Patches for T122807: [tracking] Check php crypto primatives

Patches for T103239: Patrol allows click catching and patrolling of any page

Patches for T98313

Patches for 1.26 and master for T110143.

Patches for 1.25 and most of 1.23 (missing scribunto)

Is it too late for one more? I know this is really late in the game, but the underlying issue of T133507 has been trending on blogs, so it would be really cool to get it fixed in this release.

Patches in question for that bug are:

• T133507-master4 KBDownload
• T133507-REL1_26.patch4 KBDownload
• T133507-REL1_25.patch4 KBDownload
• T133507-REL1_23.patch4 KBDownload

In T124940#2252682, @Bawolff wrote:

Is it too late for one more? I know this is really late in the game, but the underlying issue of T133507 has been trending on blogs, so it would be really cool to get it fixed in this release.

Patches in question for that bug are:

• T133507-master4 KBDownload
• T133507-REL1_26.patch4 KBDownload
• T133507-REL1_25.patch4 KBDownload
• T133507-REL1_23.patch4 KBDownload

Considering we missed our proposed deadline of this week, I don't see why not. Go ahead and add them to the table.

I removed StudiesWorld from being subscribed to this bug. If I understand correctly, him being subscribed gave him access to all the patches attached to this bug, which was probably bad... (That said, he appears to be just a curious Wikipedian who found herald, so probably not too big a deal)

I also removed them from several other private tasks visible to subscribers: {T121058} {T127646} {T123811} {T127823}

@dpatrick / @Bawolff / @MaxSem - All those patches are deployed now. Can you all make sure you have 'SECURITY: ' at the start of the commit summary? Makes it easier to see on the cluster what's been added on top of master when deploying, and probably good to be consistent when we push these into master.

@MaxSem, are you able to do backports of the patch for T130947?

I'll do the backports of T132874 today or tomorrow

csteipp added a blocking task: T134863: Reflected XSS in GlobalGroupPermissions.

Adding this here as a reminder we need to release this, but the tarball doesn't really rely on this. We can do it any time.

T130947: patch for 1.25-25 is

It also applies to REL1_23 when using --3way, so we can attach that too.

Although we should amend these to use array() syntax and not [].