forked from wikimedia/mediawiki
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathRELEASE-NOTES-1.35
2144 lines (2045 loc) · 111 KB
/
RELEASE-NOTES-1.35
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
= MediaWiki 1.35 =
MediaWiki 1.35 should mostly work on PHP 8.0/8.1, however it is not
currently actively supported. Testing (on a development wiki!) is
appreciated, and bugs with PHP 8.0/8.1 on MediaWiki 1.35 will be accepted.
It is anticipated that in a later MediaWiki 1.35 point release, we can
declare 1.35 as supporting PHP 8.0/8.1.
PHP 8.0 workboard: https://phabricator.wikimedia.org/tag/php_8.0_support/
PHP 8.1 workboard: https://phabricator.wikimedia.org/tag/php_8.1_support/
PHP 8.2 workboard: https://phabricator.wikimedia.org/tag/php_8.2_support/
PHP 8.3 workboard: https://phabricator.wikimedia.org/tag/php_8.3_support/
== MediaWiki 1.35.14 ==
This is a security and maintenance release of the MediaWiki 1.35 branch.
=== Changes since MediaWiki 1.35.13 ===
* Localisation updates.
* (T344912) mail: Encode period (ascii 46) if it appears in encoded email
header.
* (T347726, CVE-2023-51704) SECURITY: logging: Fix non-escaped messages
used in rights log.
== MediaWiki 1.35.13 ==
This is a maintenance release of the MediaWiki 1.35 branch.
=== Changes since MediaWiki 1.35.12 ===
* Tarball release to fix backport issues with patch for T341529.
== MediaWiki 1.35.12 ==
This is a security and maintenance release of the MediaWiki 1.35 branch.
=== Changes since MediaWiki 1.35.11 ===
* Localisation updates.
* (T333050, CVE-2023-45363) SECURITY: Fix infinite loop for
self-redirects with variants conversion.
* (T341434) WikiImporter: Improve error message output.
* (T341737) ApiBase: Cast $id to string in filterIDs.
* (T342632) ApiComparePages: Add help url.
* (T347227) ImportReporter: Make callback functions public.
* doc: Improve description of type in extension.schema.v1.json.
* (T340221, CVE-2023-45360) SECURITY: XSS via
'youhavenewmessagesmanyusers' and 'youhavenewmessages' messages.
* (T341529, CVE-2023-45362) SECURITY: diff-multi-sameuser
("X intermediate revisions by the same user not shown") ignores username
suppression.
* (T341565, CVE-2023-3550) SECURITY: Stored XSS when uploading crafted XML
file to Special:Upload (non-standard configuration).
== MediaWiki 1.35.11 ==
This is a security and maintenance release of the MediaWiki 1.35 branch.
=== Changes since MediaWiki 1.35.10 ===
* Localisation updates.
* (T333990) composer.json: Explicitly pin psr/http-message to 1.0.1.
* (T335203, CVE-2023-29197) SECURITY: Upgrading guzzlehttp/psr7
(1.9.0 => 1.9.1).
* (T269636) Add Access-Control-Max-Age to $wgAllowedCorsHeaders.
* (T322944) Add Authorization to default $wgAllowedCorsHeaders.
* (T332889, CVE-2023-36675) SECURITY: Fix escaping in BlockLogFormatter.
* (T297917) objectcache: avoid use of ctype_digit() in
WANObjectCache::adaptiveTTL().
* (T330464) Work around argument corruption bug in XMLReader::open.
* (T313157) IndexPager: Also protect against $offset being 0.
* (T335612, CVE-2023-36674) SECURITY: Move badFile lookup to Linker.
== MediaWiki 1.35.10 ==
This is a security and maintenance release of the MediaWiki 1.35 branch.
=== Changes since MediaWiki 1.35.9 ===
* Localisation updates.
* (T324895) MWCallbackStream: Add explicit $stream property.
* Remove /images .htaccess rules that are no longer relevent.
* Disable php in .htaccess of images directory as a hardening measure.
* (T322583) Include missing message parameter in message.
* Fix phan error when Excimer is enabled.
* (T274966) tests: Make pass on php8.0.
* (T323373) Parser: Fix extractSections() behavior for PHP >= 8.0.
* (T326021) Add matrix: to $wgUrlProtocols.
* api/en.json: api-help-datatype-expiry add missing 'may'.
* (T225218) Wait until the recent changes are updated.
* (T328222) Pass empty string to strlen() if schema is null for
PostgresDatabase.
* (T317329) OutputPage: Fix undefined ['host'] in ImagePreconnect code.
* (T289926) SpecialRevisionDelete: Set default of '' for wpReason.
* (T155582, T328503) Fix XML dumps for content types with non-string
getNativeData().
* (T295958, T278847) MediaWiki-Docker: Switch PHP images to PHP7.4.
* (T314099) revisiondelete: Replace dynamic property Status::$itemStatuses.
* (T329198) ParamValidator: Improve paramvalidator-help-multi-max message.
* (T292348) WikiImporter: do not fail if upload entry in dump lacks 'text'
tag.
* (T329484) API: Fix query+allimages user parameter description.
* (T330529) SpecialEditTags: Set default of '' for wpReason.
* (T330526) htmlform: Handle null from HTMLFormField::getDefault in
multiselects.
* (T285159, CVE-2023-29141) SECURITY: Do not apply autoblocks to untrusted
XFF headers.
== MediaWiki 1.35.9 ==
This is a security and maintenance release of the MediaWiki 1.35 branch.
=== Changes since MediaWiki 1.35.8 ===
* Localisation updates.
* (T319000) WebInstaller: Don't try and run trim() on null.
* (T320864) When calling mail(), use an array for headers.
* (T311567) In ManualLogEntry, cast the comment to string.
* (T323082) Upgrading wikimedia/xmp-reader (0.7.0 => 0.8.5).
* Language: Handle ronna and quetta.
* (T304515) LCStoreStaticArray: atomically replace the cache file.
* (T324890, T324891, T324901) Parser: Allow dynamic properties on PHP 8.2.
* (T322637) SECURITY: sqlite should not create DB file world-readable.
== MediaWiki 1.35.8 ==
This is a security and maintenance release of the MediaWiki 1.35 branch.
=== Changes since MediaWiki 1.35.7 ===
* Localisation updates.
* (T311568) UploadBase::setTempFile() handle $tempPath being passed as null.
* (T311559) SpecialListFiles: user parameter isn't always present.
* (T311561) ImageListPager: Don't call htmlspecialchars() on null.
* (T311920) SpecialBlockList: Prevent passing null to trim().
* (T311921) SpecialUserrights: Don't pass null to str_replace.
* (T311570) SpecialWithoutInterwiki: Don't pass null through to
Title::capitalize().
* (T311574, T311576) SpecialLinkSearch: Don't pass null through to the parser.
* (T312519, T312520) Parser::extensionSubstitution() Don't run substr() on null.
* (T287564) populateInterwiki: Include not null columns iw_api/iw_wikiid.
* (T312302) SpecialRedirect: Don't pass null to explode.
* RemoveInvalidEmails: Fix quoting for postgres.
* (T312678) import: UploadSourceAdapter::stream_read() don't pass null to
strlen().
* (T312300) SpecialDiff: Don't pass null to explode().
* (T312680) parser: Fix CoreParserFunctions::urlencode() null coalescence $arg.
* (T289926) Handle null passed to wfShorthandToInteger() and Html::element().
* (T289926) Ensure that strlen() does not get passed a (valid) null.
* (T312301) SpecialDiff: Don't pass null to trim().
* Hooks: Use more meaningful name for SkinAfterPortlet hook parameter.
* (T289926) Ensure we don't pass null to mb_strlen.
* (T312305, T311572, T311571, T311578) HtmlForm: Null coalescence in trim()
calls.
* (T289926) site: Consistently return null from Site::getDomain().
* (T307304, T289879) filebackend,jobqueue: Add signature for
FilterIterator::accept().
* (T312183) rdbms: Adapt hasOrMadeRecentPrimaryChanges test mock for PHP 8.1.
* Add application/vnd.ms-opentype to MIME list.
* Allow composer/installers plugin in composer.json.
* (T313663) Make HandlerTestTrait compatible with php8.1.
* (T313663) [php8.1] Change override of $wgResourceBasePath for CSP tests.
* Change type hints for BatchRowIterator and NotRecursiveIterator for
compatibility with PHP 8.1.
* (T313663) [php8] Don't use strlen on potentially null string.
* (T313663) [php8.1] Suppress test warning about providing null.
* (T313663) Parser will use current timestamp instead of null if passed a
RevisionRecord that does not have a timestamp.
* (T313663) Add explicit null check for $sha in FileBackend [php8.1].
* (T313663) LogFormatter: Cast argument of ctype_digit to string [php8.1].
* (T289879, T289926) Get rid of warnings on PHP 8.1.
* rdbms: fix some PHP 8 warnings in Database/LoadBalancer/LBFactory.
* (T313663) Avoid testing strlen on null in ApiQuerySiteinfo [php 8.1 compat].
* Fix a couple deprecation warnings in the installer under PHP 8.1.
* (T313663) Use default timezone UTC for SpecialWatchlistTest [php 8.1].
* (T314096) Migrate use of ${var}-style string interpolation.
* (T313663, T313662) Make default value for optional args {{PAGESINCAT:..}} be
'' not null.
* (T314225) SpecialCategories: Null coalescene $par.
* (T314099) User: Allow dynamic properties on PHP 8.2.
* (T314404) SpecialGoToInterwiki: Null coalescene $par.
* (T314397) SpecialBlock: Better handle null in getTargetUserTitle.
* (T314099) phpunit: Fix trivial dynamic property usages in tests.
* (T314405) UploadStash: Check if us_prop is set in the fileMetadata.
* (T314550) SpecialMergeHistory: Set timestamp to '' if no mergepoint.
* (T314551) SpecialMergeHistory: Set defaults for target and dest parameters.
* api: Add rel=nofollow to help examples.
* (T314824) tests: Update parser test after i18n change.
* (T263927) Add autocomplete HTML attribute to common auth form fields.
* (T307613) Validate length of user email on Special:ChangeEmail/
Special:CreateAccount.
* (T314906, T314907) SpecialBlock: Set defaults for wpPageRestrictions and
wpNamespaceRestrictions.
* (T315309) ImportStreamSource::newFromURL() Prevent passing null to fwrite.
* (T315892) composer.json: Pin phpunit to 8.5.28.
* (T229092) MigrateActors.php: ignore duplicate creations of actors.
* (T313049) Bump wikimedia/parsoid to v0.12.3.
* (T317750) session: Fix broken SessionTest case due to PHPUnit dependency
change.
* (T318460) SpecialChangeEmail: Set default for returntoquery.
* (T316304, CVE-2022-41767) SECURITY: reassignEdits doesn't update results
in an IP range check on Special:Contributions.
* (T309894, CVE-2022-41765) SECURITY: HTMLUserTextField exposes existence
of hidden users.
== MediaWiki 1.35.7 ==
This is a security and maintenance release of the MediaWiki 1.35 branch.
=== Changes since MediaWiki 1.35.6 ===
* Localisation updates.
* (T289879) Type hints for ArrayAccess.
* (T304783) TemplateParser: avoid warnings when called by NoLocalSettings.
* Rebuilt vendor with composer 2.3.3.
* (T289879) Address some deprecations for PHP 8.1.
* Fix old_name in UserLogoutComplete hook.
* (T286260, T307979) objectcache: normalize $exptime to a TTL in
APCUBagOStuff/WinCacheBagOStuff.
* MediaSearchWidget should declare an explicit dependency on mediawiki.user
module.
* (T288423) WikiImporter: Replace deprecated WikiRevision::setText.
* (T309377, CVE-2022-29248, T311384, CVE-2022-27776) Updating guzzlehttp/guzzle
(6.5.5 => 6.5.8).
* (T308471) SECURITY: Escape welcomeuser message passed to showSuccessPage().
* (T311272) Call parent constructor of AddSite maintenance script first.
* MediaWiki: Don't eagerly initialize action name.
* (T289926) Avoid passing null to trim() in SkinTemplate.
* (T307282) Avoid passing null to strcasecmp(), for PHP 8.1.
* (T311552) ChangesListSpecialPage: Don't pass null to FormatJson::decode().
* (T311569) FileBackend::isStoragePath() Handle being passed null.
* (T311544) Pass int to ApiUsageException::newWithMessage()'s $httpCode param.
* (T311678) SpecialEditWatchlist: Prevent passing null to strtolower().
* (T281741) ChangeTags: Fix adding CSS classes for hidden tags.
* (T296642) changetags: Fix management of a '0' tag.
* (T311554) ChangeTags: Return early in formatSummaryRow() if $tags === null.
* (T303033) Handle null in ChangeTags::modifyDisplayQuery.
== MediaWiki 1.35.6 ==
This is a security and maintenance release of the MediaWiki 1.35 branch.
=== Changes since MediaWiki 1.35.5 ===
* (T298261) Fix support for Composer 2.2.
* (T298283) composer.json: Add wikimedia/composer-merge-plugin to allow-plugins.
* Update doctrine/dbal (3.0.0 => 3.1.5).
* (T298564) MemcachedClient: Add support for IPv6.
* (T297543, CVE-2022-28202) SECURITY: properly escape output used within
galleries and Special:RevisionDelete.
* (T268847) Suppress deprecation warnings from libxml_disable_entity_loader().
* (T283275) Fix PHP 8.0 failure of WikiExporterFactoryTest.
* (T274966) Upgrading wikimedia/html-formatter (1.0.2 => 2.0.1).
* Fix the json schema and the extension processor for Parsoid extension modules.
* (T299696) update.php: Avoid passing null to substr.
* In PHP 8.1 don't throw exceptions from mysqli.
* (T289926) SiteConfiguration: Don't pass null to str_replace().
* (T264735) Fix deprecation warning from CURLPIPE_HTTP1.
* (T260735) Stop using is_resource() where possible.
* (T289879) Apply ReturnTypeWillChange to various implementations of built in
interfaces.
* (T299312) Implement __serialize/__unserialize for PHP 8.1 support.
* ExtensionRegistry: Add process cache for lazy attributes.
* (T301041) ApiPageSet: Add "missing": true to missing revisions.
* Allow ParsoidModules extension schema to register services.
* (T297708) Allow setting max execution time to several special pages.
* Upgrading wikimedia/object-factory (v2.1.0 => v2.2.0).
* (T302540) composer.json: Add ext-calendar to require.
* (T302540) composer.json: Add ext-simplexml to require-dev.
* (T302540) composer.json: Add various PHP extensions to suggests.
* Upgrading symfony/polyfill-php80 (v1.23.1 => v1.25.0).
* (T303871) Add Title::getId() as an alias for ::getArticleId().
* (T304008) Don't re-check "Move subpages" on Special:MovePage after a warning.
* (T293576) listFiles: Display file name instead of version.
* (T303560) Installer: Check correct PCRE_CONFIG_NEWLINE value.
* wrapOldPasswords: add \n to two output calls.
* (T304993) Make editcontentmodel a part of editpage grant.
* (T297571, CVE-2022-28201) Title::newMainPage() goes into an infinite recursion
loop if it points to a local interwiki.
* (T297731, CVE-2022-28203) Requesting Special:NewFiles on a wiki with many file
uploads with actor as a condition can result in a DoS.
== MediaWiki 1.35.5 ==
This is a security and maintenance release of the MediaWiki 1.35 branch.
=== Changes since MediaWiki 1.35.4 ===
* (T290697) Add symfony/polyfill-php80.
* IcuCollation: Add some more icu to unicode version mappings.
* ApiBase: Annotate deprecated constants individually.
* PHPVersionCheck: Mark PHP 7.4.0 - 7.4.2 as buggy.
* (T293044) installer: Fix 5th param to sourceFile() in DatabaseUpdater.
* (T291127) Always encode spaces in cookie values as "%20".
* Use LocalFile::getHookRunner instead of LocalFile::hookRunner.
* HistoryBlobStub: add getLocation() to get $mOldId.
* Fix checkStorage.php.
* checkStorage: pass no parameters to WikiRevision::getContent().
* (T292763, CVE-2021-44854) SECURITY: Do not cache private wiki completion
results.
* (T294316) Revert "Mark ApiClientLogin/ApiLogin as requiring write mode".
* (T250068) resources: Upgrade jQuery from 3.4.1 to 3.6.0.
* (T250068) resources: Upgrade jquery-migrate from 3.1.0 (patched) to 3.3.2
(patched).
* (T294796) JobQueueRedis: Replace deprecated zSize with zCard.
* (T212428, T267468) Allow populateContentTables to continue when there are
bad blobs.
* (T295191) ApiQuerySiteinfo: Fix "rightsinfo"/"url" when $wgRightsPage is
set.
* Update pear/mail_mime to 1.10.11.
* Update deprecated Guzzle Psr7 function calls.
* Tweak error message for missing composer dependencies.
* (T296112) Allow inserting new sections named '0'.
* nukeNS: don't run purgeRedundantText() after every change.
* (T225888) RollbackAction: fix missing pagetitle.
* (T297322, CVE-2021-44858, CVE-2021-44857) SECURITY: Fix permissions checks in
undo actions.
* (T297574, CVE-2021-45038) SECURITY: Fix permissions check in action=rollback.
* (T34716, T297416) SECURITY: Require 'read' right for most actions.
* (T271037, CVE-2021-44856) SECURITY: Fix use of EditFilterMergedContent hook
when changing content model.
== MediaWiki 1.35.4 ==
This is a security and maintenance release of the MediaWiki 1.35 branch.
=== Changes since MediaWiki 1.35.3 ===
* (T283394) Mark ApiClientLogin/ApiLogin as requiring write mode.
* (T283273) Make postgres IRC channel point to libera.chat.
* (T289108) ExtensionProcessor: Remove loaderScripts from extension.json
schemas.
* (T281549) Installer: Fix mediawiki-announce auto subscription code.
* FormatJson: Optimize encode() for supported PHP versions.
* (T290398) renameRestrictions.php: Update protected_titles as well.
* $wgMimeTypeBlacklist - This configuration array now prohibits the RFC 4329
form of JavaScript, 'application/javascript', as well as previous MIME types.
* (T51097, T290273) resourceloader: Call getStyleFiles from
FileModule::getFileHashes.
* (T277788) parser: Avoid calling ParserOptions::getOption() too many times.
* (T285515, CVE-2021-41798) SECURITY: XSS vulnerability in Special:Search.
* (T290379, CVE-2021-41799) SECURITY: ApiQueryBacklinks can cause a full
table scan.
* (T284419, CVE-2021-41800) SECURITY: fix PoolCounter protection of
Special:Contributions.
== MediaWiki 1.35.3 ==
This is a security and maintenance release of the MediaWiki 1.35 branch.
=== Changes since MediaWiki 1.35.2 ===
* (T259685) SQLite compatibility with ZeroConf VisualEditor was fixed in 1.35.2.
* (T196906, T242751) Fix the test MonologSpiTest::testDefaultChannel.
* (T279964) Parser: Trim trailing whitespace as the last step in pre-save
transform.
* (T278026) rdbms: Add DB_PRIMARY to replace DB_MASTER.
* (T252853) Update updateSearchIndex.php to 2006+ standards.
* (T276945) Define a batch size in maintenance/manageJobs.php.
* (T276945) Implement JobQueueDB::getAllAbandonedJobs.
* (T269676) authevents: strval() variables passed to status when logging.
* (T280944) $wgIncludejQueryMigrate - This setting allows the jQuery Migrate
plugin to be disabled. It has been enabled by default since MediaWiki 1.27.
* (T281584) apihelp-query+iwlinks-param-prop: s/interlanguage/interwiki/.
* (T281635) Delete maintenance/cleanupAncientTables.php.
* (T282133) RedisConnectionPool: Suppress phan issue.
* (T281549) WebInstaller: Don't show the announce-l subscribe
checkbox temporarily.
* (T278266) Fix annoying E_NOTICE about undefined 'alt' index in
Skin#makeFooterIcon.
* (T264214) UserRightsProxy::addGroup has to be allowed to update the
old group as well, which is used for granting interwiki rights.
* (T269776, T278266) getFooterIcons should not return empty arrays.
* (T274966) Skip AvroFormatterTest::testSchemaNotAvailable on PHP 8.0.
* phpunit: fail on warnings.
* (T283247) Freenode -> Libera per wikimedia moving from
freenode to libera.
* (T243124) Make phpunit:unit accept extension*.json to populate the classes.
* (T142663) Add extension.json merge strategy "provide_default".
* (T283540) HookContainer: Fix normalization of callback for static handler.
* (T283464) Fix array order for array_replace_recursive merge strategy.
* (T247223) Optimise MessageCache::isMainCacheable() for the single-message
case.
* (T278579) Don't send headers on ob_end_clean().
* (T280226, CVE-2021-35197) SECURITY: Prevent blocked users from purging
pages.
== MediaWiki 1.35.2 ==
This is a security and maintenance release of the MediaWiki 1.35 branch.
MediaWiki 1.35.2 supports Composer 2.0. It is recommended to make sure your
libraries are up to date on Composer 1.x, before running Composer 2.x.
While normally running update.php isn't required for point releases,
it is recommended to run it for 1.35.2 so that iwlinks.iwl_prefix is
updated to take 32 characters.
=== Changes since MediaWiki 1.35.1 ===
* (T270450) The confusingly-named User->isLoggedIn() method has been deprecated
in favour of the method it wraps, User->isRegistered().
* Upgrade pimple/pimple from 3.3.0 to 3.3.1 for PHP 8.0 support.
* Upgrade seld/jsonlint from 1.7.1 to 1.8.3 for PHP 8.0 support.
* Upgrade doctrine/dbal from 2.10.4 to 3.0.0 for PHP 8.0 support.
* (T270734) Fix display of Special:Preferences URL in password reset email.
* (T252774, T271441) resourceloader: Give SkinModule 'features' option an
extensible default.
* (T271441) Unknown features shouldn't break style output.
* (T264986) Make use of CURLMOPT_MAX_HOST_CONNECTIONS conditional on having
curl >= 7.30.0.
* DefaultSettings.php: Update $wgPingback documentation.
* Fix docs for LanguageConverter::translate.
* (T272250) Don't rely on implicit string->int cast in comparison.
* (T272327) Exif::isSlong: Cast input to float so PHP 8.0 abs() doesn't whine.
* (T272328) UploadBase: Don't call MimeAnalyzer if mTempPath is null.
* Remove nonfunctional default sampling for WANObjectCache metrics.
* (T258851) Prevent service injection to LoadExtensionSchemaUpdates hook.
* (T270852) Hooks: Map dash character to underscore when generating hook names.
* (T271551, T270145) Fix fetching ipblock-exempt within
BlockManager::getUserBlock.
* PHPVersionCheck: The PHP Group only supports PHP >= 7.3.0.
* (T248925) Set empty closures in DatabaseTest to fix PHP 8 tests.
* (T34217) rdbms: Remove outdated MySQL 4 references and fix doc URLs.
* (T248925) Special:Contributions reports negative namespace error on PHP 8.
* (T248925) objectcache: Fix non-numeric string check in HashBagOStuff for
PHP 8.
* (T248925) Fix CacheTime::getCacheExpiry for PHP 8.
* (T259685) Allow REST API POST handlers to opt out of mandatory SQLite locking.
* (T91820, T259685) MWLBFactory: rename magic HTTP header for opting out of
SQLite write lock.
* (T272326) Fix DeprecationHelperTest on PHP 8.
* Upgrade wikimedia/less.php from 3.0.0 to 3.1.0 for PHP 8.0 support.
* (T236639) OutputPage: Make $wgDebugRedirects work again.
* (T274648) registration: Allow reusing cached metadata between wikis.
* CdnCacheUpdate: Send full URL instead of path to Curl for purge.
* Upgrade monolog/monolog from 1.25.3 to 2.2.0 for PHP 8.0 support.
* FileBackend: Do not use SOCKET_ENOENT on windows.
* (T275441) ApiQueryUserInfo: Allow all uiprops to be requested at once.
* (T275261) Escape wikitext in the title in invalid title error messages.
* (T275242) Extend iwlinks.iwl_prefix to VARBINARY(32) on MySQL.
* (T246594, T270228) PHPVersionCheck: Complain about known-bad versions above
minimum.
* (T275824) Upgrade wikimedia/composer-merge-plugin from 1.4.1 to 2.0.1 for
Composer 2.0 support.
* (T269293) Record all used options in metadata.
* Allow usage of Composer 2.0 to install MediaWiki's dependencies.
* (T259872) skins: Call headElement() after getTemplateData() in SkinMustache.
* (T277009, CVE-2021-30158) SECURITY: Allow blocked users to access
Special:ResetTokens.
* (T272412) Add "Account data" section to user preferences.
* (T268310) Add list of thumbnail urls to LocalFilePurgeThumbnails hook.
* (T277520) registration: Allow specifying immovable namespaces in
extension.json.
* (T275619) Maintenance::hasOption and Maintenance::getOption now behave as
documented and are not altered by previous calls to these methods.
* (T254688) Remove page inner join from subquery in SpecialWhatLinksHere.
* (T122124) signup: added help message for security.
* (T278014, CVE-2021-30154) SECURITY: Escape mediastatistics-header-* messages
on Special:NewFiles.
* (T278058, CVE-2021-30157) SECURITY: Escape rcfilters-filter-* messages on
ChangesList pages.
* (T277414) HTMLFormField: Use non namespaced class name rather than
static::class.
* (T268673) maintenance: Don't create SearchUpdate in rebuildtextindex.php
for page_namespace below 0.
* (T246594, T270228) Mark ParserOptionsTests skipped on PHP 7.4.0-7.4.8.
* (T268230) Switch to new MediaWiki logo by Serhio Magpie.
* (T271735) Expand config-pingback-help, link to privacy policy in
config-pingback.
* Fix documentation of user-global in $wgRateLimits.
* BackupDumper: Add -o as shortcode for --output.
* (T235554) Disable DEFER_SET_LENGTH_AND_FLUSH headers to avoid HTTP errors.
* (T270713, CVE-2021-30152) SECURITY: Allow user to only apply protection they
have right to do so via action=protect.
* (T272386, CVE-2021-30159) SECURITY: Non-admin deleted enwiki page in fast
double move.
* (T270988, CVE-2021-30155) SECURITY: ContentModelChange: Check that user can
create pages.
* (T279451, CVE-2021-30458) SECURITY: Parsoid comment fostering allows for
inserting mostly arbitrary <meta> tags.
== MediaWiki 1.35.1 ==
This is a security and maintenance release of the MediaWiki 1.35 branch.
While normally running update.php isn't required for point releases,
it is recommended to run it for 1.35.1 so that sites.site_language is
updated to take 35 characters.
Watchlist Expiry is no longer considered experimental, but is off by default.
To enable it, set $wgWatchlistExpiry = true; in your LocalSettings.php.
=== Changes since MediaWiki 1.35.0 ===
* (T263929) purgeList.php Fix all-namespaces option to match one used in code.
* (T248719) ParserCache::get - fix wfDeprecated call.
* (T261430) WatchlistExpiryWidget: Move focus to expiry dropdown after hitting
Tab.
* Preload mediawiki.watchstar.widgets before api request.
* (T261030) ApiEditPage: Show existing watchlist expiry if status is not being
changed.
* (T264502) Fix PHP 8 compat with strcspn() $length parameter exceeding string.
* (T248925) Remove final modifier on private function.
* (T264683) Remove ipb_anon_only from ipb_address_unique index addition.
* (T261415) Add days left messages to changes-lists' clock icons.
* Fix order of wfDeprecated parameters in ExternalStoreDB::getSlave.
* (T261260) Preload class used in HeaderCallback.
* (T260868, T260009) Normalize WatchedItem expiry field.
* (T264683) Remove doTable check from (Mysql|Sqlite)Updater::indexHasFields.
* (T264534) ApiPageSet: Avoid infinite loop when merging redirects.
* (T196906) Empty Monolog loggers are now real blackholes.
* (T258649) WatchAction: avoid UPDATE when old and new watch period is
indefinite.
* Parser: Adjust typehint to show that getTitle can return null.
* (T263592) media: Fix case of FlashPixVersion in
FormatMetadata::makeFormattedData().
* (T265223) BaseTemplate: Guard against passing zero arg to array_merge().
* (T264965) Fix base path handling for MessagePosterModule registration.
* (T252183) Fix Database::getTempTableWrites for multi table DDLs.
* (T182546) Fix switch/case indentation per mediawiki coding conventions.
* Flip Yoda conditionals.
* (T263213) Move SkinTemplate::getFooterLinks() to Skin.
* build: Updating mediawiki/mediawiki-codesniffer to 33.0.0.
* (T267105) Make ImageBuilder::checkMissingImage public.
* Updating guzzlehttp/guzzle (6.5.4 => 6.5.5).
* (T266681) Support new style hook registration on install and update.
* (T266980) Fix unsetting of copyright icon in FooterIcons.
* upload.js: Don't assume that warnings array will include 'code' key.
* upload.js: Fix typo in upload API.
* (T264333, T190988, T266903) Pass along ignorewarnings param to all
individual chunks being uploaded.
* (T267558) importTextFiles.php: Replace deprecated WikiRevision:setText().
* (T266418) composer.json: add requirement for composer-plugin-api ^1.1.
* (T261431) Add ARIA attributes to watchlink and its notification.
* (T258877) Change invalid 'Content-Encoding: none' header.
* Fix trailing ; in patch-sites-site_language-35.sql.
* (T248852) wfAssembleUrl: Handle empty query field in URL bits.
* (T268846) Updating wikimedia/testing-access-wrapper (1.0.0 => 2.0.0).
* (T268887) migrateComments: Cast array keys back to string before passing
to the DB.
* (T266619) Introduce new $wgThumbPath config.
* (T269178) MemcachedClient: Cast Resource to integer.
* (T263925) Use the old HookContainer to set up the post-reset services.
* Change "site cache" to just "cache" in the right-purge message.
* [UploadedFileStreamTest] Skip test with chmod.
* (T269710) Updating composer/semver (1.5.1 => 1.7.2).
* (T269710) Updating mediawiki/mediawiki-codesniffer (33.0.0 => 34.0.0).
* (T260631, T260633), BotPassword::save() now returns a Status object for the
result rather than a bool. The length of the bot password grants and
restriction fields are now validated, and an error will be thrown if it
would be truncated by the database.
* (T265778) Fix English/*nix specific error messages in FSFileBackend.
* (T267543) Split dropping of image.img_user_timestamp.
* [FileTest] Do not assume /tmp exists on windows.
* Clean up temp files correctly after unit tests.
* Skip undo related phpunit tests when diff3 is missing.
* (T269964) rdbms: Remove outer parentheses in insert query for Postgres.
* (T263911) In MWExceptionHandler::report(), catch all throwables.
* (T268894, CVE-2020-35474) SECURITY: Use Html::element in
ChangeListSpecialPage for sanity.
* (T268917) Use Xml::element in SpecialUserrights for sanity.
* (T268938, CVE-2020-35478, CVE-2020-35479) SECURITY: Pass escaped html
to LogFormatter::makePageLink for sanity.
* (T268938) Fixed mixed escaping in Language::translateBlockExpiry.
* (T263911) UserOptionsManager: don't differentiate anons caches.
* (T261260) HeaderCallback: pre-cache request ID.
* Parsoid updated to v0.12.1.
* (T205908, CVE-2020-35477) SECURITY: Unable to change visibility of log
entries when MediaWiki:Mainpage uses Special:MyLanguage.
* (T120883, CVE-2020-35480) SECURITY: Divergent behavior for contributions
and user pages of hidden users and missing users.
* (T270145) Fix condition that can lead to using APCOND_BLOCKED in
$wgAutopromote to cause an OOM in PHP.
== MediaWiki 1.35.0 ==
=== Changes since MediaWiki 1.35.0-rc.3 ===
* (T261258) Remove checks for ancient ImageMagick versions in BitmapHandler.
* (T260232) Don't include null page ids in query list for category dumps.
* (T260009) Check existing watchitem when saving action=watch.
* (T259055) Correct success messages for action=watch.
* mediawiki.page.ready: Simpler tablesorter/makeCollapsible call.
* mediawiki.page.ready: Fix skin override config flags, wrong way round.
* (T262175, T248512) Remove requirement for ApiWatchlistTrait to be in ApiBase.
* (T259053, T260434) Watchlist: Fix updateWatchLink removing css class when
action=watch.
* (T261901, T261476) mediawiki.notification: Don't close notif when clicking
<select> element.
* (T251506) Sanitizer: Truncate IDs to a reasonable length.
* (T259452) Parsoid updated to v0.12.0.
* (T261970) watch.ajax: Add expiry support to watchpage.mw event.
* (T262900) Fix failure of rebuildLocalisationCache.php due to ResourceLoader
hook.
* (T263014) Hard deprecate File::userCan() with $user=null.
* (T262547) Use localized success message after watching via action=watch.
* (T201491) Fix typo 'Watchlst' in `apihelp-edit-param-watchlistexpiry`.
* (T261081) Installer: consistently reset Language objects.
* (T250449, T250450) Installer: consistently reset Language objects.
* Explicitly wrap some XML calls in libxml_disable_entity_loader().
* (T262934) Ensure dropdown label is always on its own line.
* (T246855) resourceloader: Use a local HookRunner.
* (T263604) Have findBadBlobs.php require Maintenance.php rather than
cleanupTable.inc.
* (T263606) Set fake time, to avoid flaky tests.
* (T261325) Add FindMissingActors script.
* (T262364) shell: Don't blacklist /run/firejail.
* (T263655) NewPagesPager: Ignore nonexistent namespaces.
* Update specialPageAliases and magicWords for Egyptian Arabic (arz).
* (T261347) ParserOutput: don't throw on bad editsection.
* (T232568, CVE-2020-25813) SpecialUserrights: If a viewer lacks `hideuser`,
ignore hidden users.
* (T255918, CVE-2020-25812) SECURITY: Unescaped message used in HTML on
Special:Contributions.
* (T256171, CVE-2020-25815) SECURITY: Unescaped message used in HTML within
LogEventsList.
* (T258763, CVE-2020-17367, CVE-2020-17368) SECURITY: Prevent invoking
firejail's --output functionality.
* (T86738, CVE-2020-25814) SECURITY: mediawiki.jqueryMsg: Sanitize URLs and
'style' attribute.
* (T115888, CVE-2020-25828) SECURITY: mediawiki.js: Escape HTML in
mw.message( ... ).parse().
* (T260485, CVE-2020-25869) SECURITY: ActorMigration: Load user from the correct
database.
* (T260485, CVE-2020-25869) SECURITY: ensure actor ID from correct wiki is used.
* Add Finnish special page aliases.
* Fix GuzzleHttpRequest request headers.
* Fix description for pruneFileCache.php.
* emptyUserGroup.php: handle more than 5000 users.
* Make ApiSandbox copyable URL absolute.
* (T261087) Add a link from a deleted page to that page's logs.
== MediaWiki 1.35.0-rc.3 ==
=== Changes since MediaWiki 1.35.0-rc.2 ===
* (T258662) mediawiki.visibleTimeout: Update the nextVisibleTimeoutId value.
* Ensure Parsoid doesn't throw when <ref> is used w/o Cite installed.
* Remove maintenance/createCommonPasswordCdb.php.
* (T260468) Increase "sites.site_global_key" to varbinary(64).
* (T183759) Fix shell edge-cases in Windows.
* (T257879) Drop PHP 7.2 support; require 7.3.19.
* (T251661, CVE-2020-25827) SECURITY: User::pingLimiter: add user-global
rate limit type.
* (T246991) User: enforce pingLimiter() expiry time.
* (T256831) Rest: Handle Uri constructor exception.
* (T259094) Fix RequestFromGlobalsTest failing in Travis CI.
* (T256831, T261344) Rest: Use try/catch to handle URIs with embedded colon.
== MediaWiki 1.35.0-rc.2 ==
=== Changes since MediaWiki 1.35.0-rc.1 ===
* (T259693) uuid: Fix filenames on Windows.
* Remove Gruntfile.js and package-lock.json from the tarball.
* firejail: Strengthen by copying from Wikimedia's profile.
* (T260059) ResourceLoaderOOUIImageModule: loadOOUIDefinition() may return
false.
* (T30162, T245387) The installer supports using a Postgres server running
on a custom port other than 5432.
* (T260201) Support private wikis in Parsoid zero configuration mode.
* Fix bad use of `|=` PHP bit operation where `= … ||` bool is intended.
* (T259212) SpecialBlock: Show error if a block could not be inserted or found.
* (T255842) UserOptionsManager: fix options reset.
* (T258649) WatchAction: avoid unnecessary UPDATEs when expiry is unchanged.
* (T250851) Allow skins to override mediawiki.page.ready initialisation.
* (T250851) mediawiki.page.ready: Allow skins to disable search lazy load.
* (T253135, T255632) Update language in watchlist expiry.
* Use IPset in MWRestrictions::checkIP.
* (T259564) Fix race condition on edit page.
* (T260759) Hide watchlist expiry label in edit form.
* mime: Fix docs of MIME_EXTENSIONS, they're arrays, not space-seperated.
* (T260031) Add application/font-sfnt to MimeMap for ttf files.
* (T259379) WatchedItemStore: Cache single WatchedItems with preexisting expiry.
* Add a maintenance script to create bot passwords.
* (T201269) Add Traditional Chinese zh-hant as fallback for Amis (ami).
* Improve wfParseUrl docs.
* (T251038) Add multi index fields in ImageListPager for unique paginate.
* (T259916) Guard against 'Widget not found' error.
== MediaWiki 1.35.0-rc.1 ==
=== Changes since MediaWiki 1.35.0-rc.0 ===
* (T252136) Fix RecentChanges watchlist filters when WatchlistExpiry is off.
* (T258662) Update time period for watchlist expiry pop-up.
* (T258443) Fix expiry dropdown not getting disabled on edit page.
* (T259398) Add license information for promise-polyfill.
* Remove executable bit from scripts without shebang.
* (T256526) Fix bold of watched items on Special:RecentChangesLinked.
* (T259060) Edit page expiry dropdown should keep state after
disabling/enabling.
* (T259009) Translate expiry period in pop-up message for watchlist expiry.
* (T258310) Add watchlist clock icon to RecentChanges.
* (T259362) Permit temporary table writes on replica DB connections.
* (T250214) Add UI support in Special:EditWatchlist for watchlist expiry.
* (T72470) Disable wgLegacyJavaScriptGlobals by default.
* (T130906) Add Edge to MediaWiki:Clearyourcache.
* (T257279) Add mediawiki.ui Less variable deprecation note.
* (T249521) Fixed reassignEdits.php to work with anonymous users.
* (T259448) Fix Circular dependency when creating service in
DBLoadBalancerFactory.
* (T257259) Default to using watchlist expiry of old page when moving pages.
== MediaWiki 1.35.0-rc.0 ==
== Upgrading notes for 1.35 ==
1.35 requires PHP 7.3.19 or above (up from 7.2.9). (T257879)
1.35 has several database changes since 1.34, and will not work without schema
updates. Note that due to changes to some very large tables like the revision
table, the schema update may take quite long (minutes on a medium sized site,
many hours on a large site).
Don't forget to always back up your database before upgrading!
MediaWiki 1.35 is the next LTS after 1.31, and will be supported for around 3
years.
MediaWiki has a lot of both soft and hard deprecations, and code removed. As
always, make sure your versions of extensions match the MediaWiki version,
and updates may be required to any custom extensions.
See the file UPGRADE for more detailed upgrade instructions, including
important information when upgrading from versions prior to 1.11.
Some specific notes for MediaWiki 1.35 upgrades are below:
* (T259685) When using SQLite as the database backend for MediaWiki,
Zeroconf (zero-configuration) VisualEditor/Parsoid only works with
MediaWiki 1.35.2 and above. It is still recommended to use
MySQL/MariaDB rather than SQLite when using VisualEditor.
For notes on 1.34.x and older releases, see HISTORY.
=== Configuration changes for system administrators in 1.35 ===
* (T72470) $wgLegacyJavaScriptGlobals is now false by default. This feature
will be completely removed in a later MediaWiki release.
==== New configuration ====
* $wgDiffEngine — This can be used to specify the difference engine to use,
rather than MediaWiki choosing the first of $wgExternalDiffEngine, wikidiff2,
or php that is usable.
* $wgSearchMatchRedirectPreference — This configuration setting controls whether
users can set a new preference, search-match-redirect, which decides if search
should redirect them to exact matches is available. By default, this is set to
false, which maintains the previous behaviour without preference bloat. Change
your site's default by setting $wgDefaultUserOptions['search-match-redirect'].
* $wgPoolCounterConf['SpecialContributions'] — Per-user concurrency in the use
of SpecialContributions can now be limited by setting this appropriately.
* $wgPasswordPolicy — PasswordCannotBeSubstringInUsername is a new password
policy check. Similar to the existing PasswordCannotMatchUsername check, this
check ensures that a user's (case-insensitive) password cannot be a part of
their username. e.g. password = MyPass, username = ThisUsersPasswordIsMyPass.
* $wgLogos — This new configuration setting combines the now-deprecated $wgLogo
and $wgLogoHD settings into a single, associative array. It provides support
for a new key, 'wordmark', for setting a horizontal wordmark to show next to
the graphical logo. To do this, set 'wordmark' to an array with 'src' set to
the path of the wordmark image, and 'width' and 'height' for its dimensions
in pixels. $wgLogos inherits the existing support provided by its predecessor
settings: '1x' mapping to the path of the logo as a 135x135px raster image
(equivalent to $wgLogo), and '1.5x', '2x', and 'svg' operating as before for
$wgLogoHD. If $wgLogos is unset, $wgLogo and $wgLogoHD values are read for
temporary backwards compatibility. (T232140)
* $wgWatchlistExpiry — (EXPERIMENTAL) This enables the new watchlist expiry
feature. The database table (watchlist_expiry) for this is created regardless
of this setting, but all other aspects of the expiry feature are controlled
by it. Enabling in production is discouraged for the time being. A future
MediaWiki 1.35 release will advertise this feature once it is stable.
* $wgWatchlistPurgeRate — This sets the chance of expired watchlist items being
purged on each page edit. Only has effect if $wgWatchlistExpiry is true.
* $wgWatchlistExpiryMaxDuration — This is the maximum definite relative duration
for watchlist expiries. Only has effect if $wgWatchlistExpiry is true.
* $wgImgAuthPath – This can be used to override the path prefix used when
handling img_auth.php requests. (T235357)
* $wgAllowedCorsHeaders — This is a list of headers which can be used in a
cross-site API request.
* $wgHTTPMaxTimeout and $wgHTTPMaxConnectTimeout — These allow site
administrators to limit the timeouts used by the HTTP client libraries.
This only affects callers using HttpRequestFactory and the deprecated
wrappers in the Http class.
* $wgCdnMaxageStale — This controls the Cache-Control s-maxage header for page
views when PoolCounter lock contention indicates that a stale cache entry
should be sent.
* $wgForceHTTPS — This makes the HTTP to HTTPS redirect be unconditional and
suppresses various hacks needed to support mixed HTTP/HTTPS wikis. We
recommend this be set to true on pure HTTPS wikis.
* $wgCookieSameSite — This setting allows login cookies to be sent with
SameSite=None. This is required for cross-site CentralAuth auto-login after
Chrome 84.
* $wgUseSameSiteLegacyCookies — This adds a compatibility hack to
SameSite=None cookies for browsers which implemented an incompatible draft
version of the specification.
==== Changed configuration ====
* $wgResourceLoaderMaxage (T235314) — This configuration array controls the
max-age for HTTP caching through the Cache-Control header. It has uses the
"versioned" key for urls that do have a version parameter, and the
"unversioned" key for urls without a version parameter. The sub keys for
"client" and "server" are no longer supported in MediaWiki 1.35.
* $wgEnableOpenSearchSuggest — This boolean variable is deprecated and no longer
used. The OpenSearch API is now always enabled.
* $wgAuthManagerConfig and $wgAuthManagerAutoConfig — These can now use the
'services' option in provider specifications.
* $wgVirtualRestConfig['modules']['parsoid'] —
- The defaults have been updated. If you were relying on the default values,
you may need to update your configuration.
- The 'URL' parameter, previously allowed for backwards-compatibility, has
been deprecated. Use 'url' instead.
* $wgXmlDumpSchemaVersion — Default is now set to XML_DUMP_SCHEMA_VERSION_11, so
dumps use the new dump format per default. Consumers of XML dumps should not
be affected if they ignore any unknown tags they encounter. Also, the format
is effectively unchanged for revisions that only contain the main slot. The
--schema-version option can be used with the dumpBackup.php script to set the
dump format. (T238921)
* $wgParserConf — This configuration is now deprecated. It has been
effectively constant since 2008, and is ignored by core code.
Configure the ParserFactory service in order to customize the Parser used.
* $wgAutoloadAttemptLowercase — This has been deprecated, and the default value
changed to false.
* $wgAllowImageMoving — This configuration setting is now deprecated. Instead,
use $wgGroupPermissions; e.g., to revoke sysops' ability to move images use
$wgGroupPermissions['sysop']['movefile'] = false.
* $wgAllowImageTag — This configuration is now deprecated; future parsers will
not support direct use of the HTML <img> tag in wikitext.
* $wgUseTwoButtonsSearchForm — This has been deprecated. If you maintain a skin
that relies on this and wishes to let system administrators change it, you
should convert it to a config variable specific to your skin. If you're using
it to configure your wiki, you should check individual skins to see whether
they have local skin config for the feature and use that.
* $wgPasswordPolicy — The deprecated policy 'PasswordCannotBePopular' has been
removed. Use PasswordNotInCommonList instead which covers many more passwords.
* Backwards compatibility for using an associative array
(e.g. [ '127.0.0.1' => 'bad-ip' ]) for $wgProxyList has been removed. This
was deprecated since 1.30. Please convert these arrays to indexed/sequential
ones (e.g. [ '127.0.0.1' ]).
* $wgShellRestrictionMethod — This now defaults to 'autodetect', which will
enable sandboxing for shell commands using firejail, if it's installed. To
disable restrictions, set it to false.
* $wgLegacyJavaScriptGlobals – This deprecated setting now default to false,
instead of true, ahead of its planned removal.
==== Removed configuration ====
* $wgSysopEmailBans — This setting, deprecated in 1.34, was removed. To let
sysops block email access, use $wgGroupPermissions['sysop']['blockemail'].
* $wgDBWindowsAuthentication — This setting had no effect anymore after support
for SQL Server was removed in 1.34. (T230418)
* $wgProfileOnly — This setting, deprecated in 1.23, was removed. The profiler
output should instead be configured via $wgProfiler['output'].
* $wgProfileLimit — This setting, deprecated in 1.25, was removed.
Set $wgProfiler['threshold'] instead.
* $wgDebugTimestamps — This setting was removed. It affected the text output
produced via $wgDebugComments, if enabled.
* $wgSkipSkin — This setting, deprecated in 1.23, was removed. To disable a
skin from being shown, use $wgSkipSkins.
* $wgUseSquid, $wgSquidServers, $wgSquidServersNoPurge, and $wgSquidMaxage —
These, deprecated in 1.34, have been removed. Use $wgUseCdn, $wgCdnServers,
$wgCdnServersNoPurge, or $wgCdnMaxAge instead.
* $wgDisableCounters — This, deprecated in 1.25, was removed. The feature that
it controlled was already removed in 1.26, but the variable remained existent
with a value of `false` for backward-compatibility.
* $wgMaxGeneratedPPNodeCount — This setting was removed. It only affected
Preprocessor_DOM, which was deprecated in 1.34 and removed in this release.
* $wgFixArabicUnicode and $wgFixMalayalamUnicode — These, deprecated in 1.33,
were removed. The fixes are now always enabled for their respective languages.
* $wgAllowTitlesInSVG — This, unused and deprecated since 1.34, was removed.
* $wgEnablePartialBlocks — This setting, deprecated when it was added in 1.33,
was removed. Partial blocks are now always enabled.
* $wgLocalInterwiki — This setting, deprecated in 1.23, has been removed.
* $wgContentHandlerUseDB — This setting, deprecated in 1.34, has been removed.
* $wgMultiContentRevisionSchemaMigrationStage — This setting must no longer
be set locally. If the migration stage was set to anything other than
SCHEMA_COMPAT_NEW locally, update.php must be run after removing the setting.
Usage of the setting in code is deprecated. The setting will be removed
completely in 1.36.
* $wgEnableRestAPI — This setting is no longer obeyed by MediaWiki core, and
should not be set set locally. Usage of the setting in code is deprecated; it
is now set true by default. The setting will be removed completely in 1.36.
* $wgObjectCaches — The 'slaveOnly' option for SqlBagOStuff, deprecated in 1.34,
was removed. Use 'replicaOnly' instead.
=== New user-facing features in 1.35 ===
* (T204618) Whitelisted the aria-hidden HTML attribute for all elements in
wikitext.
* (T13456) Special:EditPage, Special:PageHistory, Special:PageInfo, and
Special:Purge have been created as shortcuts for each action.
Special:EditPage/Foo redirects to title=foo&action=edit, with PageHistory,
PageInfo, and Purge corresponding to action= history, info, and purge
respectively. When linked to, its subpage is used as the target. Otherwise,
it displays a basic interface to allow the end user to specify the target
manually.
* (T139221) The generated table of contents is now a navigation landmark role
for assistive technologies.
* (T245931) interwiki map API doesn't report foreign language if
$wgInterwikiMagic=false
* The form at ?action=watch has a new dropdown list to support expiry dates for
watchlist items (if $wgWatchlistExpiry is true).
=== New developer features in 1.35 ===
* A Docker based local development develpoment environment configuration is
included (T238224) and DEVELOPERS.md has been added with usage documentation
and links to further help.
* If CSP is enabled, extensions can now add additional sources using the
ContentSecurityPolicy::addDefaultSource, ::addStyleSrc and ::addScriptSrc
methods (e.g. $context->getOutput()->getCSP()->addDefaultSrc( 'example.com' ))
* Extensions can now specify classes and namespaces to be autoloaded by the
test autoloader, by setting the "TestAutoloadNamespaces" and
"TestAutoloadClasses" properties in extension.json. (T196090)
* (T250977) extension.json now allows "SearchMappings" which maps the canonical
name of the search engine (used in wgSearchType and wgSearchTypeAlternatives)
to a specification using the ObjectFactory specification. This allows
extensions to register Search Engines using namespaced classes.
* Added getters for OutputPage's robot, index and follow policies;
getRobotPolicy() returns the entire policy as a string in the form
<index policy>,<follow policy> while getIndexPolicy() and getFollowPolicy()
return their respective policies as a string.
* The ResourceLoaderSiteModulePages and ResourceLoaderSiteStylesModulePages
hooks were added to allow changing which wiki pages these modules contain.
* The SkinFactory now allows skins to be specified as an ObjectFactory spec,
allowing the construction of skins with services injected.
* ContentHandlerFactory for most ContentHandler static methods. It has been
added to the constructors for many classes to improve SOLID / GRASP.
* FileDeleteForm's constructor now accepts a user as the second parameter.
Support for not passing a user has also been hard-deprecated and will be
removed in 1.36.
* The ParserPreSaveTransformComplete hook was added.
* The ParserBeforePreprocess hook was added.
* The ResourceLoaderSkinModule class now has a "legacy" feature that loads
the stylesheets previously part of the "mediawiki.legacy.shared" and
"mediawiki.legacy.commonPrint" module.
Those modules are now deprecated and no longer loaded by skins.
For skins needing to retain these styles, you will need to load these
styles via a module using the ResourceLoaderSkinModule class.
See Vector and Monobook for examples.
* ParserOutput now has methods addExtraCSPStyleSrc, addExtraCSPDefaultSrc
addExtraCSPScriptSrc for parser tags/functions to be able to add sources
to the Content Security Policy.
* The HtmlCacheUpdater service was added to unify the logic of purging CDN cache
and HTML file cache to simplify callers and make them more consistent.
* The MultiHttpClient code will fallover to non-curl if curl_multi* is blocked.
* Preferences which use HTMLTitlesMultiselectField can make use of
MultiTitleFilter class for saving title text to/from article IDs in user
preferences.
* OutputPage::addHtmlClasses() was added to allow injecting CSS classes on
to the <html> element on page load.
* The SkinAddFooterLinks hook is added to allow extensions to add items to skin
footers. Previously this had to be done via SkinTemplateOutputPageBeforeExec.
Doing so using that hook is now hard deprecated.
* A new BlockPermissionChecker service was introduced for checking
block-related permissions.
* The support of 'database' type of extensions has been added to allow 3d party
databases like Percona be used as storage. See T226857, T253248.
* Three new return parameters have been added to the
EditPageGetCheckboxesDefinition hook. Handlers of this hook are no longer
restricted to defining checkboxes. See the documentation of
EditPage::getCheckboxesDefinition() for more details.
* New flag File::RENDER_TMP was added in order to allow
File::generateAndSaveThumb and File::trasform to render a thumbnail without
saving it to the storage.
=== External library changes in 1.35 ===
==== New external libraries ====
* Added wikimedia/ip-utils 1.0.0.
* Added wikimedia/parsoid 0.12.3.
* Added wikimedia/services 2.0.1.
* Added taylorhakes/promise-polyfill v8.1.3.
* Added vuejs v2.6.11.
* Added vuex v3.1.3.
* Added symfony/symfony/polyfill-php80 1.25.0.
===== New development-only external libraries =====
* Added doctrine/dbal 3.1.5.
* Added doctrine/sql-formatter 1.1.0.
* Added pimple/pimple 3.3.1.
==== Changed external libraries ====
* pear/mail_mime was upgraded from 1.10.2 to 1.10.11.
* wikimedia/less.php was upgraded from 1.8.0 to 3.1.0.
* Updated oojs from 3.0.0 to 5.0.0.
* Updated OOUI from 0.35.1 to 0.39.3.
* zordius/lightncandy was upgraded from 0.23.0 to 1.2.5.
* Updated jQuery from v3.3.1 to v3.6.0.
* Updated jQuery Migrate from v3.0.1 to v3.3.2.
* Updated wikimedia/assert from 0.2.2 to 0.5.0.
* Updated pear/net_smtp from 1.8.1 from to 1.9.1.
* Updated psr/log from 1.0.2 to 1.1.3.
* Updated jquery.i18n from 1.0.5 to 1.0.7.
* Updated guzzlehttp/guzzle from 6.3.3 to 6.5.8.
* Updated wikimedia/xmp-reader from 0.6.3 to 0.8.5.
Fixes error log spam with too-large XMP data, and adds support for GPano tags.
* Updated wikimedia/base-convert from v2.0.0 to v2.0.1.
* Updated composer/semver from 1.5.0 to 1.7.2.
* Updated wikimedia/remex-html from 2.1.0 to 2.2.0.
* Replaced wikimedia/password-blacklist 0.1.4 with wikimedia/common-passwords
0.2.0.
* Updated wikimedia/composer-merge-plugin from 1.4.1 to 2.0.1.
* Updated wikimedia/html-formatter from 1.0.2 to 2.0.1.
* Updated wikimedia/object-factory from 2.1.0 to 2.2.0.
===== Changed development-only external libraries =====
* Updated symfony/yaml from 3.4.28 to 5.0.5.
* Updated nikic/php-parser from 3.1.5 to 4.4.0.
* Updated php-parallel-lint/php-console-highlighter from v0.3.2 to v0.5.
* Updated php-parallel-lint/php-parallel-lint from v0.9.2 to v1.2.0.
* Updated psy/psysh from 0.9.9 to 0.10.4.
* Updated monolog/monolog from 1.24.0 to 2.2.0.
* Upgrade mediawiki-codesniffer from 28.0.0 to 38.0.0.
* Updated composer/spdx-licenses from 1.5.1 to 1.5.3.
* Updated monolog/monolog from 1.25.2 to 1.25.3.
* Updated qunit from 2.9.1 to 2.10.0.
* Updating wikimedia/testing-access-wrapper from 1.0.0 to 2.0.0.
* Updated seld/jsonlint from 1.7.1 to 1.8.3.
==== Removed external libraries ====