch language (nl)
19605* (bug 5891) Linktrail for Polish language (pl)
19606* User::isBureaucrat , User::isDeveloper , User::isSysop deprecated in
19607  v1.6 now die with a backtrace. They will be removed in v1.8
19608* dumpTextPass now skips goes to database for entries that were blank in the
19609  previous dump, as this may indicate a broken dump.
19610* dumpTextPass progress includes percentage of items prefetched
19611* dumpTextPass can now use 7zip files for prefetch
19612* (bug 5915) Update to Indonesian localisation (id)
19613* (bug 5913) Update for German localisation (de)
19614* (bug 5905) Plural support for Bosnian localisation (bs)
19615* Groups which won't hit the rate limiter now configurable with
19616  $wgRateLimitsExcludedGroups
19617* (bug 5806) {{plural:}} support instead of "twin" MediaWiki messages
19618* (bug 5931) Update for Polish language (pl)
19619* Ignore the user and user talk namespaces on Special:Wantedpages
19620* Introduce NUMBEROFPAGES magic word
19621* (bug 5833) Introduce CURRENTVERSION magic word
19622* (bug 5370) Allow throttling of password reminder requests with the rate
19623  limiter
19624* (bug 5683) Respect parser output marked as uncacheable when saving
19625* (bug 5918) Links autonumbering now work for all defined protocols
19626* (bug 5935) Improvement to German localisation (de)
19627* (bug 5937) Register links from gallery captions with the parent parser output
19628  object so that link tables receive those updates too
19629* (bug 5845) Introduce BASEPAGENAME and BASEPAGENAMEE magic words
19630* (bug 5941) Use content language when getting the administrator page title for
19631  Special:Statistics
19632* (bug 5949) Update to Indonesian localisation (id)
19633* (bug 5862) Update of Belarusian translation (be)
19634* (bug 5950) Improvements to French localisation
19635* (bug 5805) {{plural:}} support for counters in some special pages
19636* (bug 5952) Improvement to German localisation (de)
19637* Rename conflicting metadata help message to "metadata_help" (was "metadata")
19638  and treat it as wiki text
19639* Improve preferences input filtering
19640* Maintenance script to import multiple files into the wiki
19641* (bug 5957) Update for Hebrew language (he)
19642* (bug 5962) Update for Italian language (it)
19643* (bug 5961) Update for Portuguese localisation (pt)
19644* (bug 5849) Remove some hard-coded references to "Wikipedia" in messages
19645* (bug 5967) Improvement to German localisation (de)
19646* (bug 5962) Update for Italian language (it)
19647* Suppress images in galleries which appear on the bad image list (when
19648  rendering for a wiki page; galleries in special pages and categories are
19649  unaffected)
19650* Maintenance script to remove orphaned revisions from the database
19651* (bug 5991) Update for Russian language (ru)
19652* (bug 6001) PAGENAMEE and FULLPAGENAMEE don't work in FULLURL and LOCALURL
19653  magic words
19654* (bug 5958) Switch Uzbek language name to use latin script
19655* (bug 839) Add URLENCODE magic word
19656* (bug 6004) Update for Polish language (pl)
19657* (bug 5971) Improvement to German localisation (de)
19658* (bug 4873) Don't overwrite the subtitle navigation when viewing a redirect
19659  page that isn't current
19660* (bug 2203) Namespace updates for Thai
19661* Fix breakage in parser test suite which caused incorrect reporting of the
19662  failure of {{NUMBEROFFILES}}. Now initialises the site_stats table with some
19663  dumb data. Updated the expected output for {{NUMBEROFARTICLES}} to reflect
19664  this.
19665* (bug 6009) Use {{ns:project}} in messages where appropriate
19666* (bug 6012) Update to Indonesian localisation (id)
19667* (bug 6017) Update list of bookstores in German localisation files
19668* (bug 5187) Allow programmatically bypassing username validation, for scripts
19669* (bug 6025) SpecialImport: wrong message when no file selected
19670* (bug 6015) EditPage: add spacing in the boxes "edit is minor" and "watch this"
19671* (bug 6018) Userrights: new message when no user specified ('nouserspecified')
19672* (bug 2015) Add "\sim" to ~ conversion for HTML rendering
19673* (bug 6029) Improvement to German localisation (de)
19674* (bug 5015) Update be: magic words
19675* (bug 3974) Add parameter for site URL to "passwordremindertext"
19676* (bug 6039) Update for Portuguese localisation (pt)
19677* (bug 764) Add CREATE TEMPORARY TABLES to default database permissions
19678* Big update to Swedish localisation (sv)
19679* Use appropriate HTML functions to create the tool links on image pages, so
19680  they don't look garbled when tidy isn't on
19681* (bug 5511) Fix URL-encoding of usernames in links on Special:Ipblocklist
19682* (bug 6046) Update to Indonesian localisation (id) #15
19683* (bug 5523) $wgNoFollowNsExceptions to allow disabling rel="nofollow" in
19684  specially-selected namespaces.
19685* (bug 6055) Fix for HTML/JS injection bug in variable handler (found by Nick
19686  Jenkins)
19687* Reordered wiki table handling and __TOC__ extraction in the parser to better
19688  handle some overlapping tag cases.
19689* Only the first __TOC__ is now turned into a TOC
19690* (bug 4610) Indicate patrolled status on watchlists and allow users to mark
19691  changes as patrolled using the diff links there
19692* Add 'DiffViewHeader' hook called before diff page output
19693* (bug 6051) Improvement to German localisation (de)
19694* (bug 6054) Update to Indonesian localisation (id) #16
19695* Add {{CURRENTTIMESTAMP}} magic word
19696* (bug 6061) Improper escaping in some html forms
19697* (bug 6065) Remove underscore when using NAMESPACE and TALKSPACE magics.
19698* (bug 6074) Correct squid purging of offsite upload URLs
19699* To simplify the lives of extension developers, the logging type arrays
19700  can now be appended to directly by an extension setup function. It is
19701  no longer necessary to write four separate functions just to add a
19702  custom log type.
19703* (bug 6057) Count "licenses" as a message (and show it in Special:Allmessages)
19704* Added $wgGrammarForms global
19705* Fixed hardcoded 'done.' when removing watchlist entries.
19706* (bug 5962) Update for Italian language (it)
19707* (bug 6086) Remove vestigial attempt to call Article::validate()
19708* wfHostname() function for consistent server hostname use in debug messages
19709* Send thumbnailing error messages to 'thumbnail' log group
19710* wfShellexec() now accepts an optional parameter to receive the exit code
19711* Failed, but not zero-length, thumbnail renderings are now removed.
19712  Should help clean up when rsvg fails in weird ways.
19713* (bug 6081) Change description for Turkmen language
19714* Increase robustness of parser placeholders; fixes some glitches when
19715  adjacent to identifier-ish constructs such as URLs.
19716* Shut up the parser test whining about files in a temp directory.
19717* (bug 6098) Add Aragonese language support (an)
19718* (bug 6101) Update for Russian language (ru)
19719* Add $wgIgnoreImageErrors to suppress error messages for thumbnail rendering
19720  problems. If errors are transitory, this should reduce annoying messages
19721  making it into cached display.
19722* (bug 6103) Wrap self-links in a CSS class ("selflink")
19723* (bug 6102) For consistency with other markup, normalize all HTML-encoded
19724  character entities in URLs, not just ampersands. This allows use of eg
19725  &#61; when making URLs for template parameters.
19726* Markup anality: escape </ as <\/ in toolbar javascript for pure correctness
19727  under HTML-compatible browsers.
19728* (bug 5077) Added hook 'BeforePageDisplay' to SkinTemplate::outputPage
19729* Replace fatally changed 'uploadnewversion' with 'uploadnewversion-linktext'
19730* (bug 472) Syndication feeds for the last few edits of page history
19731* Format edit comments in Recent Changes feed
19732* Switch incorrectly ordered column headers on Recent Changes feed diffs
19733* (bug 6117) Use message for history feed description, add German localization
19734* (bug 1017) fixed thumbnails of animated gifs.
19735* Add APC as object caching option
19736* Update to Albanian localization (sq)
19737* (bug 6099) Introduce {{DIRECTIONMARK}} magic word (with {{DIRMARK}} as an
19738  alias)
19739* Use optimized php5-only microtime()
19740* Add possibility to store local message cache as PHP executable script
19741* Fix profiling table definition
19742* (bug 6040) Run pre-save transform before calculating the diff. when doing a
19743  "show changes" operation in the editor
19744* (bug 4033) Respect $wgStyleDirectory when checking available skins
19745* Remove hideous backslashes from MessagesBr.php
19746* Fix APC object cache issues, add functionality to installer
19747* (bug 6133) Update strip state as we work. This mostly fixes extensions
19748  used in Cite.php <ref> tags when Tidy is on.
19749* (bug 6139) Workaround for transclusion oddities in Vietnamese upload text
19750* (bug 6136) Update to Catalan language (ca)
19751* Update to Japanese localization (ja)
19752* Add /usr/local/bin to the diff3 search paths in the installer
19753* (bug 6106) Update to Indonesian localisation (id) #17
19754* (bug 6125) Add links to edit old versions to diff views
19755* (bug 5127) Auto edit summary when creating/editing redirect page
19756* (bug 3926) Introduce {{#language:}} magic word
19757* Fix section links from edit comments for [[:Image:Bla.jpg]] in section titles
19758* (bug 6126) Allow fallback to customized primary language when user language
19759  message contains '-'; fixes licenses selector on Commons configuration after
19760  recent addition of the message to Messages.php
19761* (bug 5527) Batch up job queue insertions for, hopefully, better survivability
19762  of lock contention etc. Duplicates are now removed at pop time instead of
19763  at insert time.
19764* When showing the "blah has been undeleted" page, make sure it's a blue link
19765* parserTests.php accepts a --file parameter to run an alternate test sutie
19766* parser tests can now test extensions using !!hooks sections
19767* Fix oddity with open tag parameters getting stuck on </li>
19768* (bug 5384) Fix <!-- comments --> in <ref> extension
19769* Nesting of different tag extensions and comments should now work more
19770  consistently and more safely. A cleaner, one-pass tag strip lets the
19771  'outer' tag either take source (<nowiki>-style) or pass it down to
19772  further parsing (<ref>-style). There should no longer be surprise
19773  expansion of foreign extensions inside HTML output, or differences
19774  in behavior based on the order tags are loaded.
19775* (bug 885) Pre-save transform no longer silently appends close tags
19776* Pre-save transform no longer changes the case of close tags
19777* (bug 6164) Fix regression with <gallery> resetting <ref> state
19778* Hackaround for IE 7 wrapping bug in MonoBook footer
19779* New message sp-newimages-showfrom replaces rclistfrom on special:newimages
19780* Improve handling of ;: definition list construct with overlapping or
19781  nested HTML tags
19782* (bug 6171) Fix sanitizing of HTML-elements with an optional closing
19783  tag. The sanitizer still needs to learn how to make well-formed XML
19784  in this case.
19785* Fix fatal error when specifying illegal name for manual thumbnail
19786* (bug 6184) Use shinier Linker::userLink() to make user links in
19787  Special:Undelete
19788* (bug 6170) Update for Kashubian translation (csb)
19789* (bug 6191) Update to Indonesian translation (id) #18
19790* (bug 6114) Update to Walloon localization (wa)
19791* Added $wgNamespaceRobotPolicies to allow customisation of robot policies on a
19792  per-namespace basis.
19793* Add <ol> to the list of block elements for doBlockLevels; avoids <p>s being
19794  interspersed into your ordered lists.
19795* (bug 5021) Transcluding the same special page twice now works
19796* Add 'SiteNoticeBefore' and 'SiteNoticeAfter' hooks
19797* (bug 6182) Date passed in "sp-newimages-showfrom" not adjusted to user time
19798  preferences
19799* (bug 2587) Fix for section editing with comment prefix
19800* (bug 2607) Fix for section editing with mix of wiki and HTML headings
19801* (bug 3342) Fix for section editing with headings wrapped in <noinclude>
19802* (bug 3476) Fix for section editing with faux headings in extensions
19803* (bug 5272) Fix for section editing with HTML-heading subsections
19804* Fix for bogus wiki headings improperly detected with following text
19805* Fix for HTML headings improperly not detected with preceding/following text
19806* Section extraction and replacement functions merged into one implementation
19807  on the Parser object, so they can't get out of sync with each other.
19808* Edit security precautions in raw HTML mode, etc
19809* (bug 6197) Update to Indonesian translation (id) #19
19810* (bug 6175) Improvement to German translation (de)
19811* Redirect Special:Logs to Special:Log
19812* (bug 6206) Linktrail for Swedish localization (se)
19813* (bug 3202) Attributes now allowed on <pre> tags
19814* Sanitizer::validateTagAttributes now available to discard illegal/unsafe
19815  attribute values from an array.
19816* (bug 3837) Leave <center> as is instead of doing an unsafe text replacement
19817  to <div class="center">. <center> is perfectly valid in the target doctype
19818  (XHTML 1.0 Transitional), while the replacement didn't catch all cases and
19819  could even result in invalid output from valid input.
19820* (bug 4280) Use 'noindex,nofollow' instead of 'noindex,follow' for default
19821  meta robots tag on diff view and special pages. Should reduce impact of
19822  robots on scrolling special pages, diffs etc on sites where robots.txt
19823  doesn't forbid access.
19824* Regression fix: suppress warning about session failure when clicking to
19825  edit with 'preview on first edit' enabled.
19826* (bug 6230) Regression fix: <nowiki> in [URL link text]
19827* Added AutoLoader.php, which loads classes without need of require_once()
19828* (bug 5981) Add plural function Slovenian (sl)
19829* (bug 5945) Introduce {{CONTENTLANGUAGE}} magic word
19830* {{PLURAL}} can now take up to five forms
19831* (bug 6243) Fix email for usernames containing dots when using PEAR::Mail
19832* Remove a number of needless {{ns:project}}-type transforms from messages
19833  files. These usages already have separate label text. Such transforms are
19834  wasteful on each page view.
19835* Update to Yiddish localization (yi)
19836* (bug 6254) Update to Indonesian translation (id) #20
19837* (bug 6255) Fix transclusions starting with "#" or "*" in HTML attributes
19838* Whitespace now normalized more or less properly in HTML attributes
19839* Fix regression(?) in behavior of initial-whitespace-pre in <center>
19840* (bug 6260) Update to Interlingua localization (ia)
19841* Update to Vlax Romany localization (rmy)
19842* Update to Latin translation (la)
19843* Update to Dutch translation (nl)
19844* Avoid some notices in page history with bad input
19845* Use double quoted consistently on attributes in linker output; preparing
19846  for new normalization code when tidy not in use
19847* Replace "nogomatch" with "noexactmatch" and place the magic colon in the
19848  messages themselves. Some minor tweaks to the actual message content.
19849* Introduce $wgContentNamespaces which allows for articles to exist in
19850  namespaces other than the main namespace, and still be counted as valid
19851  content in the site statistics.
19852* (bug 5932) Introduce {{PAGESINNAMESPACE}} magic word
19853* Disable $wgAllowExternalImages by default.
19854* (bug 2700) Nice things like link completion and signatures now work in
19855  <gallery> tags.
19856* Cancel output buffering in StreamFile; when used inside gzip buffering this
19857  could cause funny timeout behavior as the Content-Length was wrong.
19858* Return correct content-type header with 304 responses for StreamFile;
19859  it confuses Safari if you let it return "text/html".
19860* (bug 6280) Correct GRAMMAR for Slovenian localisation (sl)
19861* (bug 6162) Change date format for Dutch Low Saxon (nds-nl)
19862* (bug 6296) Update to Indonesian localisation (id) #21
19863* Introduce EditFormPreloadText hook, see docs/hooks.txt for more information
19864* (bug 4054) Add "boteditletter" to recent changes flags
19865* Update to Catalan localization (ca)
19866* (bug 2099) Deleted image files can now be archived and undeleted.
19867  Set $wgSaveDeletedFiles on and an appropriate directory path in
19868  $wgFileStore['deleted']['directory']
19869* (bug 6324) Fix regression in enhanced RC alignment
19870* Introduce {{NUMBEROFADMINS}} magic word
19871* Update to Slovak translation (sk)
19872* Update to Alemannic localization (gsw)
19873* (bug 6300) Bug fixes for sr: variants
19874* namespaceDupes.php can now accept an arbitrary prefix, for checking rogue
19875  interwikis and such. Not yet fully automated.
19876* (bug 6344) Add Special:Uncategorizedimages page
19877* (bug 6357) Update to Russian translation (ru)
19878* Workaround possible bug in Firefox nightlies by properly removing the
19879  Content-Encoding header instead of sending explicit 'identity' value
19880  in StreamFile
19881* (bug 6304) Show timestamp for current revision in diff pages
19882* Vertically align current version with old version header in diff display
19883* (bug 6174) Remove redundant "emailforlost" message
19884* (bug 6189) Show an error to an unprivileged user trying to create account
19885* (bug 6365) Show user information in the "old revision" navigation links
19886* Introduce 'FetchChangesList' hook; see docs/hooks.txt for more information
19887* (bug 6345) Update to Indonesian localisation (id) #22
19888* (bug 6279) Add genitive month names to Slovenian localisation
19889* (bug 6351) Update to German translation (de)
19890* Respect language directionality when displaying arrow in
19891  Special:Brokenredirects
19892* Remove unused "validation" table definitions from the schema files
19893* (bug 6398) Work around apparent PCRE bug breaking section editing when
19894  massively-indented preformatted text immediately followed a header
19895* (bug 6392) Fix misbehaving <br /> in preferences form
19896* Add translated magic words to Hebrew localization
19897* (bug 6396) Change name for Chuvash language
19898* Introduce optional (off by default) language selector bar for user login
19899  and registration. Customisable via the "loginlanguagelinks" message, the
19900  links will preserve "returnto" values. If the user creates an account while
19901  using such a link, then the language in use will be saved as their language
19902  preference.
19903* Make sure '~~~' '~~~~' '~~~~~' are removed in Nickname preference.
19904* Rename "ipusuccess" to "unblocked", change the format (now wiki text)
19905* (bug 2316) Add "caption" attribute to <gallery> tag
19906* Allow setting the skin object that ImageGallery will use; needed during parse
19907  operations (the skin must come from the ParserOptions, not $wgUser)
19908* Fix notice in MacBinary detection debug data for files of certain lengths
19909* (bug 6131) Add type detection for DjVu files, allowing them to be uploaded
19910  with validity checking and size detection. No inline thumbnailing yet,
19911  but could be added in the future.
19912* (bug 6423) Don't update newtalk flag if page content didn't change (null edits
19913  were causing the newtalk flag to trigger inappropriately)
19914* Parser functions are now set using magic words.
19915* (bug 6428) Incorrect form action URL on Special:Newimages with hidebots = 0
19916  set
19917* (bug 4990) Show page source to blocked users on edits, or their modified
19918  version if blocked during an edit
19919* (bug 5903) When requesting the raw source of a non-existent message page,
19920  return blank content (as opposed to the message key)
19921* Improve default blank content of MediaWiki:Common.css and
19922  MediaWiki:Monobook.css
19923* (bug 6434) Allow customisation of submit button text on Special:Export
19924* (bug 6314) Add user tool links on page histories
19925* Fix display of file-type icons in galleries when $wgIgnoreImageErrors is off
19926* (bug 6438) Update to Indonesian translation (id) #23
19927* Adding the language code parameter to the hook "LanguageGetMagic", to allow
19928  localizble extensions magic words.
19929* Update to Romanian translation (ro)
19930* Update to Esperanto translation (eo)
19931* Check for preg_match() existence when installing and die out whining about
19932  PCRE if it's not there, instead of throwing a fatal error
19933* (bug 672) Add MathAfterTexvc hook
19934* Update to Piedmontese localization (pms)
19935* dumpBackup can optionally compress via dbzip2
19936* (bug 2483) Run link updates on change via XML import
19937* (bug 2481) List imported pages during Special:Import
19938* (bug 2482) Log and RC entries for Special:Import events
19939* Allow fetching all revisions from transwiki Special:Import
19940* Allow fetching all revisions from Special:Export GET request
19941* Disable output buffering on Special:Export; should help with streaming
19942  large numbers of history items.
19943* Allow setting a maximum number of revisions for history Special:Export;
19944  pages with more than $wgExportMaxHistory revisions are excluded from
19945  export when history is requested.
19946* Fix transwiki import of pages with space in name
19947* Save null edit when importing pages through Special:Import
19948* Update to Korean translation (ko)
19949* Show a more specific message when an anonymous user tries to access
19950  Special:Watchlist
19951* (bug 3278) Paging links in Special:Prefixindex
19952* Added Latvian localization (lv)
19953* (bug 6472) Fix regression in Special:Export with multiple pages
19954* Update to Macedonian translation (mk)
19955* Allow page moves over historyless self-redirects. Such are usually created
19956  as part of namespace rearrangements, and it's easier to clean them up if
19957  we can move over them.
19958* Show some error results in moveBatch.php
19959* (bug 6479) Allow specification of the skin to use during HTML dumps
19960* (bug 6461) Link to page histories in Special:Newpages
19961* (bug 6484) Don't do message transformations when preloading messages for
19962  editing
19963* (bug 6201) Treat spaces as underscores in parameters to {{ns:}}
19964* (bug 6006) Allow hiding the password change fields using an authentication
19965  plugin
19966* (bug 6489) Use appropriate link colour on Special:Shortpages
19967* Added formatnum magic word
19968* Added Javanese localization (jv)
19969* (bug 6491) Apply bad image list in category galleries
19970* (bug 6488) Show relevant log fragment in Special:Movepage
19971* Fix potential PHP notice in Special:Blockme when $wgBlockOpenProxies is true
19972* Use mysql_real_escape_string instead of addslashes for string escaping in
19973  the MySQL Database class. This may fix some rare breakage with binary fields.
19974  Note that MediaWiki does not support the multibyte character sets where a
19975  "dumb" byte replacement can be actively dangerous; UTF-8 is always safe
19976  in this regard due to the bit patterns which make head and tail bytes
19977  distinct.
19978* (bug 6497) Use $wgMetaNamespaceTalk for Esperanto if set
19979* (bug 6498) Use localized forms for image size in Special:Undelete
19980* (bug 6485) Update to Indonesian translation (id) #24
19981* Extension messages translation is now possible.
19982* Add target namespace override selector for transwiki imports.
19983  $wgImportTargetNamespace specifies the default, to be used for
19984  Wiktionary's 'Transwiki:' namespace etc.
19985* (bug 6506) Update to German localisation (de)
19986* (bug 502) Avoid silly tabs on bad title by using virtual special page
19987* (bug 6511) Add diff links to old revision navigation bar
19988* (bug 6511) Replace 'oldrevisionnavigation' message with
19989  'old-revision-navigation'
19990* Fix regression in Polish genitive month forms
19991* (bug 4037) Make input handling in Special:Allpages and Special:Prefixindex
19992  more consistent: Accept just a namespace prefix and a colon, reject input
19993  with interwiki prefixes, otherwise do what Title::makeTitleSafe() does.
19994* (bug 6516) Update to Russian translation
19995* New 'allpagesbadtitle' message for Special:Allpages, based on 'badtitletext'.
19996* Rename "searchquery" to "searchsubtitle" and support wiki text in it
19997* Introduce updateArticleCount maintenance script which uses a better check that
19998  reflects what Article::isCountable() tests for
19999* Introduce 'BadImage' hook; see docs/hooks.txt for more information
20000* Add "searchsubtitleinvalid" message for searches that are not valid titles.
20001* (bug 5962) Update to Italian localisation
20002* (bug 6530) Update to Indonesian localisation (id) #25
20003* (bug 6523) Fix SVG issue in rebuildImages.php
20004* (bug 6512) Link to page-specific logs on page histories
20005* (bug 6504) Allow configuring session name with $wgSessionName
20006* (bug 6185) Add standard user tool links to log page views
20007* Update to Venetian translation (vec)
20008* Update to Slovenian translation (sl)
20009* Add standard user tool links to deleted revision list
20010* Separate out EditPage's getContent bits from regular Article getContent.
20011  Cleans up read-only-mode warning on empty pages and neats up some code.
20012* (bug 6565) Strict JavaScript writing
20013* (bug 6570) Update to Indonesian localisation (id) #26
20014* Added Telugu translation (te)
20015* Update to Catalan translation (ca)
20016* (bug 6560) Avoid PHP notice when trimming ISBN whitespace
20017* Added namespace translation to Kannada (ka)
20018* (bug 6566) Improve input validation on timestamp conversion
20019* Implicit group "emailconfirmed" for all users whose email addresses are
20020  confirmed
20021* (bug 6577) Avoid multiline parser breakage on <pre> with newline in attribute
20022* (bug 6771) Make old revisions of MediaWiki pages available with action=raw
20023
20024
20025== Compatibility ==
20026MediaWiki 1.7 requires PHP 5 (5.1 recommended). PHP 4 is no longer supported.
20027
20028If you are unable to run PHP 5, you may have to stick with 1.6 for now.
20029
20030MySQL 3.23.x is no longer supported; some older hosts may need to upgrade.
20031At this time we still recommend 4.0, but 4.1/5.0 will work fine in most cases.
20032
20033Experimental Oracle support has been dropped as it is unmaintained.
20034
20035== Upgrading ==
20036Several changes to the database have been made from 1.6:
20037
20038* A new "langlinks" table tracks interlanguage links
20039* A new "filearchive" table stores information on deleted files
20040* A new "querycache_info" table stores information on query page updates
20041
20042To ensure that these tables are filled with data, run refreshLinks.php after
20043the upgrade.
20044
20045If you are upgrading from MediaWiki 1.4.x or earlier, some major database
20046changes are made, and there is a slightly higher chance that things could
20047break. Don't forget to always back up your database before upgrading!
20048
20049== Configuration changes ==
20050
20051Some configuration options have changed:
20052* $wgAllowExternalImages now defaults to off for increased security.
20053* $wgLocalTZoffset was in hours, it is now using minutes.
20054* Extensions may register special pages via the $wgSpecialPages array without
20055forcing an early load of the SpecialPage.php class file.
20056
20057== Major new features ==
20058
20059* Deleted files can now be archived and undeleted, if you set up an appropriate
20060non-web-accessible directory. Set $wgSaveDeletedFiles on and an appropriate
20061directory path in $wgFileStore['deleted']['directory']
20062* Experimental PostgreSQL support has been updated. It may or may not be in
20063usable shape; those interested in PostgreSQL are encouraged to follow 1.8
20064development.
20065
20066=== Caveats ===
20067Some output, particularly involving user-supplied inline HTML, may not
20068produce 100% valid or well-formed XHTML output. Testers are welcome to
20069set $wgMimeType = "application/xhtml+xml"; to test for remaining problem
20070cases, but this is not recommended on live sites. (This must be set for
20071MathML to display properly in Mozilla.)
20072
20073= MediaWiki 1.6 =
20074
20075== MediaWiki 1.6.12 ==
20076
20077February 7, 2009
20078
20079This is a security update to the Spring 2006 quarterly release.
20080
20081A number of cross-site scripting (XSS) security vulnerabilities were discovered
20082in the web-based installer (config/index.php). These vulnerabilities all
20083require a live installer -- once the installer has been used to install a
20084wiki,  it is deactivated.
20085
20086Note that cross-site scripting vulnerabilities can be used to attack any
20087website in the same cookie domain. So if you have an uninstalled copy of
20088MediaWiki on the same site as an active web service, MediaWiki could be used to
20089attack the active service.
20090
20091If you are hosting an old copy of MediaWiki that you have never installed, you
20092are advised to remove it from the web.
20093
20094== MediaWiki 1.6.11 ==
20095
20096December 15, 2008
20097
20098This is a security update to the Spring 2006 quarterly release.
20099
20100David Remahl of Apple's Product Security team has identified a number of
20101security issues in previous releases of MediaWiki. Subsequent analysis by the
20102MediaWiki development team expanded the scope of these vulnerabilities. The
20103issues with a significant impact are as follows:
20104
20105* An XSS vulnerability affecting Internet Explorer clients for all MediaWiki
20106installations with uploads enabled. [CVE-2008-5250]
20107* An XSS vulnerability affecting clients with SVG scripting capability (such as
20108Firefox 1.5+), for all MediaWiki installations with SVG uploads enabled.
20109[CVE-2008-5250]
20110* A CSRF vulnerability affecting the Special:Import feature, for all MediaWiki
20111installations since the feature was introduced in 1.3.0. [CVE-2008-5252]
20112
20113XSS (cross-site scripting) vulnerabilities allow an attacker to steal an
20114authorised user's login session, and to act as that user on the wiki. The
20115authorised user must visit a web page controlled by the attacker in order to
20116activate the attack. Intranet wikis are vulnerable if the attacker can
20117determine the intranet URL, even if the attacker cannot access it.
20118
20119CSRF vulnerabilities allow an attacker to act as an authorised user on the
20120wiki, but unlike an XSS vulnerability, the attacker can only act as the user in
20121a specific and restricted way. The present CSRF vulnerability allows pages to
20122be edited, with forged revision histories. Like an XSS vulnerability, the
20123authorised user must visit the malicious web page to activate the attack.
20124
20125Rather than backport our SVG validation code to this ancient branch, we have
20126instead disabled SVG uploads. To enable SVG uploads, please upgrade to
20127MediaWiki 1.13.3 or later.
20128
20129The other two issues have been fixed.
20130
20131== MediaWiki 1.6.10 ==
20132
20133February 20, 2007
20134
20135This is a security and bug-fix update to the Spring 2006 quarterly release.
20136
20137An XSS injection vulnerability based on Microsoft Internet Explorer's UTF-7
20138charset autodetection was located in the AJAX support module, affecting MSIE
20139users on MediaWiki 1.6.x and up when the optional setting $wgUseAjax is enabled.
20140
20141If you are using an extension based on the optional Ajax module, either disable
20142it or upgrade to a version containing the fix:
20143
20144* 1.9: fixed in 1.9.3
20145* 1.8: fixed in 1.8.4
20146* 1.7: fixed in 1.7.3
20147* 1.6: fixed in 1.6.10
20148
20149There is no known danger in the default configuration, with $wgUseAjax off.
20150
20151* ([[mediazilla:8819|bug 8819]]) Fix full path disclosure with skins
20152dependencies
20153* Add 'charset' to Content-Type headers on various HTTP error responses to
20154forestall additional UTF-7-autodetect XSS issues. PHP sends only 'text/html' by
20155default when the script didn't specify more details, which some inconsiderate
20156browsers consider a license to autodetect the deadly, hard-to-escape UTF-7.
20157This fixes an issue with the Ajax interface error message on MSIE when
20158$wgUseAjax is enabled (not default configuration); this UTF-7 variant on a
20159previously fixed attack vector was discovered by Moshe BA from BugSec:
20160http://www.bugsec.com/articles.php?Security=24
20161* Trackback responses now specify XML content type
20162
20163== MediaWiki 1.6.9 ==
20164
20165January 9, 2007
20166
20167* ([[mediazilla:6621|bug 6621]]) Backported German translation for
20168'eauthentsent'
20169
20170* ([[mediazilla:6680|bug 6680]]) Added localisation for Dutch bookstore list
20171(nl)
20172* ([[mediazilla:6730|bug 6730]]) Clearer usage of message 'titlematch' in
20173German translation (de)
20174* XSS fix in AJAX module
20175
20176An XSS injection vulnerability was located in the AJAX support module,
20177affecting MediaWiki 1.6.x and up when the optional setting $wgUseAjax is
20178enabled.
20179
20180There is no danger in the default configuration, with $wgUseAjax off.
20181
20182If you are using an extension based on the optional AJAX module, either disable
20183it or upgrade to a version containing the fix:
20184
20185* 1.9: fixed in 1.9.0rc2
20186* 1.8: fixed in 1.8.3
20187* 1.7: fixed in 1.7.2
20188* 1.6: fixed in 1.6.9
20189
20190== MediaWiki 1.6.8 ==
20191
20192July 8, 2006
20193
20194MediaWiki 1.6.8 is a security and bugfix maintenance release of the Spring 2006
20195snapshot:
20196
20197A potential HTML/JavaScript-injection vulnerability in a debugging script has
20198been fixed. Only versions and configurations of PHP vulnerable to the $GLOBALS
20199overwrite vulnerability are affected.
20200
20201As a workaround for existing installs, profileinfo.php may simply be deleted if
20202it's not being used.
20203
20204* ([[mediazilla:5957|bug 5957]]) Updates to Hebrew translation (he)
20205* Respect language directionality when displaying arrow in
20206Special:Brokenredirects
20207* ([[mediazilla:6415|bug 6415]]) Typo in Parser.php
20208* Fixed potential XSS in profileinfo.php
20209
20210== MediaWiki 1.6.7 ==
20211
20212June 6, 2006
20213
20214MediaWiki 1.6.7 is a security and bugfix maintenance release of the Spring 2006
20215snapshot:
20216
20217An HTML/JavaScript-injection vulnerability in the edit form has been closed.
20218This vulnerability was new in 1.6.0; MediaWiki versions 1.5.x or earlier are
20219not affected.
20220
20221Extensions, comments, and <nowiki><nowiki></nowiki> sections are now handled in
20222a one-pass way which is more reliable and safer. Under earlier versions of
20223MediaWiki, certain extensions could be abused to inject HTML/JavaScript into
20224the page.
20225
20226Additional precautions are made against offsite form submissions when the
20227restricted raw HTML mode is enabled.
20228
20229Some small localization and user interface updates are also included.
20230
20231*([[MediaZilla:6051|bug 6051]]) Improvement to German localisation (de)
20232*([[MediaZilla:6017|bug 6017]]) Update bookstore list for German language (de)
20233*([[MediaZilla:6138|bug 6138]]) Minor grammar tweak in "loginreqlink"
20234*([[MediaZilla:5957|bug 5957]]) Update for Hebrew language (he)
20235*Increase robustness of parser placeholders; fixes some glitches when adjacent
20236to identifier-ish constructs such as URLs.
20237*([[MediaZilla:5384|bug 5384]]) Fix <nowiki><!-- comments --> in <ref></nowiki>
20238extension
20239*Nesting of different tag extensions and comments should now work more
20240consistently and more safely. A cleaner, one-pass tag strip lets the 'outer'
20241tag either take source (<nowiki><nowiki></nowiki>-style) or pass it down to
20242further parsing (<nowiki><ref></nowiki>-style). There should no longer be
20243surprise expansion of foreign extensions inside HTML output, or differences in
20244behavior based on the order tags are loaded.
20245*([[MediaZilla:885|bug 885]]) Pre-save transform no longer silently appends
20246close tags
20247*Pre-save transform no longer changes the case of close tags
20248*Edit security precautions in raw HTML mode, etc
20249
20250== MediaWiki 1.6.6 ==
20251
20252May 23, 2006
20253
20254MediaWiki 1.6.6 is a security and bugfix maintenance release.
20255
20256An XSS injection vector in brace replacement has been fixed, as have some
20257potential problems with table parsing. Upgrading is strongly recommended for
20258all users of 1.6. MediaWiki versions 1.5 and earlier are not affected.
20259
20260Additionally some localization and user interface updates are included.
20261
20262* Correct "revertpage" message in English
20263* ([[MediaZilla:5507|bug 5507]]) Logouttext now uses wiki markup
20264* (bugs [[MediaZilla:5857|5857]], [[MediaZilla:5957|5957]]) Update for German
20265localisation (de)
20266* ([[MediaZilla:5586|bug 5586]]) <nowiki><gallery></nowiki> treated text as
20267links
20268* ([[MediaZilla:5957|bug 5957]]) Update for Hebrew language (he)
20269* ([[MediaZilla:6025|bug 6025]]) SpecialImport: wrong message when no file
20270selected
20271* ([[MediaZilla:6015|bug 6015]]) EditPage: add spacing in the boxes "edit is
20272minor" and "watch this"
20273* ([[MediaZilla:6018|bug 6018]]) Userrights: new message when no user specified
20274('nouserspecified')
20275* ([[MediaZilla:6055|bug 6055]]) Fix for HTML/JS injection bug in variable
20276handler (found by Nick Jenkins)
20277* Reordered wiki table handling and <nowiki>__TOC__</nowiki> extraction in the
20278parser to better handle some overlapping tag cases.
20279* Only the first <nowiki>__TOC__</nowiki> is now turned into a TOC.
20280* ([[MediaZilla:361|bug 361]]) URL in URL, they were almost fixed. Now they are.
20281
20282== MediaWiki 1.6.5 ==
20283
20284May 2, 2006
20285
20286* Rolled back the buggy patch for [[MediaZilla:5497|bug 5497]].
20287
20288== MediaWiki 1.6.4 ==
20289
20290May 2, 2006
20291
20292* Further improvements to Hebrew localisation
20293* ([[MediaZilla:5544|bug 5544]]) Fix redirect arrow in Special:Listredirects
20294for right-to-left languages
20295* Replace "doubleredirectsarrow" with a content language check that picks the
20296appropriate arrow
20297* Remove live debugging hack which caused errors with certain database names
20298* ([[MediaZilla:5510|bug 5510]]) Warning produced when using
20299<nowiki>{{SUBPAGENAME}}</nowiki> in some namespaces
20300* ([[MediaZilla:5548|bug 5548]]) Improvements to Indonesian localisation
20301[patch: Ivan Lanin]
20302* ([[MediaZilla:5403|bug 5403]]) Fix Special:Newpages RSS/Atom feeds
20303* ([[MediaZilla:3359|bug 3359]]) Add hooks on completion of file upload
20304* ([[MediaZilla:5184|bug 5184]]) CSS misapplied to elements in
20305Special:Allmessages due to conflicting anchor identifiers
20306* ([[MediaZilla:5519|bug 5519]]) Allow sidebar cache to be disabled; disable it
20307by default.
20308* Add $wgReservedUsernames configuration directive to block account creation/use
20309* ([[MediaZilla:5576|bug 5576]]) Remove debugging hack in session check
20310* ([[MediaZilla:5181|bug 5181]]) Update "nogomatch" for Slovak
20311* ([[MediaZilla:5594|bug 5594]]) Id translation up to '# Login and logout
20312pages' section
20313* ([[MediaZilla:5536|bug 5536]]) Use content language for editing help link
20314* Minor improvements to English language files
20315* Improvements to German localisation files
20316* ([[MediaZilla:5628|bug 5628]]) Translations for MessagesHr.php
20317* (bugs [[MediaZilla:5595|5595]], [[MediaZilla:5644|5644]]) Localisation for
20318Bosnian language (bs)
20319* ([[MediaZilla:5592|bug 5592]]) Actions are logged with the default language
20320for the wiki, not the language of the user performing the operation.
20321* ([[MediaZilla:5646|bug 5646]]) Compare for identical types in wfElement()
20322* Fix for concurrency problem in job queue (image description page invalidation)
20323* ([[MediaZilla:5497|bug 5497]]) regeression in HTML normalization in 1.6
20324(unclosed <nowiki><li>,<dd>,<dt></nowiki>)
20325* ([[MediaZilla:5709|bug 5709]]) Allow customisation of separator for categories
20326* ([[MediaZilla:4834|bug 4834]]) Fix XHTML output when using $wgMaxTocLevel
20327* Improvements to update scripts; print out the version, check for superuser
20328credentials before attempting a connection, and produce a friendlier error if
20329the connection fails
20330* ([[MediaZilla:5005|bug 5005]]): Fix XHTML <nowiki><gallery></nowiki> output.
20331* ([[MediaZilla:5315|bug 5315]]) "Expires: -1" HTTP header made strictly valid
20332(using 1970 date).
20333* ([[MediaZilla:4825|bug 4825]]): note in DefaultSettings.php about 'profiling'
20334table creation
20335* Remove unneeded extra whitespace at top of Special:Categories
20336* Rewrite reassignEdits script to be more efficient; support optional updates
20337to recent changes table; add reporting and silent modes
20338* Updated initStats maintenance script
20339* ([[MediaZilla:5723|bug 5723]]) Don't count pages linked to from the MediaWiki
20340namespace as "wanted"
20341* ([[MediaZilla:5789|bug 5789]]) Treat "loginreqpagetext" as wikitext
20342* ([[MediaZilla:5796|bug 5796]]) We require MySQL >=4.0.14
20343
20344== MediaWiki 1.6.3 ==
20345
20346April 10, 2006
20347
20348* Fix disappearing red-linked items in the watchlist editing view
20349* ([[MediaZilla:5512|bug 5512]]) Spacing in "page has a history" deletion
20350warning
20351* ([[MediaZilla:5508|bug 5508]]) Switch ENGINE in table statements back to
20352TYPE; fixes regression where some versions of MySQL 4.0.x wouldn't work
20353* Added note about [[Manual:$wgUrlProtocols|$wgUrlProtocols]] format change
20354
20355== MediaWiki 1.6.2 ==
20356
20357April 8, 2006
20358
20359* Further improvements to Hebrew localisation
20360* Fix 'copyright' message for Romanian
20361* ([[MediaZilla:5476|bug 5476]]) Invalid xhtml in German localization
20362* ([[MediaZilla:5479|bug 5479]]) Id translation for preferences tabs caption
20363* ([[MediaZilla:5493|bug 5493]]) Id translation for special pages
20364* Additional path fixes in the updater
20365* ([[MediaZilla:5344|bug 5344]]) Fix regression that broke slashes in extension
20366tag parameters
20367
20368== MediaWiki 1.6.1 ==
20369
20370April 5, 2006
20371
20372Some minor issues in the 1.6.0 release have been corrected:
20373* ([[MediaZilla:5458|bug 5458]]) Fix double-URL encoding in block log link in
20374contribs and contribs link in block log
20375* ([[MediaZilla:5462|bug 5462]]) Bogus missing patch warning in updater
20376* ([[MediaZilla:5461|bug 5461]]) Use of deprecated "showhideminor" in
20377Special:Recentchangeslinked
20378* PHP warning when allow_call_time_pass_reference is off
20379* Update to Finnish localization
20380
20381== MediaWiki 1.6.0 ==
20382
20383April 5, 2006
20384
20385MediaWiki is now using a "continuous integration" development model with
20386quarterly snapshot releases. The latest development code is always kept "ready
20387to run", and in fact runs our own sites on Wikipedia.
20388
20389Release branches will continue to receive security updates for about a year
20390from first release, but nonessential bugfixes and feature development will take
20391place on the development trunk and will appear in the next quarterly release.
20392
20393Those wishing to use the latest code instead of a branch release can [[Download
20394from SVN|obtain it from source control]].
20395
20396=== What's new in 1.6 ===
20397
20398'''User interface:'''
20399* The account creation form has been separated from the user login form.
20400* Page protection/unprotection uses a new, expanded form
20401
20402'''Templates:'''
20403* Categories and "what links here" now update as expected when adding or
20404removing links in a template.
20405* Template parameters can now have default values, as <nowiki>{{{name|default
20406value}}}</nowiki>
20407
20408'''Uploads:'''
20409* Optional support for rasterizing SVG images to PNG for inline display
20410
20411'''Feeds:'''
20412* Feed generation upgraded to Atom 1.0
20413* Diffs in RSS and Atom feeds are now colored for improved readability.
20414
20415'''Database:'''
20416* MySQL 3.23.x support dropped; 4.0 or later required
20417* Experimental support for Unicode mode of MySQL 4.1/5.0 (moderately tested)
20418* Experimental Oracle support (not well tested!)
20419
20420'''Anti-spam extension support:'''
20421* [[meta:SpamBlacklist extension|SpamBlacklist extension]] now has support for
20422automated cleanup.
20423* Support for a [[meta:ConfirmEdit extension|captcha extension]] to restrict
20424automated spam edits.
20425
20426Numerous bug fixes and other behind-the-scenes changes have been made; see the
20427file HISTORY for a complete change list.
20428
20429== Changes since 1.5 ==
20430
20431* (bug 2885) More PHP 5.1 fixes: skin, search, log, undelete
20432
20433Code quality:
20434* Use strval() to make sure we don't accidentally get null on bad revision
20435  text loads or other fields mucking up XML export output
20436* Clean up duplicate code for selection of changeslist style
20437* Correct blob caching to reduce redundant blob loads on backups
20438* (bug 3182) Clear link cache during import to prevent memory leak
20439* Fixed possible infinite loop in formatComment
20440* Wrap message page insertions in a transaction to speed up installation
20441* Avoid notice warning on edit with no User-Agent header
20442* (bug 3649) Remove obsolete, broken moveCustomMessages script
20443* Avoid numerous redundant latest-revision lookups in history
20444* Require PHP 4.3.2 or higher strictly now.
20445* Tweak infinite-template-handling loop for PHP 5.1.1 string handling change
20446* Remove unused OutputPage::addCookie()
20447* Fix for short_open_tag off again; please don't break this, guys
20448* (bug 4507) Adjust FULLPAGENAMEE escaping to standard form
20449* (bug 5302) Merge the two #p-search .pBody statements in monobook css.
20450
20451Database:
20452* Finally dropped MySQL 3.23.x support
20453* Oracle support
20454* (bug 3056) MySQL 3 compatibility fix: USE INDEX instead of FORCE INDEX
20455* Update all stats fields on recount.sql
20456* (bug 3227) Fix SQL injection introduced in experimental code
20457* Fix table prefix usage in Block::enumBlocks
20458* (bug 3448) Set page_len on undelete
20459* (bug 3506) Avoid MySQL error when Listusers returns no results
20460* Skip update of disused 'rc_cur_time' field (todo: discard the field)
20461* (bug 3735) Fix to run under MySQL 5's strict mode
20462* (bug 3786) Experimental support for MySQL 4.1/5.0 utf8 charset mode
20463  NOTE: Enabling this may break existing wikis, and still doesn't
20464  work for all Unicode characters due to MySQL limitations.
20465* MySQL 5.0 strict mode fix for moving unwatched pages
20466* Ability to set the table name for external storage servers
20467* Update ipblocks table in MySQL 5 table defs
20468* Removed FulltextStoplist.php, no longer used (was for MySQL 3.x workaround)
20469* Added templatelinks table, to track template inclusions. User-visible effects
20470  will be:
20471  * (inclusion) tag for inclusions in Special:Whatlinkshere
20472  * More accurate list of used templates on the edit page
20473  * More reliable cache invalidation when templates outside the template
20474    namespace are changed
20475* Respect database prefix in dumpHTML.inc
20476* Removed read-only check from Database::query()
20477* Added externallinks table, to track links to arbitrary URLs
20478* Added job table, for deferred processing of jobs. The immediate application is
20479  to complete the link table refresh operation when templates are changed.
20480* Don't change the password of the MySQL root user.
20481
20482Documentation:
20483* (bug 3306) Document $wgLocalTZoffset
20484
20485Hooks:
20486(list not complete)
20487* Move ArticleSave hook execution into Article insert/update functions,
20488  so they get called on non-EditPage actions that use these functions
20489  to create or update pages.
20490* Added EditFilter hook, and output callback on EditPage::showEditForm()
20491  for a place to add in captcha-type extensions in the edit flow
20492* (bug 3684) Fix typo in fatal error backtraces in Hooks.php
20493* Fix for hook callbacks on objects containing no fields
20494* Add a hook for additional user creation throttle / limiter extensions
20495* Use $wgOut->parse() in wfGetSiteNotice() instead of creating a new parser
20496  instance. This allows use of extension hooks if required.
20497* Added AutoAuthenticate hook for external User object suppliers
20498* Added 'PageRenderingHash' hook for changing the parser cache hash key
20499  from an extension that changes rendering based on nonstandard options.
20500* Add 'GetInternalURL' hook to match the GetFullURL and GetLocalURL ones
20501* (bug 4456) Add hook for marking article patrolled
20502* Add UserRights hook, fires after a user's group memberships are changed
20503
20504Images:
20505* Support SVG rendering with rsvg
20506* Cap arbitrary SVG renders to given image size or $wgSVGMaxSize pixels wide
20507* (bug 3127) Render large SVGs at image page size correctly
20508* Fix scaling of non-integer SVG unit sizes
20509* (bug 2800) Don't scale up small images on |thumb| without explicit size
20510* Use the real file link instead of the default-size rasterized version for
20511  large SVG images on image description page
20512* Include the file name/type/size line for non-resized images
20513* (bug 3489) PHP 5.1 compat problem with captioned images
20514* (bug 3643) Fix image page display of large images with resizing disabled
20515* Added a limit to the size of image files which can be thumbnailed
20516* (bug 3806) Gracefully fall back to client-side scaling on |thumb| image
20517  that passes $wgMaxImageArea
20518* (bug 153) Adjust thumbnail size calculations to match consistently;
20519  patch by David Benbennick
20520* (bug 4162) Add $wgThumbnailEpoch timestamp to force old thumbs to
20521  be rerendered on demand, sitewide
20522* (bug 1850) Additional fixes so existing local and remote images
20523  get a blue link even if there's no local description page
20524* Avoid FATAL ERROR when creating thumbnail of non-existing image
20525* (bug 4207) Wrong image size when using 100x200px syntax to scale image up
20526  patch by David Benbennick
20527* Don't delete thumbnails when refreshing exif metadata. This caused thumbs
20528  to vanish mysteriously from time to time for files that didn't have metadata.
20529* (bug 4426) Add link to user_talk page on image pages
20530* Support a custom convert command for thumbnailing. See DefaultSettings.php
20531  and the comments for $wgCustomConvertCommand, for more information.
20532* UserCan hook now allows advisory return values, rather than mandatory ones.
20533
20534Installer:
20535* (bug 3782) Throw fatal installation warning if mbstring.func_overload on.
20536  Why do people invent these crazy options that change language semantics?
20537* Fixed installer bugs 921 and 3914 (issues with using root and so forth)
20538* (bug 4258) Use ugly urls for ISAPI by default
20539  patch by Rob Church
20540* Improve installer
20541	* Use a superuser account (such as root), if specifed, to create tables
20542	* Don't overwrite conservative permissions on the mySQL user with ALL
20543	  permissions, if said user exists
20544	* Changes to some of the wording of explanations for fields
20545* (bug 1734) granting db permissions failed with db usernames containg '-'
20546* Add basic check for session support in PHP and die if not present
20547
20548Maintenance:
20549* Fix problem reported on mailing list where re-initialising stats didn't work
20550  (can't insert duplicate rows with the same id field)
20551* Added --conf option to command line scripts, allowing the user to specify a
20552  different LocalSettings.php.
20553* Maintenance script to delete unused text records
20554* Maintenance script to delete non-current revisions
20555* Maintenance script to wipe a page and all revisions from the database
20556* Maintenance script to reassign edits from one user to another
20557* Maintenance script to find and remove links to a given domain
20558  (cleanupSpam.php)
20559* Fix --report interval option for dumpTextPass
20560
20561i18n / Languages:
20562* Partial support for Basque language (from wikipedia and meta)
20563* (bug 3141) Partial support for Breton language (thanks Fulup).
20564* Support for venitian language
20565* (bug 1334) LanguageGa.php update
20566* Finnish date format was hardcoded, now implemented properly
20567* (bug 3190) Added some date format choices for language sr
20568* (bug 2753) Some namespaces were not translated in LanguageTa.php (Tamil)
20569* (bug 3204) Fix typo breaking special pages in fy localization
20570* (bug 3177) Estonian date formats not implemented in LanguageEt.php
20571* (bug 1020) Changing user interface language does not work immediately
20572* (bug 3271) Updated LanguageNn.php for HEAD
20573* Experimental feature to allow translation of block expiry times
20574  Implementation only for Finnish currently
20575* (bug 3304) Language file for Croatian (LanguageHr.php)
20576* (bug 2143) Update Vietnamese interface
20577* (bug 3063) Remove some hardcodings from Hebrew localisation
20578* (bug 3408) Bulgarian formatNum corrected
20579* (bug 1512) Disable x-code interp on Esperanto URLs for now, it does more
20580  harm than good under current system by breaking incoming URLs with "ux".
20581  (Editing is not affected, just URLs.)
20582* (bug 1423) LanguageJa.php update
20583* Fix language name for dv
20584* (bug 3503) Update LanguageSq.php from sq.wikipedia.org messages
20585* (bug 3629) Fix date & time format for Frisian
20586* (bug 3334) Namespace changes for Polish
20587* (bug 3580) Change default Dutch language file to more neutral
20588* (bug 3656) LanguageHr.php - added convertPlural
20589* (bug 3414) LanguageBe.php - added convertPlural
20590* (bug 3163) Full translation of LanguageBr
20591* (bug 3617) Update for portuguese language (pt)
20592* Namespaces hacks on LanguagePl
20593* (bug 3682) LanguageSr.php - added convertPlural
20594* (bug 3694) LanguageTr.php update
20595* (bug 3711) Removed invisible unicode characters from LanguageHu
20596* (bug 2981) Linktrail for Tamil (ta)
20597* (bug 3722) Update of Arabic language (ar) Namespace changes
20598* Removed hardcoded Norwegian (no) project namespaces
20599* (bug 2324) image for redirects should be without text and oriented according
20600  to content language
20601* (bug 3666) Don't spew PHP warnings in prefs on unrecognized site language
20602* (bug 3817) Use localized date formats in preferences; 'no preference' option
20603  localizable as 'datedefault' message. Tweaked lots of languages files...
20604* (bug 2721) Regression: Use European number separators for vi: wikis
20605* (bug 3961) minor languageDe changes
20606* (bug 1984) LanguageKo.php (Korean) update
20607* (bug 3804) update of LanguageWa.php file
20608* (bug 3886) Update for Portuguese language (pt)
20609* (bug 4020) Update namespaces for ms
20610* (bug 3922) bidi embedding overrides on category links
20611* (bug 4061) Update of Slovene namespace names (LanguageSl.php)
20612* (bug 4064) LanguageDe comma changes
20613* (bug 3922) Further tweaks to bidi overrides in category list for old
20614  versions of Safari and Konqueror
20615* Fix custom namespaces on wikis set for Portuguese
20616* (bug 4153) Fix block length localizations in Greek
20617* (bug 3844) ab: av: ba: ce: & kv: now inherit from LanguageRu.php
20618             ii: & za: now inherit from LanguageZn_cn.php
20619* (bug 4165) Correct validation for user language selection (data taint)
20620* (bug 4192) Remove silly 'The Free Encyclopedia' default sitesubtitle
20621* Use content-lang for sitenotice
20622* (bug 4233) Update LanguageJa.php
20623* (bug 4279) Small correction to LanguageDa.php
20624* (bug 4108, 4336) Remove trailing whitespace from various messages, which
20625  mucks up message updating to create dupe entries
20626* (bug 4389) Fix math options on zh-hk and zh-tw (but not localized)
20627* (bug 4392) Update of LanguageSr.php
20628* (bug 4382) Frisian numeric format
20629* (bug 4424) Update for Spanish language (es) 100% messages translated
20630* (bug 4425) Typos in Polish translation
20631* (bug 4436) Update for Turkish language (tr)
20632* (bug 4413) Update of Farsi language file (LanguageFa.php)
20633* Update for LanguageSr (Serbian): magic words
20634* (bug 137) MediaWiki:Copyrightwarning hardcoding
20635* (bug 4457) Update for Portuguese language (pt)
20636* convertPlural breakage fixed a little
20637* (bug 4144) Support for Sudanese language (Basa Sunda)
20638* Big cleanup:
20639 - Removed obsolote, badly or untranslated messages
20640 - Removed references to wikipedia/wikimedia etc in messages
20641 - Other cleanup, like removing html and javascript and extension calls
20642 - Removed hardcoded namespaces: Tt, Ms, Ia, Ga, Fo, Bn, Csb, He, Nv, Oc, Tlh
20643 - Removed some useless backwards compatibility hacks
20644 - Fixed formatnum on many languages
20645* wgAmericanDates check produced incorrect results in languages that don't have
20646  a such distinction
20647* (bug 4548) Update for Portuguese language (pt): time format
20648* (bug 4530) Use consistent name for Kurdish
20649* Tweak default "upload disabled" text
20650* (bug 4504) Use site language for namespace name resolution
20651* (bug 4510) Correct Barnes & Noble bookstore URLs
20652* (bug 3991) Allow the operation of wikicode on Protect move only text
20653* (bug 4267) Switch dv sd ug ks arc languages to RTL
20654* Default main page content improved per bug 4690
20655* (bug 4615) Update for Portuguese language (pt)
20656* Separated MessagesSl.php as the other languages.
20657* (bug 4960) Add additional namespaces variants to Yiddish for compatibility
20658* (bug 4805) Removed more wikipedia-references from MessagesUk.php
20659* (bug 5015) Update magic words translation in LanguageBe.php
20660* (bug 4859) Update for Portuguese messages (pt)
20661* (bug 4788) One string for MessagesPl
20662* Restriction types now use restriction-* messages instead of ui messages
20663* (bug 4685) Slovenian LanguageSl.php hardcodes project namespace
20664* (bug 5097) Fix Hungarian language (hu): thousands separator
20665* (bug 5098) Update for Portuguese messages (pt)
20666* (bug 5113) Spelling error in French language file
20667* (bug 5105) Magic words for LanguageAr.php
20668* (bug 3993) Variants for Serbian language
20669* Typo in English messages file
20670* (bug 4114) Spacing in watchlist rows (in editing mode)
20671* Update default "exporttext" to reflect that Special:Import exists
20672* (bug 4960) Add additional namespaces variants to Yi projects: Yiddish Wikinews
20673  fix
20674* (bug 5357) Add the icon near the user name also in RTL interfaces
20675* (bug 5156) Update for Hebrew language (he)
20676* (bug 4497,4704,5010) Added some new language codes.
20677* (bug 5362) Piedmontese added
20678* (bug 5349) Update for Portuguese messages (pt)
20679* (bug 3573) Finished full Greek translation: namespaces
20680* (bug 5288) Initial localisation for Az
20681* (bug 4361) Fix "allmessagesnotsupportedui" so it doesn't refer to nonexisting
20682  page
20683* Tweak wording of "allmessagesnotsupporteddb"
20684
20685Parser:
20686* (bug 2522) {{CURRENTDAY2}} now shows the current day number with two digits
20687* (bug 3210) Fix Media: links with remote image URL path
20688* (bug 3405) Don't use raw letters as aliases of MSGNW: and SUBST:
20689* (bug 3412) Clean up date format handling so ~~~~-sigs work with default
20690  format as designed. Documentation comments updated.
20691* Fix Parser::unstrip on PHP 5.1.0RC4
20692* (bug 3797) Don't expand variables and sigs in comments
20693* Allow parser cache on redirect targets
20694* Run wikitext-escaping on plaintext sigs (no wiki markup, just name)
20695* Check for unbalanced HTML tags on raw sigs (markup allowed, but show
20696  a warning in prefs and use default sig if not balanced)
20697* Respect <noinclude> and <includeonly> during {{subst:}} expansion as well as
20698  ordinary templates.
20699* Support <includeonly> in templates loaded through preload= parameter
20700* (bug 3979) Save correct {{REVISIONID}} into parser cache on edit
20701* Substitute {{REVISIONID}} correctly in diff display
20702* (bug 1850) Allow red-links on image pages linked with [[:image:foo]]
20703* Fix XML validity checks in parser tests on PHP 5.1
20704* (bug 4377) "[" is not valid in URLs
20705* (bug 4453) fix for __TOC__ dollar-number breakage
20706* Convert unnecessary URL escape codes in external links to their equivalent
20707  character before doing anything with them. This prevents certain kinds of
20708  spam filter evasion.
20709* (bug 4783) : Fix for "{{ns:0}} does not render"
20710* Improved support for interwiki transclusion
20711* (bug 1850) Image link to nonexistent file fixed.
20712* (bug 5167) Add {{SUBPAGENAME}} and {{SUBPAGENAMEE}} variables
20713* (bug 4949) Missing : in "addedwatchtext" for English and Spanish
20714* Allow user-defined functions, which work in a similar way to {{GRAMMAR:}}
20715  etc. Registered via an interface similar to tag hooks.
20716
20717Upload:
20718* (bug 2527) Always set destination filename when new file is selected
20719* (bug 3076) Support MacBinary-encoded uploads from IE/Mac
20720* (bug 2554) Tell users they are uploading too large file
20721* Support for a license selection box on Special:Upload, configurable from
20722  MediaWiki:Licenses
20723* Add 'reupload' and 'reupload-shared' permission keys to restrict new uploads
20724  overwriting existing files; default is the old behavior (allowed).
20725
20726Security:
20727* (bug 3244) Fix remote image loading hack, JavaScript injection on MSIE
20728* (bug 3280) Respect 'move' group permission on page moves
20729* (bug 2613) Clear saved passwords from the form
20730* IP privacy fix for blocklist search on autoblocks
20731* Security fix for <math>
20732* Security fix for tables
20733* Security fix for Special:Upload license selection list
20734* Add UploadVerification hook for custom file upload validation/security checks
20735* Blacklist additional MSIE CSS safety tricks
20736* Fix meta robots tag on Special:Version again to avoid listing vulnerable
20737  versions for convenient harvesting by automated worms
20738* Sanitizer CSS comment processing order fix
20739* Forbid usernames that can be interpreted as titles with namespaces, as that
20740  leads to hard-to-manage names.
20741* (bug 4071) Generate passwords long enough for $wgMinimalPasswordLength
20742* Add createpage and createtalk permission keys, allowing a quick
20743  switch to disable page creation for anonymous users.
20744* (bug 675) Add page protection level for unregistered/new accounts
20745* User::isNewbie now uses the registration date and $wgAutoconfirmAge
20746* Add 'deletedhistory' permission key for ability to view deleted history
20747  list via Special:Undelete. Default is off, replicating the 1.5 behavior,
20748  but it can be turned back on for random users to replicate the previous
20749  1.6 dev behavior.
20750* Set cookies to secure mode based on use of HTTPS or $wgCookieSecure
20751* (bug 4371) Disallow tilde character in signatures
20752* Removed broken wgAllowAnonymousMinor and added new group right minoredit
20753* Added detection for WMF files (application/x-msmetafile), added this
20754  MIME type to the default blacklist. Prevented inline display of images
20755  which are not of known image types. This is in response to
20756  http://en.wikipedia.org/wiki/Windows_Metafile_vulnerability
20757* Blocked users can no longer roll back, change the protection of, or
20758  delete/undelete pages
20759* Protect against spoofing of X-Forwarded-For header
20760* XSS issue : now sanitize search query input (fixed in 1.5rc3)
20761* Remove deprecated $wgOnlySysopsCanPatrol references; use
20762  User::isAllowed( 'patrol' )
20763  per bug 5282. Patch by Alan Harder.
20764* Prevent registration/login with the username "MediaWiki default"
20765
20766Special Pages:
20767* Rearranged Special:Movepage form to reduce confusion between destination
20768  title and reason input boxes
20769* (bug 1956) Hide bot uploads from Special:Newimages
20770* (bug 3220) Fix escaping of block URLs in Recentchanges
20771* (bug 3284) Ipblocklist paging, substring search
20772* Allow filtering of robot edits in Special:Watchlist by setting
20773  $wgFilterRobotsWL = true.
20774* Fix interlanguage links on special pages when extra namespaces configured
20775* (bug 3475) anon contrib links on Special:Newpages
20776* Special:Import/importDump fixes: report XML parse errors, accept <minor/>
20777* (bug 2369) Add separate message for input box on Special:Prefixindex
20778* (bug 3798) DoubleRedirects no longer has hard coded arrows
20779* (bug 3803) Fix links on Special:Wantedcategories with miser mode off
20780* Fix Special:BrokenRedirects on MySQL 5.0
20781* (bug 3807) Fix 'all' in namespaces drop-down on contribs, rc
20782* Fail gracefully on invalid namespace in Special:Newpages
20783* (bug 3762) Define missing Special:Import UI messages
20784* (bug 3761) Avoid deprecation warnings in Special:Import
20785* (bug 2894) Enhanced Recent Changes link fixes
20786* (bug 4059) fix 'hide minor edits' on Recentchangeslinked
20787* (bug 146) List number of category members in Special:Categories
20788  (patch by Joel Nothman)
20789* (bug 4090) Fix diff links in Special:Recentchangeslinked
20790* (bug 4093) '&bot=1' in Special:Contributions now propagate to other links
20791* Fix display of old recentchanges records for page moves
20792* (bug 360) Let Whatlinkshere track [[:image:foo]] links
20793* (bug 3073) Keep search parameter on paging in Special:Newimages
20794* Removed Special:Validate, it's been superseded by the Review extension
20795* (bug 4359) red [[user:#id]] links generated in [[special:Log]]
20796* (bug 1996) Special page to list redirects
20797* (bug 4334) Add "watch" links to Special:Unwatchedpages
20798* Generate target user page links in Special:Ipblocklist where appropriate
20799  (i.e. not an autoblock)
20800* Generate link to talk page of the blocker in Special:Ipblocklist, move
20801  contribs. link of the target next to their name
20802* (bug 2714) Backlink from special:whatlinkshere was hard set as 'existing'
20803* Move parentheses out of <a> link in Special:Contributions
20804* (bug 3192): properly check 'limit' parameter on Special:Contributions
20805* (bug 3187) watchlist text refer to unexistent "Stop watching" action
20806* Add block, block log and general log links to Special:Contributions
20807* Add contributions link to block log items
20808* Added optional "hide own edits" feature to Special:Recentchanges
20809* (bug 5018) Anchors for each message in Special:Allmessages
20810* Introduce $wgWantedPagesThreshold per bug 5011; Special:Wantedpages will not
20811  list pages with less than this number of links. Defaults to 1.
20812* (bug 4319) Don't show a "create account" link on the login form when
20813  account creation is disabled.
20814* JavaScript filter for Special:Allmessages
20815* (bug 3047) Don't mention talk pages on Special:Movepage when there isn't one
20816* Show links to user page, talk page and contributions page on Special:Newpages
20817* Special:Export can now export a list of all contributors to an article (off by
20818  default)
20819* (bug 5372) Add number of files to Special:Statistics
20820* (bug 2871) Links to talk pages in watchlist editing view
20821* (bug 5385) Allow hiding anonymous edits on Special:Recentchanges
20822* (bug 2544) Illogical error reporting order in Special:Userlogin
20823* (bug 5409) Hide "show/hide patrolled edits" in Special:Recentchanges if
20824  patrolling is disabled
20825* (bug 5447) Convert first letter of username to uppercase before searching in
20826  Special:Listusers
20827* (bug 759) Wrap redirects on the watchlist editing page in a span, class
20828  "watchlistredir"
20829* (bug 1862) Namespace filtering in watchlists
20830
20831Misc.:
20832* PHP 4.1 compatibility fix: don't use new_link parameter to mysql_connect
20833  if running prior to 4.2.0 as it causes the call to fail
20834* (bug 3117) Fix display of upload size and type with tidy on
20835* (bug 2323) Remove "last" tabindex from history page
20836* (bug 3116) Division by zero on [[Image:Foo.png|123x123px|]]
20837* Fix display of read-only lockfile message
20838* Include software-visible client IP address in Special:Version comment
20839  as a proxy debugging aid
20840* (bug 3170) Page Title failed to obey MediaWiki:Pagetitle.
20841  wikititlesuffix was removed
20842* Add ability to break off certain debug topics into additional log files;
20843  use $wgDebugLogGroups to configure and wfDebugLog() to log.
20844* Edit conflict on recreation of deleted page
20845* (bug 3216) Don't show empty warning page when no warnings.
20846* (bug 3218) Use proper quoting on history Compare Revisions button
20847* Fix upgrade from 1.4 due to version number check breakage [for rc future]
20848* Fix upgrade from 1.4 with no old revisions
20849* Remove "info" editing toolbar that was shown in browsers which do not
20850fully support the editing toolbar, but was found to be too confusing.
20851* Don't override edit conflict suppression on section edits; section merging
20852  should provide the expected transparency here and fits usage patterns better.
20853* (bug 3292) Fix move-over-redirect test when current entries are not plaintext
20854* (bug 2078) Don't hide watch tab on preview
20855* Fix regressions in ChangesList traditional layout
20856* Fix edit on double-click for move-protected pages in Classic skin
20857* (bug 3485) Fix bogus warning about filename capitalization when off
20858* (bug 2570) Add 'watch this page' checkbox on uploads, watch uploads
20859  by default when 'watchdefault' option is on
20860* Add options to dumpBackup.php for making split/partial dumps by page id
20861* Added filter options, compression piping, and multiple output streams for
20862  dumpBackup.php
20863* (bug 3595) Warn and abort if importDump.php called in read-only mode.
20864* (bug 3598) Update message cache on message page deletion, patch by Tietew
20865* Added separate noarticletext and newarticletext messages for logged in and
20866  anon users.
20867* (bug 3332) Installation now uses Monobook, validates, plus usability
20868  improvements.
20869* (bug 3660) Update diff3 detection to work with Windows/Cygwin
20870* (bug 2330) Don't do funny thinks with "links" in MediaWiki:Undeletedtext
20871* Two-pass data dump for friendliness to the DB (--stub, then dumpTextPass.php)
20872* Data dump 'prefetch' mode to read normalized text from a prior dump
20873  (requires PHP 5, XMLReader extension)
20874* (bug 2773) Print style sheet no longer overrides RTL text direction
20875* (bug 2938) Update MediaWiki:Exporttext to be more general
20876* Various fixes
20877* Fix wfMsg*() replacements; args containing literal $[2-9] were wiped
20878* Added @import for [[MediaWiki:Common.css]] to all skins
20879* Edit box now remembers scrollbar position on preview
20880* (bug 3816) Throw edit conflict instead of fatal error when a page is
20881  moved or deleted during section edit
20882* (bug 3771) Handle internal functions in backtrace in wfAbruptExit()
20883* (bug 3291) 'last' diff link for last history line when not at end
20884* (bug 3667) Add missing global in page move code
20885* (bug 2885) Remove unnecessary reference parameter which broke classic skin
20886  talk notification on PHP 5.0.5
20887* (bug 3852) "Redirected from" link no longer obscured on double-redirects
20888* changed directory hierarchy in images/math/. System upgrades from old to
20889  new hierarchy on the fly.
20890* (bug 3487) Fix category edit preview with preview-on-bottom
20891* (bug 918) Search index incorrectly joined words at == headings ==
20892* (bug 3877) Render math images into temp directory, then move to hashed
20893  subdir so you can render new math images and have them work
20894* (bug 2392) Fix Atom items content type, upgrade to Atom 1.0
20895* Allow $wgFeedCacheTimeout of 0 to disable feed caching
20896* Fix WebRequest::getRequestURL() to strip off the host bits squid prepends
20897* Require POST for action=purge, to stop bots from purging the cache
20898* Added local message cache feature ($wgLocalMessageCache), to reduce bandwidth
20899  requirements to the memcached server.
20900* (bug 3562) for go search, try Caps-Variants-Broken-At-Non-Whitespace
20901* (bug 2569) Use PATH_SEPARATOR instead of trying to guess based on
20902  DIRECTORY_SEPARATOR (was wrong on NetWare)
20903* (bug 2740) Accept image deletions on 'enter' submit from MSIE
20904* (bug 3939) Don't try to load text for interwiki redirect target
20905* (bug 3948) Avoid notice warning in debug statement in bad search
20906* Recognize Special:Search consistently so read whitelist works
20907* (bug 3999) Change atom 1.0 feed id; had been unnecessarily complex due to
20908  unclear language in the spec. Now using the URL, same as the permalink,
20909  which someone else will probably whine about because it's not 'perma'
20910  enough or something.
20911* (bug 4014) Fix include mode for Allpages on small page sets
20912* (bug 3996) Fix text for new entries in RC RSS/Atom feed
20913* (bug 3065) Update both watched namespaces when renaming pages
20914* Changed mail form to have a bigger message entry box (like for editing
20915  a page
20916* Fix ulimit parameters for wfShellExec when memory_limit is specified in 'm'
20917* (bug 2111) Collapsable exif metadata table, clean up display
20918* Reduce fractions in display of exif exposure time
20919* (bug 4048) Optional footer link to site privacy policy
20920* Don't die() when update.php reaches the end of the warning count
20921* (bug 1915) Fix edit links when 'direction' used with 'oldid';
20922  using revision ID reported via OutputPage; Skin::editUrlOptions()
20923* Remove obsolete 'redirect=no' on some edit links
20924* Include oldid for the second revision on edit link on diff view
20925* (bug 4035) Fix prev/next revision links on edit page
20926* (bug 4100, 3049) Add 'edittools' message to hold edit tools, put it
20927  on Special:Upload as well as edit, rearrange edit page pieces a bit.
20928  Copyright warning now above the buttons to ensure it's visible,
20929  template list at the bottom so it can grow.
20930* Optional summary parameter to action=rollback, for user javascript
20931* (bug 4167) Fix regression caused by patch for bug 153
20932* (bug 4169) Use $wgLegalTitleChars in pipe trick conversions
20933* (bug 4170) Decode HTML character escapes in sort key
20934* (bug 4201) Fix user-talk mode for Enotif, and general code cleanup
20935* (bug 4214) Skip redundant action text inserts into the HTML <title>
20936* (bug 4212) Skip redundant meta-robots tag for default settings
20937* Fix regression: old version missing from edit links in Nostalgia skin
20938* (bug 1600) Trigger edit conflict on duplicate section=new submissions
20939* (bug 4001) Use local variables properly in wikibits.js akeytt()
20940* Fix regression: old version missing from edit links on CSS/JS pages
20941* (bug 3211) Include Date, To mail headers when using PEAR::Mail
20942* (bug 3407) Fix encoding of subject and from/to headers on notification
20943  mails; userMailer() now takes a MailAddress wrapper object instead of
20944  a raw string to abstract things a level.
20945* Fixed --server override on dumpTextPass.php
20946* Added plugin interface for dumpBackup, so additional filters and output
20947  sink types can be registered at runtime from an extension
20948* (bug 349) Fix for some numeric differences not being highlighted
20949  patch by Andrius Ramanauskas
20950* (bug 4298) Include rc_id on enhanced RC singleton diff links for patrolling
20951* Did some refactoring on ChangesList.php merging dupe code
20952* (bug 1586) Fix interwiki generator for wikimedia obscure domains
20953* (bug 3493) Mark edits patrolled when they are reverted
20954  patch by Leon Planken
20955* Removed experimental Amethyst skin from default set
20956* Upgrade old skin preferences properly at Special:Preferences
20957  (used to spontaneously switch to Classic skin for old numeric pref records)
20958* (bug 3424) Update page_touched for category members on category page creation
20959* Log views show message when no matches
20960* Fix raw sitenotice display on database error
20961* Fix autoconfirm check for old accounts
20962* (bug 4368) Don't show useless empty preview on new section creation
20963* Don't show useless empty preview on new page creation
20964* (bug 4411) Fix messages diff link for classic skin
20965* (bug 4385) Separate parser cache entries for non-editing users, so section
20966  edit links don't vanish / appear unwanted on protected pages
20967* (bug 2726, 3397) Fix [[Special:]] and [[:Image]] links in action=render
20968* (bug 4419) Remove obsolete magnify.png.old
20969* Removed $wgUseCategoryMagic option, categories are now enabled unconditionally
20970* (bug 3318) UI workarounds for disabled items in license selector
20971  MSIE/Win: items now grayed out, JS will revert to 'non selected' if clicked
20972  Safari: JS will revert to 'non selected' if clicked (but not gray)
20973  MSIE/Mac: indented items now visible (JS hack)
20974* (bug 714) "plainlinks" class issues in IE, Opera
20975* (bug 4317) Inconsistent "broken redirects" messages
20976* Default interface text for "selflinks" tweaked
20977* (bug 3194) default implementation of translateBlockExpiry
20978  which uses ipboptions
20979* (bug 4446) $wgExportAllowHistory option to explicitly disable history in
20980  Special:Export form, 'exportnohistory' message to translate live hack.
20981* Maintenance script to delete unused user accounts
20982* (bug 912) Search box easier to reach in text browsers (lynx, links)
20983* $wgParserCacheExpireTime added
20984* Skip loading of RecentChange.php except where needed
20985* Enforce $wgSVGMaxSize when rendering, even for SVGs with a very large source
20986  size. This is necessary to limit server memory usage.
20987* Cleanup and error checking on Special:Listredirects
20988* Clear up some instances of old OutputPage::sysopRequired() function usage
20989* Improve "upload disabled" notice
20990* Move parts of index.php to include/Wiki.php in an attempt to both cleanup
20991  index.php and create a MediaWiki-class mediaWiki base object
20992* (bug 4104) Added OutputPageBeforeHTML hook for tweaking primary wiki output
20993  HTML on final output (cached or not)
20994* Avoid PHP notice on command-line scripts if empty argument is passed ('')
20995* (bug 4571) Partial fix hack for {{fulllurl:}} in action=render
20996* (bug 3502) Bowtie symbol for TeX
20997* (bug 4000) Support for \textstyle et al. in <math>
20998* (bug 1663) support color in TeX formulas
20999* (bug 2026) missing glue around \not= (TeX)
21000* (bug 4576) Missing '>' broke license selector's first option in IE, Opera
21001* Override $wgLocaltimezone in parser tests for us outside Iceland and UK
21002* Fix extra whitespace at end of Wiki.php, DESTROYS XML OUTPUT
21003* Remove redundant 'echo' statements from MonoBook.php
21004* (bug 1103) Fix up redirect handling for images, categories
21005  Redirects are now followed from the top-level, outside of the Article
21006  content loading and viewing, for clarity and consistency.
21007* (bug 4104) 'OutputPageBeforeHTML' hook to postprocess article HTML on
21008  page view (comes after parser cache, if used). Patch by ThomasV.
21009* Linker::formatComment corrupted the passed title object on PHP 5
21010  if the comment included a section link. Use clone() to make a safe copy.
21011* Add wfClone() wrapper since we're still using PHP 4 on some servers.
21012* Remove obsolete killthread.php
21013* Added wfDie() wrapper, and some manual die(-1), to force the return code
21014  to the shell to return nonzero when we crap out with an error.
21015* Allow input of the stub from a compressed file instead of stdin
21016  for dumpTextPass.php; easier to get errors back on the shell
21017* Added an attractive space on the namespace selector on contribs
21018* Move PHP 5-friendly XHTML doctype hack to Sanitizer, use for sig checks.
21019  Fixes use of named entities in sigs on PHP 5
21020* (bug 4482) Include move comment on the null edit as well as the redirect
21021* (bug 3990) Use existing session name if session.auto_start is on
21022  Fixes checks for open sessions, such as the cookie warning on login.
21023  Patch by Zbigniew Braniecki.
21024* Add cache-safe alternate sitenotice for anonymous users.
21025  (MediaWiki:Anonnotice) This is displayed instead of the regular sitenotice,
21026  if it exists. If not, the regular sitenotice shows. If that doesn't exist,
21027  the value of $wgSiteNotice is used, and if that's null, then nothing is shown.
21028* Spit the generated LocalSettings code out during the installer as an aid
21029  to debugging issues. (Keep this?)
21030* Use __FILE__ to form path in new LocalSettings.php, so it stays accurate
21031  when the directory is relocated for typical usage.
21032* Auto-update $wgCacheEpoch when LocalSettings.php changes on new installs.
21033  For typical usage this will be a light burden and should reduce confusion
21034  when the configuration is edited.
21035* Fix $wgCacheEpoch's effect on client-side caching.
21036* (bug 1122) gray out 'older revision' when viewing first article revision.
21037* Clearer message in DefaultSettings.php: edit LocalSettings.php instead
21038* MonoBook skin top link id changed from "contentTop" to "top" (shared with
21039  name attribute)
21040* (bug 3350) Missing label for move talk page checkbox.
21041* (bug 2108) Sort entries when using category browser
21042* (bug 2393) Fix MIME type for Atom feeds ( application/rss+atom )
21043* Add ".deps.php" include-file preloaders for some dynamically-loaded
21044  language and skin classes. Should help with the broken base-class
21045  problem under PHP 5 with APC as opcode cache. See details:
21046  http://mail.wikipedia.org/pipermail/wikitech-l/2006-January/033660.html
21047* Small changes to tabs in Monobook skin c/o Chris Ware
21048* (bug 4679) Work around buggy basename() function in PHP5, which breaks
21049  uploads of files starting with multibyte characters on Linux.
21050  wfBaseName() doesn't suffer this bug, and understands backslash on
21051  both Unix and Windows.
21052* (bug 3603) headscripts variable not hooked up to MonoBook skin
21053* Allow local cdb-based interwiki cache
21054* Use the "block", not the "protect" permission, when determining whether to
21055  show a "block user" link in the toolbox
21056* Fix backup dump text prefetch for XMLReader constant changes in PHP 5.1
21057* Suppress useless percentage indicator on output from 7za during dumps
21058* (bug 4633) Add (previous 200) (next 200) also above catlinks
21059* (bug 4686) Fix regression where ?diff=0&oldid=0 caused fatal error on
21060  pages with only one revision. Fixes message diff link on first edit.
21061* Fix dependence on hardcoded UNIQ_PREFIX in LanguageConverter.php
21062* Do not check lag on external storage servers
21063* Do not tidy interface messages (unless full tidy is set)
21064* Do not trust equality propagation and give more hints to MySQL
21065  optimizer for revision fetches (avoids index scans)
21066* Use revision rate for ETA in dump generation; it tends to be more stable
21067  than the per-page count for full-history dumps.
21068* Include timestamp in wfDebugLog breakouts
21069* (bug 4469) Namespace-specific notice to be displayed below site-notice
21070  Edit messages like "MediaWiki:Namespacenotice-" plus namespace name
21071  which is blank for main namespace, or like e.g. "User_talk"
21072* Adjust user login/creation form hooks to work with a captcha plugin
21073* (bug 1284) Inline styles for diffs in Recent Changes RSS/Atom feeds
21074* (bug 4824) IE7 beta 2 broke compatibility with PNG logo workarounds,
21075  and seems to work ok with other bits. No longer including the IE
21076  workarounds JavaScript for IE 7 and above.
21077* Fix extra namespace for Bulgarian
21078* (bug 4303) Add $wgFavicon to change the shorticon icon link from
21079  the default /favicon.ico or disable it (if set to false)
21080* (bug 3347) strip linebreaks in math error source
21081* (bug 4841) Warning for non-logged-in edits
21082* (bug 4867) Leave invalid EXIF date fields unformatted instead of
21083  showing a bogus current timestamp
21084* Reset $wgActionPaths during parser test; corrects some false failures
21085  in the automated test report.
21086* (bug 4875) Define a div containing the shared image description
21087* (bug 4860) Expose Title->userCan() as Hooks
21088* (bug 4828) Fix genitive month-name variable for cs, pl, uk
21089* (bug 4842) Fix 'show number of watching users' with enhanced RC
21090* (bug 4889) Fix image talk namespace for Tamil
21091* (bug 4147) Added cleanupWatchlist.php to clear out bogus watchlist entries
21092* (partial bug 3456) Disable auto redirect to Main Page after account creation
21093* (bug 4824) Separate out IE7 CSS compat hacks, fix for RTL pages
21094* Added support for wikidiff2 and similar external diff engines.
21095* Allow cookies to be shared between multiple wikis with a shared user database
21096* Blocking some Unicode whitespace characters in usernames. Should check
21097  if some or all should be blocked from all page titles.
21098* Unknown log types no longer throw notices everywhere in RecentChanges
21099* (bug 4502, 5017) Don't render potentially hostile deleted page contents
21100  on Special:Undelete by default; show source, with an optional preview.
21101  The revisions list no longer shows the latest text by default, so it can
21102  still be operated if the text is hostile.
21103* (bug 5013) Check for existence on "return to" links
21104* Removed trailing whitespace on a bunch more messages.
21105* Fix missing bad title check in Special:Booksources
21106* Remove empty booksources string in fy
21107* Avoid corrupting <gallery> inside <!-- comment -->
21108* Remove legacy PHPTal code, hasn't been maintained in ages.
21109* Tweak Userlogin include order for APC issue
21110* Don't try to link to current page on protection tab
21111* More exact checking in Title::equals() to fox moves of numerically similar
21112  page titles. (Odd hex title bug on 64-bit.)
21113* Fix explicit s-maxage=0 on raw pages; should help with proxy issues in
21114  generated stylesheets... hopefully...
21115* (bug 4685) More fixes for Slovenian project namespace
21116* Fixed and enhanced a little the Live Preview, which had been broken for some
21117  time
21118* Added article size limit, $wgMaxArticleSize
21119* (bug 4974) Don't follow redirected talk page on "new messages" link
21120* (bug 4970) Make category paging limits configurable
21121* (bug 4535) Warn user when editing CSS or JS subpage of a skin that doesn't
21122  exist
21123* Make Live Preview an user preference, still controllable by the global
21124  variable
21125* Rename the stub LanguageAls / LanguageGem_alsation to LanguageGsw to follow
21126  updated language code assignments
21127* (bug 5081) Remove bogus fix for invalid characters in links which simply
21128  broke use of legitimate multiple whitespace characters in bracketed link.
21129* (bug 4838) Add relative oldids (prev, next, cur) for raw pages
21130  Patch by Lupin
21131* (bug 5086) Force image resize dimensions on ImageMagick, as for instance
21132  "-resize 100x35!"; some thumbs were off due to differences in rounding and
21133  would be generated smaller than expected.
21134* (bug 5062) Width sometimes one pixel short when using maximum heights
21135* Purge thumbnails and metadata cache for action=purge on an image page
21136* (bug 4273) Bounce back with a message when attempting to submit a new comment
21137  with an empty main textbox (user probably hit Enter in subject field)
21138* (bug 5141) Gracefully handle the new account link when createaccount off
21139* (bug 5150 and related) Fix missing ID attribute in HTML namespace selector
21140* (bug 5152) Proper HTML escaping on subpage breadcrumbs
21141* (bug 4855) Section edit links now have the section name in the title
21142  attribute.
21143* (bug 2115) Support shift-selecting multiple checkboxes with JavaScript.
21144* (bug 5161) Don't try to load template list for nonexistent pages
21145* (bug 5228) Workaround for broken LanguageConverter title overrides; avoid
21146  unnecessary hidden UI work when watch/unwatch is performed on edit
21147* Fixed bogus master fallback in external storage
21148* (bug 5246) Add speak:none to "hiddenStructure" class in main.css
21149* Further work on rev_deleted; changed to a bitfield with several data-hiding
21150  options. Not yet ready for production use; Special:Revisiondelete is
21151  incomplete, and the flags are not preserved across page deletion/undeletion.
21152  To try it; add the 'deleterevision' permission to a privileged group.
21153* (bug 5270) Fix broken linktrail for br, cv, fr, hr, nn, oc, ta, wa
21154* Add a clickable contribs link in user tool links (rc, watchlist, diff view)
21155  to see how people like it. (There was one in the old hacked-up diff view.)
21156* (bug 5236) Load wikibits.js before site-customized javascript
21157* (bug 4119) Workaround for <nowiki> following link in Walloon; remove capitals
21158  from linktrail, as they're not used anywhere else.
21159* (bug 4781) Output links with the percent-encoding they're supplied with;
21160  save the normalization for internal link storage. The normalization is a bit
21161  buggy and can make incorrect foldings in the query string and such, so isn't
21162  reliable beyond the hostname where it's used for the spam bulk checker.
21163* Don't URL-decode in the title attribute for URL links; it can produce false
21164  results that don't code back to their original values.
21165* (bug 4611) Add user preference (default on) to add new pages to creators's
21166  watchlist
21167* (bug 5286) Fix regression in display of missing/bad revision IDs
21168* (bug 4729) Add user preference that marks a user's edits as patrolled if user
21169  is able to
21170* (bug 4630) Add user preference to prompt users when entering blank edit
21171  summaries
21172* Added optional suggest feature for the search box. Set wgUseAjax to true to
21173  enable it.
21174* (bug 5277) Use audio/midi rather that audio/mid
21175* (bug 5410) Use namespace name when a custom namespace's nstab-NS message is
21176  nonexistent
21177* (bug 5432) Fix inconsistencies in cookie names when using table prefixes
21178* Additional protections against HTML breakage in table parsing
21179* (bug 5355) Include skin name and style JS settings in page source;
21180  fixes regression where Opera 6/7 and KHTML CSS fixes weren't applied
21181  when wikibits.js was moved up before user JS inclusion.
21182* Added $wgColorErrors: if set, database error messages will be highlighted
21183  when running command-line scripts in a Unix terminal.
21184* (bug 5195) rebuildrecentchanges.php works again; Database::insertSelect now
21185  has a parameter for select options.
21186* Fix updateSearchIndex.php for new schema
21187* Fix bogus "filename too short" error when uploading files with a period in the
21188  base name, e.g. "Mr. Zee.png"
21189* (bug 2139) Show page title in subtitle when viewing "read only" page
21190* (bug 5452) Update language name for Cree
21191
21192== Compatibility ==
21193
21194Older PHP 4.2 and 4.1 releases are no longer supported; PHP 4 users must
21195upgrade to 4.3 or later.
21196
21197MediaWiki 1.6 is the last major version to support PHP 4; future versions will
21198require PHP 5.
21199
21200MySQL 3.23.x is no longer supported; some older hosts may need to upgrade.
21201At this time we still recommend 4.0, but 4.1/5.0 will work fine in most cases.
21202
21203== Upgrading ==
21204
21205Several changes to the database have been made from 1.5; these are relatively
21206minor but do require that the update process be run before the new code will
21207work properly:
21208
21209* A new "templatelinks" table tracks template inclusions.
21210* A new "externallinks" table tracks URL links; this can be used by a mass
21211spam-cleanup tool in the SpamBlacklist extension.
21212* A new "jobs" table stores a queue of pages to update in the background; this
21213is used to update links in including pages when templates are edited.
21214
21215To ensure that these tables are filled with data, run refreshLinks.php after
21216the upgrade.
21217
21218If you are upgrading from MediaWiki 1.4.x or earlier, some major database
21219changes are made, and there is a slightly higher chance that things could
21220break. Don't forget to always back up your database before upgrading!
21221
21222=== Caveats ===
21223
21224Some output, particularly involving user-supplied inline HTML, may not produce
21225100% valid or well-formed XHTML output. Testers are welcome to set $wgMimeType
21226= "application/xhtml+xml"; to test for remaining problem cases, but this is not
21227recommended on live sites. (This must be set for MathML to display properly in
21228Mozilla.)
21229
21230
21231= MediaWiki 1.5 =
21232
21233== MediaWiki 1.5.9 ==
21234* (bug 3359) Add hooks on completion of file upload
21235
21236== MediaWiki 1.5.8 ==
21237
21238March 26, 2006
21239
21240MediaWiki 1.5.8 is a security and bugfix maintenance release.
21241
21242A bug in decoding of certain encoded links could allow injection of raw
21243HTML into page output; this could potentially lead to XSS attacks.
21244
21245Some minor UI fixes were also made, see the change log at the bottom of
21246this file.
21247
21248
21249== MediaWiki 1.5.7 ==
21250
21251March 2, 2006
21252
21253MediaWiki 1.5.7 is a bugfix maintenance release.
21254
21255Most importantly, a security issue in the installer has been fixed. The bug
21256affects new installations of 1.5.6 only. If the user specified the MySQL root
21257password, to allow the installer to create an unprivileged account, the
21258installer would not only create the new account but also change the root
21259password to be equal to the password of the new account.
21260
21261Anyone affected by this bug will need to change the root password back
21262manually. For information about how to change passwords in MySQL please see:
21263http://dev.mysql.com/doc/refman/5.1/en/passwords.html
21264
21265This version includes fixes for compatibility with Internet Explorer 7
21266beta 2, and various other bugs; see the full changelog at the end of
21267the release notes.
21268
21269
21270== MediaWiki 1.5.6 ==
21271
21272January 19, 2006
21273
21274MediaWiki 1.5.6 is a security and bugfix maintenance release.
21275
21276A bug in edit comment formatting could send PHP into an infinite loop
21277if certain malformed links were included. In most installations, this
21278would cause the script to fail after PHP's 30-second failsafe timeout.
21279
21280Some improvements have been made to the installer which should make
21281installation possible on a system with a broken MySQL "root" account.
21282
21283For several other minor fixes, see the complete changelog at the end
21284of this file.
21285
21286
21287== MediaWiki 1.5.5 ==
21288
21289January 5, 2006
21290
21291MediaWiki 1.5.5 is a security and bugfix maintenance release.
21292
21293Detection for uploads of Windows Metafile (.wmf) images has been added
21294to help protect against a client-side vulnerability in unpatched Microsoft
21295Windows operating systems.
21296
21297Sites which have enabled uploads and added non-standard file types
21298(such as .ogg, .doc, or .pdf) should upgrade to this release to ensure
21299that malicious .wmf files can't be uploaded with a fake extension;
21300such files could put visitors to the site at risk.
21301
21302For more details on this, see:
21303http://en.wikipedia.org/wiki/Windows_Metafile_vulnerability
21304
21305Additionally, a maintenance script removeUnusedAccounts.php has been added;
21306this replaces an older Perl script which had not been updated for the new
21307schema in 1.5.
21308
21309
21310== MediaWiki 1.5.4 ==
21311
21312December 21, 2005
21313
21314MediaWiki 1.5.4 is a security and bugfix maintenance release.
21315
21316A hardcoded internal placeholder string has been replaced with a random
21317one. This closes a hole where security checks in inline style attributes
21318could be bypassed, injecting JavaScript code that could execute in
21319Microsoft Internet Explorer.
21320
21321Other browsers would not be vulnerable.
21322
21323Several minor fixes are included in this release, most notably a fix
21324to clear the "you have new messages" flag properly for usernames
21325containing spaces when e-mail notification is enabled.
21326
21327See the changelog at the end of the release notes for a full list of
21328fixes.
21329
21330
21331== MediaWiki 1.5.3 ==
21332
21333December 4, 2005
21334
21335MediaWiki 1.5.3 is a security and bugfix maintenance release.
21336
21337Validation of the user language option was broken by a code change in
21338May 2005, opening the possibility of remote code execution as this
21339parameter is used in forming a class name dynamically created with
21340eval().
21341
21342The validation has been corrected in this version. All prior 1.5 release
21343and prelease versions are affected; 1.4 and earlier and not affected.
21344
21345Additionally several bugs have been fixed; see the changelog later in
21346this file for a complete list.
21347
21348
21349== MediaWiki 1.5.2 ==
21350
21351November 2, 2005
21352
21353MediaWiki 1.5.2 is a bugfix maintenance release.
21354
21355A change in PHP 4.4.1 and PHP 5.1.0RC broke handling of extension and
21356<pre> sections, causing garbage data to be inserted in output and saved
21357edits. This version works around the change.
21358
21359Several other glitches with MySQL 5.0 and PHP 5.0.5 were also fixed;
21360see the change log below for a complete list.
21361
21362
21363== MediaWiki 1.5.1 ==
21364
21365October 26, 2005
21366
21367MediaWiki 1.5.1 is a bugfix and security maintenance release, and is a
21368recommended upgrade for all installations.
21369
21370This release includes further corrections to the inline CSS style sanitation
21371which works around a JavaScript "feature" on Microsoft Internet Explorer.
21372Users of Microsoft Internet Explorer for Windows may be vulnerable to
21373XSS injections on prior versions; users of standards-compliant browsers
21374are not vulnerable.
21375
21376Major fixes include:
21377* Image pages work again with resizing disabled
21378* Works in MySQL 5.0 strict mode
21379
21380There is experimental support in this release for explicitly declaring
21381the UTF-8 charset in the database; this has been tested with MySQL 5.0.15
21382but should work on 4.1 as well.
21383
21384IMPORTANT: Changing this setting on an existing wiki may produce interesting
21385data corruption, depending on server configuration. Page contents should,
21386usually, be unaffected, but page titles and other items may be. Limitations
21387in MySQL's Unicode support mean that characters outside the BMP cannot be used
21388in page titles or various other fields when using this mode.
21389
21390Table definitions are in maintenance/mysql5/tables.sql, and the runtime
21391option to send 'SET NAMES utf8' is set by $wgDBmysql5 = true.
21392
21393(MySQL 3.23.x and 4.0.x do not support character set declarations; on these
21394versions MediaWiki simply works with UTF-8 data and MySQL is blissfully
21395unaware of it.)
21396
21397
21398
21399== MediaWiki 1.5.0 final ==
21400
21401October 5, 2005
21402
21403MediaWiki 1.5.0 is the new stable release branch of MediaWiki, and is
21404recommended for all new installations.
21405
21406Any wikis running a 1.5 beta or release candidate are strongly recommended
21407to upgrade to the final release, which includes a number of bug fixes and
21408a security fix for CSS bugs in Microsoft Internet Explorer.
21409
21410IMPORTANT: Running a 1.3 or 1.4 wiki and don't want to jump to 1.5 yet?
21411Be sure to upgrade to 1.3.17 or 1.4.11, also released today. Versions
21412prior to 1.3.16 and 1.4.10 have a serious data corruption bug which is
21413triggered by a spambot known to operate in the wild.
21414
21415
21416=== What's new in 1.5? ===
21417
21418Schema:
21419  The core table schema has changed significantly. This should make better
21420  use of the database's cache and disk I/O, and make significantly speed up
21421  rename and delete operations on pages with very long edit histories.
21422
21423  Unfortunately this does mean upgrading a wiki of size from 1.4 will require
21424  some downtime for the schema restructuring, but future storage backend
21425  changes should be able to integrate into the new system more easily.
21426
21427Permalinks:
21428  The current revision of a page now has a permanent 'oldid' number assigned
21429  immediately, and the id numbers are now preserved across deletion/undeletion.
21430  A permanent reference to the current revision of a page is now just a matter
21431  of going to the 'history' tab and copying the first link in the list.
21432
21433Page move log:
21434  Renames of pages are now recorded in Special:Log and the page history.
21435  A handy revert link is available from the log for sysops.
21436
21437Editing diff:
21438  Ever lost track of what you'd done so far during an edit? A 'Show diff'
21439  button on the edit page now makes it easy to remember.
21440
21441Uploads:
21442  It's now possible to specify the final filename of an upload distinct
21443  from the original filename on your disk.
21444
21445  An image link for a missing file will now take you straight to the upload
21446  page.
21447
21448  More metadata is pre-extracted from uploaded images, which will ease pressure
21449  on disk or NFS volumes used to store images. EXIF metadata is displayed on
21450  the image description page if PHP is configured with the necessary module.
21451
21452  If .svg files are added to the upload whitelist, you can choose to render
21453  them to rasterized .png images for inline display using one of several
21454  external helper programs. See DefaultSettings.php for SVG options.
21455
21456User accounts:
21457  There are some changes to the user permissions system, with assignable
21458  groups. Note that this does *not* allow you to make pages which are only
21459  accessible to certain groups.
21460
21461  For details see: https://www.mediawiki.org/wiki/Manual:User_rights
21462
21463E-mail:
21464  User-to-user e-mail can now be restricted to require a mail-back confirmation
21465  first to reduce potential for abuse with false addresses.
21466
21467  Updates to user talk pages and watchlist entries can optionally send e-mail
21468  notifications.
21469
21470External hooks:
21471  A somewhat experimental interface for hooking in an external editor
21472  application is included.
21473
21474And...
21475  A bunch of stuff we forgot to mention.
21476
21477
21478=== What's gone? ===
21479
21480Latin-1:
21481  Wikis must now be encoded in Unicode UTF-8; this has been the default for
21482  some time, but some languages could optionally be installed in Latin-1 mode.
21483  This is no longer supported.
21484
21485  You can check if your current wiki is in Latin-1 mode by using your browser's
21486  "view source"; look for a line like this:
21487
21488    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
21489
21490  If it says charset=utf-8, you're ready. If it says charset=iso8859-1,
21491  you may need to convert your data. (English-language wikis avoiding
21492  any accented characters may be able to get away without conversion.)
21493
21494MySQL 3.x:
21495  Some optimization hacks for MySQL 3.x have been removed as part of the schema
21496  clean-up (specifically, the inverse_timestamp fields).
21497
21498  MediaWiki 1.5 may still run on 3.x, but wikis of non-trivial size should
21499  very seriously consider upgrading to a more modern release. MySQL 3.x support
21500  will probably be entirely dropped in the next major release.
21501
21502Special:Maintenance
21503  These tools were, ironically enough, not really maintained. This special
21504  page has been removed; insofar as some of its pieces were useful and haven't
21505  already been supplanted by other special pages they should be rewritten in
21506  an efficient and safe manner in the future.
21507
21508
21509=== Caveats ===
21510
21511Upgrade:
21512  Wikis in Latin-1 encoding are no longer supported; only Unicode UTF-8.
21513  A new option $wgLegacyEncoding is provided to allow on-the-fly recoding of
21514  old page text entries, but other metadata fields (titles, comments etc) need
21515  to be pre-converted. The standard upgrade process does not yet fully automate
21516  this, but you can try the alternate partial-upgrader in upgrade1_5.php.
21517
21518  The upgrade from 1.4 to 1.5 schema has not been tested for all cases, so
21519  it's possible you may experience problems in some combinations.
21520
21521Backups:
21522  The text entries of deleted pages are no longer removed from the main
21523  text table on deletion. If you provide public backup dumps of your databases,
21524  you will probably want to use the new XML-format dump generator, available
21525  as maintenance/dumpBackup.php.
21526
21527  For more information on how we run our own public data dumps at Wikimedia,
21528  see http://meta.wikimedia.org/wiki/Data_dumps
21529
21530PostgreSQL:
21531  The table definitions for PostgreSQL install are out of date. PostgreSQL
21532  support may return in later releases, pending appropriate patches.
21533
21534MySQL 4.1+:
21535  Some users may encounter installation problems with MySQL 4.1 or higher
21536  due to strange charset encoding / collation configurations. Try setting
21537  to 'latin1' or 'utf8' if you encounter problems.
21538
21539
21540
21541== MediaWiki 1.5 release candidate 4 ==
21542
21543August 29, 2005
21544
21545MediaWiki 1.5rc4 is a preview release of the new 1.5 release series.
21546It fixes compatibility with PHP 5.1, and corrects two cross-site scripting
21547security bugs:
21548
21549* <math> tags were handled incorrectly when TeX rendering support is off,
21550  as in the default configuration.
21551* Extension or <nowiki> sections in Wiki table syntax could bypass HTML
21552  style attribute restrictions for cross-site scripting attacks against
21553  Microsoft Internet Explorer
21554
21555Wikis where the optional math support has been *enabled* are not vulnerable
21556to the first, but are vulnerable to the second.
21557
21558
21559
21560== MediaWiki 1.5 release candidate 3 ==
21561
21562August 24, 2005
21563
21564MediaWiki 1.5rc3 is a preview release of the new 1.5 release series.
21565It fixes several major problems in 1.5rc2:
21566
21567* Fixed a cross-site scripting injection in the search form
21568  (broken since 1.5beta1)
21569
21570* Fixed upgrades from 1.4 database schema
21571  (broken since 1.5rc2)
21572
215731.3 and 1.4 releases are not vulnerable to the XSS bug, but anyone
21574running an earlier 1.5 beta or release candidate should upgrade
21575immediately.
21576
21577
21578== MediaWiki 1.5 release candidate 2 ==
21579
21580August 23, 2005
21581
21582MediaWiki 1.5rc2 is a preview release of the new 1.5 release series.
21583Numerous bug fixes since last beta, plus a security fix; see change
21584log below for full details.
21585
21586A flaw in the interaction between extensions and HTML attribute
21587sanitization was discovered which could allow unauthorized use
21588of offsite resources in style sheets, and possible exploitation
21589of a JavaScript injection feature on Microsoft Internet Explorer.
21590
21591This version expands the returned text and properly checks it
21592before output.
21593
21594A 1.5rc1 release was mistakenly made from the incorrect source code
21595branch; 1.5rc2 is identical to the actual 1.5rc1 in revision control
21596except for version number.
21597
21598
21599== MediaWiki 1.5 beta 4 ==
21600
21601July 30, 2005
21602
21603MediaWiki 1.5 beta 4 is a preview release of the new 1.5 release series.
21604A number of bugs have been fixed since beta 3; see the full changelist below.
21605
21606
21607== MediaWiki 1.5 beta 3 ==
21608
21609July 7, 2005
21610
21611MediaWiki 1.5 beta 3 is a preview release of the new 1.5 release
21612series, with a security update over beta 2.
21613
21614Incorrect escaping of a parameter in the page move template could
21615be used to inject JavaScript code by getting a victim to visit a
21616maliciously constructed URL. Users of vulnerable releases are
21617recommended to upgrade to this release.
21618
21619Vulnerable versions:
21620* 1.5 preview series: n <= 1.5beta2 vulnerable, fixed in 1.5beta3
21621* 1.4 stable series: 1.4beta6 <= n <= 1.4.5 vulnerable, fixed in 1.4.6
21622* 1.3 legacy series: not vulnerable
21623
21624This release also includes several bug fixes and localization updates.
21625See the changelog at the end of this file for a detailed list.
21626
21627
21628
21629== MediaWiki 1.5 beta 2 ==
21630
21631July 5, 2005
21632
21633MediaWiki 1.5 beta 2 is a preview release of the new 1.5 release series.
21634While most exciting new bugs should have been ironed out at this point,
21635third-party wiki operators should probably not run this beta release
21636on a public site without closely following additional development.
21637
21638Anyone who _has_ been running beta 1 is very very strongly advised to
21639upgrade to beta 2, as it fixes many bugs from the previous beta including
21640a couple of HTML and SQL injections.
21641
21642This release should be followed by one or two release candidates and
21643a 1.5.0 final within the next few weeks.
21644
21645Beta upgraders, note there are some minor database changes. For upgrades
21646from 1.4, see the file UPGRADE for details on significant database and
21647configuration file changes.
21648
21649Beta 2 includes a preliminary command-line XML wiki dump importer tool,
21650maintenance/importDump.php, paired with maintenance/dumpBackup.php.
21651These use the same format as Special:Export and Special:Import, able
21652to package a wiki's entire page set independent of the backend database
21653and compression format.
21654
21655
21656== MediaWiki 1.5 beta 1 ==
21657
21658June 26, 2005
21659
21660MediaWiki 1.5 beta 1 is a preview release, pretty much feature complete,
21661of the new 1.5 release series. There are several known and likely a number
21662of unknown bugs; it is not recommended to use this release in a production
21663environment but would be recommended for testing in mind of an upcoming
21664deployment.
21665
21666A number of significant changes have been made since the alpha releases,
21667including database changes and a reworking of the user permissions settings.
21668See the file UPGRADE for details of upgrading and changing your prior
21669configuration settings for the new system.
21670
21671
21672
21673== MediaWiki 1.5 alpha 2 ==
21674
21675June 3, 2005
21676
21677MediaWiki 1.5 alpha 2 includes a lot of bug fixes, feature merges,
21678and a security update.
21679
21680Incorrect handling of page template inclusions made it possible to
21681inject JavaScript code into HTML attributes, which could lead to
21682cross-site scripting attacks on a publicly editable wiki.
21683
21684Vulnerable releases and fix:
21685* 1.5 prerelease: fixed in 1.5alpha2
21686* 1.4 stable series: fixed in 1.4.5
21687* 1.3 legacy series: fixed in 1.3.13
21688* 1.2 series no longer supported; upgrade to 1.4.5 strongly recommended
21689
21690
21691== MediaWiki 1.5 alpha 1 ==
21692
21693May 3, 2005
21694
21695This is a testing preview release, being put out mainly to aid testers in
21696finding installation bugs and other major problems. It is strongly recommended
21697NOT to run a live production web site on this alpha release.
21698
21699**  WARNING: USE OF THIS ALPHA RELEASE MAY INFEST YOUR HOUSE WITH  **
21700**  TERMITES, ROT YOUR TEETH,  GROW HAIR ON YOUR PALMS, AND PASTE  **
21701**  INNUENDO  INTO  YOUR  C.V.  RIGHT  BEFORE  A  JOB  INTERVIEW!  **
21702**  DON'T SAY WE DIDN'T WARN YOU, MAN. WE TOTALLY DID RIGHT HERE.  **
21703
21704
21705=== Smaller changes since 1.4 ===
21706
21707Various bugfixes, small features, and a few experimental things:
21708
21709* 'live preview' reduces preview reload burden on supported browsers
21710* support for external editors for files and wiki pages:
21711  https://www.mediawiki.org/wiki/Manual:External_editors
21712* Schema reworking:
21713  https://www.mediawiki.org/wiki/Proposed_Database_Schema_Changes/October_2004
21714* (bug 15) Allow editors to view diff of their change before actually submitting
21715  an edit
21716* (bug 190) Hide your own edits on the watchlist
21717* (bug 510): Special:Randompage now works for other namespaces than NS_MAIN.
21718* (bug 1015) support for the full wikisyntax in <gallery> captions.
21719* (bug 1105) A "Destination filename" (save as) added to Special:Upload Upload.
21720* (bug 1352) Images on description pages now get thumbnailed regardless of
21721  whether the thumbnail is larger than the original.
21722* (bug 1662) A new magicword, {{CURRENTMONTHABBREV}} returns the abbreviation of
21723  the current month
21724* (bug 1668) 'Date format' supported for other languages than English, see:
21725  http://mail.wikipedia.org/pipermail/wikitech-l/2005-March/028364.html
21726* (bug 1739) A new magicword, {{REVISIONID}} give you the article or diff
21727  database revision id, useful for proper citation.
21728* (bug 1998) Updated the Russian translation.
21729* (bug 2064) Configurable JavaScript mimetype with $wgJsMimeType
21730* (bug 2084) Fixed a regular expression in includes/Title.php that was accepting
21731  invalid syntax like #REDIRECT [[foo] in redirects
21732* It's now possible to invert the namespace selection at Special:Allpages and
21733  Special:Contributions
21734* No longer using sorbs.net to check for open proxies by default.
21735* What was $wgDisableUploads is now $wgEnableUploads, and should be set to true
21736  if one wishes to enable uploads.
21737* Supplying a reason for a block is no longer mandatory
21738* Language conversion support for category pages
21739* $wgStyleSheetDirectory is no longer an alias for $wgStyleDirectory;
21740* Special:Movepage can now take parameters like Special:Movepage/Page_to_move
21741  (used to just be able to take parameters via a GET request like
21742  index.php?title=Special:Movepage&target=Page_to_move)
21743* (bug 2151) The delete summary now includes editor name, if only one has edited
21744  the article.
21745* (bug 2105) Fixed from argument to the PHP mail() function. A missing space
21746  could prevent sending mail with some versions of sendmail.
21747* (bug 2228) Updated the Slovak translation
21748* ...and more!
21749
21750
21751=== Changes since 1.5alpha1 ===
21752
21753* (bug 73) Category sort key is set to file name when adding category to
21754  file description from upload page (previously it would be set to
21755  "Special:Upload", causing problems with category paging)
21756* (bug 419) The contents of the navigation toolbar are now editable through
21757  the MediaWiki namespace on the  MediaWiki:navbar page.
21758* (bug 498) The Views heading in MonoBook.php is now localizable
21759* (bug 898) The wiki can now do advanced sanity check on uploaded files
21760  including virus checks using external programs.
21761* (bug 1692) Fix margin on unwatch tab
21762* (bug 1906) Generalize project namespace for Latin localization, update
21763  namespaces
21764* (bug 1975) The name for Limburgish (li) changed from "Lèmburgs" to "Limburgs
21765* (bug 2019) Wrapped the output of Special:Version in <div dir='ltr'> in order
21766  to preserve the correct flow of text on RTL wikis.
21767* (bug 2067) Fixed crash on empty quoted HTML attribute
21768* (bug 2075) Corrected namespace definitions in Tamil localization
21769* (bug 2079) Removed links to Special:Maintenance from movepagetext message
21770* (bug 2094) Multiple use of a template produced wrong results in some cases
21771* (bug 2095) Triple-closing-bracket thing partly fixed
21772* (bug 2110) "noarticletext" should not display on Image page for "sharedupload"
21773  media
21774* (bug 2150) Fix tab indexes on edit form
21775* (bug 2152) Add missing bgcolor to attribute whitelist for <td> and <th>
21776* (bug 2176) Section edit 'show changes' button works correctly now
21777* (bug 2178) Use temp dir from environment in parser tests
21778* (bug 2217) Negative ISO years were incorrectly converted to BC notation
21779* (bug 2234) allow special chars in database passwords during install
21780* Deprecated the {{msg:template}} syntax for referring to templates, {{msg: is
21781  now the wikisyntax representation of wfMsgForContent()
21782* Fix for reading incorrectly re-gzipped HistoryBlob entries
21783* HistoryBlobStub: the last-used HistoryBlob is kept open to speed up
21784  multiple-revision pulls
21785* Add $wgLegacySchemaConversion update-time option to reduce amount of
21786  copying during the schema upgrade: creates HistoryBlobCurStub reference
21787  records in text instead of copying all the cur_text fields. Requires
21788  that the cur table be left in place until/unless such fields are migrated
21789  into the main text store.
21790* Special:Export now includes page, revision, and user id numbers by
21791  default (previously this was disabled for no particular reason)
21792* dumpBackup.php can dump the full database to Export XML, with current
21793  revisions only or complete histories.
21794* The group table was renamed to groups because "group" is a reserved word in
21795  SQL which caused some inconveniances.
21796* New fileicons for c, cpp, deb, dvi, exe, h, html, iso, java, mid, mov, o,
21797  ogg, pdf, ps, rm, rpm, tar, tex, ttf and txt files based on the KDE
21798  crystalsvg theme.
21799* Fixed a bug in Special:Newimages that made it impossible to search for '0'
21800* Added language variant support for Icelandic, now supports "Íslenzka"
21801* The #p-nav id in MonoBook is now #p-navigation
21802* Putting $4 in msg:userstatstext will now give the percentage of
21803  admnistrators out of normal users.
21804* links and brokenlinks tables merged to pagelinks; this will reduce pain
21805  dealing with moves and deletes of widely-linked pages.
21806* Add validate table and val_ip column through the updater.
21807* Simple rate limiter for edits and page moves; set $wgRateLimits
21808  (somewhat experimental; currently needs memcached)
21809* (bug 2262) Hide math preferences when TeX is not enabled
21810* (bug 2267) Don't generate thumbnail at the same size as the source image.
21811* Fix rebuildtextindex.inc for new schema
21812* Remove linkscc table code, no longer used.
21813* (bug 2271) Use faster text-only link replacement in image alt text
21814  instead of rerunning expensive link lookup and HTML generation.
21815* Only build the HTML attribute whitelist tree once.
21816* Replace wfMungeToUtf8 and do_html_entity_decode with a single function
21817  that does both numeric and named chars: Sanitizer::decodeCharReferences
21818* Removed some obsolete UTF-8 converter functions
21819* Fix function comment in debug dump of SQL statements
21820* (bug 2275) Update search index more or less right on page move
21821* (bug 2053) Move comment whitespace trimming from edit page to save;
21822  leaves the whitespace from the section comment there on preview.
21823* (bug 2274) Respect stub threshold in category page list
21824* (bug 2173) Fatal error when removing an article with an empty title from the
21825  watchlist
21826* Removed -f parameter from mail() usage, likely to cause failures and bounces.
21827* (bug 2130) Fixed interwiki links with fragments
21828* (bug 684) Accept an attribute parameter array on parser hook tags
21829* (bug 814) Integrate AuthPlugin changes to support Ryan Lane's external
21830  LDAP authentication plugin
21831* (bug 2034) Armor HTML attributes against template inclusion and links munging
21832
21833=== Changes since 1.5alpha2 ===
21834
21835* (bug 2319) Fix parse hook tag matching
21836* (bug 2329) Fix title formatting in several special pages
21837* (bug 2223) Add unique index on user_name field to prevent duplicate accounts
21838* (bug 1976) fix shared user database with a table prefix set
21839* (bug 2334) Accept null for attribs in wfElement without PHP warning
21840* (bug 2309) Allow templates and template parameters in HTML attribute zone,
21841  with proper validation checks. (regression from fix for 2304)
21842* Disallow close tags and enforce empty tags for <hr> and <br>
21843* Changed user_groups format quite a bit.
21844* (bug 2368) Avoid fatally breaking PHP 4.1.2 in a debug line
21845* (bug 2367) Insert correct redirect link record on page move
21846* (bug 2372) Fix rendering of empty-title inline interwiki links
21847* (bug 2384) Fix typo in regex for IP address checking
21848* (bug 650) Prominently link MySQL 4.1 help page in installer if a possible
21849  version conflict is detected
21850* (bug 2394) Undo incompatible breakage to {{msg:}} compatibility includes
21851* (bug 1322) Use a shorter cl_sortkey field to avoid breaking on MySQL 4.1
21852  when the default charset is set to utf8
21853* (bug 2400) don't send confirmation mail on account creation if
21854  $wgEmailAuthentication is false.
21855* (bug 2172) Fix problem with nowiki beeing replaced by marker strings
21856  when a template with a gallery was used.
21857* Guard Special:Userrights against form submission forgery
21858* (bug 2408) page_is_new was inverted (whoops!)
21859* Added wfMsgHtml() function for escaping messages and leaving params intact
21860* Fix ordering of Special:Listusers; fix groups list so it shows all groups
21861  when searching for a specific group and can't be split across pages
21862* (bug 1702) Display a handy upload link instead of a useless blank link
21863  for [[media:]] links to nonexistent files.
21864* (bug 873) Fix usage of createaccount permission; replaces $wgWhitelistAccount
21865* (bug 1805) Initialise $wgContLang before $wgUser
21866* (bug 2277) Added Friulian language file
21867* (bug 2457) The "Special page" href now links to the current special page
21868  rather than to "".
21869* (bug 1120) Updated the Czech translation
21870* A new magic word, {{SCRIPTPATH}}, returns $wgScriptPath
21871* A new magic word, {{SERVERNAME}}, returns $wgServerName
21872* A new magic word, {{NUMBEROFFILES}}, returns the number of rows in the image
21873  table
21874* Special:Imagelist displays titles with " " instead of "_"
21875* Less gratuitous munging of content sample in delete summary
21876* badaccess/badaccesstext to supercede sysop*, developer* messages
21877* Changed $wgGroupPermissions to more cut-n-paste-friendly format
21878* 'developer' group deprecated by default
21879* Special:Upload now uses 'upload' permission instead of hardcoding login check
21880* Add 'importupload' permission to disable direct uploads to Special:Import
21881* (bug 2459) Correct escaping in Special:Log prev/next links
21882* (bug 2462 etc) Taking out the experimental dash conversion; it broke too many
21883  things for the current parser to handle cleanly
21884* (bug 2467) Added a Turkish language file
21885* Fixed a bug in Special:Contributions that caused the namespace selection to
21886  be forgotten between submits
21887* Special:Watchlist/edit now has namespace subheadings
21888* (bug 1714) the "Save page" button now has right margin to separate it from
21889  "Show preview" and "Show changes"
21890* Special:Statistics now supports action=raw, useful for bots designed to
21891  harwest e.g. article counts from multiple wikis.
21892* The copyright confirmation box at Special:Upload is now turned off by default
21893  and can be turned back on by setting $wgCopyrightAffirmation to a true value.
21894* Restored prior text for password reminder button and e-mail, replacing
21895  the factually inaccurate text that was there.
21896* (bug 2178) Fix temp dir check again
21897* (bug 2488) Format 'deletedtext' message as wikitext
21898* (bug 750) Keep line endings consistent in LocalSettings.php
21899* (bug 1577) Add 'printable version' tab in MonoBook for people who don't
21900  realize you can just hit print to get a nicely formatted printable page.
21901* Trim whitespace from option values to weather line-ending corruption problems
21902* Fixed a typo in the Romanian language file (NS_MESIA => NS_MEDIA)
21903* (bug 2504) Updated the Finnish translation
21904* (bug 2506, 2512) Updated the Nynorsk translation
21905* (bug 996) Replace $wgWhitelistEdit with 'edit' permission; fixup UPGRADE
21906  documentation about edit and read whitelists.
21907* (bug 2515) Fix incremental link table update
21908* Removed some wikipedia-specifica from LanguageXx.php's
21909* (bug 2496) Allow MediaWiki:edithelppage to point to external page
21910* Added a versionRequired() function to OutputPage, useful for extension
21911  writers that want to control what version of MediaWiki their extension
21912  can be used with.
21913* Serialized user objects now checked for versioning
21914* Fix for interwiki link regression
21915* Printable link shorter in monobook
21916* Experimental Latin-1-and-replication-friendly upgrader script
21917* (bug 2520) Don't show enotif options when disabled
21918
21919== Changes since 1.5beta1 ==
21920
21921* (bug 2531) Changed the interwiki name for sh (Serbocroatian) to
21922  Srpskohrvatski/Српскохрватски (was Српскохрватски (Srbskohrvatski))
21923* Nonzero return code for command-line scripts on wfDebugDieBacktrace()
21924* Conversion fix for empty old table in upgrade1_5.php
21925* Try reading revisions from master if no result on slave
21926* (bug 2538) Suppress notice on user serialized checks
21927* Fix paging on Special:Contributions
21928* (bug 2541) Fix unprotect tab
21929* (bug 1242) category list now show on edit page
21930* Skip sidebar entries where link text is '-'
21931* Convert non-UTF-8 URL parameters even if referer is local
21932* (bug 2460) <img> width & height properly filled when resizing image
21933* (bug 2273) deletion log comment used user interface language
21934* Try reading revision _text_ from master if no result on slave
21935* Use content-language message cache for raw view of message pages
21936* (bug 2530) Not displaying talk pages on Special:Watchlist/edit
21937* Fixed a bug that would occour if $wgCapitalLinks was set to false, a user
21938  agent could create a username that began with a lower case letter that was
21939  not in the ASCII character set ( now user $wgContLang->ucfirst() instead of
21940  PHP ucfirst() )
21941* Moved the user name / password validity checking from
21942  LoginForm::addNewAccountInternal() to two new functions,
21943  User::isValidUserName() and User::isValidPassword(), extensions can now do
21944  these checks without rewriting code.
21945* Fix $wgSiteNotice when MediaWiki:Sitenotice is set to default '-'
21946* Fixed a bug where the watchlist count without talk pages would be off by a
21947  factor of two.
21948* upgrade1_5.php uses insert ignore, allows to skip image info initialization
21949* Fix namespaces in category list.
21950* Add rebuildImages.php to update image metadata fields
21951* Special:Ancientpages is expensive in new schema for now
21952* (bug 2568) Fixed a logic error in the Special:Statistics code which caused
21953  the displayed percentage of admins to be totally off.
21954* (bug 2560) Don't show blank width/height attributes for missing size
21955* Don't show bogus messages about watchlist notifications when disabled
21956* Don't show old debug messages in watchlist
21957* (bug 2576) Fix recording of transclusion links
21958* (bug 2577) Allow sysops to enter non-standard block times
21959* Fixed a bug where Special:Contributions wouldn't remember the 'invert'
21960  status between next/previous buttons.
21961* Move MonoBook printable link from tab to sidebar
21962* (bug 2567) Fix HTML escaping on category titles in list
21963* (bug 2562) Show rollback link for current revisions on diff pages
21964* (bug 2583) Add --missinig option on rebuildImages.php to add db entries
21965  for uploaded files that don't have them
21966* (bug 2572) Fix edit conflict handling
21967* (bug 2595) Show "Earlier" and "Latest" links on history go to the first/last
21968  page in the article history pager.
21969* Don't show empty-page text in 'Show changes' on new page
21970* (bug 2591) Check for end, fix limits on Whatlinkshere
21971* (bug 2584) Fix output of subcategory list
21972* (bug 2597) Don't crash when undeleting an image description page
21973* (bug 2564) Don't show "editingold" warning for recent revision
21974* Various code cleanup and HTML escaping fixlets
21975* Copy IRC-over-UDP update option from REL1_4
21976* (bug 2548) Keep summary on 'show changes' of section edit
21977* Move center on toc to title part to avoid breaking .toc style usage
21978* HTML sanitizer: correct multiple attributes by keeping last, not first
21979* (bug 2614) Fix section edit links on diff-to-current with oldid set
21980  Also fix navigation links on current-with-oldid view.
21981* (bug 2620) Return to prior behavior for some more things (such as
21982  subpage parent links) on current-diff view.
21983* (bug 2618) Fix regression from another fix; show initial preview for
21984  categories only if the page does not exist.
21985* (bug 2625) Keep group & user settings when paging in Listusers
21986* (bug 2627) Fix regression: diff radio button initial selection
21987* Copy fix for old search URLs with Lucene search plugin from REL1_4
21988* (bug 619) Don't use incompatible diff3 executable on non-Linux systems.
21989* (bug 2631) Fix Hebrew namespaces.
21990* (bug 2630) Indicate no-longer-valid cached entries in BrokenRedirects list
21991* (bug 2644, 2645) "cur" diff links in page history, watchlist and
21992  recentchanges should specify current ID explicitly.
21993* (bug 2609) Fix text justification preferenced with MonoBook skin.
21994* (bug 2594) Display article tab as red for non-existent articles.
21995* (bug 2656) Fix regression: prevent blocked users from reverting images
21996* (bug 2629) Automatically capitalize usernames again instead of
21997  rejecting lowercase with a useless error message
21998* (bug 2661) Fix link generation in contribs
21999* Add support for &preload=Page_name (load text of an existing page into
22000edit area) and &editintro=Page_name (load text of an existing page instead
22001of MediaWiki:Newpagetext) to &action=edit, if page is new.
22002* (bugs 2633, 2672, 2685, 2695) Fix Estonian, Portuguese, Italian, Finnish and
22003  Spanish numeric formatting
22004* Fixed Swedish numeric formatting
22005* (bug 2658) Fix signature time, localtime to match timezone offset again
22006* Files from shared repositories (e.g. commons) now display with their
22007  image description pages when viewed on local wikis.
22008* Restore compatibility namespace aliases for French Wikipedia
22009* Fix diff order on Enhanced RC 'changes' link
22010* (bug 2650) Fix national date type display on wikis that don't support
22011  dynamic date conversion.
22012* FiveUpgrade: large table hacks, install iw_trans update before links
22013* (bug 2648) Rename namespaces in Afrikaanse
22014* Special:Booksources checks if custom list page exists before using it
22015* (bug 1170) Fixed linktrail for da: and ru:
22016* (bug 2683) Really fix apostrophe escaping for toolbox tips
22017* (bug 923) Fix title and subtitle for rclinked special page
22018* (bug 2642) watchdetails message in several languages used  <a></a> instead of
22019  [ ]
22020* (bug 2181) basic CSB language localisation by Tomasz G. Sienicki (thanks for
22021  the patch)
22022* Fix correct use of escaping in edit toolbar bits
22023* Removed language conversion support from Icelandic
22024* (bug 2616) Fix proportional image scaling, giving correct height
22025* (bug 2640) Include width and height attributes on unscaled images
22026* Workaround for mysterious problem with bogus epoch If-Last-Modified reqs
22027* (bug 1109) Suppress compressed output on 304 responses
22028* (bug 2674) Include some site configuration info in export data:
22029  namespaces definitions, case-sensitivity, site name, version.
22030* Use xml:space="preserve" hint on export <text> elements
22031* Make language variant selection work again for zh
22032
22033== Changes since 1.5beta2 ==
22034
22035* Escaped & correctly in Special:Contributions
22036* (bug 2534) Hide edit sections with CSS to make right click to edit section
22037  work
22038* (bug 2708) Avoid undefined notice on cookieless login attempt
22039* (bug 2188) Correct template namespace for Greek localization
22040* Fixed number formatting for Dutch
22041* (bug 1355) add class noprint to commonPrint.css
22042* (bug 2350) Massive update for Limburgish (li) language using Wikipédia
22043* Massive update for Arab (ar) language using Wikipédia
22044* (bug 1560) Massive update for Kurdish (ku) language using Wikipédia
22045* (bug 2709) Some messages were not read from database
22046* (bug 2416) Don't allow search engine robots to index or follow nonexisting
22047  articles
22048* Fix escaping in page move template.
22049* (bug 153) Discrepancy between thumbnail size and <img> height attribute
22050
22051== Changes since 1.5beta3 ==
22052
22053* Fix talk page move handling
22054* (bug 2721) New language file for Vietnamese with the Vietnamese number
22055  notation
22056* (bug 2749) &nbsp; would appear as a literal in image galleries for Cs, Fr,
22057  Fur, Pl and Sv
22058* (bug 787) external links being rendered when they only have one slash
22059* Fixed a missing typecast in Language::dateFormat() that would cause some
22060  interesting errors with signitures.
22061* (bug 2764) Number format for Nds
22062* (bug 1553) Stop forcing lowercase in Monobook skin for German language.
22063* (bug 1064) Implements Special:Unusedcategories
22064* (bug 2311) New language file for Macedonian
22065* Fix nohistory message on empty page history
22066* Fix fatal error in history when validation on
22067* Cleaned up email notification message formatting
22068* Finally fixed Special:Disambiguations that was broke since SCHEMA_WORK
22069* (bug 2761) fix capitalization of "i" in Turkish
22070* (bug 2789) memcached image metadata now cleared after deletion
22071* Add serialized version number to image metadata cache records
22072* (bug 2780) Fix thumbnail generation with GD for new image schema
22073* (bug 2791) Slovene numeric format
22074* (bug 655) Provide empty search form when searching for nothing
22075* Nynorsk numeric format fix
22076* (bug 2825) Fix regression in newtalk notifications for anons w/ enotif off
22077* (bug 2833) Fix bug in previous fix
22078* With $wgCapitalLinks off, accept off-by-first-letter-case in 'go' match
22079* Optional parameters for [[Special:Listusers]]
22080* (bug 2832) [[Special:Listadmins]] redirects to [[Special:Listusers/sysop]]
22081* (bug 785) Parser did not get out of <pre> with list elements
22082* Some shared upload fixes
22083* (bug 2768) section=new on nonexistent talk page does not add heading
22084* support preload= parameter for section=new
22085* show comment subject in preview when using section=new
22086* use comment form when creating a new talk page
22087* (bug 460) Properly handle <center> tags as a block.
22088* Undo inconsistent editing behavior change
22089* (bug 2835) Back out fix for bug 2802, caused regressions in category sort
22090* PHP 4.1.2 compatibility fix: define floatval() equivalent if missing
22091* (bug 2901) Number format for Catalan
22092* Special:Allpages performance hacks: index memcached caching, removed
22093  inverse checkbox, use friendlier relative offsets in index build
22094* Bring back "Chick" skin for mobile devices. It needs testing.
22095* Fix spelling of $wgForwardSearchUrl in DefaultSettings.php
22096* Specify USE INDEX on Allpages chunk queries, sometimes gets lost
22097  due to bogus optimization
22098* (bug 275) Section duplication fix
22099* Remove unused use of undefined variable in UserMailer
22100* Fix notice on search index update due to non-array
22101* (bug 2885) Fix fatal errors and notices in PHP 5.1.0beta3
22102* (bug 2931) Fix additional notices on reference use in PHP 4.4.0
22103* (bug 2774) Add three new $wgHooks to LogPage which enable extensions to add
22104  their own logtypes, see extensions/Renameuser/SpecialRenameuser.php for an
22105  example of this.
22106* (bug 740) Messages from extensions now appear in Special:Allmessages
22107* (bug 2857) fixed parsing of lists in <pre> sections
22108* (bug 796) Trackback support
22109* Fix 1.5 regression: weird, backwards diff links on new pages in enhanced RC
22110  are now suppressed as before.
22111* New skin: Simple
22112* "uselang" and "useskin" URL parameters can now be used in the URL when
22113  viewing a page, to change the language and skin of a page respectively.
22114* Skins can now be previewed in preferences
22115* (bug 2943) AuthPlugin::getCanonicalName() name canonicalization hook,
22116  patch from robla
22117* Wrap revision insert & page update in a transaction, rollback on late
22118  edit conflict.
22119* (bug 2953) 'other' didn't work in Special:Blockip when localized
22120* (bug 2958) Rollback and delete auto-summary should be in the project's
22121  content language
22122* Removed useless protectreason message
22123* Spelling fix: $wgUrlProtcols -> $wgUrlProtocols
22124* Switch Moldovan local name to cyrillic
22125* Fix typo in undefined array index access prevention
22126* (bug 2947) Update namespaces for sr localization
22127* (bug 2952) Added Asturian language file with translated namespaces
22128* (bug 2676) Apply a protective transformation on editing input/output
22129  for browsers that hit the Unicode blacklist. Patch by plugwash.
22130* (bug 2999) Fix encoding conversion of pl_title in upgrade1_5.php
22131* compressOld.php disabled, as it's known to be broken.
22132
22133
22134=== Changes since 1.5beta4 ===
22135
22136* Fix Special:Allmessages under PHP 5
22137* (bug 2911) Special:Watchlist allowed only one type of limit at a time
22138* (bug 693) Special:Allmessages is excessively wide and redundant
22139* (bug 3001) Updated and applied live hack for recentchanges-based watchlist
22140* (bug 145) Finish 'exclude redirect' implementation in search form
22141* Rearranged Special:Movepage form to reduce confusion between destination
22142  title and reason input boxes
22143* (bug 2527) Always set destination filename when new file is selected
22144* (bug 3056) MySQL 3 compatibility fix: USE INDEX instead of FORCE INDEX
22145* PHP 4.1 compatibility fix: don't use new_link parameter to mysql_connect
22146  if running prior to 4.2.0 as it causes the call to fail
22147* (bug 3117) Fix display of upload size and type with tidy on
22148* (bug 1487) invalid html on empty list in banlist
22149* (bug 3017) Hotkey conflict for delete and show changes
22150* made pixel unit translateable and blocklistline now eats infiniteblock
22151  and expiringblock
22152* (bug 3092) Wrong numerical separator for big numbers in Serbian.
22153* (bug 2855) Credit for a uniq author showed its realname even with
22154  $wgAllowRealName=false.
22155* New special page: SpecialMostlinked
22156* (bug 2393) Fix MIME type for Atom feeds ( application/rss+atom )
22157* Fix display of read-only lockfile message
22158* Added a new hook, 'AddNewAccount', which is run after account creation
22159* Update all stats fields on recount.sql
22160* Include software-visible client IP address in Special:Version comment
22161  as a proxy debugging aid
22162* (bug 3162) Fix 'undefined property page_is_new' error on watchlist
22163* (bug 1734) granting db permissions failed with db usernames containg '-'
22164* (bug 3170) wikititlesuffix was removed, use pagetitle instead
22165* (bug 3187) watchlist text refer to unexistent "Stop watching" action
22166* (bug 3190) Added some date format choices for language sr
22167* (bug 1334) LanguageGa.php update
22168* (bug 1020) Changing user interface language does not work immediately
22169* (bug 2753) Some namespaces were not translated in LanguageTa.php (Tamil)
22170* (bug 3204) Fix typo breaking special pages in fy localization
22171* (bug 3210) Fix Media: links with remote image URL path
22172* (bug 3220) Fix escaping of block URLs in Recentchanges
22173* (bug 3238): Updated LanguageNn.php for 1_5 branch
22174* (bug 3192): properly check 'limit' parameter on Special:Contributions
22175* (bug 3244) Fix remote image loading hack, JavaScript injection on MSIE
22176* Fix URL sanitization in HTML attributes, which broke in this branch
22177* (bug 3475) anon contrib links on Special:Newpages
22178
22179
22180=== Changes since 1.5rc2 ===
22181
22182* Fix upgrade from 1.4 due to version number check breakage
22183* Fix upgrade from 1.4 with no old revisions
22184* (bug 2108) Sort entries when using category browser
22185* XSS issue : now sanitize search query input
22186
22187
22188=== Changes since 1.5rc3 ===
22189
22190* (bug 3280) Respect 'move' group permission on page moves
22191* (bug 2885) More PHP 5.1 fixes: skin, search, log, undelete
22192* Security fix for <math>
22193* Security fix for tables
22194
22195
22196=== Changes since 1.5rc4 ===
22197
22198* (bug 3292) Fix move-over-redirect test when current entries are not plaintext
22199* (bug 2078) Don't hide watch tab on preview
22200* (bug 3306) Document $wgLocalTZoffset
22201* Support SVG rendering with rsvg
22202* Cap arbitrary SVG renders to given image size or $wgSVGMaxSize pixels wide
22203* (bug 3127) Render large SVGs at image page size correctly
22204* (bug 3448) Set page_len on undelete
22205* (bug 2800) Don't scale up small iamges on |thumb| without explicit size
22206* Use the real file link instead of the default-size rasterized version for
22207  large SVG images on image description page
22208* Include the file name/type/size line for non-resized images
22209* (bug 3412) Clean up date format handling so ~~~~-sigs work with default
22210  format as designed. Documentation comments updated.
22211* (bug 1423) LanguageJa.php update
22212* (bug 3405) Don't use raw letters as aliases of MSGNW: and SUBST:
22213* (bug 3485) Fix bogus warning about filename capitalization when off
22214* (bug 2792) Update rebuildrecentchanges.inc for new schema
22215* Special:Import/importDump fixes: report XML parse errors, accept <minor/>
22216* (bug 3489) PHP 5.1 compat problem with captioned images
22217* (bug 3350) Missing label for move talk page checkbox.
22218* (bug 2570) Add 'watch this page' checkbox on uploads, watch uploads
22219  by default when 'watchdefault' option is on
22220* (bug 3182) Clear link cache during import to prevent memory leak
22221* (bug 3573) Full Greek Translation
22222* (bug 3595) Warn and abort if importDump.php called in read-only mode.
22223* (bug 3598) Update message cache on message page deletion, patch by Tietew
22224* Blacklist additional MSIE CSS safety tricks
22225
22226
22227=== Changes since 1.5.0 ===
22228
22229* (bug 3629) Fix date & time format for Frisian
22230* (bug 3641) Fix handling of unrecognized file uploads with known extensions
22231* (bug 3643) Fix image page display of large images with resizing disabled
22232* Fix meta robots tag on Special:Version again to avoid listing vulnerable
22233  versions for convenient harvesting by automated worms
22234* (bug 3684) Fix typo in fatal error backtraces in Hooks.php
22235* Backport fix for reference usage notice in Special:Search on PHP 4.4.0
22236* Backport database connect error display fix from HEAD
22237* (bug 2773) Print style sheet no longer overrides RTL text direction
22238* MonoBook skin top link id changed from "contentTop" to "top" (shared with
22239  name attribute)
22240* Wrap message page insertions in a transaction to speed up installation
22241* Fix Special:MovePage invalid HTML attribute for reason textarea
22242* Avoid notice warning on edit with no User-Agent header
22243* (bug 3734) Swapped out obsolete recount.sql with initStats.php
22244* (bug 3735) Fix to run under MySQL 5's strict mode
22245* (bug 3786) Experimental support for MySQL 4.1/5.0 utf8 charset mode
22246  NOTE: Enabling this may break existing wikis, and still doesn't
22247  work for all Unicode characters due to MySQL limitations.
22248* Sanitizer CSS comment processing order fix
22249
22250
22251=== Changes since 1.5.1 ===
22252
22253* Fix Special:BrokenRedirects on MySQL 5.0
22254* (bug 3809) Backport fix for detecting diff3 failure
22255* MySQL 5.0 strict mode fix for moving unwatched pages
22256* (bug 3782) Throw fatal installation warning if mbstring.func_overload on.
22257  Why do people invent these crazy options that change language semantics?
22258* (bug 3762) Define missing Special:Import UI messages
22259* (bug 3771) Handle internal functions in backtrace in wfAbruptExit()
22260* (bug 3649) Remove obsolete, broken moveCustomMessages script
22261* (bug 3667) Add missing global in page move code
22262* (bug 3761) Avoid deprecation warnings in Special:Import
22263* (bug 2885) Remove unnecessary reference parameter which broke classic skin
22264  talk notification on PHP 5.0.5
22265* (bug 3845) Update attribute.php for 1.5 schema
22266* Fix Parser::unstrip on PHP 4.4.1 and PHP 5.1.0RC4
22267
22268
22269=== Changes since 1.5.2 ===
22270
22271* (bug 3612) Remove old broken version of maintenance/compressOld.php
22272  The working version is in maintenance/storage/compressOld.php
22273* (bug 2740) Accept image deletions on 'enter' submit from MSIE
22274* (bug 3933) specify XML namespace for Atom 0.3 feeds
22275* (bug 3939) Don't try to load text for interwiki redirect target
22276* (bug 3948) Avoid notice warning in debug statement in bad search
22277* Recognize Special:Search consistently so read whitelist works
22278* (bug 4013) typo in fr
22279* (bug 3996) Fix text for new entries in RC RSS/Atom feed
22280* (bug 2894) Enhanced Recent Changes link fixes
22281* (bug 3065) Update both watched namespaces when renaming pages
22282* Move parentheses out of <a> link in Special:Contributions
22283* (bug 4071) Generate passwords long enough for $wgMinimalPasswordLength
22284* (bug 4035) Fix prev/next revision links on edit page
22285* (bug 4165) Correct validation for user language selection (data taint)
22286* Clearer message in DefaultSettings.php: edit LocalSettings.php instead
22287
22288
22289=== Changes since 1.5.3 ===
22290
22291* (bug 3805) Clear 'new messages' flag properly in enotif mode
22292  for usernames containing spaces
22293* (bug 2714) Backlink from special:whatlinkshere was hard set as 'existing'
22294* (bug 4249) Typo in entities2literals.pl
22295* (bug 4233) Update for japanese language
22296* (bug 4279) Small correction to LanguageDa.php
22297* (bug 4267) Switch dv sd ug ks arc languages to RTL
22298* (bug 3991) Allow the operation of wikicode on Protect move only text
22299* Added AutoAuthenticate hook for external User object suppliers
22300* Parser internal placeholder string now fully randomized for safety
22301
22302=== Changes since 1.5.4 ===
22303
22304* Maintenance script to delete unused user accounts
22305* Added detection for WMF files (application/x-msmetafile), added this
22306  MIME type to the default blacklist. Prevented inline display of images
22307  which are not of known image types. This is in response to
22308  http://en.wikipedia.org/wiki/Windows_Metafile_vulnerability
22309
22310=== Changes since 1.5.5 ===
22311
22312* (bug 4258) When installing under IIS, $wgArticlePath = "$wgScript?title=$1"
22313  should be set
22314* (bug 4510) Correct Barnes & Noble bookstore URLs
22315* (bug 4504) Use site language for namespace name resolution
22316* Installer fixes from HEAD backported; now uses a more sensible method of
22317  establishing which mySQL user to use, which clears up bug 921 et al. Minor
22318  changes to installer.
22319* Fix problem reported on mailing list where re-initialising stats didn't work
22320  (can't insert duplicate rows with the same id field)
22321* (bug 1122) gray out 'older revision' when viewing first article revision.
22322* Respect database prefix in dumpHTML.inc
22323* Minor improvements to removeUnusedAccounts.php maintenance script
22324* Fix for single-digit week numbers from {{CURRENTWEEK}}, broken by PHP 4.4.1
22325* Removed read-only check from Database::query()
22326* Added --conf option to command line scripts, allowing the user to specify a
22327  different LocalSettings.php.
22328
22329=== Changes since 1.5.6 ===
22330
22331* Default main page content improved per bug 4690
22332* Fix dependence on hardcoded UNIQ_PREFIX in LanguageConverter.php
22333* Fixed Special:Unlockdb
22334* Maintenance script to delete unused text records
22335* Maintenance script to delete non-current revisions
22336* Maintenance script to wipe a page and all revisions from the database
22337* (bug 4768) Wrong Russian translation (typo)
22338* Performance bugfix: propagate equality manually for Revision fetches
22339* (bug 4773) PHP fatal error when invalid title passed to Special:Export
22340* Added missing table defs. for transcache to installer schemas
22341* (bug 4824) IE7 beta 2 broke compatibility with PNG logo workarounds,
22342  and seems to work ok with other bits. No longer including the IE
22343  workarounds JavaScript for IE 7 and above.
22344* (bug 2532) Image directory structure migration bug
22345* (bug 4881) Correction to the fix for 1487; Ipblocklist showed 'no blocks'
22346  message at the end of the list even if there were blocks.
22347* (bug 4805) Removed more wikipedia-references from LanguageUk.php
22348* Introduce $wgWantedPagesThreshold per bug 5011; Special:Wantedpages will not
22349  list pages with less than this number of links. Defaults to 1.
22350* Allow customisation of paging limits for items in categories using the
22351  $wgCategoryPagingLimit global, per bug 4970.
22352* Improve "nogomatch" text to make it more obvious that a page can be created.
22353* (bug 5113) Spelling error in French language file
22354* Don't change the password of the MySQL root user.
22355
22356=== Changes since 1.5.7 ===
22357
22358* (bug 5180) User login page shows inappropriate email blurb
22359* Add the "AbortNewAccount" hook on account creation; see hooks.txt for more
22360  info.
22361* Update default "exporttext" to reflect that Special:Import exists
22362* Add links to useful material to the default main page content
22363* Fix fragment HTML injection
22364
22365=== Changes since 1.5.8 ===
22366
22367* Fixed obvious mistakes in Finnish (fi) translation
22368* Fixed obvious mistakes in Kurdish (ku) translation
22369* Merge two #p-search .pBody statements i monobook/main.css
22370* (bug 5156) Update for Hebrew language (he) translation
22371* Add the "UserRights" hook on user group changes; see hooks.txt for more info.
22372* Translated "listingcontinuesabbrev" for German
22373
22374=== Caveats ===
22375
22376Some output, particularly involving user-supplied inline HTML, may not
22377produce 100% valid or well-formed XHTML output. Testers are welcome to
22378set $wgMimeType = "application/xhtml+xml"; to test for remaining problem
22379cases, but this is not recommended on live sites. (This must be set for
22380MathML to display properly in Mozilla.)
22381
22382= MediaWiki 1.4 =
22383
22384== MediaWiki 1.4.15 ==
22385
22386(released March 26, 2006) MediaWiki 1.4.15 is a security maintenance release. A
22387bug in decoding of certain encoded links could allow injection of raw HTML into
22388page output; this could potentially lead to XSS attacks. Additionally, this
22389release may display more correctly in IE7 betas.
22390
22391== MediaWiki 1.4.14 ==
22392(released January 19, 2006) MediaWiki 1.4.14 is a security and bugfix
22393maintenance release. A bug in edit comment formatting could send PHP into an
22394infinite loop if certain malformed links were included. In most installations,
22395this would cause the script to fail after PHP's 30-second failsafe timeout. For
22396several other minor fixes, see the complete changelog at the end of this file.
22397
22398== MediaWiki 1.4.13 ==
22399(released January 5, 2006) MediaWiki 1.4.13 is a security maintenance
22400release.Detection for uploads of Windows Metafile (.wmf) images has been added
22401to help protect against a client-side vulnerability in unpatched Microsoft
22402Windows operating systems. Sites which have enabled uploads and added
22403non-standard file types (such as .ogg, .doc, or .pdf) should upgrade to this
22404release to ensure that malicious .wmf files can't be uploaded with a fake
22405extension; such files could put visitors to the site at risk. For more details
22406on this, see: http://en.wikipedia.org/wiki/Windows_Metafile_vulnerability
22407
22408== MediaWiki 1.4.12 ==
22409(released 2005-11-02) MediaWiki 1.4.12 is a bugfix and security maintenance
22410release. A change in PHP 4.4.1 broke handling of extension and
22411<nowiki><pre></nowiki> sections, causing garbage data to be inserted in output
22412and saved edits. This version works around the change. This release includes
22413further corrections to the inline CSS style sanitation which works around a
22414JavaScript "feature" on Microsoft Internet Explorer. Users of Microsoft
22415Internet Explorer for Windows may be vulnerable to XSS injections on prior 1.4
22416releases; users of standards-compliant browsers are not vulnerable.
22417
22418== MediaWiki 1.4.11 ==
22419(released 2005-10-05) MediaWiki 1.4.11 is a security maintenance release.
22420Unsafe handling of CSS by Microsoft Internet Explorer could be exploited to
22421produce cross-site scripting attacks by JavaScript injection to clients running
22422that browser. This release blacklists several additional variants from use in
22423HTML inline style attributes. All publicly accessible wikis are recommended to
22424upgrade to reduce the risk to visitors using Microsoft web browsers. Note: the
22425MediaWiki 1.4.x series is not compatible with PHP 5.0.5 or higher. Upgrade to
22426the 1.5.0 release if you require this version of PHP 5.
22427
22428== MediaWiki 1.4.10 ==
22429(released 2005-09-21) MediaWiki 1.4.10 is a security maintenance release. A bug
22430in edit submission handling could cause corruption of the previous revision in
22431the database if an abnormal URL was used, such as those used by some spambots.
22432Affected releases:
22433* 1.4.x <= 1.4.9; fixed in 1.4.10
22434* 1.3.x <= 1.3.15; fixed in 1.3.16
224351.5 release candidates are not affected by this problem. All publicly editable
22436wikis are strongly recommended to upgrade immediately.
224371.4 releases can be manually patched by changing this bit in EditPage.php:
22438
22439<syntaxhighlight lang="php">
22440function importFormData( &$request ) {
22441        if( $request->wasPosted() ) {
22442</syntaxhighlight>
22443to:
22444<syntaxhighlight lang="php">
22445    function importFormData( &$request ) {
22446        if( $request->getVal( 'action' ) == 'submit' && $request->wasPosted() )
22447        {
22448</syntaxhighlight>
22449== MediaWiki 1.4.9 ==
22450(released 2005-08-29) MediaWiki 1.4.9 is a security maintenance release. It
22451corrects two cross-site scripting security bugs:
22452* <nowiki><math></nowiki> tags were handled incorrectly when TeX rendering
22453support is off, as in the default configuration.
22454* Extension or <nowiki><nowiki></nowiki> sections in Wiki table syntax could
22455bypass HTML style attribute restrictions for cross-site scripting attacks
22456against Microsoft Internet Explorer Wikis where the optional math support has
22457been *enabled* are not vulnerable to the first, but are vulnerable to the
22458second.
22459
22460== MediaWiki 1.4.8 ==
22461(released 2005-08-23) MediaWiki 1.4.8 is a bug fix and security maintenance
22462release. A flaw in the interaction between extensions and HTML attribute
22463sanitization was discovered which could allow unauthorized use of offsite
22464resources in style sheets, and possible exploitation of a JavaScript injection
22465feature on Microsoft Internet Explorer. This version expands the returned text
22466and properly checks it before output. Additionally, an update to
22467skins/MonoBook.php ensures that sites using the default MonoBook skin will
22468display correctly in the Internet Explorer 7 beta. (1.3 and 1.5 are not
22469affected by this bug.)
22470
22471== MediaWiki 1.4.7 ==
22472(released 2005-07-16)
22473MediaWiki 1.4.7 is a bug fix release. Those affected by the following problems
22474in 1.4.6 should upgrade:
22475* Watchlist breakage on MySQL 3.23.x and with table prefix enabled
22476* Possible breakage in watchlist, some image resizing modes on PHP 4.1.2 1.4.6
22477included a fix for a cross-site scripting vulnerability, so anyone running
22478older 1.4 releases is very strongly encouraged to upgrade as well. Note to
22479upgraders: this version of MediaWiki is known to produce a large number of
22480notice-level warnings under the newly released PHP 4.4.0. These appear however
22481to be harmless; if you encounter them add this to your LocalSettings.php to
22482suppress the notices: error_reporting( E_ALL & ~E_NOTICE ); PHP 5.1.0beta3 is
22483known to be incompatible at this time.
22484
22485== MediaWiki 1.4.6 ==
22486(released 2005-07-07) MediaWiki 1.4.6 is a bug fix and security update release.
22487Incorrect escaping of a parameter in the page move template could
22488be used to inject JavaScript code by getting a victim to visit a maliciously
22489constructed URL. Users of vulnerable releases are recommended to upgrade to
22490this release. Vulnerable versions:
22491* 1.5 preview series: n <= 1.5beta2 vulnerable, fixed in 1.5beta3
22492* 1.4 stable series: 1.4beta6 <= n <= 1.4.5 vulnerable, fixed in 1.4.6
22493* 1.3 legacy series: not vulnerable This release also includes fixes for some
22494rare bug annoying HTTP errors, a PHP 4.1.2 breakage bug, and works around some
22495template limitations introduced in 1.4.5. See the changelog at the end of this
22496file for a detailed list of bugs fixed.
22497
22498== MediaWiki 1.4.5 ==
22499(released 2005-06-03) MediaWiki 1.4.5 is a security update and bugfix release.
22500Incorrect handling of page template inclusions made it possible to inject
22501JavaScript code into HTML attributes, which could lead to cross-site scripting
22502attacks on a publicly editable wiki. Vulnerable releases and fix:
22503* 1.5 prerelease: fixed in 1.5alpha2
22504* 1.4 stable series: fixed in 1.4.5
22505* 1.3 legacy series: fixed in 1.3.13
22506* 1.2 series no longer supported; upgrade to 1.4.5 strongly recommended This
22507release also includes a number of bug fixes (see changelog below) and merges
22508some large-server load balancing patches from Wikipedia. An experimental rate
22509limiter for page edits and moves can be enabled with global, per-IP,
22510per-subnet, or per-user bases. See configuration options in
22511includes/DefaultSettings.php
22512
22513== MediaWiki 1.4.4 ==
22514(released 2005-05-04) MediaWiki 1.4.4 is a bugfix release for the 1.4 stable
22515release series. Some bugs in the installer/updater and refreshLinks maintenance
22516script were introduced in the last release and have been corrected.
22517
22518== MediaWiki 1.4.3 ==
22519
22520(released 2005-04-28)
22521
22522MediaWiki 1.4.3 is a bugfix release for the 1.4 stable release series.
22523
22524Chiefly, this fixes a compatibility problem with PHP 5 and a minor link
22525table corruption bug on initial page save.
22526
22527
22528== MediaWiki 1.4.2 ==
22529
22530(released 2005-04-20)
22531
22532MediaWiki 1.4.2 is a security and bug fix release for the 1.4 stable release
22533series.
22534
22535A cross-site scripting injection vulnerability was discovered, which
22536affects only MSIE clients and is only open if MediaWiki has been
22537manually configured to run output through HTML Tidy ($wgUseTidy).
22538
22539Several other bugs are fixed in this release, see the changelog below.
22540
22541All new installations are highly recommended to use 1.4.2 instead of
225421.3.x; 1.3.x users should consider upgrading for bug fixes and new
22543features. Ealier 1.4.x release and beta users should upgrade to this
22544release for relevant bug fixes; see the changelog later in this file.
22545
22546
22547If you have trouble, remember to read this whole file and the online FAQ page
22548before asking for help:
22549
22550https://www.mediawiki.org/wiki/Manual:FAQ
22551
22552
22553=== READ THIS FIRST: Upgrading ===
22554
22555If upgrading from an older release, see the notes in the file UPGRADE.
22556There are a couple of minor database changes from the beta releases,
22557and somewhat larger changes from 1.3.x.
22558
22559Upgrading from a previous 1.4.x stable release installation should
22560generally only require copying the new files over the old ones.
22561
22562
22563==== READ THIS FIRST, TOO: MySQL 4.1 AND 5.0 ====
22564
22565MySQL 5.0 is a beta release, not yet ready for production use. If you
22566are using it, the notes below about 4.1 apply to you too.
22567
22568If you have the choice of MySQL 4.0 or MySQL 4.1 and don't need 4.1 for
22569some other application, you should consider sticking with 4.0 for the
22570moment. 4.1 may require you to do extra fiddling to get things to work
22571due to changes that aren't fully backwards-compatible.
22572
22573MySQL 4.1 has changed the authentication protocol in an incompatible
22574way; many PHP installations still use the older client libraries and
22575CANNOT CONNECT TO THE SERVER WITH A PASSWORD without some changes.
22576
22577See: http://dev.mysql.com/doc/mysql/en/Old_client.html
22578
22579If MySQL is set with utf-8 as the default character set, installation
22580may fail with "key too long" errors. Set the default charset to 'latin1'
22581for installation and it should work.
22582
22583The mysqldump backup generator now applies an automatic conversion to
22584UTF-8, which may irretrivably corrupt your data. Pass the -charset option
22585with the original default charset (eg 'latin1') to skip the conversion.
22586
22587
22588==== READ THIS FIRST IF RUNNING ON A WINDOWS SERVER ====
22589
22590MediaWiki is tested and deployed primarily under the Apache web server
22591on Linux Unix systems. There are known to be problems running on
22592Microsoft's IIS which are not fully resolved. If you have a choice,
22593try running under Apache on Windows, or on a Unix/Linux box instead.
22594
22595If you're having trouble with blank pages on IIS and can't switch,
22596try the workaround suggested in this bug report:
22597http://bugzilla.wikimedia.org/show_bug.cgi?id=1763
22598
22599
22600=== New features ===
22601
22602* 'Recentchanges Patrol' to mark new edits that haven't yet been viewed.
22603* New, searchable deletion/upload/protection logs
22604* Image gallery generation (Special:Newimages and <gallery> tag)
22605* SVG rasterization support (requires external support tools)
22606* Users can select from the available localizations to override the
22607  default user interface language.
22608* Traditional/Simplified Chinese conversion support
22609* rel="nofollow" support to combat linkspam
22610
22611The current implementation adds this attribute to _all_ external URL
22612links in wiki text (but not internal [[wiki links]] or interwiki links).
22613To disable the attribute for _all_ external links, add this line to your
22614LocalSettings.php:
22615
22616  $wgNoFollowLinks = false
22617
22618For background information on nofollow see:
22619
22620  http://www.google.com/googleblog/2005/01/preventing-comment-spam.html
22621
22622
22623=== Installation and compatibility ===
22624
22625* The default MonoBook theme now works with PHP 5.0
22626* Installation on systems with PHP's safe mode or other oddities
22627  should work more reliably, as MonoBook no longer needs to
22628  create a compiled template file for the wiki to run.
22629* A table prefix may be specified, to avoid conflicts with other
22630  web applications forced to share a database.
22631* More thorough UTF-8 input validation; fixes non-ASCII uploaded
22632  filenames from Safari.
22633* Command-line database upgrade script.
22634
22635
22636=== Customizability ===
22637
22638* Default user options can now be overridden in LocalSettings.
22639* Skins system more modular: templates and CSS are now in /skins/
22640  New skins can be dropped into this directory and used immediately.
22641* More extension hooks have been added.
22642* Authentication plugin hook.
22643* More internal code documentation, generated with phpdoc:
22644  https://doc.wikimedia.org/mediawiki-core/master/php/html/
22645
22646
22647=== Optimization ===
22648
22649* For many operations, MediaWiki 1.4 should run faster and use
22650  less memory than MediaWiki 1.3. Page rendering is up to twice
22651  as fast. (Use a PHP accelerator such as Turck MMCache for best
22652  results with any PHP application, though!)
22653* The parser cache no longer requires memcached, and is enabled
22654  by default. This avoids a lot of re-rendering of pages that
22655  have been shown recently, greatly speeding longer page views.
22656* Support for compiled PHP modules to speed up page diff and
22657  Unicode validation/normalization. (Requires ability to compile
22658  and load PHP extensions).
22659
22660
22661=== What isn't ready yet ===
22662
22663* A new user/groups permissions scheme has been held back to 1.5.
22664* An experimental SOAP interface will be made available as an extension
22665* PostgreSQL support is largely working, minus search and the installer.
22666  You can perform a manual installation.
22667* E-mail notification of watched page changes and verification of
22668  user-submitted e-mail addresses is not yet included.
22669* Log pages are not automatically imported into the new log table
22670  at upgrade time. A script to import old text log entries is
22671  incomplete, but may be available in later point releases.
22672* Some localizations are still incomplete.
22673
22674
22675
22676== Changelog ==
22677
22678=== Important security updates ===
22679
22680A security audit found and fixed a number of problems. Users of MediaWiki
226811.3.10 and earlier should upgrade to 1.3.11; users of 1.4 beta releases
22682prior to 1.4rc1 should upgrade immediately.
22683
22684==== Cross-site scripting vulnerability ====
22685
22686XSS injection points can be used to hijack session and authentication
22687cookies as well as more serious attacks.
22688
22689* Media: links output raw text into an attribute value, potentially
22690  abusable for JavaScript injection. This has been corrected.
22691* Additional checks added to file upload to protect against MSIE and
22692  Safari MIME-type autodetection bugs.
22693
22694As of 1.3.10/1.4beta6, per-user customized CSS and JavaScript is disabled
22695by default as a general precaution. Sites which want this ability may set
22696$wgAllowUserCss and $wgAllowUserJs in LocalSettings.php.
22697
22698
22699==== Cross-site request forgery ====
22700
22701An attacker could use JavaScript-submitted forms to perform various
22702restricted actions by tricking an authenticated user into visiting
22703a malicious web page. A fix for page editing in 1.3.10/1.4beta6 has
22704been expanded in this release to other forms and functions.
22705
22706Authors of bot tools may need to update their code to include the
22707additional fields.
22708
22709
22710==== Directory traversal ====
22711
22712An unchecked parameter in image deletion could allow an authenticated
22713administrator to delete arbitary files in directories writable by the
22714web server, and confirm existence of files not deletable.
22715
22716
22717==== Older issues ====
22718
22719Note that 1.4 beta releases prior to beta 5 include an input validation
22720error which could lead to execution of arbitrary PHP code on the server.
22721Users of older betas should upgrade immediately to the current version.
22722
22723
22724Beta 6 also introduces the use of rel="nofollow" attributes on external
22725links in wiki pages to reduce the effectiveness of wiki spam. This will
22726cause participating search engines to ignore external URL links from wiki
22727pages for purposes of page relevancy ranking.
22728
22729
22730=== Misc bugs fixed in beta 1 ===
22731
22732* (bug 95) Templates no longer limited to 5 inclusions per page
22733* New user preference for limiting the image size for images on image
22734  description pages
22735* (bug 530) Allow user to preview article on first edit
22736* (bug 479) [[RFC 1234]] will now make an internal link
22737* (bug 511) PhpTal skins shown bogus 'What links here' etc on special pages
22738* (bug 770) Adding filter and username exact search match for Special:Listusers
22739* (bug 733) Installer die if it can not write LocalSettings.php
22740* (bug 705) Various special pages no more show the rss/atom feed links
22741* (bug 114) use category backlinks in Special:Recentchangeslinked
22742
22743=== Beta 2 fixes ===
22744
22745* (bug 987) Reverted bogus fix for bug 502
22746* (bug 992) Fix enhanced recent changes in PHP5
22747* (bug 1009) Fix Special:Makesysop when using table prefixes
22748* (bug 1010) fix broken Commons image link on Classic & Cologne Blue
22749* (bug 985) Fix auto-summary for section edits
22750* (bug 995) Close <a> tag
22751* (bug 1004) renamed norsk language links (twice)
22752* Login works again when using an old-style default skin
22753* Fix for load balancing mode, notify if using old settings format
22754* (bug 1014) Missing image size option on old accounts handled gracefully
22755* (bug 1027) Fix page moves with table prefix
22756* (bug 1018) Some pages fail with stub threshold enabled
22757* (bug 1024) Fix link to high-res image version on Image: pages
22758* (bug 1016) Fix handling of lines omitting Image: in a <gallery> tag
22759* security fix for image galleries
22760* (bug 1039) Avoid error message in certain message cache failure modes
22761* Fix string escaping with PostgreSQL
22762* (bug 1015) [partial] -- use comment formatter on image gallery text
22763* Allow customization of all UI languages
22764* use $wgForceUIMsgAsContentMsg to make regular UI messages act as content
22765* new user option for zh users to disable language conversion
22766* Defer message cache initialization, shaving a few ms off file cache hits
22767* Fixed Special:Allmessages when using table prefixes
22768* (bug 996) Fix $wgWhitelistRead to work again
22769* (bug 1028) fix page move over redirect to not fail on the unique index
22770
22771=== Beta 3 fixes ===
22772
22773* Hide RC patrol markers when patrol is disabled or not allowed to patrol.
22774* Fix language selection for upgraded accounts
22775* (bug 1076) navigation links in QueryPage should be translated by wgContLang.
22776* (bug 922) bogus DOS line endings in LanguageEl.php
22777* Fix index usage in contribs
22778* Caching and load limiting options for Recentchanges RSS/Atom feed
22779* (bug 1074) Add stock icons for non-image files in gallery/Newimages
22780* Add width and height attributes on thumbs in gallery/Newimages
22781* Enhance upload extension blacklist to protect against vulnerable
22782  Apache configurations
22783
22784=== Beta 4 fixes ===
22785
22786* (bug 1090) Fix sitesupport links in CB/classic skins
22787* Gracefully ignore non-legal titles in a <gallery>
22788* Fix message page caching behavior when $wgCapitalLinks is turned off
22789  after installation and the wiki is subsequently upgraded
22790* Database error messages include the database server name/address
22791* Paging support for large categories
22792* Fix image page scaling when thumbnail generation is disabled
22793* Select the content language in prefs when bogus interface language is set
22794* Fix interwiki links in edit comments
22795* Fix crash on banned user visit
22796* Avoid PHP warning messages when thumbnail not generated
22797* (bug 1157) List unblocks correctly in Special:Log
22798* Fix fatal errors in LanguageLi.php
22799* Undo overly bright, difficult to read colors in Cologne Blue
22800* (bug 1162) fix five-tilde date inserter
22801* Add raw signatures option for those who simply must have cute sigs
22802* (bug 1164) Let wikitext be used in Loginprompt and Loginend messages
22803* Add the dreaded <span> to the HTML whitelist
22804* (bug 1170) Fix Russian linktrail
22805* (bug 1168) Missing text on the bureaucrat log
22806* (bug 1180) Fix Makesysop on shared-user-table sites
22807* (bug 1178) Fix previous diff link when using 'oldid=0'
22808* (bug 1173) Stop blocked accounts from reverting/deleting images
22809* Keep generated stylesheets cache-separated for each user
22810* (bug 1175) Fix "preview on first edit" mode
22811* Fix revert bug caused by bug 1175 fix
22812* Fix CSS classes on minor, new, unpatrolled markers in enhanced RC
22813* Set MySQL 4 boolean search back to 'and' mode by default
22814* (bug 1193) Fix move-only page protection mode
22815* Fix zhtable Makefile to include the traditional manual table
22816* Add memcache timeout for the zh conversion tables
22817* Allow user customization of the zh conversion tables through
22818  Mediawiki:zhconversiontable
22819* Add zh-min-man (back) to language names list
22820* Ported $wgCopyrightIcon setting from REL1_3A
22821* (bug 1218) Show the original image on image pages if the thumbnail would be
22822  bigger than the original image
22823* (bug 1213) i18n of Special:Log labels
22824* (bug 1013) Fix jbo, minnan in language names list
22825* Added magic word MAG_NOTITLECONVERT to indicate that the title of the page
22826  do not need to be converted. Useful in zh:
22827* (bug 1224) Use proper date messages for date reformatter
22828* (bug 1241) Don't show 'cont.' for first entry of the category list
22829* (bug 1240) Special:Preferences was broken in Slovenian locale when
22830  $wgUseDynamicDates is enabled
22831* Added magic word MAG_NOCONTENTCONVERT to suppress the conversion of the
22832  content of an article. Useful in zh:
22833* write-lock for updating the zh conversion tables in memcache
22834* recursively parse subpages of MediaWiki:Zhconversiontable
22835* (bug 1144) Fix export for fy language
22836* make removal of an entry from zhconversiontable work
22837* (bug 752) Don't insert newline in link title for url with %0a
22838* Fix missing search box contents in MonoBook skin
22839* Add option to forward search directly to an external URL (eg google)
22840* Correctly highlight the fallback language variant when the selected
22841  variant is disabled. Used in zh: only for now.
22842
22843=== Beta 5 fixes ===
22844
22845* (bug 1124) Fix ImageGallery XHTML compliance
22846* (bug 1186) news: in the middle of a word
22847* (bug 1283) Use underlining and borders to highlight additions/deletions
22848  in diff-view
22849* Use user's local timezone in Special:Log display
22850* Show filename for images in gallery by default (restore beta 3 behavior)
22851* (bug 1201) Double-escaping in brokenlinks, imagelinks, categorylinks,
22852  searchindex
22853* When using squid reverse proxy, cache the redirect to the Main_Page
22854* (bug 1302) Fix Norwegian language file
22855* (bug 1205) Fix broken article saving in PHP 5.1
22856* (bug 1206) Implement CURRENTWEEK and CURRENTDOW magic keyword (will give
22857  number of the week and number of the day).
22858* (bug 1204) Blocks do not expire automatically
22859* (bug 1184) expiry time of indefinite blocks shown as the current time
22860* (bug 1317) Fix external links in image captions
22861* (bug 1084) Fix logo not rendering centrally in IE
22862* (bug 288) Fix tabs wrapping in IE6
22863* (bug 119) Fix full-width tabs with RTL text in IE
22864* (bug 1323) Fix logo rendering off-screen in IE with RTL language
22865* Show "block" link in Special:Recentchanges for logged in users, too, if
22866  wgUserSysopBans is true.
22867* (bug 1326) Use content language for '1movedto2' in edit history
22868* zh: Fix warning when HTTP_ACCEPT_LANGUAGE is not set
22869* zh: Fix double conversion for zh-sg and zh-hk
22870* (bug 1132) Fix concatenation of link lists in refreshLinks
22871* (bug 1101) Fix memory leak in refreshLinks
22872* (bug 1339) Fix order of @imports in Cologne Blue CSS
22873* Don't try to create links without namespaces ([[Category:]] link bug)
22874* Memcached data compression fixes
22875* Several valid XHTML fixes
22876* (bug 624) Fix IE freezing rendering whilst waiting for CSS with MonoBook
22877* (bug 211) Fix tabbed preferences with XHTML MIME type
22878* Fix for script execution vulnerability.
22879
22880=== Beta 6 fixes ===
22881
22882* (bug 1335) implement 'tooltip-watch' in Language.php
22883* Fix linktrail for nn: language
22884* (bug 1214) Fix prev/next links in Special:Log
22885* (bug 1354) Fix linktrail for fo: language
22886* (bug 512) Reload generated CSS on preference change
22887* (bug 63) Fix displaying as if logged in after logout
22888* Set default MediaWiki:Sitenotice to '-', avoiding extra database hits
22889* Skip message cache initialization on raw page view (quick hack)
22890* Fix notice errors in wfDebugDieBacktrace() in XML callbacks
22891* Suppress notice error on bogus timestamp input (returns epoch as before)
22892* Remove unnecessary initialization and double-caching of parser variables
22893* Call-tree output mode for profiling
22894* (bug 730) configurable $wgRCMaxAge; don't try to update purged RC entries
22895* Add $wgNoFollowLinks option to add rel="nofollow" on external links
22896  (on by default)
22897* (bug 1130) Show actual title when moving page instead of encoded one.
22898* (bug 925) Fix headings containing <math>
22899* (bug 1131) Fix headings containing interwiki links
22900* (bug 1380) Update Nynorsk language file
22901* (bug 1232) Fix sorting of cached Special:Wantedpages in miser mode
22902* (bug 1217) Image within an image caption broke rendering
22903* (bug 1384) Make patrol signs have the same width for page moves as for edits
22904* (bug 1364) fix "clean up whitespace" in Title:SecureAndSplit
22905* (bug 1389) i18n for proxyblocker message
22906* Add fur/Furlan/Friulian to language names list
22907* Add TitleMoveComplete hook on page renames
22908* Allow simple comments for each translation rules in MW:Zhconversiontable
22909* (bug 1402) Make link color of tab subject page link on talk page indicate
22910  whether article exists
22911* (bug 1368) Fix SQL error on stopword/short word search w/ MySQL 3.x
22912* Translated Hebrew namespace names
22913* (bug 1429) Stop double-escaping of block comments; fix formatting
22914* (bug 829) Fix URL-escaping on block success
22915* (bug 1228) Fix double-escaping on &amp; sequences in [enclosed] URLs
22916* (bug 1435) Fixed many CSS errors
22917* (bug 1457) Fix XHTML validation on category column list
22918* (bug 1458) Don't save if edit form submission is incomplete
22919* Logged-in edits and preview of user CSS/JS are now locked to a session token.
22920* Per-user CSS and JavaScript subpage customizations now disabled by default.
22921  They can be re-enabled via $wgAllowUserJs and $wgAllowUserCss.
22922* Removed .ogg from the default uploads whitelist as an extra precaution.
22923  If your web server is configured to serve Ogg files with the correct
22924  Content-Type header, you can re-add it in LocalSettings.php:
22925    $wgFileExtensions[] = 'ogg';
22926
22927=== RC1 fixes ===
22928
22929* Fix notice error on nonexistent template in wikitext system message
22930* (bug 1469) add missing <ul> tags on Special:Log
22931* (bug 1470) remove extra <ul> tags from Danish log messages
22932* Fix notice on purge w/ squid mode off
22933* (bug 1477) hide details of SQL error messages by default
22934  Set $wgShowSQLErrors = true for debugging.
22935* (bug 1430) Don't check for template data when editing page that doesn't exist
22936* Recentchanges table purging fixed when using table prefix
22937* (bug 1431) Avoid redundant objectcache garbage collection
22938* (bug 1474) Switch to better-cached index for statistics page count
22939* Run Unicode normalization on all input fields
22940* Fix translation for allpagesformtext2 in LanguageZh_cn and LanguageZh_tw
22941* Block image revert without valid login
22942* (bug 1446) stub Bambara (bm) language file using French messages
22943* (bug 1432) Update Estonian localization
22944* (bug 1471) unclosed <p> tag in Danish messages
22945* convertLinks script fixes
22946* Corrections to template loop detection
22947* XHTML encoding fix for usernames containing & in Special:Emailuser
22948* (for zh) Search for variant links even when conversion is turned off,
22949  to help prevent duplicate articles.
22950* Disallow ISO 8859-1 C1 characters and "no-break space" in user names
22951  on Latin-1 wikis.
22952* Correct the name of the main page it LanguageIt
22953* Allow Special:Makesysop to work for usernames containing SQL special
22954  characters.
22955* Fix annoying blue line in Safari on scaled-down images on description page
22956* Increase upload sanity checks
22957* Fix XSS bug in Media: links
22958* Add cross-site form submission protection to various actions
22959* Fix fatal error on some dubious page titles
22960* Stub threshold displays correctly again
22961
22962
22963=== 1.4.0 final fixes ===
22964
22965* (bug 65) Fix broken interwiki link encoding on Latin-1 wikis; force to UTF-8
22966* (bug 563) Fix UTF-8 interwiki URL redirects via Latin-1 wikis
22967* (bug 1536) Fix page info
22968* Support os (Ossetic) as language code, using Russian localization base
22969* (bug 1610) Support non (Old Norse) as language code, using Icelandic
22970  localization base
22971* (bug 1618) Properly list custom namespaces in Special:Allpages
22972* (bug 1622) Remove trailing' >' when using category browser
22973* (bug 1570) Fix php 4.2.x error on conflict merging
22974* (bug 1585) Fix page title on post-login redirection page
22975* Run UTF-8 validation on old text in Recentchanges RSS diffs
22976* (bug 1642) fix a mime type typo in img_auth.php
22977* Automated interwiki redirects only for local interwikis
22978* Respect read-only mode on block removals
22979* Trim old illegal characters from syndication feeds
22980* Reduce message cache outage recovery delay from 1 day to 5 minutes
22981* (bug 1403) Update Finnish localization
22982* (bug 1478) Punjabi localization
22983* (bug 1667) Update script 5 second countdown.
22984* (bug 1057) Fix logging table encoding (error on MySQL 4.1)
22985* (bug 1680) Fix linktrail for fo
22986* (bug 1653) Removing hardcoded messages in Special:Allmessages
22987* (bug 1594) Render a hyphen in a formula as &minus; in HTML
22988* (bug 1495) Fall back to default language MediaWiki: for custom messages
22989* (bug 1617) Show different error messages for "user does not
22990    exist" and "wrong password" when using AuthPlugin
22991* (bug 1532), (bug 1544) Changed language names for
22992    'bn', 'bo', 'dv', 'dz', 'ht', 'ii', 'li', 'lo', 'ng', 'or', 'pa', 'si',
22993    'ti', 've'
22994* Fix editing on non-Esperanto wiki with user language pref set to Esperanto
22995* Make conversion table for zh-sg default to zh-cn, and zh-hk default to zh-tw
22996* Fix PHP notice in MonoBook when counters disabled
22997* (bug 1696) Update namespaces, dates in uk localization
22998* (bug 551) Installer warns about magic_quotes_runtime and magic_quotes_sybase
22999  instead of trying to install with corrupt table files
23000* Installer no longer tries to move non-default MediaWiki: pages into Template:
23001* User-to-user email disabled by default ($wgEnableUserEmail)
23002
23003
23004=== 1.4.1 fixes ===
23005
23006* (bug 1720) fix genitive month names for uk
23007* (bug 1704) fixed untranslateable string in Special:Log
23008* (bug 1638) Added Belrusian language file
23009* (bug 1736) typo in SpecialValidate.php
23010* (bug 73) Upload doesn't run edit updates on description page (links,
23011  search index and categories)
23012* (bug 646) <math> fails to recognize \ll and \gg
23013* (bug 926) \div element from TeX not supported in <math> element
23014* (bug 1147) add \checkmark to whitelist in texutil.ml
23015* (bug 937) \limits function from LaTeX not supported in <math> element
23016* Support for manually converting article title to different Chinese
23017  variants (for zh)
23018* (bug 1488, bug 1744) Fix encoding for preferences, dates in Latin-1 mode
23019* (bug 1042) Fix UTF-8 case conversion for PHP <4.3 with mbstring extension
23020* Fix code typo that broke article credits display
23021* Installation fixes for running under IIS
23022* (bug 1556) login page tab order. "remember" checkbox now come after password.
23023* SQL debug log fixlets
23024* (bug 1815) Fix namespace in old revision display with mismatched title
23025* (bug 1788) Fix link duplication when edit/upload comment includes newlines
23026* Change default on $wgSysopUserBans and $wgSysopRangeBans to true
23027* Fix link conversion for URL request
23028* (bug 1851) Updated download URL for the SCIM packages used by zhtable
23029* (bug 1853) Try stripping quotes from term for 'go' title match
23030* Fix missing function in Latin1 mode
23031* (bug 1860) Anchors of interwiki links did not get normalized
23032* (bug 1847) accept lowercase x in ISBN, do not accept invalid A-W,Y,Z
23033* Fix link conversion for URL request, hopefully without breaking the wiki
23034* (bug 1849) New option allows to consider categorized images as used on
23035  Special:Unusedimages
23036* Localized category namespace for ka (Georgian)
23037* (bug 1107) Work around includes problem in installer when parent dir is not
23038  readable by the web server
23039* (bug 1927) Incorrect escaping on wikitext message in Blockip
23040
23041
23042=== 1.4.2 fixes ===
23043
23044* Fix math options in Finnish localization
23045* Use in-process Tidy extension if available when $wgUseTidy is on
23046* (bug 1933) Fix PATH_INFO usage under IIS with PHP ISAPI module
23047* (bug 1188) <nowiki> in {{subst:}} includes fixed
23048* (bug 1936) <!-- comments --> in {{subst:}} includes fixed
23049* Fix a potential MSIE JavaScript injection vector in Tidy mode
23050
23051
23052=== 1.4.3 fixes ===
23053
23054* (bug 1636) Refs like &#0355; were misinterpreted as octal in some places
23055* (bug 1163) Special:Undelete showed oldest revision instead of newest
23056* (bug 1938) Fix escaping of illegal character references in link text
23057* (bug 1997) Fix for error on display of renamed items in Recentchanges on PHP5
23058* (bug 1949) Profiling typo in rare error case
23059* (bug 1963) Fix deletion log link when $wgCapitalLinks is off
23060* (bug 1970) Don't show move tab for immobile pages
23061* (bug 1770) Page creation recorded links from the 'newarticletext' message
23062* Optional change to the site_stats table. When applied, this removes the need
23063  for expensive queries in Special:Statistics.
23064
23065
23066=== 1.4.4 fixes ===
23067
23068* (bug 725) Let dir="ltr" attribute work again in MonoBook on RTL languages
23069* (bug 2024) Skip JavaScript error for custom skins where .js message not set
23070* (bug 2025) Updated Indonesian localization
23071* (bug 2039) Updated Lithuanian localization
23072
23073
23074=== Caveats ===
23075
23076Some output, particularly involving user-supplied inline HTML, may not
23077produce 100% valid or well-formed XHTML output. Testers are welcome to
23078set $wgMimeType = "application/xhtml+xml"; to test for remaining problem
23079cases, but this is not recommended on live sites. (This must be set for
23080MathML to display properly in Mozilla.)
23081
23082
23083For notes on 1.3.x and older releases, see HISTORY.
23084
23085
23086=== Online documentation ===
23087
23088Documentation for both end-users and site administrators is currently being
23089built up on MediaWiki.org, and is covered under the GNU Free Documentation
23090License:
23091
23092  https://www.mediawiki.org/
23093
23094
23095=== Mailing list ===
23096
23097A MediaWiki-l mailing list has been set up distinct from the Wikipedia
23098wikitech-l list:
23099
23100  http://lists.wikimedia.org/mailman/listinfo/mediawiki-l
23101
23102A low-traffic announcements-only list is also available:
23103  http://lists.wikimedia.org/mailman/listinfo/mediawiki-announce
23104
23105It's highly recommended that you sign up for one of these lists if you're
23106going to run a public MediaWiki, so you can be notified of security fixes.
23107
23108
23109=== IRC help ===
23110
23111There's usually someone online in #mediawiki on irc.freenode.net
23112
23113=MediaWiki 1.3=
23114
23115== MediaWiki 1.3.18 ==
23116(released 2005-11-02)
23117MediaWiki 1.3.18 is a bugfix and security maintenance release. A change in PHP
231184.4.1 broke handling of extension and <nowiki><pre></nowiki> sections, causing
23119garbage data to be inserted in output and saved edits. This version works
23120around the change. This release includes further corrections to the inline CSS
23121style sanitation which works around a JavaScript "feature" on Microsoft
23122Internet Explorer. Users of Microsoft Internet Explorer for Windows may be
23123vulnerable to XSS injections on prior 1.3 releases; users of
23124standards-compliant browsers are not vulnerable.
23125
23126== MediaWiki 1.3.17 ==
23127(released 2005-10-05)
23128MediaWiki 1.3.17 is a security maintenance release. Unsafe handling of CSS by
23129Microsoft Internet Explorer could be exploited to produce cross-site scripting
23130attacks by JavaScript injection to clients running that browser. This release
23131blacklists several additional variants from use in HTML inline style
23132attributes. All publicly accessible wikis are recommended to upgrade to reduce
23133the risk to visitors using Microsoft web browsers.Note: the MediaWiki 1.3.x
23134series is not compatible with PHP 5.0.5 or higher. Upgrade to the 1.5.0 release
23135if you require this version of PHP 5.
23136
23137== MediaWiki 1.3.16 ==
23138(released 2005-09-21)
23139MediaWiki 1.3.16 is a security maintenance release. A bug in edit submission
23140handling could cause corruption of the previous revision in the database if an
23141abnormal URL was used, such as those used by some spambots. Affected releases:
23142* 1.4.x <= 1.4.9; fixed in 1.4.10
23143* 1.3.x <= 1.3.15; fixed in 1.3.16
231441.5 release candidates are not affected by this problem. All publicly editable
23145wikis are strongly recommended to upgrade immediately.
231461.3 releases can be manually patched by changing this bit in
23147{{manual|EditPage.php}}:
23148<syntaxhighlight lang="php">
23149    if( $this->tokenOk( $request ) ) {
23150        $this->save    = $request->wasPosted() && !$this->preview;
23151    } else {
23152</syntaxhighlight>
23153to:
23154<syntaxhighlight lang="php">
23155    if( $this->tokenOk( $request ) ) {
23156        $this->save    = $request->getVal( 'action' ) == 'submit' &&
23157                         $request->wasPosted() && !$this->preview;
23158    } else {
23159</syntaxhighlight>
23160
23161== MediaWiki 1.3.15, 2005-08-29 ==
23162MediaWiki 1.3.15 is a security maintenance release. It corrects across-site
23163scripting security bug:
23164* <nowiki><math></nowiki> tags were handled incorrectly when TeX rendering
23165support is off, as in the default configuration. Wikis where the optional math
23166support has been *enabled* are not vulnerable. The 1.3.x series is no longer
23167maintained except for security fixes; new users and those seeking bug fixes
23168should upgrade to 1.4.9 or 1.5.0.
23169
23170== MediaWiki 1.3.14, 2005-08-23 ==
23171MediaWiki 1.3.14 is a security maintenance release. A flaw in the interaction
23172between extensions and HTML attribute sanitization was discovered which could
23173allow unauthorized use of offsite resources in style sheets, and possible
23174exploitation of a JavaScript injection feature on Microsoft Internet Explorer.
23175The 1.3.x series is no longer maintained except for security fixes; new users
23176and those seeking bug fixes should upgrade to 1.4.8 or 1.5.0. Existing 1.3.x
23177installations not willing to upgrade to the current stable release should apply
23178the change manually:
23179In includes/Parser.php, function {{code|inline=y|lang=php|fixTagAttributes()}}
23180add:
23181<syntaxhighlight lang="php">
23182       # Any placeholder items should have been unstripped already before
23183       # we got to this point. Raw text inserted later could be dangerous.
23184       if( strpos( $t, UNIQ_PREFIX ) !== false ) {
23185           wfDebug( "Parser::fixTagAttributes found stripped data placeholder;
23186           dropping attributes\n" );
23187           $t = '';
23188       }
23189</syntaxhighlight>
23190If you are actively using extensions to generate HTML attribute values, upgrade
23191to 1.4 or 1.5 for a more thorough fix.
23192
23193== MediaWiki 1.3.13, 2005-06-03 ==
23194MediaWiki 1.3.13 is a security maintenance release. Incorrect handling of page
23195template inclusions made it possible to inject JavaScript code into HTML
23196attributes, which could lead to cross-site scripting attacks on a publicly
23197editable wiki. Vulnerable releases and fix:
23198* 1.5 prerelease: fixed in 1.5alpha2
23199* 1.4 stable series: fixed in 1.4.5
23200* 1.3 legacy series: fixed in 1.3.13
23201* 1.2 series no longer supported; upgrade to 1.4.5 strongly recommended The
232021.3.x series is no longer maintained except for security fixes; new users and
23203those seeking general bug fixes should install 1.4.5. Existing 1.3.x
23204installations not willing or able to upgrade to the current stable relase
23205should update the installation to 1.3.13; only includes/Parser.php has changed
23206from 1.3.12.
23207
23208== MediaWiki 1.3.12, 2005-02-20 ==
23209MediaWiki 1.3.12 is a security maintenance release. A cross-site scripting
23210injection vulnerability was discovered, which affects only MSIE clients and is
23211only open if MediaWiki has been manually configured to run output through HTML
23212Tidy ($wgUseTidy). The 1.3.x series is no longer maintained except for security
23213fixes; new users and those seeking bug fixes should upgrade to 1.4.2. Existing
232141.3.x installations using Tidy not willing to upgrade to the current stable
23215relase should either turn off Tidy or update the installation to 1.3.12.
23216
23217== MediaWiki 1.3.11, 2005-02-20 ==
23218MediaWiki 1.3.11 is a security release.
23219A security audit found and fixed a number of problems. Users of MediaWiki
232201.3.10 and earlier should upgrade to 1.3.11; users of 1.4 beta releases should
23221upgrade to 1.4rc1.
23222
23223=== Cross-site scripting vulnerability ===
23224XSS injection points can be used to hijack session and authentication cookies
23225as well as more serious attacks.
23226* Media: links output raw text into an attribute value, potentially abusable
23227for JavaScript injection. This has been corrected.
23228* Additional checks added to file upload to protect against MSIE and Safari
23229MIME-type autodetection bugs.
23230As of <code>1.3.10/1.4beta6</code>, per-user customized CSS and JavaScript is
23231disabled by default as a general precaution. Sites which want this ability may
23232set {{wg|AllowUserCss}} and {{wg|AllowUserJs}} in LocalSettings.php.
23233
23234=== Cross-site request forgery ===
23235An attacker could use JavaScript-submitted forms to perform various restricted
23236actions by tricking an authenticated user into visiting a malicious web page. A
23237fix for page editing in 1.3.10/1.4beta6 has been expanded in this release to
23238other forms and functions. Authors of bot tools may need to update their code
23239to include the additional fields.
23240
23241=== Directory traversal ===
23242An unchecked parameter in image deletion could allow an authenticated
23243administrator to delete arbitary files in directories writable by the web
23244server, and confirm existence of files not deletable.
23245
23246== MediaWiki 1.3.10, 2005-02-03 ==
23247MediaWiki 1.3.10 is a security release.
23248An attacker could craft a URL which, when visited by a particular logged-in
23249user, would execute arbitrary JavaScript code on the user's browser in the
23250wiki's site context. This attack has been blocked, and as an extra precaution
23251the user CSS and JavaScript subpage support is now disabled by default. Sites
23252which want this ability may set {{wg|AllowUserCss}} and {{wg|AllowUserJs}} in
23253{{manual|LocalSettings.php}}. Additional protections have been added against
23254off-site form submissions
23255hijacking user credentials. Authors of bot tools may need to update their code
23256to include additional fields. All wikis running 1.3.x are strongly urged to
23257upgrade to 1.3.10.
23258Changes from 1.3.9:
23259* Logged-in edits and preview of user CSS/JS are now locked to a session token.
23260* Per-user CSS and JavaScript subpage customizations now disabled by default.
23261They can be re-enabled via {{wg|AllowUserJs}} and {{wg|AllowUserCss}}.
23262* Removed .ogg from the default uploads whitelist as an extra precaution. If
23263your web server is configured to serve Ogg files with the correct Content-Type
23264header, you can re-add it in LocalSettings.php: {{wg|FileExtensions}}<code>[] =
23265'ogg'</code>
23266
23267== MediaWiki 1.3.9, 2004-12-12 ==
23268MediaWiki 1.3.9 is a security and bug fix release.
23269A flaw in upload handling has been found which may allow upload and  execution
23270of arbitrary scripts with the permissions of the web server. Only wikis that
23271have enabled uploads and have a vulnerable Apache  configuration will be
23272affected, but to be safe all wikis should upgrade. Wikis with uploads available
23273should either disable uploads or upgrade to 1.3.9 immediately; if other files
23274are customized and require merging changes,
23275includes/{{manual|SpecialUpload.php}} may be replaced individually to add the
23276fix. (It is also recommended to configure your web server to disable script
23277execution in the 'images' subdirectory where uploads are placed, which prevents
23278most attacks even if the wiki fails.)
23279Changes from 1.3.8:
23280* Backported "Templates used in this page"-feature of EditPage
23281* Allow "MySkin" as a default skin.
23282* ({{bugzilla|938}}) Parse namespaces correctly on self-interwiki links
23283* ({{bugzilla|1010}}) fix broken Commons image link on [[Skin:Classic|Classic]]
23284& [[Skin:Cologne Blue|Cologne Blue]]
23285* ({{bugzilla|1004}}) Norsk language names for interwiki links changed, Nauruan
23286language name changed
23287* Enhance upload extension blacklist to protect against vulnerable Apache
23288configurations
23289
23290== MediaWiki 1.3.8, 2004-11-15 ==
23291MediaWiki 1.3.8 is a bugfix release. Those running wikis with uploads enabled
23292are strongly recommended to upgrade as this fixes several problems with
23293overwriting previously-uploaded files.
23294Changes from 1.3.7:
23295* ({{bugzilla|506}}) fix {{code|inline=y|lang=html|array_key_exists()}} warning
23296for IIS servers using ISAPI mode
23297* ({{bugzilla|718}}) fix bad charset in (file) cached pages
23298* use local numerals in category page (for Hindi et al)
23299* alias month abbreviations to month names in Hindi
23300* add localized numerals for Gujarati and Kannada
23301* fix Category and project namespaces for Hindi
23302* Don't output bogus timestamp on [[Special:RecentChanges]] if no entries
23303* Correct template include path which broke some but not all Windows installs
23304* Fix edit form submission problem with some PHP versions
23305* Disallow unreachable titles with %XX hex codes
23306* Allow page [[0]] to be renamed
23307* ({{bugzilla|774}}) when saving with <code>section=new</code>, return to the
23308anchor as with existing numbered section edits
23309* Experimental shared upload overlay area (disabled by default)
23310* ({{bugzilla|806}}) Removed some "Wikipedia" hardcoding in German localization
23311* User option localization fix for some extensions
23312* ({{bugzilla|809}}) now try to load the mysql php extension if it isn't loaded
23313* ({{bugzilla|848}}) fix error message in [[Special:Newpages]] RSS and Atom
23314feeds
23315* ({{bugzilla|26}}) fix cache headers on anon talk page notification
23316* ({{bugzilla|874}}) added 'cgi' to {{wg|FileBlacklist}}
23317* ({{bugzilla|862}}) localize date and time format for Finnish
23318* ({{bugzilla|548}}) Don't overwrite images until the user confirms it
23319
23320== MediaWiki 1.3.7, 2004-10-18 ==
23321Changes from 1.3.6:
23322* Fix protected-page related security issue.
23323
23324== MediaWiki 1.3.6, 2004-10-14 ==
23325Changes from 1.3.5:
23326* ({{bugzilla|296}}) Variables in user interface messages are no longer
23327substituted at install time, so changes to the site name etc should be easier
23328to make
23329* ({{bugzilla|149}}) [[Special:RecentChanges]] "changes from" link preserves
23330limit
23331* ({{bugzilla|433}}) tooltip for "Undelete" tab now labeled correctly
23332* ({{bugzilla|439}}) unclickable "Move" tab no longer displays on protected
23333pages
23334* ({{bugzilla|484}}) graceful deletion of images where the actual file is
23335missing
23336* ({{bugzilla|686}}) fixed [[plural]]s in Catalan localization
23337* Fixed potential HTML/JavaScript injection attack in the
23338[[Extension:UnicodeConverter|UnicodeConverter]] extension. (This extension is
23339not enabled by default.)
23340* Fixed potential HTML/JavaScript injection attack via raw page views to a
23341maliciously crafted wiki page.
23342* ({{bugzilla|187}}, {{bugzilla|669}}) Fixed centered thumbnails, using
23343{{code|inline=y|lang=html|<div>}} instead of {{code|inline=y|lang=html|<span>}}.
23344* catch MySQL error 2000 during installation.
23345* ({{bugzilla|704}}) Removed misleading LocalSettings.sample
23346* Fix cross site scripting bugs in [[Special:Ipblocklist]],
23347[[Special:EmailUser]]
23348* Fix SQL injection and cross site scripting bugs in Special:Maintenance
23349* Fix cross site scripting bugs and possible filename validation vulnerability
23350in ImagePage.
23351* and more of that sort
23352
23353== MediaWiki 1.3.5, 2004-09-30 ==
23354Changes from 1.3.4:
23355* Clean up input validation in 'raw' page output mode which was a potential
23356cross-site scripting opportunity.
23357
23358== MediaWiki 1.3.4, 2004-09-28 ==
23359=== SECURITY NOTE ===
23360As of 1.3.4, MediaWiki performs some screening of newly uploaded files for
23361validity. (Some)  corrupt image files, and HTML files mistakenly or maliciously
23362masquerading as images, should now be rejected. These checks protect against
23363Internet Explorer security holes relating to type autodetection which are a
23364potential cross-site scripting attack vector, and also rejects at least one
23365known version of the "JPEG virus" which might attack unpatched clients. If you
23366already have invalid files uploaded this will not protect against them. If you
23367have expanded the <code>filetype</code> whitelist or disabled the strict type
23368checking, other dangerous file types may still get through. You should always
23369be careful when allowing uploads!
23370Changes from 1.3.3:
23371* Fixed lots of template-related bugs, esp. for cases where template variables
23372are used for links, images, etc.
23373* Fixed transformation of page messages when viewing [[Special:Allmessages]]
23374* Handle "ISBN ISBN 1234" correctly
23375* Fixed warning on Category pages
23376* Fixed some bad error messages on login page
23377* Fixed history entry for initial main page on install
23378* Removed problematic <code>{</code> and <code>}</code> from legal title
23379characters
23380* Strip leading blank from output in preformatted text.
23381* Fixed problem when moving pages to titles with '#' in
23382* Optional {{wg|RawHtml}} for raw {{code|inline=y|lang=html|<html>}} sections.
23383Use only on limited- participation 'trusted' wikis, as it does not protect
23384against cross-site scripting attacks. For security, this option can only be
23385enabled if in {{wg|WhitelistEdit}} mode.
23386* Fixed problem where pages which were created as a redirect following a move
23387never showed on [[Special:Randompage]].
23388* Fixed line spacing on printed table of contents
23389* Allow links to pages with names of the form [[RFC 1234]]
23390* Fixed broken edit links being shown for sections from included templates
23391* Verify that uploaded image files are of the claimed type.
23392
23393== MediaWiki 1.3.3, 2004-09-09 ==
23394Changes from 1.3.2:
23395* Fix for long numeric page titles
23396* Fix Go search for "0", numeric almost-self-links
23397* Avoid caching of pages with "You have new messages" headers
23398* Fix for upgrades as non-root users from 1.2 command-line installs.
23399* Fix for {{wg|DebugDumpSql}} debug mode.
23400* {{wg|ExtraNamespaces}} setting for configuring additional namespaces (see
23401note in {{manual|DefaultSettings.php}})
23402* 'recache' on query pages now disabled when miser mode is on; special case the
23403global settings in your {{manual|LocalSettings.php}} to do automatic updates.
23404* Don't block UTF-8 titles containing byte 0xA0 (bug added in 1.3.2)
23405* Watch/unwatch tabs now shown on edit pages in MonoBook.
23406* Fix default skin in Irish localization (ga)
23407* Add Traditional Chinese localization (zh-tw)
23408* Changed default sortkey of subcategories. Don't include "Category:"-prefix
23409any longer
23410* More helpful info on spam catcher.
23411* Allow larger offsets for queries such as [[Special:Listusers]]
23412* Semicolon (;) added to French non-break space rules
23413* Possible fix for some install errors with path names permission problems.
23414* Removed [[Project:All system messages]], which has been superseded by the
23415much faster [[Special:Allmessages]]. This speeds up installation considerably.
23416
23417== MediaWiki 1.3.2, 2004-08-30 ==
23418Changes from 1.3.1:
23419* Fix namespaced page creation links when no go match
23420* When cookies are disabled, don't show login screen twice
23421* Install should no longer die when PHP is pre-configured to compress output
23422* Fixed bug that caused long Japanese pages to time out with Tidy active
23423* When session.handler is set incorrectly, try automatic override to 'files'
23424* Watch/Unwatch links back to the affected page instead of Main Page
23425* Upload link no longer displayed on Monobook if uploading is disabled
23426* Special:Allmessages faster, shows correct original text, works in safe mode
23427
23428== MediaWiki 1.3.1, 2004-08-14 ==
23429Changes from 1.3.0:
23430* Watchlist parameters now work with register_globals off
23431* Fixed parsing of ''italics'' and '''bold''' mark-up (again)
23432* Special:Allpages display is more sensible on smaller wikis
23433* Fixed XHTML parsing error in classic skins
23434* Moved pages update watchlist correctly
23435* Fixed rebuildall.php on case-sensitive Unix filesystems
23436* Disabled file cache compression by default due to incompatibility with output
23437buffer compression (ob_gzhandler)
23438* New magic word {{code|inline=y|PAGENAMEE}} (URL-escaped version of
23439{{code|inline=y|PAGENAME}})
23440* Installation avoids blank username; better message on missing XML module
23441* {{wg|WhitelistAccount}} no longer breaks all logins.
23442
23443== MediaWiki 1.3.0, 2004-08-11 ==
23444Look & layout:
23445* New default layout '[[Skin:MonoBook|MonoBook]]' (available on PHP4 only
23446currently)
23447* Print stylesheet now built-in to every page
23448* More or less correct XHTML 1.0 (served as text/html by default)
23449Wiki features:
23450* Image captions can now include links and other basic formatting
23451* Image bounding box can be specified instead of width, e.g. as 100x100px,
23452making the image not wider than 100px and not higher than 100px, keeping aspect
23453ratio.
23454* Templates have been expanded with parameters, and separated from the
23455MediaWiki: localization scheme.
23456* Categories more or less work
23457* added a special page for listing users with sysop rights.
23458Editing:
23459* Automatic merging of edit conflicts that don't directly interfere
23460* Edit summaries can now include basic formatting and links
23461Metadata and output:
23462* Linked Creative Commons copyright metadata (optional)
23463* RSS 2.0 & Atom 0.3 feeds for Recent Changes, New Pages
23464Optional modules:
23465* WikiHiero hieroglyphic module can be added (separate download)
23466* Timeline module can be added (separate download). Requires ploticus.
23467* TeX now has an experimental MathML output mode (incomplete!)
23468Installation and upgrading:
23469* The old install.php and update.php have been removed. In-place installation
23470introduced in 1.2 is now the standard installation and upgrade method, see
23471INSTALL and UPGRADE for directions.
23472Database:
23473* The links table has been changed to use a cur_id for l_from. The link tables
23474must be converted on upgrade, which may entail some downtime.
23475Code and compatibility:
23476* Should now run clean with error reporting set to E_ALL.
23477* register_globals hack from 1.2 has been replaced with safer code
23478* Bundled PHPTAL 0.7.0 from http://phptal.sourceforge.net/ (with some patches)
23479* Most image-related code moved to Image.php
23480* More fixes for PHP 4.1.2 (thanks to Asheesh Laroia)
23481* URL encoding fix for anchors
23482* All languages now available in UTF-8 mode
23483* Various other fixes
23484
23485=== Caveats ===
23486Some output, particularly involving user-supplied inline HTML, may not produce
23487100% valid or well-formed XHTML output. Testers are welcome to set $wgMimeType
23488= "application/xhtml+xml"; to test for remaining problem cases, but this is not
23489recommended on live sites. (This must be set for MathML to display properly in
23490Mozilla.) The new 'MonoBook' skin is not compatible with PHP 5 due to bugs in
23491the underlying PHPTAL library. It will be automatically disabled when running
23492on PHP5; the older look and feel will be used instead.
23493