CVS commit: pkgsrc/www/mediawiki

["Wen Heping" <wen%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   wen
Date:           Sun Dec 20 02:31:05 UTC 2015

Modified Files:
        pkgsrc/www/mediawiki: Makefile distinfo

Log Message:
Update to 1.26.1(security update)

Upstream changes:
MediaWiki 1.26.1

This is a security and bug fix release of the MediaWiki 1.26 branch.
Changes since 1.26

    (bug T117899) SECURITY: $wgArticlePath can no longer be set to relative paths that do not begin with a slash. This enabled trivial XSS attacks. Configuration values such as 
"http://my.wiki.com/wiki/$1"; are fine, as are "/wiki/$1". A value such as "$1" or "wiki/$1" is not and will now throw an error
    (bug T119309) SECURITY: Use hash_compare() for edit token comparison
    (bug T118032) SECURITY: Don't allow cURL to interpret POST parameters starting with '@' as file uploads
    (bug T115522) SECURITY: Passwords generated by User::randomPassword() can no longer be shorter than $wgMinimalPasswordLength
    (bug T97897) SECURITY: Improve IP parsing and trimming. Previous behavior could result in improper blocks being issued
    (bug T109724) SECURITY: Special:MyPage, Special:MyTalk, Special:MyContributions and related pages no longer use HTTP redirects and are now redirected by MediaWiki
    Fixed ConfigException in ExpandTemplates due to AlwaysUseTidy.
    Fixed stray literal \n in Special:Search.
    Fix issue that breaks HHVM Repo Authorative mode.
    (bug T120267) Work around APCu memory corruption bug


To generate a diff of this commit:
cvs rdiff -u -r1.56 -r1.57 pkgsrc/www/mediawiki/Makefile
cvs rdiff -u -r1.42 -r1.43 pkgsrc/www/mediawiki/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.