Previous work T168823: Tracking bug for 1.27.4/1.28.3/1.29.2 security releases
Tracking bug for next security release
This will be the final 1.29 release.
Description
Description
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | Reedy | T199021 Release MediaWiki 1.27.5/1.29.3/1.30.1/1.31.1 | |||
| Resolved | Reedy | T181665 Tracking bug for 1.27.5/1.29.3/1.30.1/1.31.1 security release | |||
| Resolved | matmarex | T169545 $wgRateLimits (rate limit / ping limiter) entry for 'user' overrides that for 'newbie' (CVE-2018-0503) | |||
| Resolved | Samwilson | T187638 When a log event is (partially) hidden Special:Redirect/logid can link to the incorrect log and reveal hidden information (CVE-2018-0504) | |||
| Resolved | Bawolff | T194605 BotPassword can bypass CentralAuth's account lock (CVE-2018-0505) | |||
| Resolved | Anomie | T194237 bot passwords should call checkLoginSecurityLevel | |||
| Resolved | Legoktm | T199029 1.31.0 tarball is missing .htaccess files (CVE-2018-13258) |
Event Timeline
Comment Actions
As I said in email: Let's shoot for this to happen before REL1_31 is branched (April 17th) to make things clean for everyone.
Comment Actions
I didn't want to upload 20 individual files to Phabricator...here's tars of the 3 backported security patches for each branch, and then release branches have one more patch bumping $wgVersion and adding release notes.