Resolved Bugs
1208072 – mediawiki: mediawiki: security issues fixed in the 1.24.2, 1.23.9, and 1.19.24 releases
1208073 – mediawiki: mediawiki: security issues fixed in the 1.24.2, 1.23.9, and 1.19.24 releases [fedora-all]<br
Changes since 1.24.1
* (bug T85848, bug T71210) SECURITY: Don’t parse XMP blocks that contain XML entities, to prevent various DoS attacks.
* (bug T85848) SECURITY: Don’t allow directly calling Xml::isWellFormed, to reduce likelihood of DoS.
* (bug T88310) SECURITY: Always expand xml entities when checking SVG’s.
* (bug T73394) SECURITY: Escape > in Html::expandAttributes to prevent XSS.
* (bug T85855) SECURITY: Don’t execute another user’s CSS or JS on preview.
* (bug T64685) SECURITY: Allow setting maximal password length to prevent DoS when using PBKDF2.
* (bug T85349, bug T85850, bug T86711) SECURITY: Multiple issues fixed in SVG filtering to prevent XSS and protect viewer’s privacy.
* Fix case of SpecialAllPages/SpecialAllMessages in SpecialPageFactory to fix loading these special pages when $wgAutoloadAttemptLowercase is false.
* (bug T70087) Fix Special:ActiveUsers page for installations using PostgreSQL.
* (bug T76254) Fix deleting of pages with PostgreSQL. Requires a schema change and running update.php to fix.