MediaWiki Updated to 1.9.2 (Security Fix)

Discussion in 'Security' started by nevetS, Feb 5, 2007.

  1. #1
    From my email:
    This is a bug-fix update that fixes some installation and other minor
    issues with the 1.9.1 release as well as a security issue which was
    introduced in the 1.9 branch.

    JavaScript code which regenerated the "sortable tables" feature did
    not properly sanitize input, leading to an HTML injection vulnerability.

    * (bug 8774) Fix path for GNU FDL rights icon on new installs
    * (bug 8819) Fix full path disclosure with skins dependencies
    * (bug 4268) Fixed data-loss bug in compressOld batch text compression
    affecting pages which had null edits (move, protect, etc) as second
    edit in a batch group. Isolated and patched by Travis Derouin.
    * Security fix for sortable tables JavaScript

    All users of 1.9.x should upgrade.
     
    nevetS, Feb 5, 2007 IP