Server : Apache System : Linux server2.thebrownbagmedia.com 4.18.0-553.34.1.el8_10.x86_64 #1 SMP Wed Jan 8 09:40:06 EST 2025 x86_64 User : topnotchcv ( 1029) PHP Version : 8.1.32 Disable Function : NONE Directory :  /var/softaculous/mw14/

Upload File : current_dir [ Writeable ] document_root [ Writeable ]

== MediaWiki 1.43.1 ==

This is a security and maintenance release of the MediaWiki 1.43 branch.

=== Changes since MediaWiki 1.43.0 ===
* Localisation updates.
* (T375707) exception: Convert E_STRICT errors to E_USER_NOTICE.
* (T380755) session: Do not set session.use_trans_sid.
* (T382987) $wgDnsBlacklistUrls now defaults to an empty array. See the comment
  in the "Configuration changes for system administrators" section.
* (T383037) MimeMap: add gltf and glb mime types.
* (T383037) MimeAnalyzer: detect magic number for gltf binary.
* Commit swagger-ui's NOTICE.
* (T382484) dumps: Use proc_close() to close proc_open() subprocess.
* (T375707) MWExceptionHandler: Add error suppression to constant( 'E_STRICT' ).
* (T384879) FormatMetadata: Prevent running preg_match() on null.
* (T384995) specialpage: Improve handling of invalid lang codes on login/signup.
* (T385055) resourceloader: Fix hash computation for virtual files with
  versionFilePath.
* (T385169) MultiUsernameFilter: Don't try to split ids if they're not a string.
* (T385567) parser: Gracefully handle invalid ParsoidRenderID keys.
* (T385568) rest: Return a 400 for invalid render IDs.
* (T383646) installer: Simplify the information box.
* (T384524) installer: Fix conflation between warning and info messages.
* (T376711) language: Use fallback chain to create NumberFormatter.
* (T384524) installer: Restore success messages.
* (T384524) installer: Restore "complete" success message.
* (T385332) feeds: Fix str_replace() deprecation warnings on PHP 8.
* (T386891) Revert "maintenance: Use DatabaseSqlite for type-hinting instead of
  DBConnRef".
* (T381205) Add explanation text for "Allow emails from brand-new users".
* (T380880) ExternalLinks: fix mailto: links reversal.
* (T381033) RateLimiter: Fix peek mode.
* initEditCount: Join from user to actor to revision.
* (T387130,CVE-2025-32699) SECURITY: Update wikimedia/parsoid to 0.20.2.
* (T385519) Sanitizer::normalizeWhitespace warn on preg_replace error.
* (T387638) RevDelList: Ensure setVisibility always includes itemStatuses in
  value if applicable.
* (T388296) ImportImages: Exit with non-zero code if import fails.
* Request: Improve log message when headers already sent.
* (T386368, T387397) REST page metadata endpoints: handle supressed data
  gracefully.
* (T388066) Avoid trying to load the session user in MW_NO_SESSION endpoints.
* (T388171) HttpError: Cast Message to string.
* (T384197) permissions: Avoid potential infinite loop if BlockDisablesLogin =
  true.
* (T388255) ApiLogin: Don't break BotPasswords if password or user is blank,
  just error.
* (T388924) MagicWord::replace*: Make sure we don't pass null into preg_match/
  preg_replace.
* (T388944) Html: Fix "substr(): Passing null to parameter #1 ($string) of type
  string is deprecated".
* (T388728, T385519) Sanitizer::normalizeSectionNameWhitespace: Apply same
  anti-null fix as 270499b.
* (T387690) upload: Suppress warnings from iconv().
* (T388733) Sanitizer::normalizeWhitespace: simplify redundant preg_replace.
* (T315573) Fix GREATEST usage in site_stats.
* (T304474, CVE-2025-32696) SECURITY: Apply proper restrictions on file revert
  action.
* (T24521, T62109, T140010, CVE-2025-32697) SECURITY: PermissionManager:
  Differentiate between cascading protection of file content and file pages.
* (T387507) ResourceLoader: update wikimedia/minify from 2.8.0 to 2.8.1.
* (T388273, T388335) Upgrading pear/net_url2 (v2.2.2 => v2.2.3).
* (T390063, T277675) ResourceLoader: update wikimedia/minify to 2.9.0.
* (T384851) FileBackend: PHP Deprecated: strrpos(): Passing null to parameter #1
  ($haystack).
* (T378622) Parameterize ChangeTags::buildTagFilterSelector to support various
  tag sets.
* (T344352) ChangeTags: Optimize label and description parsing.
* In .htaccess deny files, use "Satisfy All".
* (T322672, T387478) REST: Remove unused setUseParserCache() as potential
  footgun.
* (T389028) block: Fix DBS::acquireTarget() race using GET_LOCK().
* (T388807) LanguageConverter: Only set mTablesLoaded once they're really
  loaded.
* RestrictionStore: Remove short-circuit mode when fetching cascading sources.
* (T385958, CVE-2025-32698) SECURITY: LogPager.php: Restriction enforcer
  functions do not correctly enforce suppression restrictions.
* (T387130, CVE-2025-32699) SECURITY: Potential javascript injection attack
  enabled by Unicode normalization in Action API.
* (T358689, CVE-2025-3469) SECURITY: i18n XSS vulnerability in
  HTMLMultiSelectField when sections are used.
  
= MediaWiki 1.43 =

=== Changes since MediaWiki 1.43.0-rc.0 ===
* (T381728) Use PHP 8.3 in MediaWiki-Docker
* (T382375) Misaligned label margins on Special:MathStatus
* (T382196) \overbrace rendered below (not above) in MathML and client-side
  Mathjax
* (T381310) Math Popup not working in newer version of Popup-Extension
* (T380079) This page is using the deprecated ResourceLoader module
  "mediawiki.Uri" on page load
* (T381311) Preview has wrong location in MathML mode
* (T381046) Preview not working with MathML rendering
* (T381102) <math>\left(a\right)'</math> in MathML and MathJax renders
  with one prime symbol too much
* (T380184) <math>\operatorname{vec}</math> crashes with native MathML
* (T380654) vertical space between multline equations is ignored
* (T375274) mediawiki_function_names math functions eat the following paren in
  native MML mode
* (T373732) Audit SUL3 shared-domain i18n messages for XSS
* (T381068) PHP Deprecated: Creation of dynamic property
  MediaWiki\\Auth\\ButtonAuthenticationRequest::$skipReset is deprecated
  at AuthenticationRequest.php:182
* (T20110) Define AbuseFilter consequence to display a CAPTCHA
* (T332743) On private wikis the ellipsis should not appear above 720px
  (wikitech, office, translate wiki)

== MediaWiki 1.43.0-PRERELEASE ==

== Upgrading notes for 1.43 ==
Don't forget to always back up your database before upgrading!

See the file UPGRADE for more detailed per-version upgrade instructions from the
oldest supported upgrading version, MediaWiki 1.35.

Some specific notes for MediaWiki 1.43 upgrades are below:

* It is now necessary that the OpenSSL PHP extension is installed.
* update.php updates the Linter database table with two migration scripts that
  can take a long time to run: with the provided settings, each migration
  script update roughly 500 rows per second. If at all possible, it is
  highly recommended to let update.php run these migration scripts.

  If this is deemed too long a maintenance operation (depending on the number
  of rows in the Linter database table), it is possible, for a upgrade from
  1.40 onwards, to run the migration scripts before updating the MediaWiki
  and extensions files to 1.43. Set $wgLinterWriteNamespaceColumnStage and
  $wgLinterWriteTagAndTemplateColumnsStage to true, and run the
  extensions/Linter/maintenance/migrateNamespace.php and
  extensions/Linter/maintenance/migrateTagTemplate.php migration scripts
  before proceeding with any other code update.
  When upgrading from a version <= 1.39, a multi-step update is necessary to
  be able to run the migration scripts independently from update.php: first
  update to 1.42, then proceed as indicated.