309
Bearbeitungen
Änderungen
keine Bearbeitungszusammenfassung
== Update Long Term Support (LTS) Version ==
Bei der Wartung am 1922. Oktober 2016 2018 wurde das Wiki von LTS legacy auf die aktuelle LTS-Version aktualisiert. Diese Version wird bis 2019 Juni 2021 gepflegt. Ein paar kleine Probleme habe ich bereits entdeckt, aber wahrscheinlich wird sich für alles eine Lösung finden. Die wichtigsten Änderungen unten im Überblick. --[[Benutzer:UkAdmin mw|ukAdmin mw]] 20([[Benutzer Diskussion:Admin mw|Diskussion]]) 14:1725, 2622. Okt. 2016 2018 (CEST)
<pre>
== MediaWiki 1.2731.1 ==
== Security fixes =Changes since MediaWiki 1.31.0 ===* (T169545, CVE-2018-0503) SECURITY: $wgRateLimits entry for 'user' overrides 'newbie'.* (T194605, CVE-2018-0505) SECURITY: BotPasswords can bypass CentralAuth's account lock.* (T199029, CVE-2018-13258) SECURITY: Tarball was missing .htaccess files.* (T197229) Bundle Nuke extension, it was accidentally omitted.* (T193995) Fix undefined patchPath() method call in parser tests.* (T198687) Fix various selectFields methods to use the string 'NULL', not null.* Special:BotPasswords now requires reauthentication.* (T191608, T187638) Add 'logid' parameter to Special:Log.* (T193829) Indicate when a Bot Password needs reset.* (T198037) GitInfo: Don't try shelling out if it's disabled.* (T151415) Log email changes.* (T197206) Fix performance regression when multiple DB used without caching.* (T197030) PHPSessionHandler: Suppress headers warnings in initialize().* (T182377, T196793) Exif: Guard against uncountable tag values.* (T200861) Fix total breakage of SQLite web upgrade.* (T200864) Fix pingback over-reporting on non-MySQL databases* (T202550) Unbreak SpecialListusersHeaderForm and SpecialListusersHeader hooks.
=== Changes since MediaWiki 1.31.0-rc.2 ===* (T139565T195783) API: Generate head items in the context of the given title(CVE-2016Initialize PSR-6335)4 namespaces at same stage as normal autoloader.* (T137264T196092) XSS Hide MySQL binary/utf-8 charset option in unclosed internal links (CVE-2016-6334)the installer.* (T133147T196185) Escape '<' and ']]>Don' t allow setting $wgDBmysql5 in inline <style> blocks (CVE-2016-6333)the installer.* (T133147T196125) Require login to preview user CSS pages php-memcached 3.0 (CVE-2016-6333provided with PHP 7.0)is now supported.* (T132926T182366) Do not allow undeleting a revision deleted file if it is thetop file UploadBase::checkXMLEncodingMissmatch(CVE-2016-6336)now works on PHP 7.1+* (T129738T118683) Make Fix exception from &$wgBlockDisablesLogin also restrict logged user deref on HHVM in permissions(CVE-2016-6332)the TitleMoveComplete hook.* (T129738T196672) Make blocks log users out if $wgBlockDisablesLogin The mtime of extension.json files is true(CVE-2016-6332)now able to be zero* (T115333T180403) Check read permission when loading page content Validate $length in ApiParse(CVE-2016-6331)padleft/padright parser functions.* (T57548T143790) Remove support for Make $wgWellFormedXml = false, all output is nowwell formedwgEmailConfirmToEdit only affect edit actions.
=== PHP version requirement in Important pre-upgrade notes for 1.27 31 ===As of 1* If you're using MySQL, SQLite, or MSSQL, are not using update.27php to apply schema changes, MediaWiki now requires PHP 5.5and cannot have downtime to run migrateArchiveText.9 or higher (see Compatibilityphp andsection) apply patch-drop-ar_text. Additionallysql manually, you'll have to apply a default value to the ar_text and ar_flags columns of the following PHP extensions are required:archive table or make those* ctype columns nullable before upgrading to MediaWiki 1.31.* iconv maintenance/archives/patch-nullable-ar_text.sql shows how to do this for MySQL.* jsonThe CologneBlue and Modern skins are no longer bundled with the tarball. You* mbstring will need to remove the wfLoadSkin(new requirement in 1) calls from your LocalSettings.27)php or* xml download them separatelyThe following PHP extensions are strongly recommended (<https://www.mediawiki.org/wiki/Special:* opensslSkinDistributor>).
=== Configuration changes in 1.27 31 ===* $wgAllowMicrodataAttributes wgEnableAPI and $wgAllowRdfaAttributes were wgEnableWriteAPI are now deprecated and will be removed,in now always enableda future version. If you use RDFa on your wiki, you The API is now have considered to explicitlybe stable, secure and set $wgHtml5Version to 'HTML+RDFa 1.0' or 'XHTML+RDFa 1.0'essential.* $wgUseLinkNamespaceDBFields wgUsejQueryThree was removed, as it is now the default.* Deprecated $wgResourceLoaderMinifierStatementsOnOwnLine and $wgResourceLoaderMinifierMaxLineLength, because there This was little value indocumented making as a temporary variable during the behavior configurable. The default values (`false` for the formermigration period, 1000 for the latter) are now hard-coded.* $wgDebugDumpSqlLength was removed (deprecated in 1.24).* $wgDebugDBTransactions was removed (deprecated in since 1.20)29.* $wgUseXVO wgLogoHD has been removed, as it provides functionality only used by custom Wikimedia patches against Squid 2.x that probably noone updated to support svg images and uses in production anymore. There is now $wgUseKeyHeader that provides similarwgLogo where functionality but instead of the MediaWiki-specific X-Vary-Options header, uses the draft Key header standardpossible for fallback images such as png.* (T44246) $wgScriptExtension (and support for wgFilterLogTypes will no longer ignore '.php5patrol' entry points) was removed. See thewhen user does not deprecation notice in have the release notes for version 1right to mark things patrolled.25 for advice on how to* Wikis that contain imported revisions or CentralAuth global blocks should run preserve support for 'maintenance/cleanupUsersWithNoId.php5' entry points via URL rewritingphp.* Password handling via the User object has been deprecated The configuration settings $wgResourceLoaderMinifierStatementsOnOwnLine and partially removed$wgResourceLoaderMinifierMaxLineLength, pending the future introduction of AuthManagerdeprecated since 1. In particular:** expirePassword()27, getPasswordExpireDate(), resetPasswordExpiration(), and getPasswordExpired() have been removed. They were unused outside of core.** The mPassword, mNewpassword, mNewpassTime, and mPasswordExpires fields are now private and will be removed in the future.** The getPassword(T180921) and getTemporaryPassword() methods $wgReferrerPolicy now throwsupports having fallbacks for browsers that BadMethodCallException and will be removed in are not using the latest version of the futureReferrer Policy specification.** The ability $wgFragmentMode is now set to pass [ 'passwordlegacy' and , 'newpasswordhtml5' to createNew() has been] by default. This is a removed. The only users first step of it seem migration to have been using it to set invalidhuman-readable section IDs that will later result passwords, and so shouldn in 'html5't be greatly affected.** setPassword(), setInternalPassword(), and setNewpassword() have been deprecated, pending being the introduction of AuthManagerdefault mode.** User::randomPasswordCACHE_ACCEL now only supports APC(u) is deprecated in favor of a new method PasswordFactory::generateRandomPasswordString()** User::getPasswordFactory() is deprecated, callers should just create a PasswordFactory themselvesor WinCache.** A new constructor, User::newSystemUser(), has been added to simplify the creation of passwordless "system" users for logged actions.* $wgMaxSquidPurgeTitles XCache support was removed.* $wgAjaxWatch was removed. This as upstream is now enabled by default.* $wgUseInstantCommons now hotlinks Commons images by default instead of downloading originals inactive and thumbnailing them locally. This allows wikis has no plans to save on CPU and bandwidth while reducing time move to first byte for pages, even without a thumbnail handler. See $wgForeignFileRepos documentation for tweaksPHP 7.* (T27397) WebP is enabled by default as an uploadable filetype.* (T48998) $wgArticlePath must now be either a full urlThe old CategorizedRecentChanges feature, or start with a "/".including its related configuration* option $wgRateLimitLog was removed; use $wgDebugLogGroups['ratelimit'] instead.* Deprecated API formats dbgwgAllowCategorizedRecentChanges, txt, and yaml have has been removed.* CLDRPluralRule* classes have been replaced with wikimedia/cldr-plural-rule-parser.* Removed $wgProfilePerHost, $wgUDPProfilerHost, $wgUDPProfilerPort, $wgUDPProfilerFormatString, $wgStatsMethod, $wgAggregateStatsID, $wgStatsFormatString, and $wgProfileCallTree (deprecated since 1.20T188472).* For proper operation of LocalIdLookup with shared user tables, ensure that $wgSharedDB and The 'comma' value for $wgSharedTables are properly set even on the "central" wiki that all others are sharing from and that $wgLocalDatabases is set to the full list of sharing wikis on all those wikis.* Massive overhaul to session handling:** $wgSessionsInObjectCache wgArticleCountMethod is no longer supported and must be true, due to MediaWiki\Session\SessionManager. $wgSessionHandler is similarly no longer used.** ObjectCacheSessionHandler is removed for performance reasons, replaced and installations withthis setting will now work as MediaWiki\Session\PhpSessionHandler if it was configured with 'any'.** PHP session handling in general ($_SESSION, session_id(), and so onT185753) is deprecated. Use MediaWiki\Session\SessionManager instead. A new config variable, $wgPHPSessionHandling, is available now defaults to cause use of $_SESSION using RemexHtml to issue a deprecation warning or to cause most PHP session handling to throw exceptions.** Deprecated UserSetCookies hook. Session-handling extensions should generally be creating a custom subclass of CookieSessionProvider. Other extensions messing with cookies can no longer count on tidy up user data being saved in cookies versus other methods.** Deprecated UserLoadFromSession hookinput, extensions should create a MediaWiki\Session\SessionProvider rather than being off by default.** The User cannot be loaded from session until after Setup.php completes. Attempts If you wish to do so will be ignored and the User will remain unloaded.disable HTML tidying** CSRF tokens may be fetched from the MediaWiki\Session\Session entirely, which uses set $wgTidyConfig to null; if you wish to use the MediaWiki\Session\Token class.* MediaWiki will now auto-create users as necessaryold, removing the need fordeprecated extensions Tidy external binary, both set $wgTidyConfig to do so. An 'autocreateaccount' right is added null and $wgUseTidy to allow auto-creation when 'createaccount' is not granted to all userstrue.* Deprecated AuthPluginAutoCreate hook in favor $wgLogAutopatrol now defaults to false instead of LocalUserCreated.* Most cookie-handling methods in User are deprecatedtrue.* $wgAllowAsyncCopyUploads and $CopyUploadAsyncTimeout were wgValidateAllHtml was removed. This was an experimental feature that has never worked.* Login and createaccount tokens now vary by timestampwill be ignored.* LoginForm::getLoginToken() and LoginForm::getCreateaccountToken() return a MediaWiki\Session\Token$wgScriptExtension, deprecated and tokens must be checked using that class's methodsignored since 1.* $wgEnotifUseJobQ 25, was removed and the job queue is always used.* The functionality of See the ApiSandbox extension has been merged into core. The extension should no longer be used1.25 release notes for more information.* $wgPreloadJavaScriptMwUtil was removed (wgUseAjax is now marked as deprecated in 1.26). Extensions, skins, gadgets and scripts that use just like the mediawiki.util module must express a dependency on it.* $wgIncludeLegacyJavaScript, deprecated in MediaWiki 1.26, now defaults false.AJAX Extensions, skins, gadgets and scripts framework that need the mediawiki.legacy.wikibits module should express a dependency on itenables.* Removed configuration option $wgCopyrightIcon (deprecated since 1.18). Use $wgFooterIcons['copyright']['copyright'] instead.* If the openssl and mcrypt PHP Some extensions are both unavailable, secure session storage (mistakenly used for login) will raise an exception. This exception maythis to check whether any AJAX functionality at all should be bypassed by setting $wgSessionInsecureSecrets = true.enabled, further making this* Massive overhaul problematic to authentication:** AuthPlugin and AuthPluginUser are deprecatedretain.** LoginForm and associated templates are $wgDBmysql5 is now deprecated. Extensions which called static LoginForm methods should be converted into authentication providers.** The following hooks are deprecated:*** AbortAutoAccount (create a MediaWiki\Auth\PreAuthenticationProvider instead)*** AbortLogin (create a MediaWiki\Auth\PreAuthenticationProvider instead)*** AbortNewAccount (create a MediaWiki\Auth\PreAuthenticationProvider instead)*** AddNewAccount (use LocalUserCreated instead)*** AuthPluginSetup (create a MediaWiki\Auth\PrimaryAuthenticationProvider instead)*** ChangePasswordForm (use AuthChangeFormFields instead, or security levels)*** LoginUserMigrated (create a MediaWiki\Auth\PreAuthenticationProvider instead)*** UserCreateForm (create a MediaWiki\Auth\AuthenticationProvider of some type instead)*** UserLoginForm (create a MediaWiki\Auth\AuthenticationProvider of some type instead)** The following hooks are removed:*** AbortChangePassword*** LoginPasswordResetMessage*** PrefsPasswordAudit** The UserLoginComplete hook and will no longer be called for all logins, only for those via the web UIremoved in a future version. Use UserLoggedIn if you need to do something on allIt logins.** $wgRequirePasswordforEmailChange is removed has been marked as experimental ever since it was introduced.
=== New features in 1.27 31 ===* $wgDataCenterUpdateStickTTL was also added. This decides how long a user sticks to the primary DC (via cookiesT76554) after they make changes to the siteUser sub-pages named ….* Added a new hook, 'UserMailerTransformContent', to transform json are now protected in the contentssame way that of an email…. This is similar to the EmailUser hook but applies to all mail sent via UserMailerjs and ….* Added a new hook, 'UserMailerTransformMessage'css pages are, to transform the contents of an emai after MIME encoding.* Added a new hook, 'UserMailerSplitTo', to control which users have to be emailed separately (ie. there is a single address in the To: field) so user-specific changes to the email that configuration options can safely be applied safely.* $wgCdnMaxageLagged was added, which limits the CDN cache TTLplaced when any load balancer uses a DB that is lagged beyond the 'max lag' setting in the relevant section of $wgLBFactoryConfthere.* User::newSystemUserWikimedia\Rdbms\IDatabase->select() may be used to simplify the creation of passwordlessand similar methods now support joins "system" users with parentheses for logged actions from scripts and extensionsgrouping.* Extensions can now return detailed error information via As a first pass in standardizing dialog boxes across the API whenMediaWiki product, preventing user actions using 'getUserPermissionsErrors' and similar hooks by using ApiMessage instances instead of strings Html class now provides helper methods for the $result value.* $wgAPIMaxLagThreshold was added to limit bot changes when databases lagmessageBox, successBox, errorBox becomes too highand warningBox generation.* Skins and extensions can (T9240) Imports will now use FlexBox mixins record unknown (.flex-display(@display: flex) and .flex(@grow: 1, @shrink: 1, @width: autooptionally, @order: 1)known) usernames in Less to create cross-browser-compatible FlexBox rules. Users will still need to add fallback float rules or the a format like for compatibility with IE9- separately"iw>Example".* Added MWTimestamp::getTimezoneString(T20209) which returns the localized timezoneLinker (used on history pages, log pages, and so on) will display stringusernames formed like "iw>Example" as interwiki links, as if available. To localize this string, see the comments ofby wikitext like $wgLocaltimezone in includes/DefaultSettings.php[[iw:User:Example|iw>Example]].* Added CentralIdLookup, a service that (T111605) The 'ImportHandleUnknownUser' hook allows extensions needing a concept ofto auto-create "central" users to get that without having to know about specific central authentication extensionsduring an import.* $wgMaxUserDBWriteDuration added Added a hook, ParserOutputPostCacheTransform, to allow extensions to limit huge user-generated transactions.affect Regular web request transactions that takes longer than this are abortedthe ParserOutput::getText() post-cache transformations.* Added a new hook, 'TitleMoveCompleting'UploadForm:getInitialPageText, which runs before a page move is committed.* $wgCdnReboundPurgeDelay was added to provide secondary delayed purges of URLsallow extensions to alter the from CDN to mitigate DB replication lag and WAN cache purge laginitial page text for file uploads.* (T49162T181651) Installer will default to setting CACHE_ACCEL as The info page for File pages now displays the main cache typefile's base-16 SHA1 if it is availablehash value in the table of basic information.* It is now possible to patrol file uploads (both for new files and new versionsStyle tags with a 'data-mw-deduplicate' attribute will be deduplicated as a of existing filesParserOutput::getText()post-cache transformation. Special:NewFiles has gained an option to filter This may be disabled by patrol status. This functionality can be disabled using $wgUseFilePatrolpassing 'deduplicateStyles' => false to that method.* MediaWiki\Session infrastructure allows The identity of the logged-in or IP "actor" for easier use of session mechanismslogged actions is being moved other than into a new actor table, with the usual cookies.** SessionMetadata and SessionCheckInfo hooks allow for setting and checking custom session metadata.* Added MWGrants and associated configuration settings $wgGrantPermissions rows in tables such as revision andlogging $wgGrantPermissionGroups referring to hold configuration for authentication features such as OAuth that want to allow restricting the actor ID instead of storing the user rights a user may makeID and name/IP in use ofevery row. ** If you're already using the OAuth extension, these new variables areThis is currently gated by $wgActorTableSchemaMigrationStage. Most wikis identical can set this to (MIGRATION_NEW and will replace) $wgMWOAuthGrantPermissions and $wgMWOAuthGrantPermissionGroupsrun maintenance/migrateActors.php as* Added MWRestrictions soon as a class to check restrictions on a WebRequest, e.gany necessary extensions are updated. to assert that the request comes from a particular IP range.* Added bot passwords, a rights-restricted login mechanism Most code accessing rows for API-using bots.logged actions from the database should use* Whitelisted the following HTML attributes for all elements in wikitext: aria-describedby, aria-flowto, aria-label, aria-labelledby, aria-owns.* Removed "presentation" restriction on relevant getQueryInfo() methods to get the HTML role attribute in wikitext.information needed to build All values are now allowed for the role attributeSQL query.* $wgContentHandlers now The ActorMigration class may also supports callbacks be used to create an instance of theget feature appropriate ContentHandler subclass.* Added $wgAuthenticationTokenVersion, which if non -flagged information needed to access actor-null prevents related fields during the user_token database field from being exposed in cookies. Setting this would be a good idea, but will log out all current sessions migration period.* $wgEventRelayerConfig was added, for managing PubSub event relay configurationAdded Wikimedia\Rdbms\IDatabase::cancelAtomic(),to roll back an atomic specifically for reliable CDN url purgessection without having to roll back the whole transaction.* Requests have unique IDsWikimedia\Rdbms\IDatabase::doAtomicSection(), equal to the UNIQUE_ID environment variable non-native ::insertSelect(when MediaWiki is behind Apache+mod_unique_id or something similar) or a randomly- generated 24-character string. This request ID is used to annotate log records, and error messages. It is available clientnon-side via mw.config.getMySQL ::replace( 'wgRequestId' ). The request ID supplants exception IDs. Accordingly, MWExceptionHandlerand ::getLogIdupsert()no longer roll back the whole is deprecatedtransaction on failure.* (T33313T189785) Add Added a preference for watching uploads by default, also applies monthly heartbeat ping to API-based upload toolsthe pingback feature.* $wgJpegPixelFormat was added The CLI installer (maintenance/install.php) learned to override chroma subsampling for JPEG imagedetect and include thumbnails created via ImageMagickextensions. Defaults Pass --with-extensions to 'yuv420', providing bandwidth savings versus the previous behavior on many filesenable that feature.* MediaWiki\Auth infrastructure (called T184791) rc_patrolled now has three states: "AuthManager0") allows for more flexibleunpatrolled, configuration of multiple authentication pieces that was possible with"1" for manually patrolled and "2" for autopatrolled actions. AuthPlugin. For example, it's * Extensions can now easy set their type to plug in second-factor"editor" if they provide an editor or authentication, or add additional checks to enhance the login process, or to support multiple login methods at once, or to support non-password-based login methodsediting experience.** Providers are configured via the global Extensions can use a PSR-4 autoloader by setting $wgAuthManagerConfigan "AutoloadNamespaces" property in extension.** A global, $wgDisableAuthManager, is temporarily available to disable AuthManager until extensions are ready to support itjson.** New hook, AuthChangeFormFields, to adjust See the form fields ondocumentation at AuthManager-related special pages <https://mediawiki.** New hook, AuthManagerLoginAuthenticateAudit, for additional logging of AuthManager-related authentication requestsorg/wiki/Manual:Extension.json/Schema#AutoloadNamespaces>** New hook, ChangeAuthenticationDataAudit, for additional logging of AuthManager-related authentication data changesmore details and an example.** New hook, SecuritySensitiveOperationStatus, (T19099) Tabs which link to work with the new mechanism for requiring a recent login before taking security-sensitive operations pages that don't exist (like changing a password.** Two new globals, $wgChangeCredentialsBlacklist and $wgRemoveCredentialsBlacklist can be used those to prevent the web UI and the API changing certain authentication data.uncreated* The file upload dialog (available if you install WikiEditor or VisualEditor discussion pages) can now be configured using $wgUploadDialoghave a tooltip to indicate state, not just colour.
=== External library changes in 1.27 31 ===* pear/mail, pear/mail_mime and pear/mail_mime-decode have been moved from suggested to required. These packages now must be installed via composer and not via PEAR itself.
==== Upgraded external libraries ====
* Updated oojsjquery.chosen from v0.9.14 to v1.8.2.* Updated composer/spdx-licenses from 1.1.4 to 1.3.0 (development dependency).* Updated nikic/oojsphp-ui parser from v02.121.12 0 to v03.131.3(development dependency).* Updated composerwikimedia/ip-set from 1.1.0 to 1.2.0.* Updated wikimedia/semver relpath from v12.0.0 to v12.1.1.* Updated wikimedia/running-stat from 1.1.0 to 1.2.0.* Updated liuggiowikimedia/statsdwrappedstring from 2.2.0 to 2.3.0.* Updated mediawiki/at-ease from 1.1.0 to 1.2.0.* Updated wikimedia/php-client session-serializer from 1.0.4 to 1.0.186.* Updated QUnit wikimedia/remex-html from v11.0.2 to 1.0.3.18* Updated wikimedia/html-formatter from 1.0 .1 to v11.220.02.
==== New external libraries ====
* Added wikimedia/baseobject-convert v1.0.1.* Added wikimedia/cldr-plural-rule-parser v1.0.0.* Added wikimedia/relpath v1.0.3.* Added wikimedia/running-stat v1.factory 1.0.* Added wikimedia/php-session-serializer v1.0.3.
==== Removed and replaced external libraries ====
* (T17845) The deprecated 'jquery.badge' module was removed.
* The deprecated 'jquery.autoEllipsis' module was removed. Use the CSS
text-overflow property instead.
* The deprecated 'jquery.placeholder' module was removed.
* The deprecated 'jquery.appear' module was removed. Use the
'mediawiki.viewport' module instead.
* mediawiki/at-ease was replaced with wikimedia/at-ease.
=== Bug fixes in 1.27 31 ===* Special:Upload will (T90902) Non-breaking space in header ID breaks anchor.* (T189375) CSSMin now display correct maximum allowed file size when runningallows quoted urls in `url()` syntax to start with a under HHVM (T116347)space.* (T54077T2087, T10897, T87753, T174639) The APIEditBeforeSave hook will once again give only the content ofWhitespace created by category and language the section being edited, links is now stripped rather than the whole revisionleaving blank lines in odd places. This reverts the change made in MediaWiki * (T3780) Uploads with UTF-8 names now work on PHP7.1+ on Windows servers.22* (T182366) UploadBase::checkXMLEncodingMissmatch() now works on PHP 7.1+
=== Action API changes in 1.27 31 ===* Added list=allrevisions.* generator=recentchanges now has the option to generate revids.* ApiPageSet::setRedirectMergePolicy(T185058) was added. This allows generator modules The 'name' value to define how generator data tgprop for a redirect source gets merged into the redirect destination.* propaction=imageinfoquery&iiproplist=uploadwarning will no longer include the possibility oftags has been "was-deleted" warningremoved.* Added difftotextpst to query=revisions which preforms It has never made a pre-save transform on difference in the text before diffing it.* Deprecated formats dbgoutput, txt, and yaml have been removed.the name was always* (T47988) The protect log event details now use new-style formatting returned regardless.* The following response properties from 'watch' and 'unwatch' parameters for action=login are deprecated, and may be move have been removed in the future: lgtoken, cookieprefix, sessionid. Clients shouldThey handle cookies to properly manage session state.* action=login transparently allows login using bot passwords. Clients should merely need to change the username were deprecated and password used after setting up a bot passwordalso accidentally nonfunctional since 1.* action=upload no longer understands statuskey, asyncdownload or leavemessage.* Several changes when $wgDisableAuthManager is false:** action=login is deprecated for uses other than bot passwords.** list=users can now indicate if a missing username is creatable.** action=createaccount is changed 17 in a non-backwards-compatible manner2010.Use** Added action=query&meta=authmanagerinfo.** Added action=clientlogin to be used to log into the main account 'watchlist' instead of action=login.** Added action=linkaccount.** Added action=unlinkaccount.** Added action=changeauthenticationdata.** Added action=removeauthenticationdata.** Added action=resetpassword.
=== Action API internal changes in 1.27 31 ===* ApiQueryORM removed.* The following classes have been removed:** ApiFormatDbg** ApiFormatTxt** ApiFormatYaml* ApiBase::addTokenProperties() was removed (getProfileDBTime, deprecated since 1.24).* ApiBase::getFinalPossibleErrors() 25, was removed (deprecated since 1.24).* ApiBase::getFinalResultProperties() was removed (getModuleProfileName, deprecated since 1.24).* ApiBase::getRequireAtLeastOneParameterErrorMessages() 25, was removed (deprecated since 1.24).* ApiBase::getPossibleErrors() was removed (deprecated since 1.24).* ApiBase::getRequireMaxOneParameterErrorMessages() was removed (deprecated since 1.24).* ApiBase::getRequireOnlyOneParameterErrorMessages() was removed (deprecated since 1.24).* ApiBase::getResultProperties() was removed (deprecated since 1.24).* ApiBase::getTitleOrPageIdErrorMessage() was removed (deprecated since 1.24).* ApiBase::parseErrors() was removed (deprecated since 1.24).* ApiQueryBase::titleToKey()getProfileTime, ApiQueryBase::keyToTitle() and ApiQueryBase::keyPartToTitle() all removed (deprecated since 1.24).* ApiQueryBase::checkRowCount() was removed (deprecated since 1.24).* ApiQueryBase::getDirectionDescription() was removed (deprecated since 1.25).* ApiQuery::getGenerators() was removed (deprecated since 1.21).* ApiQuery::getModules() was removed (deprecated since 1.21).* ApiQuery::getModuleType() was removed (deprecated since 1.21).* ApiQuery::setGeneratorContinue() , was removed (deprecated since 1.24).* ApiMain::getModules() was removed (deprecated since 1.21).* ApiBase::getVersion() was removed (deprecated since 1.21).* ApiMain::getShowVersions() was removed (deprecated in 1.21).* ApiMain::addModule() was removed (deprecated in 1.21).* ApiMain::addFormat() was removed (deprecated in 1.21).* ApiMain::getFormats() was removed (deprecated in 1.21).* ApiPageSet::finishPageSetGeneration() was removed (deprecated in 1.21).* ApiCreateAccount is deprecated, and will be removed soon. === Languages updated in 1.27 ===
=== Languages updated in 1.31 ===
MediaWiki supports over 350 languages. Many localisations are updated
regularly. Below only new and removed languages are listed, as well as
changes to languages because of Phabricator reports.
* (T113688T180052) Change default numerals from Gurmukhi to Arabic for Punjabi locale.* Mirandese (T116020mwl) Aliases of magic words in MessagesXx.php are sorted by usage. === Other changes in 1.27 ===* Added dependency injection (DI) infrastructure, see docsnow supports gendered NS_USER/injection.txt for details. It is planned to incrementally move MediaWiki code towards using DI, using the service locator (SL) pattern as a stepping stone.* ProfilerOutputUdp was removed. Note that there is a ProfilerOutputStats classNS_USER_TALK.* WikiPage::doDeleteArticleReal(T182305) and WikiPageNew language support::doDeleteArticleNyungar (nys) now ignore the 2nd and 3rd arguments (formerly $id and $commit).* Removed "loaderScripts" option from ResourceLoaderFileModule class.* Removed ORM-like wrapper added in 1.20.* LinkCache::getGoodLinks and LinkCache::getBadLinks were removed (deprecated in 1.26T186359).* WikiPageNew language support::doQuickEditSiberian Tatar [cебертатар] () was removed (deprecated since 1.21sty).* Removed SiteObject and SiteArray classes (deprecated in 1.21T186635).* MessageBlobStoreNew language support::getInstanceGuianan Creole () was removed (deprecated since 1.25gcr).* (T84937T186647) Free external links ("autolinked" urls) will now be terminated by and HTML entity encodings of  , <, and >.* (T36948) The default file revert message's timestamp is now in $wgLocaltimezone, instead of UTC.* The default name of the 'suppress' group page has been changed from 'Project:Oversight' to 'Project:Suppress'.* DatabaseBase:New language support:resultObject() is now protected Kumyk [къумукъ] (use outside Database classes not necessary since 1.11kum).* Calling ResourceLoaderFileModule::readStyleFiles(T187750) without a ResourceLoaderContext instance is deprecated.* ResourceLoader:New language support:getLessCompilerSpanish formal address (es-formal) now takes an optional parameter of additional LESS variables to set for the compiler.* wfBaseConvert(T187824) marked as deprecated, use Wikimedia\base_convert() directly instead.* Obsolete maintenance scripts clearCacheStats.php and showCacheStats.php were removed. The underlying data is sent to StatsD (see $wgStatsdServer).* Removed msg_resource_links database table and associated code.* Removed msg_resource database table and associated code.* Skin::getNamespaceNotice() was removed.* wfIsConfiguredProxy() was removed (deprecated since 1.24).* wfDebugTimer() was removed (deprecated since 1.25).* wfIsTrustedProxy() was removed (deprecated since 1.24).* wfGetIP() was removed (deprecated since 1.19).* MWHookException was removed.* OutputPage::appendSubtitle() was removed (deprecated since 1.19).* OutputPage::loginToUse() was removed (deprecated since 1.19).* Article::loadContent() was removed (deprecated since 1.19).* UserNew language support::editTokenHungarian formal address () was removed (deprecated since 1.19).* Removed --forcehu-normal option of dumpBackup.php, as it no longer served any useful purpose since 1.22.* The functions processOption() and processArgs() on the BackupDumper and TextPassDumper classes have been removed.* The maintenance/backupTextPass.inc file was deleted. You should include maintenance/dumpTextPass.php instead.* WikiPage::getUsedTemplates() was removed (deprecated since 1.19).* wfEmptyMsg() was removed (deprecated since 1.18).* OutputPage::permissionRequired() was removed (deprecated since 1.18).* OutputPage::blockedPage() was removed (deprecated since 1.18).* User::getSkin() was removed (deprecated since 1.18).* OutputPage::includeJQuery() was removed (deprecated since 1.17).* WikiPage::updateRestrictions() was removed (deprecated since 1.19).* WikiPage::testPreSaveTransform() was removed (deprecated since 1.19).* LogPage::logName() was removed (deprecated since 1.19).* LogPage::logHeader() was removed (deprecated since 1.19).* wfCheckLimits() was removed (deprecated since 1.24).* Linker::makeKnownLinkObj() was removed (deprecated since 1.16).* Linker::makeLinkObj() was removed (deprecated since 1.16).* wfMsgForContentNoTrans() was removed (deprecated since 1.18).* ChangesList::usePatrol was removed (deprecated since 1.22).* wfMsgNoTrans() was removed (deprecated since 1.18).* Linker::makeImageLink2 was removed (deprecated since 1.20).* Title::userIsWatching() was removed (deprecated since 1.20).* Removed WaitForSlave maintenance script; use SELECT MASTER_POS_WAIT() database function directly instead.* wfMsg() was removed (deprecated since 1.18).* wfMsgForContent() was removed (deprecated since 1.18).* wfMsgReal() was removed (deprecated since 1.18).* wfMsgGetKey() was removed (deprecated since 1.18).* wfMsgHtml() was removed (deprecated since 1.18).* wfMsgWikiHtml() was removed (deprecated since 1.18).* wfMsgExt() was removed (deprecated since 1.18).* Language::armourMath() was removed (deprecated since 1.22).* LanguageConverter::armourMath() was removed (deprecated since 1.22).* FakeConverter::armourMath() was removed (deprecated since 1.22).* The unused jquery.validate ResourceLoader module was removed.* FileRepo::getRootUrl() was removed (deprecated since 1.20).* User::generateToken() was removed (deprecated since 1.20).* WikiPage::getRawText() was removed (deprecated since 1.21).* ParserOutput::hasCustomDataUpdates() was removed (deprecated since 1.25).* ParserOutput::addSecondaryDataUpdate() was removed (deprecated since 1.25).* ParserOutput::getSecondaryDataUpdates(formal) was removed (deprecated since 1.25).* Gallery images with multiple caption pipes no longer concatenate them all together but instead pick the final one, similar to image syntax.* XML-like parser tags (such as <gallery>T189127), when unclosed, will be left unparsed rather than consume everything until the end of the page.* New maintenance script resetUserEmail.php allows sysadmins to reset user emails in case a user forgot password/account was stolen.* wfCheckEntropy() was removed (deprecated in 1.27).* Browser support for Internet Explorer 8 lowered from Grade A to Grade C.* ContentHandler::supportsCategories method added. Default is true. CategoryMembershipChangeJob updates are skipped for content that does not language support categories.* wikidiff difference engine is no longer supported, anyone still using it are encouraged to upgrade to wikidiff2 which is actively maintained and has better package availability.* Database logic was removed from WatchedItem and a WatchedItemStore was created:** WatchedItem::IGNORE_USER_RIGHTS and WatchedItem::CHECK_USER_RIGHTS were deprecated. User::IGNORE_USER_RIGHTS and User::CHECK_USER_RIGHTS were introduced.** WatchedItem::fromUserTitle was deprecated in favour of the constructor.** WatchedItem::resetNotificationTimestamp was deprecated.** WatchedItem::batchAddWatch was deprecated.** WatchedItem::addWatch was deprecated.** WatchedItem::removeWatch was deprecated.** WatchedItem::isWatched was deprecated.** WatchedItem::duplicateEntries was deprecated.** EmailNotification::updateWatchlistTimestamp was deprecated.** User::getWatchedItem was removed.* Unit tests don't work with external PHPUnit anymore, Composer is now the only supported way. Run `composer install` to install it and other dev dependencies to run unit tests.* wl_id field added to the watchlist table.* Revision::getRawText() was removed (deprecated since 1.21).* WikiPage::replaceSection() was removed (deprecated since 1.21).* Article::replaceSection() was removed (deprecated since 1.21).* Language::getLangObj() was removed (deprecated since 1.24).* Language::getLanguageName() was removed (deprecated since 1.20).* Language::getLanguageNames() was removed (deprecated since 1.20).* Language::getTranslatedLanguageNames() was removed (deprecated since 1.20).* Language::specialPage() was removed (deprecated since 1.24).* MediaWikiTestCase::assertException() was removed (deprecated since 1.22).* OutputPage::getHeadItems() was removed (deprecated since 1.24).* OutputPage::getScript() was removed (deprecated since 1.24).* OutputPage::out() was removed (deprecated since 1.22).* OutputPage::setAllowedModules() was removed (deprecated since 1.24).* UserrightsPage::makeGroupNameListForLog() was removed (deprecated since 1.21).* MediaWikiSite::newFromGlobalId() was removed (deprecated since 1.21).* Title::newFromRedirect() was removed (deprecated since 1.21).* Skin::commonPrintStylesheet() was removed (deprecated since 1.22).* Skin::getCommonStylePath() was removed (deprecated since 1.24).* Skin::newFromKey() was removed (deprecated since 1.24).* Skin::getUsableSkins() was removed (deprecated since 1.23).* LoadBalancer::pickRandom() was removed (deprecated in 1.21).* Article::getUndoText() and WikiPage::getUndoText were removed (deprecated since 1.21).* DifferenceEngine::setText() was removed (deprecated in 1.21).* Title::newFromRedirectArray() was removed (deprecated in 1.21).* UserMailer::send() no longer accepts $replyto as the 5th argument and $contentType as the 6th. These must be passed in the options array now.* Title::newFromRedirectRecurse() was removed (deprecated in 1.21).* Skin::accesskey was removed (deprecated since 1.21).* Skin::blockLink was removed (deprecated since 1.21).* Skin::buildRollbackLink was removed (deprecated since 1.21).* Skin::emailLink was removed (deprecated since 1.21).* Skin::formatComment was removed (deprecated since 1.21).* Skin::formatHiddenCategories was removed (deprecated since 1.21).* Skin::formatLinksInComment was removed (deprecated since 1.21).* Skin::formatRevisionSize was removed (deprecated since 1.21).* Skin::formatSize was removed (deprecated since 1.21).* Skin::formatTemplates was removed (deprecated since 1.21).* Skin::generateTOC was removed (deprecated since 1.21).* Skin::getInternalLinkAttributes was removed (deprecated since 1.21).* Skin::getInternalLinkAttributesObj was removed (deprecated since 1.21).* Skin::getInterwikiLinkAttributes was removed (deprecated since 1.21).* Skin::getInvalidTitleDescription was removed (deprecated since 1.21).* Skin::getLinkColour was removed (deprecated since 1.21).* Skin::getRevDeleteLink was removed (deprecated since 1.21).* Skin::getRollbackEditCount was removed (deprecated since 1.21).* Skin::makeBrokenImageLinkObj was removed (deprecated since 1.21).* Skin::makeCommentLink was removed (deprecated since 1.21).* Skin::makeExternalImage was removed (deprecated since 1.21).* Skin::makeExternalLink was removed (deprecated since 1.21).* Skin::makeHeadline was removed (deprecated since 1.21).* Skin::makeImageLink was removed (deprecated since 1.21).* Skin::makeMediaLinkFile was removed (deprecated since 1.21).* Skin::makeMediaLinkObj was removed (deprecated since 1.21).* Skin::makeSelfLinkObj was removed (deprecated since 1.21).* Skin::makeThumbLink2 was removed (deprecated since 1.21).* Skin::makeThumbLinkObj was removed (deprecated since 1.21).* Skin::normaliseSpecialPage was removed (deprecated since 1.21).* Skin::normalizeSubpageLink was removed (deprecated since 1.21).* Skin::processResponsiveImages was removed (deprecated since 1.21).* Skin::revComment was removed (deprecated since 1.21).* Skin::revDeleteLink was removed (deprecated since 1.21).* Skin::revDeleteLinkDisabled was removed (deprecated since 1.21).* Skin::revUserLink was removed (deprecated since 1.21).* Skin::revUserTools was removed (deprecated since 1.21).* Skin::specialLink was removed (deprecated since 1.21).* Skin::splitTrail was removed (deprecated since 1.21).* Skin::titleAttrib was removed (deprecated since 1.21).* Skin::tocIndent was removed (deprecated since 1.21).* Skin::tocLine was removed (deprecated since 1.21).* Skin::tocLineEnd was removed (deprecated since 1.21).* Skin::tocList was removed (deprecated since 1.21).* Skin::tocUnindent was removed (deprecated since 1.21).* Skin::tooltip was removed (deprecated since 1.21).* Skin::tooltipAndAccesskeyAttribs was removed (deprecated since 1.21).* Skin::userTalkLink was removed (deprecated since 1.21).* Skin::userToolLinksRedContribs was removed (deprecated since 1.21).* wikidiff3 is now the default and only PHP diff engine. It provides improved diff performance on complex changes. $wgExternalDiffEngine = 'wikidiff3' therefore makes no difference now. Users are still recommended to use wikidiff2 if possible, though.* User::addNewUserLogEntryGorontalo (gor) was deprecated.* User::addNewUserLogEntryAutoCreate() was deprecated.* User::isPasswordReminderThrottled() was deprecated.* Bot-oriented parameters to Special:UserLogin (wpCookieCheck, wpSkipCookieCheck) were removed.* Installer can now be customized without patching MediaWiki code, see mw-config/overrides/README for details. === Compatibility === MediaWiki 1.27 requires PHP 5.5.9 or later. There is experimental support forHHVM 3.6.5 or later. MySQL is the recommended DBMS. PostgreSQL or SQLite can also be used, butsupport for them is somewhat less mature. There is experimental support forOracle and Microsoft SQL Server.
=== Breaking changes in 1.31 ===* MessageBlobStore::insertMessageBlob(), deprecated in 1.27, was removed.* The OutputPage class constructor now requires a context parameter. Instantiating without context was deprecated in 1.18.* The mw.page JavaScript singleton, deprecated in 1.30, was removed.* Article::getLastPurgeTimestamp(), WikiPage::getLastPurgeTimestamp(), and the related WikiPage::PURGE_* constants, deprecated in 1.29, were removed.* The Article::selectFields(), ::onArticleCreate(), ::onArticleDelete(), and ::onArticleEdit() methods, deprecated in 1.24, were removed.* Installer::locateExecutable() and ::locateExecutableInDefaultPaths() were removed. Use ExecutableFinder::findInDefaultPaths() instead.* The deprecated MW_DIFF_VERSION constant was removed. DifferenceEngine::MW_DIFF_VERSION should be used instead.* Due to significant refactoring, method ContribsPager::getUserCond() that had no access restriction has been removed.* The Block class will no longer accept usable-but-missing usernames for 'byText' or ->setBlocker(). Callers should either ensure the blocker exists locally or use a new interwiki-format username like "iw>Example".* The following methods and constants from the WatchedItem class, which were deprecated in 1.27, have been removed: * WatchedItem::getTitle() * WatchedItem::fromUserTitle() * WatchedItem::addWatch() * WatchedItem::removeWatch() * WatchedItem::isWatched() * WatchedItem::duplicateEntries() * WatchedItem::IGNORE_USER_RIGHTS * WatchedItem::CHECK_USER_RIGHTS * WatchedItem::DEPRECATED_USAGE_TIMESTAMP* The $statementsOnOwnLine parameter of JavaScriptMinifier::minify was removed. $wgResourceLoaderMinifierStatementsOnOwnLine, the corresponding configuration variable, has been deprecated since 1.27 and was removed as well.* The $maxLineLength parameter of JavaScriptMinifier::minify was removed. $wgResourceLoaderMinifierMaxLineLength, the corresponding configuration variable, has been deprecated since 1.27 and was removed as well.* The HtmlFormatter class, deprecated in 1.27, was removed. The namespaced HtmlFormatter\HtmlFormatter class should be used instead.* The driver 'mysql' for MySQL, deprecated in MediaWiki 1.30, has been removed. The driver has been deprecated since PHP 5.5 and was removed in PHP 7.0. The default driver for MySQL has been 'mysqli' since MediaWiki 1.22.* The following properties of PreparedEdit were deprecated in 1.21 and have been removed: * PreparedEdit->newText * PreparedEdit->oldText * PreparedEdit->pst* ParserOutput objects which are generated using a non-default value for ParserOptions::setWrapOutputClass() can no longer be added to the parser cache.* The following deprecated methods from the OutputPage class have been removed: * OutputPage::addExtensionStyle(); deprecated in 1.27 * OutputPage::getExtStyle(); deprecated in 1.27 * OutputPage::setETag(); deprecated in 1.28 (obsolete no-op) * OutputPage::setSquidMaxage(); deprecated in 1.27 * OutputPage::readOnlyPage(); deprecated in 1.25 * OutputPage::rateLimited(); deprecated in 1.25 * Additionally, the protected OutputPage::$mExtStyles array, only accessed through the above and with no known uses, was removed.* The no-op method Skin::showIPinHeader(), deprecated in 1.27, was removed.* The following variables and methods in EditPage, deprecated in MediaWiki 1.30, were removed: * $isCssJsSubpage — use ::isUserConfigPage() * $isCssSubpage — use ::isUserCssConfigPage() * $isJsSubpage — use ::isUserJsConfigPage() * $isWrongCaseCssJsPage – use ::isWrongCaseUserConfigPage() * ::getSummaryInput() – use ::getSummaryInputWidget() * ::getSummaryInputOOUI() – use ::getSummaryInputWidget() * ::getCheckboxes() – use ::getCheckboxesWidget() or ::getCheckboxesDefinition() * ::getCheckboxesOOUI() – use ::getCheckboxesWidget() or ::getCheckboxesDefinition()* ResourceLoaderModule::getPosition(), deprecated in 1.29, has been removed.* In User, the cookie-related methods which were wrappers for the functions on the response object, and were deprecated in 1.27, have been removed: * ::setCookie() * ::clearCookie() * ::setExtendedLoginCookie() Note that User::setCookies() remains, and is not deprecated.* Also in User, some auth-related methods which were deprecated in 1.27 have been removed: * ::getEditTokenTimestamp() – use MediaWiki\Session\Token::getTimestamp() * ::getPasswordFactory() – create a PasswordFactory directly * ::passwordChangeInputAttribs()* The global functions wfProfileIn and wfProfileOut, deprecated in 1.25, have been removed.* SpecialPageFactory::getList(), deprecated in 1.24, has been removed. You can use ::getNames() instead.* OpenSearch::getOpenSearchTemplate(), deprecated in 1.25, has been removed. You can use ApiOpenSearch::getOpenSearchTemplate() instead.* The global function wfBaseConvert, deprecated in 1.27, has been removed. Use Wikimedia\base_convert() directly.* Calling Database::begin() explicitly during an implicit transaction or when DBO_TRX is set results in an exception. Calling Database::commit() explicitly for an implicit transaction also results in an exception. Previously these were logged as errors. The startAtomic() and endAtomic() methods, or AtomicSectionUpdate should be used instead.* The global function wfOutputHandler() was removed, use the its replacement MediaWiki\OutputHandler::handle() instead. The supported versions global function was only sometimes defined. Its replacement is always available via the autoloader.* ChangeTags::listExtensionActivatedTags and ::listExtensionDefinedTags, deprecated in 1.28, have been removed. Use ::listSoftwareActivatedTags() and ::listSoftwareDefinedTags() instead.* Title::getTitleInvalidRegex(), deprecated in 1.25, has been removed. You can use MediaWikiTitleCodec::getTitleInvalidRegex() instead.* HTMLForm & VFormHTMLForm::isVForm(), deprecated in 1.25, have been removed.* The ProfileSection class, deprecated in 1.25 and unused, has been removed.* The ResourceLoaderGetLessVars hook, deprecated in 1.30, has been removed. Use ResourceLoaderModule::getLessVars() to expose local variables instead of global ones.* As part of work to modernise user-generated content clean-up, a config option and some methods related to HTML validity were removed without deprecation. The public methods MWTidy::checkErrors() and the path through which it was called, TidyDriverBase::validate(), areremoved, as are the testing methods MediaWikiTestCase::assertValidHtmlSnippet() and ::assertValidHtmlDocument(). The $wgValidateAllHtml configuration option is removed and will be ignored.* Execution of external programs using MediaWiki\Shell\Command now applies the RESTRICT_DEFAULT Firejail restriction by default.* The ResourceLoaderModule::getHashMtime() and ::getDefinitionMtime() methods, deprecated in 1.26, were removed.* The deprecated 'mediawiki.widgets.CategorySelector' module alias was removed. Use the 'mediawiki.widgets.CategoryMultiselectWidget' module directly.
=== Deprecations in 1.31 ===* The Revision class was deprecated in favor of RevisionStore, BlobStore, and RevisionRecord and its subclasses.* The global function wfBCP47 is deprecated in favour of LanguageCode::bcp47.* The global function wfCountDown is now deprecated in favor of Maintenance::countDown.* Several methods for returning lists of fields to select from the database have been deprecated in favor of similar methods that also return the tables to select from and the join conditions for those tables. * Block::selectFields() → Block::getQueryInfo() * RecentChange::selectFields() → RecentChange::getQueryInfo() * ArchivedFile::selectFields() → ArchivedFile::getQueryInfo() * LocalFile::selectFields() → LocalFile::getQueryInfo() * LocalFile::getCacheFields() with a prefix no longer works * LocalFile::getLazyCacheFields() with a prefix no longer works * OldLocalFile::selectFields() → OldLocalFile::getQueryInfo() * RecentChange::selectFields() → RecentChange::getQueryInfo() * Revision::userJoinCond() → Revision::getQueryInfo( [ 'user' ] ) * Revision::selectUserFields() → Revision::getQueryInfo( [ 'user' ] ) * Revision::pageJoinCond() → Revision::getQueryInfo( [ 'page' ] ) * Revision::selectPageFields() → Revision::getQueryInfo( [ 'page' ] ) * MySQL 5Revision::selectTextFields() → Revision::getQueryInfo( [ 'text' ] ) * Revision::selectFields() → Revision::getQueryInfo() * Revision::selectArchiveFields() → Revision::getArchiveQueryInfo() * User::selectFields() → User::getQueryInfo() * WikiPage::selectFields() → WikiPage::getQueryInfo()* Revision::setUserIdAndName() was deprecated.0* Access to TitleValue class properties was deprecated, the relevant getters should be used instead.3 or later* PostgreSQL 8DifferenceEngine::getDiffBodyCacheKey() is deprecated. Subclasses should override DifferenceEngine::getDiffBodyCacheKeyParams() instead.3 or later* SQLite 3Use of Maintenance::error( $err, $die ) to exit script was deprecated.3Use Maintenance::fatalError() instead.* Passing a ParserOptions object to OutputPage::parserOptions() is deprecated.7 or later* Oracle 9The RevisionInsertComplete hook is now deprecated; use instead the hook RevisionRecordInserted.0RevisionInsertComplete is still called, but the second and third parameter will always be null.Hard deprecation is scheduled for 1 .32.* The following methods that get and set ParserOutput state are deprecated. Callers should use the new stateless $options parameter to ParserOutput::getText() instead. * ParserOptions::getEditSection() * ParserOptions::setEditSection() * ParserOutput::getEditSectionTokens() * ParserOutput::setEditSectionTokens() * ParserOutput::getTOCEnabled() * ParserOutput::setTOCEnabled() * OutputPage::enableSectionEditLinks() * OutputPage::sectionEditLinksEnabled() * The public ParserOutput state fields $mTOCEnabled and $mEditSectionTokens are also deprecated.* License::getLicenses has been deprecated; use License::getLines instead.* QuickTemplate::setRef() was deprecated in favour of QuickTemplate::set(). Setting template variables by reference allowed violating the principle of data being immutable once added to the skin template. In practice, this method was not being used for that. Rather, setRef() existed as memory optimisation for PHP 4.* QuickTemplate::setTranslator() and MediaWikiI18N::set() were deprecated in favour of Skin::msg() parameters.* MediaWikiI18N::translate() was deprecated in favour of Skin::msg() or later wfMessage().* Microsoft SQL Server 2005 Passing false to ParserOptions::setWrapOutputClass(9) is deprecated.00Use the 'unwrap' transform to ParserOutput::getText() instead.1399* \ObjectFactory (no namespace)is deprecated, the namespaced class \Wikimedia\ObjectFactory from the wikimedia/object-factory library should be used instead.* CommentStore::newKey is deprecated. Instead, get an instance from MediaWikiServices.* The following CommentStore methods have had their signatures changed to introduce a $key parameter, usage of the methods on instances retrieved from CommentStore::newKey will remain unchanged but deprecated: * CommentStore::getFields * CommentStore::getJoin * CommentStore::getComment * CommentStore::getCommentLegacy * CommentStore::insert * CommentStore::insertWithTemplate* The following methods in Title have been renamed, and the old ones are deprecated: * Title::getSkinFromCssJsSubpage – use ::getSkinFromConfigSubpage * Title::isCssOrJsPage – use ::isSiteConfigPage * Title::isCssJsSubpage – use ::isUserConfigPage * Title::isCssSubpage – use ::isUserCssConfigPage * Title::isJsSubpage – use ::isUserJsConfigPage* The following methods related to caching of half-parsed HTML were deprecated: * Parser::serializeHalfParsedText() * Parser::unserializeHalfParsedText() * Parser::isValidHalfParsedText() * StripState::getSubState() * StripState::merge()* The DeferredStringifier class is deprecated, use Message::listParam() instead.* The type string for the parameter $lang of DateFormatter::getInstance is deprecated.* Wikimedia\Rdbms\SavepointPostgres is deprecated.* The DO_MAINTENANCE constant is deprecated. RUN_MAINTENANCE_IF_MAIN should be used instead.* The function wfShellWikiCmd() has been deprecated, use MediaWiki\Shell::makeScriptCommand().* In the future, the hooks 'PreferencesFormPreSave' and 'PreferencesGetLegend' will be allowed to provide any HTMLForm object rather than PreferencesForm.
=== Upgrading Other changes in 1.31 ===* Browser support for Internet Explorer 10 was lowered from Grade A to Grade C.* Browser support for Opera 12 and older was dropped entirely. Opera 15+ continues at Grade A.* Multi-content-revision capability was introduced into the storage layer. See <https://mediawiki.org/wiki/Requests_for_comment/Multi-Content_Revisions>.* The "free" CSS class is now only applied to unbracketed URLs in wikitext. Links written using square brackets will get the class "text" not "free".* RFC 157418: Whitespace is trimmed from wikitext headings, wikitext list items, wikitext table captions, wikitext table headings, wikitext table cells. HTML headings, HTML list items, HTML table captions, HTML table headings, HTML table cells will not have this trimming behavior.
== MediaWiki 1.27 has several database changes since 30.1.26, and will not work without schemaupdates. Note that due to changes to some very large tables like the revisiontable, the schema update may take quite long (minutes on a medium sized site,many hours on a large site).==
=== Configuration changes in 1.30 ===* The "C.UTF-8" locale should be used for $wgShellLocale, if available, to avoid unexpected behavior when code uses locale-sensitive string comparisons. For notes example, the Scribunto extension considers "bar" < "Foo" in most locales since it ignores case.* $wgShellLocale now affects LC_ALL rather than only LC_CTYPE. See documentation of $wgShellLocale for details.* $wgShellLocale is now applied for all requests. wfInitShellLocale() is deprecated and a no-op, as it is no longer needed.* $wgJobClasses may now specify callback functions as an alternative to plain class names. This is intended for extensions that want control over the instantiation of their jobs, to allow for proper dependency injection.* $wgResourceModules may now specify callback functions as an alternative to plain class names, using the 'factory' key in the module description array. This allows dependency injection to be used for ResourceLoader modules.* $wgExceptionHooks has been removed.* (T163562) $wgRangeContributionsCIDRLimit was introduced to control the size of IP ranges that can be queried at Special:Contributions.* (T45547) $wgUsePigLatinVariant added (off by default).* (T152540) MediaWiki now supports a section ID escaping style that allows to display non-Latin characters verbatim on many modern browsers. This is controlled by the new configuration setting, $wgFragmentMode.* $wgExperimentalHtmlIds is now deprecated and will be removed in a future version, use $wgFragmentMode to migrate off it to a modern alternative.* $wgExternalInterwikiFragmentMode was introduced to control how fragments in sinterwikis going outside of current wiki farm are encoded.* (T120333) Soft-deprecated the use of PHP extension 'mysql' in favor of 'mysqli'. This PHP extension was deprecated in PHP 5.5 and removed in PHP 7.0. MediaWiki auto-selects the 'mysqli' driver since MediaWiki 1.2622, except if explicitly requested through the configuration parameter $wgDBservers.x and older releases* $wgOOUIEditPage was removed, see HISTORYas it is now the default. This was documented as a temporary variable during the migration period.
=== New features in 1.30 ===
* (T37247) Output from Parser::parse() will now be wrapped in a div with
class="mw-parser-output" by default. This may be changed or disabled using
ParserOptions::setWrapOutputClass().
* (T163562) Added ability to search for contributions within an IP ranges
at Special:Contributions.
* Added 'ChangeTagsAllowedAdd' hook, enabling extensions to allow software-
specific tags to be added by users.
* Added a 'ParserOptionsRegister' hook to allow extensions to register
additional parser options.
* (T45547) Included Pig Latin, a language game in English, as a
LanguageConverter variant. This allows English-speaking developers
to develop and test LanguageConverter more easily. Pig Latin can be
enabled by setting $wgUsePigLatinVariant to true.
* Added RecentChangesPurgeRows hook to allow extensions to purge data that
depends on the recentchanges table.
* Added JS config values wgDiffOldId/wgDiffNewId to the output of diff pages.
* (T2424) Added direct unwatch links to entries in Special:Watchlist (if the
'watchlistunwatchlinks' preference option is enabled). With JavaScript
enabled, these links toggle so the user can also re-watch pages that have
just been unwatched.
* Added $wgParserTestMediaHandlers, where mock media handlers can be passed to
MediaHandlerFactory for parser tests.
* Edit summaries, block reasons, and other "comments" are now stored in a
separate database table. Use the CommentFormatter class to access them.
** This is currently gated by $wgCommentTableSchemaMigrationStage. Most wikis
can set this to MIGRATION_NEW and run maintenance/migrateComments.php as
soon as any necessary extensions are updated.
* (T138166) Added ability for users to prohibit other users from sending them
emails with Special:Emailuser. Can be enabled by setting
$wgEnableUserEmailBlacklist to true.
* (T67297) $wgBrowserBlacklist is deprecated, and changing it will have no effect.
Instead, users using browsers that do not support Unicode will be unable to edit
and should upgrade to a modern browser instead.
= MediaWiki == External library changes in 1.26 30 ===
==== Upgraded external libraries ====
* Updated es5justinrainbow/json-shim schema from v4.0v3.0 to v4v5.1.52.* Updated json2 from revision 2014-02mediawiki/mediawiki-04 to 2015-05-03.* Updated Sinon.JS codesniffer from 1v0.107.3 2 to 1v0.1512.40.* Updated jQuery Client wikimedia/composer-merge-plugin from v1.04.0 to v2v1.04.01.* Updated QUnit wikimedia/relpath from v1.170.1 3 to v1v2.180.0.* Updated liuggio/statsd-php-client OOjs from v1v2.0.12 0 to v1v2.1.0.16.* Updated oojs/oojs-ui OOUI from v0.1121.3 1 to v0.1223.120.* Updated wikimedia/cdb QUnit from v1.023.1 to v1v2.34.0.* Updated wikimediaphpunit/utfnormal phpunit from v1v4.08.2 35 to v1v4.08.336.* Updated wikimedia/composer-merge-plugin Upgraded Moment.js from v1v2.015.0 to v1v2.19.3.0.* Updated zordius/lightncandy from v0.18 to v0.21.
==== New external libraries ====
* Added composer/semver v1.0.0.The class \TestingAccessWrapper has been moved to the external library* Added mediawiki wikimedia/attesting-ease v1.1.0.* Added wikimedia/assert v0.2.2.* Added wikimedia/ipaccess-set v1.0.1wrapper and renamed \Wikimedia\TestingAccessWrapper.* Added wikimedia/wrappedstring v2.0.0Purtle, a fast, lightweight RDF generator.
==== Removed and replaced external libraries ====
* Replaced leafo/lessphp v0.5.0 with oyejorge/less.php v1.7.0.9.…
=== Bug fixes in 1.26 30 ===* (T53283T151633) load.php sometimes sends 304 response without full headers* (T65198) Talk page tabs Ordered list items use now have a "rel=discussion" attributeDevanagari digits in Nepalese* (T98841thanks to Sfic) {{msgnw:}} now preserves comments even when subst: is not used.* (T104142) $wgEmergencyContact and $wgPasswordSender now use their default value if set to an empty string.
=== Action API changes in 1.26 30 ===* New(T37247) action=parse output will be wrapped in a div with class="mw-parser-style continuation is now the output" by default for action=continue. Clients This maybe changed or disabled using use the new 'rawcontinuewrapoutputclass' parameter to receive raw query-continue data, but the. new style * When errorformat is encouraged as itnot 'bc's harder to implement incorrectly.* Deprecated API formats dump and wddx have been completely removed.* API , abort reasons from action=query&list=tags: The displayname can now login will be boolean false if the tag is meant to be hidden from user interfaces.* action=import no longer allows both formatted as specified by the namespace= and rootpage= error formatter parameters to be set. If they are both set, the value of rootpage= will be ignored.* propaction=revision output in enum mode is compare can now sorted by timestamp rather thanhandle arbitrary text, deleted revisions, and revision ID. This usually won't make any differencereturning users and edit comments.* (T102645T164106) Namespace list from meta=siteinfo&siprop=namespaces is now an arrayThe 'rvdifftotext', 'rvdifftotextpst', 'rvdiffto', with formatversion'rvexpandtemplates', 'rvgeneratexml', 'rvparse', and 'rvprop=2.* Various other output from meta=siteinfo will now always be arrays instead ofparsetree' sometimes being numerically-indexed objects with formatversionparameters to prop=2.* When errors about users being blocked revisions are returneddeprecated, they now includeas are the similarly named information about the relevant block.* (T99926) listparameters to prop=random has higher limitsdeletedrevisions, in line with other API modules.* list=random's rnredirect parameter is deprecated in favor of a new rnfilterredir parameter that also allows for listing both redirects allrevisions, and non-redirects.* list=random now supports continuationalldeletedrevisions.* API responses to GET requests may now include ETag and Last-Modified headersUse action=compare, action=parse,or and will honor corresponding If-None-Match and If-Modified-Since on such requestsaction=expandtemplates instead.
=== Action API internal changes in 1.26 30 ===* New metadata item ApiResultApiBase::META_KVP_MERGE to allow for merging getDescriptionMessage() and the KVP key into the value when the value is an assoc."apihelp-* API action modules may now provide values for the RFC 7232 ETag and-description" messages are Last-Modified headersdeprecated. The API will check these against Ifexisting message should be split between "apihelp-None*-Match andsummary" Ifand "apihelp-*-Modifiedextended-Since request headers on GET requests and avoid executing the module when appropriatedescription".* (T123931) Individual values of multi-valued parameters can now be marked as=== Languages updated in 1 deprecated.26 ===
=== Languages updated in 1.30 ===
MediaWiki supports over 350 languages. Many localisations are updated
regularly. Below only new and removed languages are listed, as well as
changes to languages because of Phabricator reports.
* Languages addedAdded:** ase kbp (American sign languageKabɩyɛ / Kabiyè), thanks to translator Icemandeaf** dty Added: skr (डोटेली/DoteliSaraiki, سرائیکی), thanks to translators जनक राज भट्ट, बिप्लब आनन्द, मेश सिंह बोहरा, and राम प्रसाद जोशी** luz Added: tay (لئری دوٙمینی Tayal / Southern LuriAtayal)** olo Removed: tokipona (Livvinкarjala / Livvi-KarelianToki Pona), thanks to translators Denö, Hiloin Natoi, Ilja.mos, and Mashoi7
=== Other changes in 1.26 = Pig Latin added ====* ChangeTags::tagDescription(T45547) will return false if the interface message for the tag is disabled.* Added PageHistoryPager::doBatchLookups hook.* Added $wikiId parameter to FormatAutocomments hook.* Added ParserCacheSaveComplete to ParserCache* supportsDirectEditing and supportsDirectApiEditing methods added to ContentHandlerPig Latin, to provide a way for ApiEditPage and EditPage to check if direct editing of content is allowed. These methods return false, by default for the ContentHandler base class and true for TextContentHandler and it's derivative classes (everything in core). For Content types that do not support direct editing, an alternative mechanism should be provided for editing, such as action overrides or specific api modules.* mediaWiki.confirmCloseWindow now returns an object of functions, instead of one function. The callback can't be called directly any more. The callback function is replaced with confirmCloseWindow.release().* BREAKING CHANGE: Added an optional ResouceLoaderContext parameter to ResourceLoaderModule::getDependencies(). Extension classes that override that method should be updated. If they aren't updated, PHP Strict standards warnings will appear when E_STRICT error reporting is enabled. Note: in the near future, this parameter will probably become nonmade-optional.* Removed maintenance script deleteImageMemcached.php.* MWFunction::newObjup English variant () was removed (deprecated in 1.25). ObjectFactory::getObjectFromSpec() should be used instead.* The parser will no longer randomize the string it uses to mark the place of items that were stripped during parsing. It will use a fixed string instead. This causes the parser to re-use the regular expressions it uses to search and replace markers rather than generate novel expressions on each parse. Reen-using regular expressions will improve performance on HHVM and the forthcoming PHP 7. The interfaces changes accompanying this change are: x- Parser::getRandomString(piglatin) and Parser::uniqPrefix() have been deprecated., - The $uniq_prefix argument for Parser::extractTagsAndParams() and the $prefix argument for StripState::_construct() are deprecated easier variant development and their value is ignoredtesting.* wfSuppressWarnings() and wfRestoreWarnings() were split into a separate library, mediawiki/at-ease, and are now deprecatedDisabled by default. Callers should use MediaWiki\suppressWarnings() and MediaWiki\restoreWarnings() directly.* The Block class constructor now takes an associative array of parameters instead of many optional positional arguments. Calling the constructor the old way will issue a deprecation warning.* The jquery.mwExtension module was deprecated.* $wgSpecialPageGroups was removed (deprecated in 1.21).* SpecialPageFactory::setGroup was removed (deprecated in 1.21).* SpecialPageFactory::getGroup was removed (deprecated in 1.21).* DatabaseBase::ignoreErrors() is now protected.* BREAKING CHANGE: mediawiki.legacy.ajax has been removed, following a lengthy deprecation period.* The ScopedPHPTimeout class was removed.* Removed maintenance script fixSlaveDesync.php.* Watchlist tokens, SpecialResetTokens, and User::getTokenFromOption() are deprecated. Applications using those It can work via the OAuthbe extension instead. New tokens types should not be added.* DatabaseBase::errorCount() was removed (unused).* enabled by setting $wgDeferredUpdateList was removed.* DeferredUpdates::addHTMLCacheUpdate() was removedwgUsePigLatinVariant to true.
= MediaWiki == Other changes in 1.30 ===* The use of an associative array for $wgProxyList, where the IP address is in the key instead of the value, is deprecated (e.g. [ '127.0.0.1' => 'value' ]). Please convert these arrays to indexed/sequential ones (e.g. [ '127.0.0.1' ]).* mw.user.bucket (deprecated in 1.23) was removed.* LoadBalancer::getServerInfo() and LoadBalancer::setServerInfo() are deprecated. There are no known callers.* File::getStreamHeaders() was deprecated.* MediaHandler::getStreamHeaders() was deprecated.* Title::canTalk() was deprecated. The new Title::canHaveTalkPage() should be used instead.* MWNamespace::canTalk() was deprecated. The new MWNamespace::hasTalkNamespace() should be used instead.* The ExtractThumbParameters hook (deprecated in 1.21) was removed.* The OutputPage::addParserOutputNoText and ::getHeadLinks methods (both deprecated in 1.24) were removed.* wfMemcKey() and wfGlobalCacheKey() were deprecated. BagOStuff::makeKey() and BagOStuff::makeGlobalKey() should be used instead.* (T146304) Preprocessor handling of LanguageConverter markup has been improved. As a result of the new uniform handling, '-{' may need to be escaped (for example, as '-<nowiki/>{') where it occurs inside template arguments or wikilinks.* (T163966) Page moves are now counted as edits for the purposes of autopromotion, i.e., they increment the user_editcount field in the database.* Two new hooks, LogEventsListLineEnding and NewPagesLineEnding, were added for manipulating Special:Log and Special:NewPages lines.* The OldChangesListRecentChangesLine, EnhancedChangesListModifyLineData, PageHistoryLineEnding, ContributionsLineEnding and DeletedContributionsLineEnding hooks have an additional parameter, for manipulating HTML data attributes of RC/history lines. EnhancedChangesListModifyBlockLineData can do that via the $data['attribs'] subarray.* (T130632) The OutputPage::enableTOC() method was removed.* WikiPage::getParserOutput() will now throw an exception if passed ParserOptions that would pollute the parser cache. Callers should use WikiPage::makeParserOptions() to create the ParserOptions object and only change options that affect the parser cache key.* Article::viewRedirect() is deprecated.* IP::isValidBlock() was deprecated. Use the equivalent IP::isValidRange().* DeprecatedGlobal no longer supports passing in a direct value, it requires a callable factory function or a class name.* The $parserMemc global, wfGetParserCacheStorage(), and ParserCache::singleton() are all deprecated. The main ParserCache instance should be obtained from MediaWikiServices instead. Access to the underlying BagOStuff is possible through the new ParserCache::getCacheStorage() method.* .mw-ui-constructive CSS class (deprecated in 1.27) was removed.* Sanitizer::escapeId() was deprecated, use escapeIdForAttribute(), escapeIdForLink() or escapeIdForExternalInterwiki() instead.* Title::escapeFragmentForURL() was deprecated, use one of the aforementioned Sanitizer functions or, if possible, Title::getFragmentForURL().* Second parameter to Sanitizer::escapeIdReferenceList() ($options) now does nothing and is deprecated.* mw.util.escapeId() was deprecated, use escapeIdForAttribute() or escapeIdForLink().* MagicWord::replaceMultiple() (deprecated in 1.25 ) was removed.* WikiImporter now requires the second parameter to be an instance of the Config, class. Prior to that, the Config parameter was optional (a behavior deprecated in 1.25).* Removed 'jquery.mwExtension' module. (deprecated since 1.26)* mediawiki.ui: Deprecate greys, which are not part of WikimediaUI color palette any more.* CdbReader, CdbWriter, CdbException classes (deprecated in 1.25) were removed. The namespaced classes in the Cdb namespace should be used instead.* IPSet class (deprecated in 1.26) was removed. The namespaced IPSet\IPSet should be used instead.* RunningStat class (deprecated in 1.27) was removed. The namespaced RunningStat\RunningStat should be used instead.* MWMemcached and MemCachedClientforWiki classes (deprecated in 1.27) were removed. The MemcachedClient class should be used instead.* EditPage underwent some refactoring and deprecations: * EditPage::isOouiEnabled() is deprecated and will always return true. * EditPage::getSummaryInput() and ::getSummaryInputOOUI() are deprecated. Please use ::getSummaryInputWidget() instead. * EditPage::getCheckboxes() and ::getCheckboxesOOUI() are deprecated. Please use ::getCheckboxesWidget() instead. * Creating an EditPage instance without calling EditPage::setContextTitle() should be avoided and will be deprecated in a future release. * EditPage::safeUnicodeInput() and ::safeUnicodeOutput() are deprecated and no-ops. * EditPage::$isCssJsSubpage, ::$isCssSubpage, and ::$isJsSubpage are deprecated. The corresponding methods from Title should be used instead. * EditPage::$isWrongCaseCssJsPage is deprecated. There is no replacement. * EditPage::$mArticle and ::$mTitle are deprecated for public usage. The getters ::getArticle() and ::getTitle() should be used instead. * Trying to control or fake EditPage context by overriding $wgUser, $wgRequest, $wgOut, and $wgLang is no longer supported and won't work. The IContextSource returned from EditPage::getContext() must be modified instead.* Parser::getRandomString() (deprecated in 1.26) was removed.* Parser::uniqPrefix() (deprecated in 1.26) was removed.* Parser::extractTagsAndParams() now only accepts three arguments. The fourth, $uniq_prefix was deprecated in 1.26 and has now been removed.* (T172514) The following tables have had their UNIQUE indexes turned into proper PRIMARY KEYs for increased maintainability: categorylinks, imagelinks, iwlinks, langlinks, log_search, module_deps, objectcache, pagelinks, query_cache, site_stats, templatelinks, text, transcache, user_former_groups, user_properties.* IDatabase::nextSequenceValue() is no longer needed by any database backends (formerly it was needed by PostgreSQL and Oracle), and is now deprecated.* (T146591) The lc_lang_key index on the l10n_cache table has been changed into a PRIMARY KEY.* (T157227) bot_password.bp_user, change_tag.ct_log_id, change_tag.ct_rev_id, page_restrictions.pr_user, tag_summary.ts_log_id, tag_summary.ts_rev_id and user_properties.up_user have all been made unsigned on MySQL.* DB_SLAVE is deprecated. DB_REPLICA should be used instead.* wfUsePHP() is deprecated.* wfFixSessionID() was removed.* wfShellExec() and related functions are deprecated, use Shell::command(). This also slightly changes the behavior of how execution time limits are calculated when only some of defaults are overridden per-call. When in doubt, always override both wall clock and CPU time.* (T138166) SpecialEmailUser::getTarget() now requires a second argument, the sending user object. Using the method without the second argument is deprecated.* (T67297) Browsers that don't support Unicode will have their edits rejected.* (T178450) The module 'jquery.badge' is deprecated and will be removed in a future release. For notifying the user of an event, the Notifications ("Echo") system should be used instead.* (T178451) SECURITY: Potential XSS when $wgShowExceptionDetails =false and browser sends non-standard url escaping.* (T165846) SECURITY: BotPassword login attempts weren't throttled.
== MediaWiki 1.2529.5 3 ==
This is a security and maintenance release of the MediaWiki 1.25 29 branch.
=== Changes since 1.2529.4 2 ===* (T121892T169545, CVE-2018-0503) SECURITY: $wgRateLimits entry for 'user' overrides 'newbie'.* (T194605, CVE-2018-0505) SECURITY: BotPasswords can bypass CentralAuth's account lock.* (T180551) Fix LanguageSrTest for language converter* (T180552) Fix fatal error langauge converter parser test with self-close tags* (T180537) Remove $wgAuth usage from wrapOldPasswords.php* (T180485) InputBox: Have inputbox langconvert certain attributes* (T161732, T181547) Upgraded Moment.js from v2.15.0 to v2.19.3.* (T172927) Drop vendor from MW release branch* (T87572) Make FormatMetadata::flattenArrayReal() work for an associative array* Updated composer/spdx-licenses from 1.1.4 to 1.3.0 (development dependency).* (T189567) the CLI installer (maintenance/install.php) learned to detect and include extensions. Pass --with-extensions to enable that feature.* (T182381) Mask deprecated call in WatchedItemUnitTest* (T190503) Let built-in web server (maintenance/dev) handle .php requests.* The karma qunit tests would fail on some configuration due to headers already sent. Check headers_sent() before sending cpPosTime headers* (T167507) selenium: Run Chrome headlessly.* selenium: Pass -no-sandbox to Chrome under Docker* (T191247) Use MediaWiki\SuppressWarnings around trigger_error('') instead @* (T75174, T161041) Unit test ChangesListSpecialPageTest::testFilterUserExpLevel fails under SQLite.* (T192584) Stop incorrectly passing USE INDEX to RecentChange::newFromConds().* (T179190) selenium: Move test running logic from package.json to selenium.sh.* (T117839, T193200) PDFHandler: Fix for pdfinfo changes in poppler-utils 0.48.* Add default edit rate limit of 90 edits/minute for all users.* (T196125) php-memcached 3.0 (provided with PHP 7.0) is now supported.* (T196672) The mtime of extension.json files is now able to be zero* (T180403) Validate $length in padleft/padright parser functions.* (T143790) Make $wgEmailConfirmToEdit only affect edit actions.* (T194237) Special pages:BotPasswords now requires reauthentication.* (T191608, introduced in 1T187638) Add 'logid' parameter to Special:Log.* (T176097) resourceloader: Disable a flaky MessageBlobStoreTest case* (T193829) Indicate when a Bot Password needs reset.25* (T151415) Log email changes.4* (T118420) Unbreak Oracle installer.
== MediaWiki 1.2529.4 2 ==
This is a security and maintenance release of the MediaWiki 1.25 29 branch.
=== Changes since 1.2529.3 1 ===* (T117899T166757) SECURITYAvoid scoped lock errors in Category:: $wgArticlePath can no longer be set refreshCounts() due to relative pathsnesting. that do not begin with * (T175439) Unbreak Postgres Updater when setting defaults for a slashcolumn.* (T160298) Remove use of implicitGroupBy() in ActiveUsersPager.* Fixed login button label to accept RawMessage.* Fixed case of SpecialRecentChanges class usage.* (T174255) Declare uploadCount property in importDump.php. This enabled trivial XSS attacks* (T163646) Pass a string not an int to mysql_real_escape_string(). Configuration values such as "http:* (T180143) Bump justinrainbow//myjson-schema development dependency to ~5.wiki2.com/wiki/$1" are fine, as are "* Updated dev dependancy phpunit/wiki/$1"phpunit from v4.8.35 to v4.8.36. A value such as "* (T178451) SECURITY: Potential XSS when $1" or "wiki/$1" is not wgShowExceptionDetails = false and will now throw anbrowser errorsends non-standard url escaping.* (T119309T165846) SECURITY: Use hash_compareBotPassword login attempts weren't throttled.* (T128209) for edit token comparisonSECURITY: Reflected File Download from api.php.* (T118032T134100) SECURITY: Don't allow cURL to interpret POST parameters starting with '@' as file uploadsDo not reveal if user exists during login failure.* (T115522T176247) SECURITY: Passwords generated by UserEnsure Message::randomPasswordrawParams can't lead to XSS.* (T125163) can no longer be shorter than $wgMinimalPasswordLengthSECURITY: Make anchor for headlines escape > and <.* (T97897T180237) SECURITY: Improve IP parsing and trimmingProtect vendor folder with .htaccess. Previous behavior could result * (T180231) SECURITY: Remove PHPUnit file with known RCE if exists in improper blocks being issuedupdate.php.* (T109724T124404) SECURITY: Special:MyPage, Special:MyTalk, Special:MyContributions and related pages no longer use HTTP redirects and are now redirected by MediaWikiXSS in langconverter when regex hits pcre.backtrack_limit.* (T103237T119158) $wgUseGzip had no effect when using file cacheSECURITY: Handle -{}- syntax in attributes safely.* (T114606T180488) (T125177) mw"api.notify was not log contains passwords in plaintext" wasn't correctly fixed to the page ifin all initialized while not at branches in the top of the pageprevious security release.* (T200861) Fix issue that breaks HHVM Repo Authorative modetotal breakage of SQLite web upgrade.
== MediaWiki 1.2529.3 1 ==
This is a security and maintenance release of the MediaWiki 1.25 29 branch.
== MediaWiki 1.25.2 29 ==
=== Configuration changes in 1.29 ===* Default cookie expiration time has been reduced to 30 days. Login cookie expiration time is kept at 180 days.* A new configuration variable has been added: $wgCookieSetOnAutoblock. This determines whether to set a cookie when a user is autoblocked. Doing so means that a blocked user, even after logging out and moving to a security new IP address, will still be blocked.* The resetpassword right and maintenance release of associated password reset capture feature has been removed.* The $error parameter to the EmailUser hook should be set to a Status object or boolean false. This should be compatible with at least MediaWiki 1.23 if not earlier. Returning a raw HTML string is now deprecated.* The $message parameter to the ApiCheckCanExecute hook should be set to an ApiMessage. This is compatible with MediaWiki 1.25 branch27 and later. Returning a code for ApiBase::parseMsg() will no longer work.* ApiBase::$messageMap is no longer public. Code attempting to access it will result in a PHP fatal error.* $wgUserEmailUseReplyTo is now true by default to work around restrictive DMARC policies.* Subpages are now enabled by default in the Template namespace. Set $wgNamespacesWithSubpages[NS_TEMPLATE] to false to keep the old behavior.* $wgRunJobsAsync is now false by default (T142751). This change only affects wikis with $wgJobRunRate > 0.* (T158474) "Unknown user" has been added to $wgReservedUsernames.* (T156983) $wgRateLimitsExcludedIPs now accepts CIDR ranges as well as single IPs.* $wgDummyLanguageCodes is deprecated. Additional language code mappings may be added to $wgExtraLanguageCodes instead.* (T161453) LocalisationCache will no longer use the temporary directory in it's fallback chain when trying to work out where to write the cache.* The user right 'editusercssjs' (deprecated in 1.16) was removed. Use 'editusercss' and 'edituserjs' in $wgGroupPermissions and elsewhere instead.
=== Changes since New features in 1.2529 ===* (T5233) A cookie can now be set when a user is autoblocked, to track that user if they move to a new IP address. This is disabled by default.* Added ILocalizedException interface to standardize the use of localized exceptions, largely so the API can handle them more sensibly.* Blocks created automatically by MediaWiki, such as for configured proxies or dnsbls, are now indicated as such and use a new i18n message when displayed.* Added new $wgHTTPImportTimeout setting. Sets timeout for downloading the XML dump during a transwiki import in seconds.* Parser limit report is now available in machine-readable format to JavaScript via mw.config.get('wgPageParseReport').* Added $wgSoftBlockRanges, to allow for automatically blocking anonymous edits from certain IP ranges (e.g. private IPs).* (T59603) Added new magic word {{PAGELANGUAGE}} which returns the language code of the page being parsed.* HTML5 form validation attributes will no longer be suppressed. Originally browsers had poor support for them, but modern browsers handle them fine. This might affect some forms that used them and only worked because the attributes were not actually being set.* Expiry times can now be specified when users are added to user groups.* Completely new user interface for the RecentChanges page, which structures filters into user-friendly groups. This has corresponding changes to how filters are registered by core and extensions.* The edit form now uses pretty OOjs UI buttons, checkboxes and summary input. Because this change can cause problems for extensions and on-wiki scripts depending on the exact HTML, the old version is still available and can be used by setting $wgOOUIEditPage = false; in LocalSettings.1 php. This will be removed later and OOjs UI will become the only option. To make testing easier, users can also force either mode by adding &ooui=true or &ooui=false to the action=edit URL.
== MediaWiki == Upgraded external libraries ====* Updated QUnit from v1.22.0 to v1.23.1.* Updated cssjanus from v1.1.2 to v1.2.0.* Updated psr/log from v1.0.0 to v1.0.2.* Update Moment.js from v2.8.4 to v2.15.0.* Updated oyejorge/less.php from v1.7.0.10 to v1.7.0.14.* Updated monolog from v1.18.2 to 1.2522.1 ==.* Updated wikimedia/composer-merge-plugin from v1.3.1 to v1.4.0.* Updated OOjs from v1.1.10 to v2.0.0.
=== Changes since 1.25 =Removed and replaced external libraries ==* (T100351) Fix syntax errors in extension.json of ConfirmEdit extension == MediaWiki 1.25.0 ==
=== Configuration changes Bug fixes in 1.25 29 ===* $wgPageShowWatchingUsers was removed.(T62604) Core parser functions returning a number now format the number according* $wgLocalVirtualHosts has been added to replace $wgConf->localVHoststhe page content language, not wiki content language.* $wgAntiLockFlags was removed.* $wgJavaScriptTestConfig was removed.* Edit tokens returned from User::getEditToken may change (T27187) Search suggestions based on every calljquery. Tokensuggestions will now correctly only validity must be checked by passing highlight prefix matches in the user-supplied token to User::matchEditToken rather than by testing for equality with a newly-generated tokenresults.* (T74951T157035) The UserGetLanguageObject hook may be passed any IContextSource for its $context parameter"new mw. Formerly it Uri()" was documented as receiving a RequestContext specificallyignoring options when using default URI.* Profiling was restructured and $wgProfiler now requires an 'output' parameter. See StartProfiler.sample for detailsSpecial:Allpages can no longer be filtered by redirect in miser mode.* $wgMangleFlashPolicy was added to make MediaWiki's mangling of anything that might (T160519) CACHE_ANYTHING will not be a flash policy directive configurableCACHE_ACCEL if no accelerator is installed.* ApiOpenSearch now supports XML output. The OpenSearchXml extension should no longer be used. If extracts and page images are desired, the TextExtracts (T109140) (T122209) SECURITY: Special:UserLogin andSpecial:Search allow redirect PageImages extensions are requiredto interwiki links.* $wgOpenSearchTemplate is deprecated (T144845) SECURITY: XSS in favor of $wgOpenSearchTemplates.* Edits are now prepared via AJAX as users type edit summaries. This behaviorSearchHighlighter::highlightText() when can be disabled via $wgAjaxEditStashwgAdvancedSearchHighlighting is true.* (T46740T125177) The temporary option $wgIncludejQueryMigrate was removed, along with the jQuery Migrate library, SECURITY: API parameters may now be marked as indicated when this option was provided in MediaWiki 1.24.* ProfilerStandard and ProfilerSimpleTrace were removed. Make sure that any StartProfiler.php config is updated "sensitive" to reflect this. Xhprof is availablekeep for zend/hhvm. Also, for hhvm, one can consider using its xenon profiler.* Default value their values out of $wgSVGConverters['rsvg'] now uses the 'rsvg-convert' binary rather than 'rsvg'logs.* Default value of $wgSVGConverters['ImageMagick'] (T150044) SECURITY: "Mark all pages visited" on the watchlist now uses transparentrequires a CSRF background with white fallback color, rather than just white backgroundtoken. * MediaWikiBagOStuff class removed, make sure any object cache config uses SqlBagOStuff instead(T156184) SECURITY: Escape content model/format url parameter in message.* The 'daemonized' flag must be set to true (T151735) SECURITY: SVG filter evasion using default attribute values in $wgJobTypeConf for any redisDTD job queuesdeclaration. This means that mediawiki/services/jobrunner service has to* (T161453) SECURITY: LocalisationCache will no longer use the temporary directory be installed and running for any such queues in it's fallback chain when trying to workout where to write the cache.* $wgAutopromoteOnce no longer supports the 'view' event. For keeping some(T48143) SECURITY: Spam blacklist ineffective on encoded URLs inside file inclusion compatibility, any 'view' event triggers will still trigger on 'editsyntax's link parameter.* $wgExtensionDirectory was added for when your extensions directory (T108138) SECURITY: Sysops can undelete pages, although the page is somewhereprotected against other than $IP/extensions (as $wgStyleDirectory does with the skins directory)it.
=== New features Action API changes in 1.25 29 ===* (T64861) Updated plural rules Submitting sensitive authentication request parameters to CLDR 26. Includes incompatible changesaction=login, for plural forms in Russianaction=clientlogin, Prussianaction=createaccount, Tagalogaction=linkaccount, Manx and several languages that fall back to Russianaction=changeauthenticationdata in the query string is now an error.* (T60139) ResourceLoaderFileModule now supports language fallbackThey for 'languageScripts'should be submitted in the POST body instead.* Added a new hook, "ContentAlterParserOutput", to allow extensions to modify the parser output The capture option for a content object before links update.action=resetpassword has been removed* (T37785) Enhanced recent changes and extended watchlist are action=clearhasmsg now default. Documentation: https://meta.wikimedia.org/wiki/Special:MyLanguage/Help:Enhanced_recent_changes and https://www.mediawiki.org/wiki/Special:MyLanguage/Manual:$wgDefaultUserOptionsrequires a POST.* (T69341T47843) SVG images will no longer API errors and warnings may be base64requested in non-encoded when being embeddedEnglish languages in CSS. This results in slight size increase before gzip compression (due to percent-encoding)using the new 'errorformat', 'errorlang', but up to 20% decrease after itand 'errorsuselocal' parameters.* Update jStorage to v0API error codes may have changed.4.12.* MediaWiki now natively supports page status indicators: icons (or short text snippets) usually displayed in the top-right corner of the page. They have been in use on Wikipedia for a long timeMost notably, implemented errors from modules using templates and CSS absolute positioningparameter prefixes (e. - Basic wikitext syntax: <indicator name="foo">[[File:Foog.svg|20px]]</indicator> - Usage instructions: https://www.mediawiki.org/wiki/Help:Page_status_indicators - Adjusting custom skins to support indicators: https://www.mediawikiall query submodules) will no longer be prefixed.org/wiki/Special:MyLanguage/Manual:Skinning#Page_status_indicators* Edit tokens may now be timeApiPageSet-limited: passing a maximum age to User::matchEditToken using modules will reject any older tokens.* The debug logging internals have been overhauled, and are now report the 'invalidreason' using thespecified PSR-3 interfaces'errorformat'.* Update CSSJanus to v1.1.1.* Update lessphp to v0.5.0.* Added action=emailuser may return a hook, "ApiOpenSearchSuggestWarnings"status, to allow extensions to provide extracts and images for ApiOpenSearch output. The semantics are identical to the "OpenSearchXml" hook provided by the OpenSearchXml extension.* PrefixSearchBackend hook now has an $offset parameter. Combined with $limit,returns 'warnings' and this allows for pagination 'errors' subelements (as applicable) instead of prefix results. Extensions using this hook should implement supporting behavior. Not doing so can result in undefined behavior from API clients trying to continue through prefix results'message'.* Update jQuery from v1.11.1 to v1.11.3action=imagerotate returns an 'errors' subelement rather than 'errormessage'.* External libraries installed via composer will now be displayed on Special:Version in their own section. Extensions or skins that are installed via composer will not be shown in this section as it is assumed they will add the proper credits to the skins or extensions section. They can also be accessed through the API via the new sipropaction=libraries to ApiQuerySiteInfo.* Update QUnit from v1.14.0 to v1.16.0.* Update Moment.js from v2.8.3 to v2.8.4.* Special:Tags move now allows for manipulating reports errors when moving the list of user-modifiable changetalk page as an array under tags.* Added key 'managetags' user right and 'ChangeTagCanCreatetalkmove-errors', rather than using 'ChangeTagCanDeletetalkmove-error-code',and and 'ChangeTagCanCreatetalkmove-error-info' hooks to allow . The format for managing user-modifiable change tagssubpage move errors has also changed.* Added 'ChangeTagsListActive' hook, to separate the concepts of action=revisiondelete no longer includes a "definedrendered" property on warnings anderrors for each item. Use errorformat=wikitext if you're wanting parsed "active" formerly conflated by the 'ListDefinedTags' hookoutput.* Added TemplateParser class that provides action=rollback no longer returns a server-side interface to cachable"messageHtml" property. Use dynamically-compiled Mustache templates (currently uses lightncandy library)errorformat=html if you're wanting HTML formatting of error messages.* Clickable anchors for each section heading in the content are action=upload now generatedreports optional stash failures as an array under key and appear in the gutter on hovering over the heading.* Added 'CategoryViewer::doCategoryQuerystasherrors' and rather than a 'CategoryViewer::generateLinkstashfailed' hooks to allow extensions to override how links to pages are rendered within NS_CATEGORY* (T19665) Special:WantedPages only lists page which having at least one red link pointing to ittext string.* New hooks action=watch reports 'ApiMain::moduleManagererrors' and 'ApiQuery::moduleManagerwarnings', can be used for conditional registration instead of API modules.* New hook a single 'EnhancedChangesList::getLogTexterror' to alter, remove or add to theand links of no longer returns a group of changes in EnhancedChangesList'message' on success.* A full interface Added action=validatepassword to validate passwords for StatsD metric reporting has been added to the contextaccount creation interface, reachable via IContextSource::getStats()and password change forms.* Move the jQuery Client library from being mastered in MediaWiki as v0.1.0 to action=purge now requires a proper, published library, which is now tagged as v1.0.0POST.* A There is a new message (defaulting to blank)`languagevariants` siprop for action=query&meta=siteinfo, 'editnotice-notext', can be shown to users when they are editing if no edit notices apply to the page being editedwhich returns a list of languages with active LanguageConverter instances.* (T94536) You can now make the sitenotice appear to logged-in users only by editing MediaWiki:Anonnotice and replacing its content with "". Setting it to "-" (default) action=query&query=allpages will continue disable it and fallback to MediaWiki:Sitenotice.* Modifying the tagging of no longer filter redirects using a revision or log entry is now available viadatabase Special:EditTags, generally accessed via the revision-deletion-like interface on history pages and Special:Log is likely to be more usefulquery in miser mode.* Added 'applychangetags' and 'changetags' user rights.* (T35235) LogFormatter subclasses are now responsible for formatting theThis may result in less results being returned than were parameters for API log event output. Extensions should implement the new getParametersForApi() method in their log formattersrequested.
==== External libraries =Action API internal changes in 1.29 ===* MediaWiki now requires certain external libraries New methods were added to be installed. In the past these were bundled inside the Git repository of MediaWiki core, but now they need ApiBase to be installed separately. For users handle errors and warnings using the tarball, this will be takeni18n care of and no action will be requiredkeys. Users Methods for using Git will either need to usehard-coded English messages were deprecated: composer to fetch dependencies or use the mediawiki/vendor repository which includes* ApiBase::dieUsage() was deprecated all dependencies for MediaWiki core and ones used in Wikimedia deployment. Detailed* ApiBase::dieUsageMsg() was deprecated instructions can be found at* ApiBase::dieUsageMsgOrDebug() was deprecated https* ApiBase:://www.mediawiki.org/wiki/Download_from_Git#Fetch_external_librariesgetErrorFromStatus() was deprecated * The following libraries are now requiredApiBase::parseMsg() was deprecated ** psr/log This library provides the interfaces set by the PSR-3 standard ApiBase::setWarning(http://www.php-fig.org/psr/psr-3/)was deprecated which are used by MediaWiki internally via the MediaWiki\Logger\LoggerFactory class. See the structured logging RfC (https* ApiBase:://www$messageMap is no longer public.mediawiki.org/wiki/Special:MyLanguage/Requests_for_comment/Structured_logging)Code attempting to access it will for more background information result in a PHP fatal error.** cssjanus/cssjanusThe $message parameter to the ApiCheckCanExecute hook should be set to an ApiMessage. This library was formerly bundled is compatible with MediaWiki core 1.27 and has been removedlater.Returning a It automatically flips CSS code for RTL supportApiBase::parseMsg() will no longer work.** leafo/lessphpUsageException is deprecated in favor of ApiUsageException. For the time This library was formerly bundled with MediaWiki core and has been removed. being ApiUsageException is a subclass of UsageException to allow things that It compiles LESS files into CSS catch only UsageException to still function properly.** wikimedia/cdb This library If, for some strange reason, code was formerly a part using an ApiErrorFormatter instead of MediaWiki core ApiErrorFormatter_BackCompat, note that the result format has changed and has been moved into various methods now take a module path rather than a separate librarymodule name. It provides CDB functions which are used in the Interwiki * ApiMessageTrait::getApiCode() now strips 'apierror-' and Localization caches.'apiwarn-' prefixes More information about from the library can be found at https://www.mediawiki.org/wiki/Special:MyLanguage/CDBmessage key, and maps some message keys for backwards compatibility.** liuggio/statsd-php-client This library provides a StatsD client API for logging application metrics parameters may now be marked as "sensitive" to a remote serverkeep their values out of the logs.
=== Bug fixes extension.json changes in 1.25 29 ===* (T73003) No additional code will be generated to try to load CSS-embedded SVG images Extensions must set a value for "manifest_version" in Internet Explorer 6 and 7, as they don't support them anywaytheir extension.* (T69021) On Special:BookSources, corrected validation of ISBNs (bothjson 10- and 13-digit forms) containing "X"or skin.* Page moving was refactored into a MovePage classjson files. As part of that:See** The AbortMove hook was removed.** MovePageIsValidMove is for extensions to specify whether a page cannot be moved for technical reasons, and should not be overridden.** MovePageCheckPermissions is for checking whether the given user is allowed to make the move.** Title <https::moveNoAuth() was deprecated//www. Use the MovePage class insteadmediawiki.** Title:org/wiki/Manual:moveTo() was deprecated. Use the MovePage class insteadExtension.json/Schema#manifest_version>** Title::isValidMoveOperation() broken down into MovePage::isValidMove() and MovePage::checkPermissions() for details.* (T18530) Multiple autocomments are Extensions can now formatted in an edit summary.specify dependencies upon other extensions by using the* (T70361) Autocomments containing "/*requires" are parsed correctlykey.See* The Special <https:WhatLinksHere page linked from 'Number of redirects to this page' on action=info about a file page does not list file links anymore//www.* (T78637) Search bar is not autofocused unless it is empty so that proper scrolling using arrow keys is possiblemediawiki.* (T50853) Databaseorg/wiki/Manual::makeList() modified to handle 'NULL' separately when building IN clause* (T85192) Captcha position modified in Usercreate templateExtension. As a result:json/Schema#requires> for** extrafields parameter added to Usercreate more details.php to insert additional data** 'extend' method added to QuickTemplate to append additional values to any field of data array* (T86974T151136) Several Title methods Functions set as the "callback" now load from the database when necessaryrecieve that extension's credits (instead of returning incorrect results) even when information as the page ID is knownfirst argument.* (T74070T149597) Duplicate search for archived files on file upload now omits the extension. This requires the fa_sha1 field being populated.* Removed rel="archivesPasswordPolicy" from the "View history" link, as it did not pass HTML validation.* $wgUseTidy is now can be set when parserTests are run with the tidy option to match output on wiki.* (T37472) updatein extension.php will purge ResourceLoader cache unless --nopurge is passed to it.* (T72109) mediawiki.language should respect $wgTranslateNumerals in convertNumber()json.
MediaWiki supports over 350 languages. Many localisations are updated
regularly. Below only new and removed languages are listed, as well as
changes to languages because of Bugzilla Phabricator reports.
* Languages added:Based as always on linguistic studies on intelligibility and language knowledge by geography, language fallbacks have been expanded. When a translation is missing in the user's preferred interface language, the corresponding translation for the fallback language will be used instead. English will only be used as last resort when there are no translations.** awa Some configurations (अवधी / Awadhisuch as date formats and gender namespaces), thanks to translator 1AnuraagPandey;have also been updated when using the fallback language's configuration was inadequate.** bgn The new or reinstated language fallbacks are (بلوچی رخشانی / Western Balochiafter cs ↔ sk in 1.28): ca ↔ oc; hsb ↔ dsb; io → eo; mdf → ru; pnt → el; roa-tara → it; rup → ro; sh → bs, thanks to translators Baloch Afghanistansr-el, Ibrahim khashrowdi and Rachitrali;hr.** ses (Koyraboro SenniT137376) New language support: Atikamekw (atj), thanks to translator Songhay.* (T66440T163600) Kazakh New language support: Dinka (kkdin) wikis should no longer forcefully reset the user's interface language to kk where unexpected.* The Chinese conversion table was substantially (T155957) Talk Namespaces for Javanese language (jv) have been updated to fix a lot of bugs and ensure better reading experience for different variants.
=== Other changes in 1.25 = No fallback for Ukrainian ====* (T45591T39314) Links The fallback from Ukrainian to MediaWikiRussian was removed. The Ukrainian language will now use the default fallback language: English.org translatable help were added When a translation to indicatorsUkrainian is not available,an English string will be shown. mostly === Other changes in special pages1. Local custom target titles can be placed in the29 === relevant '* Database::getSearchEngine() (namespace-X|action name|special page namedeprecated in 1.28)-helppage' systemwas removed. Use message. Extensions can use the addHelpLinkSearchEngineFactory::getSearchEngineClass() function to do the sameinstead.* The skin autodiscovery mechanism, $wgSessionsInMemcached (deprecated in MediaWiki 1.23, has been 20) was removed. See https://www.mediawiki.org/wiki/Manual:Skin_autodiscovery forNo replacement is migration guide for creators and users of custom skins that relied on itrequired as all sessions are stored in Object Cache now.* Javascript variables 'wgFileCanRotate' and 'wgFileExtensions' now only available on SpecialMWHttpRequest::Upload.* execute(T58257) Set site logo from mediawiki.skinning.interface module instead ofshould be considered to return a StatusValue; the inline styles in the HTMLStatus return type is deprecated.* Removed ApiQueryUsersUser::getAutoGroupsedits(). (deprecated since in 1.2021)was removed.* Removed XmlDumpWriterXml::schemaVersionescapeJsString(). (deprecated since in 1.2021)was removed.* Removed LogEventsListArticle::getDisplayTitlegetText(). (deprecated since 1.20)* Removed Preferencesand Article::trySetUserEmailprepareTextForEdit(). (deprecated since in 1.2021) were removed.* Removed mw.user.nameArticle::getAutosummary() and mw.user.anonymousWikiPage::getAutosummary() methods. (deprecated since in 1.2021) were removed.* Removed 'ok' and 'err' parameters Hook ArticleViewCustom (deprecated in the mediawiki1.api modules21) was removed. (deprecatedUse ArticleContentViewCustom since 1instead.20)* Removed 'async' parameter from the mwHooks EditPageGetDiffText and ShowRawCssJs (deprecated in 1.Api#getCategories(21) methodwere removed. * Class RevisiondeleteAction (deprecated since in 1.2025)was removed.* Removed 'jquery.json' module. WikiPage::prepareTextForEdit() (deprecated since in 1.2421) Use the 'json' module and global JSON object insteadwas removed.* Deprecated OutputPageWikiPage::readOnlyPagegetText() and OutputPage::rateLimited(deprecated in 1.21). Also, the former will now throw an MWException if called with one or more argumentswas removed.* Removed hitcounters and associated code.* The "temp" zone of the upload respository is now considered private. If it already exists Article::fetchContent(such as under the images/ directory), please make sure that the directory is not web readable (edeprecated in 1.g. via a .htaccess file21)was removed.* BREAKING CHANGEUser: In the XML dump format used by Special:Export and dumpBackupgetPassword() (deprecated in 1.php, the <model> and <format> tags now apprear before the <text> tag, instead of after the <text> and <sha1> tags27) was removed. The new schema version is 0.10, the new schema URI is* User: https://wwwgetTemporaryPassword() (deprecated in 1.mediawiki27) was removed.org/xml/export-0.10.xsd* MWFunctionUser::callisPasswordReminderThrottled() and MWFunction::callArray() were removed, having being deprecated in 1.2227) was removed.* Deprecated the getInternalLinkAttributes, getInternalLinkAttributesObj, and getInternalLinkAttributes methods in Linker, and removed getExternalLinkAttributes method, which was Class FSRepo (deprecated in MediaWiki 1.1819) was removed.* Removed Sites class, which was WebRequest::checkSessionCookie() (deprecated in 1.21 and replaced by SiteSQLStore27) was removed.Use* Added wgRelevantArticleId to the client \MediaWiki\Session\SessionManager::singleton()-side config, for use on special pages>getPersistedSessionId() instead.* Deprecated the TitleIsCssOrJsPage hook. Superseded by the ContentHandlerDefaultModelFor hook since MediaWiki Class ImageGallery (deprecated in 1.2122) was removed.* Deprecated the TitleIsWikitextPage hook. Superseded by the ContentHandlerDefaultModelFor hook since MediaWiki 1.21Use ImageGalleryBase::factory instead.* Changed parsing of variables in schema Title::moveNoAuth(.sql) files:** The substituted values are no longer parsed. (Formerly, several passes were made for each variable, so depending on the order deprecated in which variables were defined, variables might have been found inside encoded values. This is no longer the case1.25)** Variables are no longer string encoded when the /*$var*/ syntax is usedwas removed. If string encoding is necessary, use the '{$var}' syntax Use MovePage class instead.** Variable names must only consist of one or more of the characters "A-Za-z0-9_".** In source text of the form '{$A}'{$B}' or `{$A}`{$B}`, where variable A does not exist yet variable B does, the latter may not be replaced. However, this difference is unlikely to arise Hook UnknownAction (deprecated in practice1.* 19) was actually deprecated (T67278) RFC, PMID, and ISBN "magic links" must be surrounded by non-word characters on both sides.* The FormatAutocomments hook it will now receive $pre and $post as booleans, rather than as strings that must be prepended or appended to $comment.* (T30950, T31025emit warnings) RFC, PMID, and ISBN "magic links" can no longer contain newlines; but they can contain and other non-newline whitespace.* The 'mediawiki.action.edit' ResourceLoader module no longer generates the edit toolbar, which has been moved to Create a separate 'mediawiki.toolbar' module. If you relied on this behavior, update your scripts' dependencies.* HTMLForm's 'vform' display style has been separated subclass of Action and add it to a subclass$wgActions instead. Therefore: * HTMLFormWikiRevision::isVFormgetText() (deprecated since 1.21) is now no longer marked deprecated. * You can no longer do thisLinker:: $form = new HTMLFormgetInterwikiLinkAttributes( … ); $form->setDisplayFormat( 'vform' deprecated since 1.25); // throws exceptionwas removed. Instead, do this* Linker: $form = HTMLForm::factory( 'vform', … );* Deprecated Revision methods getRawUsergetInternalLinkAttributes(), getRawUserText() and getRawComment(deprecated since 1.25)was removed.* BREAKING CHANGELinker: mediawiki.user.generateRandomSessionId: The alphabet of the prior string returned was A-Za-z0-9 and now it is 0-9A-F* getInternalLinkAttributesObj(T87504) Avoid serving SVG background-images in CSS for Opera 12, which renders them incorrectly when combined with border-radius or background-size(deprecated since 1.* Removed maintenance script dumpSisterSites.php.* DatabaseBase class constructors must be called using the array argument style. Ideally, DatabaseBase:factory(25) should be used instead in most cases.* Deprecated ParserOutput::addSecondaryDataUpdate and ParserOutput::getSecondaryDataUpdates. This is a hard deprecation, with getSecondaryDataUpdates returning an empty array and addSecondaryDataUpdate throwing an exception. These functions will be was removed in 1.26, since they interfere with caching of ParserOutput objects.* Introduced new hook 'SecondaryDataUpdates' that allows extensions to inject custom updates.* Introduced new hook 'OpportunisticLinksUpdate' that allows extensions to perform updates when a page is re-rendered.* EditPageLinker::attemptSave has been modified not to call handleStatus itself and instead just returns the Status object. Extension calling it should be aware of this.* Removed class DBObject. getLinkAttributesInternal(unused since 1.10)* wfDiff() is deprecatedsince 1.* The -m (maximum replication lag25) option of refreshLinks.php was removed. It had no effect * RedisConnectionPool::handleException (deprecated since MediaWiki 1.18 and should be 23) was removed from any cron jobs or similar scripts you may have set up.* (T85864) The following messages no longer support raw html: redirectto, thisisdeleted, viewdeleted, editlink, retrievedfrom, version-poweredby-others, retrievedfrom, thisisdeleted, viewsourcelink, lastmodifiedat, laggedslavemode, protect-summary-cascade* All BloomCache related code has been removedstatic properties mw.Api. This was largely experimentalerrors and mw.* $wgResourceModuleSkinStyles no longer supports per-module local or remote pathsApi. Theywarnings, containing incomplete can only be set for and outdated lists of errors/warnings returned by the entire skin.* Removed global function swap(). (API, are now deprecated since 1.24)* Deprecated the "wiki.php5" file extension phtml entry points and the $wgScriptExtension configuration variablepoint was removed. Refer to the "index.php" files instead. If you want "wiki.php5phtml" URLs to continue to work, set up redirects. In Apache, this can be done by enabling mod_rewrite and adding the following rules to your configuration:
RewriteEngine On
RewriteBase /
RewriteRule ^(.*)/w/wiki\.php5 phtml$1/w/index.php [R=301,L]* Hook ArticleAfterFetchContent (deprecated in 1.21) was removed. Use ArticleAfterFetchContentObject instead.* Hook ArticleInsertComplete (deprecated in 1.21) was removed. Use PageContentInsertComplete instead.* Hook ArticleSave (deprecated in 1.21) was removed. Use PageContentSave instead.* Hook ArticleSaveComplete (deprecated in 1.21) was removed. Use PageContentSaveComplete instead.* Hook EditFilterMerged (deprecated in 1.21) was removed. Use EditFilterMergedContent instead.* Hook EditPageGetPreviewText (deprecated in 1.21) was removed. Use EditPageGetPreviewContent instead.* Hook TitleIsCssOrJsPage (deprecated in 1.21) was removed. Use ContentHandlerDefaultModelFor instead.* Hook TitleIsWikitextPage (deprecated in 1.21) was removed. Use ContentHandlerDefaultModelFor instead.* Article::getContent() (deprecated in 1.21) was removed.* Revision::getText() (deprecated in 1.21) was removed.* Article::doEdit() and WikiPage::doEdit() (deprecated in 1.21) were removed.* Parser::replaceUnusualEscapes() (deprecated in 1.24) was removed.* Article::doEditContent() was marked as deprecated, to be removed in 1.30 or later.* ContentHandler::runLegacyHooks() was removed.* refreshLinks.php now can be limited to a particular category with --category=... or a tracking category with --tracking-category=...* User-like objects that are passed to SpecialUserRights and its subclasses are now required to have a getGroupMemberships() method. See UserRightsProxy for an example.* User::$mGroups (instance variable) was marked private. Use User::getGroups() instead.* User::getGroupName(), User::getGroupMember(), User:getGroupPage(), User::makeGroupLinkHTML(), and User::makeGroupLinkWiki() were deprecated. Use equivalent methods on the UserGroupMembership class.* Maintenance scripts and tests that call User::addGroup() must now ensure that User objects have been added to the database prior to calling addGroup().* Protected function UsersPager::getGroups() was removed, and protected function UsersPager::buildGroupLink() was changed from a static to an instance method.* The third parameter ($cache) to the UsersPagerDoBatchLookups hook was changed; see docs/hooks.txt.* User::crypt() (deprecated in 1.24) was removed.* User::comparePasswords() (deprecated in 1.24) was removed.* ArchivedFile::getUserText() (deprecated in 1.23) was removed.* HTMLFileCache::newFromTitle() (deprecated in 1.24) was removed.* BREAKING CHANGE: Internal signature changes to ChangesListSpecialPage and subclasses. It should only break if you call buildMainQueryConds (changed to buildQuery with new signature) or doMainQuery (new signature). Subclasses are likely to call at least doMainQuery (possibly both), but other classes might too, because they were public. Also, some related hooks were deprecated, but this is not yet a breaking change.* Removed 'jquery.arrowSteps' module. (deprecated since 1.28)* The 'jquery.autoEllipsis' ResourceLoader module is now deprecated.* WikiRevision::$fileIsTemp was deprecated.* WikiRevision::$importer was deprecated.* WikiRevision::$user was deprecated.* Article::getLastPurgeTimestamp(), WikiPage::getLastPurgeTimestamp(), and the WikiPage::PURGE_* constants are deprecated, and the functions will always return false. They were a hack for an issue that has since been fixed.* Hook 'EditPageBeforeEditChecks' is now deprecated. Instead use the new hook 'EditPageGetCheckboxesDefinition', or 'EditPage::showStandardInputs:options' if you don't actually care about checkboxes and just want to add some HTML to the page.* Selflinks are now rendered as href-less <a> tags with the class mw-selflink rather than <strong> tags. The old class name, "selflink", was deprecated and will be removed in a future release. (T160480)* (T156184) $wgRawHtml will no longer apply to internationalization messages.* Browser support for non-ES5 JavaScript browsers, including Android 2, Opera <12.10, and Internet Explorer 9, was lowered from Grade A to Grade C.* Removed wikibits global methods deprecated since MediaWiki 1.17 (T122755): is_gecko, is_chrome_mac, is_chrome, webkit_version, is_safari_win, is_safari, webkit_match, is_ff2, ff2_bugs, is_ff2_win, is_ff2_x11, opera95_bugs, opera7_bugs, opera6_bugs, is_opera_95, is_opera_preseven, is_opera, ie6_bugs, clientPC, changeText, killEvt, addHandler, hookEvent, addClickHandler, removeHandler, getElementsByClassName, getInnerText, setupCheckboxShiftClick, addCheckboxClickHandlers, mwEditButtons, mwCustomEditButtons, injectSpinner, removeSpinner, escapeQuotes, escapeQuotesHTML, jsMsg, addPortletLink, appendCSS, tooltipAccessKeyPrefix, tooltipAccessKeyRegexp, updateTooltipAccessKeys.* The ID of the <li> element containing the login link has changed from 'pt-login' to 'pt-login-private' in private wikis.* The old, neglected "bulletin board style toolbar" in the edit form is now deprecated (T30856). This old code dates from 2006, and was replaced in the MediaWiki release tarball and in Wikimedia production by the WikiEditor extension in 2010. It is only shown to users if no other editor was installed, and leads to confusion.* (T92459) Loading ResourceLoader modules containing JavaScript through addModuleStyles() is deprecated and will log a warning server-side.
== MediaWiki = Changes since 1.28.2 ==* (T168856) Allow SVGs created by Dia to be uploaded.* (T157545) Add missing doUpdates() call to refreshLinks.php.* (T165714) (T100085) Better handling of jobs execution in post-connection shutdown.* (T154425) (T154438) (T157679) Use AutoCommitUpdate instead of Database->onTransactionIdle.* (T154425) Make DeferredUpdates detect LBFactory transaction rounds.* (T149454) Restore erroneously removed realTableName call from DatabasePostgres.* (T167798) Fix phrase search and highlighting for phrase queries.* (T151136) Provide credits information to callbacks in extension registration.* (T160462) Allow namespaces defined in extension.json to be overwritten locally.* (T168337) Fix ErrorPageError to work from non-UI contexts.* (T143788) Backports for PHP 7.0 and 7.1support.* (T175439) Unbreak Postgres Updater when setting defaults for a column.* (T160298) Remove use of implicitGroupBy() in ActiveUsersPager.* (T174255) Declare uploadCount property in importDump.php.* (T180231) SECURITY: Updated dev dependancy phpunit/phpunit from v4.8.24to v4.6 =8.36.* (T178451) SECURITY: Potential XSS when $wgShowExceptionDetails =false and browser sends non-standard url escaping.* (T165846) SECURITY: BotPassword login attempts weren't throttled.* (T128209) SECURITY: Reflected File Download from api.php.* (T134100) SECURITY: Do not reveal if user exists during login failure.* (T176247) SECURITY: Ensure Message::rawParams can't lead to XSS.* (T125163) SECURITY: Make anchor for headlines escape > and <.* (T180237) SECURITY: Protect vendor folder with .htaccess.* (T180231) SECURITY: Remove PHPUnit file with known RCE if exists in update.php.* (T124404) SECURITY: XSS in langconverter when regex hits pcre.backtrack_limit.* (T119158) SECURITY: Handle -{}- syntax in attributes safely.
== MediaWiki 1.2428.5 1 ==
This is a security and maintenance release of the MediaWiki 1.23 28 branch.
=== Changes since 1.2428.4 0 ===* (T117899) SECURITY: $wgArticlePath can no longer be set to relative paths that do not begin with a slash. This enabled trivial XSS attacks. Configuration values such as "http://my.wiki.com/wiki/$1" are fine, as are "/wiki/$1". A value such as "$1" or "wiki/$1" is not and will now throw an error.* (T119309) SECURITY: Use hash_compare() for edit token comparison* (T118032) SECURITY: Don't allow cURL to interpret POST parameters starting with '@' as file uploads* (T115522) SECURITY: Passwords generated by User::randomPassword() can no longer be shorter than $wgMinimalPasswordLength* (T97897) SECURITY: Improve IP parsing and trimming. Previous behavior could result in improper blocks being issued* (T109724) SECURITY: Special:MyPage, Special:MyTalk, Special:MyContributions and related pages no longer use HTTP redirects and are now redirected by MediaWiki* (T103237) $wgUseGzip had no effect when using file cache.
=== Changes since 1.2428.3 0-rc1 ===* (T148957) Replace wgShowExceptionDetails with wgShowDBErrorBacktrace on db errors.* (T148956) Only apply wgDBschema to postgres/mssql.* (T145991) Introduce separate log action for deleting pages on move.* (T141474) (T110464) Bypass login page if no user input is required.
== MediaWiki = Configuration changes in 1.24.3 28 ===* $wgSend404Code now affects status code of action=history if the page is not there.* BREAKING CHANGE: $wgHTTPProxy is now *required* for all external requests made by MediaWiki via a proxy. Relying on the http_proxy environment variable is no longer supported.* The load.php entry point now enforces the existing policy of not allowing access to session data, which includes the session user and the session user's language. If such access is attempted, an exception will be thrown.* The number of internal PBKDF2 iterations used to derive the session secret is configurable via $wgSessionPbkdf2Iterations.* Upload dialog's file upload log comment can now be configured separately for local and foreign uploads.* $wgForeignUploadTargets now defaults to `[ 'local' ]`, where `'local'` signifies local uploads. A value of `[]` (empty array) now means that no upload targets are allowed, effectively disabling the upload dialog.* The deprecated $wgEditEncoding variable has been removed; it was only used for Esperanto language character conversion. You are now recommended to use input methods provided by the UniversalLanguageSelector extension.* When $wgPingback is true, MediaWiki will periodically ping https://www.mediawiki.org/beacon with basic information about the local MediaWiki installation. This data includes, for example, the type of system, PHP version, and chosen database backend. This behavior is off by default.* When $wgEditSubmitButtonLabelPublish is true, MediaWiki will label the button to store-to-database-and-show-to-others as "Publish page"/"Publish changes"; if false, the default, they will be "Save page"/"Save changes".* The 'editcontentmodel' permission is now granted to all logged-in users ('user'). instead of just administrators ('sysop'). Documentation for this feature is available at <https://www.mediawiki.org/wiki/Help:ChangeContentModel>.* $wgRevisionCacheExpiry is now set to one week by default instead of being disabled.* Magic links are now disabled by default, and can be re-enabled by modifying the value of $wgEnableMagicLinks. Their usage is discouraged, but if they are manually enabled, a tracking category will be added to help identify usage and make it easier to migrate away from. If you depend upon magic link functionality, it is requested that you comment on <https://www.mediawiki.org/wiki/Requests_for_comment/Future_of_magic_links> and explain your use case(s).* New config variable $wgCSPFalsePositiveUrls to control what URLs to ignore in upcoming Content-Security-Policy feature's reporting.
=== Changes since External library changes in 1.24.2 28 ===
== MediaWiki 1== New external libraries ====* Added wikimedia/scoped-callback v1.0.0* Added wikimedia/wait-condition-loop v1.240.2 ==1
=== Changes Action API changes in 1.28 ===* Added 'maxarticlesize' property to action=query&meta=siteinfo which contains the value of $wgMaxArticleSize.* Property 'modulemessages' from action=parse&prop=modules was removed (deprecated since 1.2426).* The following response properties from action=login, deprecated in 1 .27, are now removed: lgtoken, cookieprefix, sessionid. Clients should handle cookies to properly manage session state.* Submitting the lgtoken and lgpassword parameters in the query string to action=login is now deprecated and outputs a warning. They should be submitted in the POST body instead.* Submitting sensitive authentication request parameters to action=clientlogin, action=createaccount, action=linkaccount, and action=changeauthenticationdata in the query string is now deprecated and outputs a warning. They should be submitted in the POST body instead.* (T141960) Multi-valued parameters may now be separated using U+001F (Unit Separator) instead of the pipe character. This will be useful if some of the multiple values need to contain pipes, e.g. for action=options.* The API will now warn if input is not NFC-normalized Unicode or if it contains invalid characters.* The 'normalized' list output by action=query and other modules that use ApiPageSet may contain entries where the 'from' value is percent-encoded as the raw value cannot be represented in a valid API response. These are indicated by a 'fromencoded' boolean alongside the existing 'from' parameter.* (T28680) action=paraminfo can now return info about all submodules of a module without listing them all explicitly.* (T146770) It is now possible to assert that the current user is a specific named user, using the 'assertuser' parameter.* (T141963) Added a 'known' property when missing-but-known titles (e.g. from the 'TitleIsAlwaysKnown' hook) are output in various modules.
=== Action API internal changes in 1.28 ===* (T85848Added a new hook, T71210) SECURITY: Don't parse XMP blocks that contain XML entitiesApiMakeParserOptions',to allow extensions to better to prevent various DoS attacksinteract with ApiParse and ApiExpandTemplates.* (T85848T139565) SECURITY: Don't allow directly calling XmlAPI: Generate head items in the context of the given title* (T115333) SECURITY: Check read permission when loading page content in ApiParse* ApiBase::getResultData() was removed (deprecated since 1.25)* ApiBase::makeHelpArrayToString() was removed (deprecated since 1.25)* ApiBase::makeHelpMsgParameters() was removed (deprecated since 1.25)* ApiBase::makeHelpMsg() was removed (deprecated since 1.25)* ApiFormatBase::formatHTML() was removed (deprecated since 1.25)* ApiFormatBase::getNeedsRawData() was removed (deprecated since 1.25)* ApiFormatBase::getWantsHelp() was removed (deprecated since 1.25)* ApiFormatBase::setBufferResult() was removed (deprecated since 1.25)* ApiFormatBase::setHelp() was removed (deprecated since 1.25)* ApiFormatBase::setUnescapeAmps() was removed (deprecated since 1.25)* ApiMain::makeHelpMsgHeader() was removed (deprecated since 1.25)* ApiMain::reallyMakeHelpMsg() was removed (deprecated since 1.25)* ApiMain::isWellFormed, to reducesetHelp() was removed (deprecated since 1.25) likelihood of DoS* ApiResult::beginContinuation() was removed (deprecated since 1.25)* ApiResult::cleanUpUTF8(T88310) SECURITYwas removed (deprecated since 1.25)* ApiResult:: Always expand xml entities when checking SVG'sconvertStatusToArray() was removed (deprecated since 1.25)* ApiResult::disableSizeCheck(T73394) SECURITYwas removed (deprecated since 1.24)* ApiResult:: Escape > in HtmlenableSizeCheck() was removed (deprecated since 1.24)* ApiResult::expandAttributes to prevent XSSendContinuation() was removed (deprecated since 1.25)* ApiResult::getData(T85855) SECURITYwas removed (deprecated since 1.25)* ApiResult:: Don't execute another user's CSS or JS on previewgetIsRawMode() was removed (deprecated since 1.25)* ApiResult::setContent() was removed (T64685deprecated since 1.25) SECURITY* ApiResult:: Allow setting maximal password length to prevent DoS whensetContinueParam() was removed (deprecated since 1.25) using PBKDF2* ApiResult::setElement() was removed (deprecated since 1.25)* ApiResult::setGeneratorContinueParam(T85349, T85850, T86711) SECURITYwas removed (deprecated since 1.25)* ApiResult:: Multiple issues fixed in SVG filtering tosetIndexedTagName_internal() was removed (deprecated since 1.25) prevent XSS and protect viewer's privacy* ApiResult::setIndexedTagName_recursive() was removed (deprecated since 1.25)* Fix case of SpecialAllPages/SpecialAllMessages in SpecialPageFactory to fixApiResult::setMainForContinuation() was removed (deprecated since 1.25) loading these special pages when $wgAutoloadAttemptLowercase is false* ApiResult::setParsedLimit() was removed (deprecated since 1.25)* ApiResult::setRawMode() was removed (bug T70087deprecated since 1.25) Fix Special* ApiResult:ActiveUsers page :size() was removed (deprecated since 1.25)* Added new hooks, 'ApiQueryBaseBeforeQuery', 'ApiQueryBaseAfterQuery', and 'ApiQueryBaseProcessRow', to make it easier for installations usingextensions to add 'prop' and PostgreSQL'show' parameters to existing API query modules.A query module can enable these hooks by passing an array for $hookData to ApiQueryBase::select() and* by calling ApiQueryBase->processRow(bug T76254) Fix deleting of pages with PostgreSQL. Requires before adding a schema changerow's data to the and running updateresult.php * (T125177) SECURITY: API parameters may now be marked as "sensitive" to fixkeep their values out of the logs.
== MediaWiki = Languages updated in 1.24.1 28 ===
=== Configuration Other changes in 1.24 28 ===* MediaWiki will no longer run if register_globals is enabled(T128697) Improved handling of large diffs. It * [BREAKING CHANGE] $wgExtendedLoginCookies has beenremoved. You can use or update a custom session provider if needed.* Deprecated APIEditBeforeSave hook in favor of EditFilterMergedContent.* The 'UploadVerification' hook is deprecated for 5 years now, and was removed in PHP 5.4Use 'UploadVerifyFile' instead. For more information about why, see <https* SiteConfiguration:://wwwisLocalVHost() was removed (deprecated since 1.mediawiki.org/wiki/register_globals>25).* MediaWiki now requires PHPThe 'UserLoginComplete's iconv extension. openSUSE users may need hook has a new parameter todifferentiate between actual install login and visiting the php5-iconv packagelogin page while already logged in.* ResourceLoader::makeLoaderURL() was removed (deprecated since 1.24). Users of other systems may need to add extension=iconv* $.fn.so to phpliveAndTestAtStart was removed (deprecated since 1.ini or recompile PHP without --without-iconv24).* MediaWiki will no longer function if magic quotes are enabledmw.util. It has been deprecated for 5 years now, and tooltipAccessKeyPrefix was removed in PHP 5(deprecated since 1.424).* The server's canonical hostname is available as $wgServerName, which is exposed in both mw.config and ApiQuerySiteInfoutil.tooltipAccessKeyRegexp was removed (deprecated since 1.24).* Introduced $wgPagePropsHaveSortkey as a backwards-compatibility switch,Linker::link() and Linker::linkKnown() were deprecated; please instead use for using the old schema of the page_props tableMediaWiki\Linker\LinkRenderer. In addition, in case the respectiveLinkBegin and LinkEnd hooks were replaced by HtmlPageLinkRendererBegin and HtmlPageLinkRendererEnd schema update was not appliedrespectively. See docs/hooks.txt for the specific changes needed for those hooks.* $wgSearchEverythingOnlyLoggedIn Linker::formatSize() was removed as the 'searcheverything' user option was removeddeprecated. Use $wgNamespacesToBeSearchedDefault instead or if you used to have $wgDefaultUserOptions['searcheverything'] = 1Language::formatSize() directly.* $wgMasterWaitTimeout has been Aliases for Linker methods, deprecatedsince 1.* $wgDBClusterTimeout has been 21, were removed.from Skin: * $wgProxyKey has been removed. It is no longer used by MediaWiki core.Skin::commentBlock() (use Linker::commentBlock() instead) Ensure $wgSecretKey is set in LocalSettings.php.* $wgExtraInterlanguageLinkPrefixes is a new configuration variable thatSkin::generateRollback() (use Linker::generateRollback() instead) contains an array of interwiki prefixes that should be treated as language* Skin::link() (use MediaWiki\Linker\LinkRenderer instead) prefixes * Skin::linkKnown() (i.e. turned into interlanguage links when $wgInterwikiMagic is setuse MediaWiki\Linker\LinkRenderer instead) to true* Skin::userLink() (use Linker::userLink() instead). * $wgParserTestRemote has been removed.Skin::userToolLinks() (use Linker::userToolLinks() instead)* $wgCountTotalSearchHits has been removed. If you're concerned about efficiency Disabled "bug 2702" HTML tidying of search, you should use something like CirrusSearch instead of built inparsed UI messages on wikis where Tidy is searchdisabled.* Users in the 'sysop' group have access to SpecialDifferenceEngine::MergeHistory by default.* $wgFileStore generateDiffBody() was removed after having been (deprecated in since 1.1721). Alternative configurations are $wgDeletedDirectory * UploadBase::stashFileGetKey() and $wgHashedUploadDirectory.* The UploadBase::stashSession() were deprecated $wgUseCommaCount variable has been removed.* $wgEnableSorbs and $wgSorbsUrl have been removed Use .* The UserCryptPassword and UserComparePassword hooks are no longer called. Any extensions using them must be updated to use the Password Hashing API.* $wgCompiledFiles has been removed->stashFile()->getFileKey() instead.* $wgSortSpecialPages "Public domain" was removedas a wiki license option from the installer, the listing on Special:SpecialPages isin now always sortedfavour of CC-0.* AuthenticationRequest::$wgSpecialPages may required is now use callback functions as an alternative changed from REQUIRED to plain class namesPRIMARY_REQUIRED on requests needed by primary providers even if all primaries need them. This allows more control over constructor parametersPrimary providers are discouraged from returning multiple REQUIRED requests.* $wgHTCPMulticastAddress, $wgHTCPMulticastRouting and $wgHTCPPort were removedOOjs UI PHP widgets constructed with the `'infusable' => true` config option will no longer be automatically infused. You should call `OO.ui.infuse()` on them yourself from your JavaScript code.* $wgRC2UDPAddress, $wgRC2UDPInterwikiPrefix, $wgRC2UDPOmitBots, $wgRC2UDPPort and $wgRC2UDPPrefix have been removedparserTests.php has moved to tests/parser/parserTests.php* The default password type for MediaWiki has command line options specific to parser tests have been changed removed from MD5 to PBKDF2. Password hashes will automatically be updated as users log inphpunit.php: --regex and --keep-uploads. If necessaryInstead of --regex, theuse --filter. old MD5 hashing can be restored by changing $wgPasswordDefault Instead of --keep-uploads, use the same option to 'B'parserTests. In additionphp,but you there must specify a directory with --upload-dir.* The 'jquery.arrowSteps' ResourceLoader module is a maintenance script wrapOldPasswordnow deprecated.php that can wrap all passwords in PBKDF2 * IP::isConfiguredProxy() and IP::isTrustedProxy(or the hashing algorithm of your choice) if you don't want were removed. Callers should migrate to wait for yourusing the same functions on a ProxyLookup instance, obtainable from users to log inMediaWikiServices.* $wgImportSources can now either be a regular arrayThe ArticleAfterFetchContent, ArticleInsertComplete, ArticleSave, ArticleSaveComplete, or an associative map specifying subprojects on the interwiki map of the target wikiArticleViewCustom, EditFilterMerged, EditPageGetDiffText, or a mix ofEditPageGetPreviewText and the two. Existing configurations ShowRawCssJs hooks will still worknow emit deprecation warnings if used.* Users must be able to edit through a page's protection to be able to delete it.* The default thumb size ($wgDefaultUserOptions['thumbsize']T68404) CSS3 attr() function with url type is now 300px, up fromno longer allowed 180px. If you have altered the number of entries in $wgThumbLimits for your wiki, you may need to adjust your default user settings to compensate for the index changeinline styles.* $wgDeferredUpdateList Database::getSearchEngine() is now deprecated, you should use DeferredUpdatesSearchEngineFactory::addUpdate()getSearchEngineClass
instead.
== MediaWiki 1.2327.15 5 == This is a security and maintenance release of the MediaWiki 1.27 branch.
</pre>
