Page MenuHomePhabricator
Create Task
Maniphest T256334

Release MediaWiki 1.31.9/1.34.3/1.35.0
Closed, ResolvedPublic
Actions

Description

Previous release work: T248534: Release MediaWiki 1.31.8/1.33.4/1.34.2

Tracking for activities actually pertaining to making the release of MediaWiki 1.31.9/1.34.3/1.35.0

Details

Due Date
Sep 30 2020, 10:00 PM

Related Objects
Search...

StatusSubtypeAssignedTask
 ResolvedReedyT256334 Release MediaWiki 1.31.9/1.34.3/1.35.0
 ResolvedReedyT256335 Tracking bug for MediaWiki 1.31.9/1.34.3/1.35.0
 ResolvedSecuritysbassettT255918 Unescaped message used in HTML on Special:Contributions (CVE-2020-25812)
 ResolvedSecuritysbassettT256171 Unescaped message used in HTML within LogEventsList (CVE-2020-25815)
 ResolvedSecurityDannyS712T232568 Special:UserRights exposes the existence of hidden users (CVE-2020-25813)
 ResolvedSecurityLegoktmT258763 Vulnerabilities in firejail due to --output (CVE-2020-17367, CVE-2020-17368)
 ResolvedNoneT86738 mw.message.parse() accepts javascript: protocol in wikilinks (CVE-2020-25814)
 ResolvedLucas_Werkmeister_WMDET115888 Non-jqueryMsg version of mw.message(…).parse() doesn't escape HTML (CVE-2020-25828)
 ResolvedSecuritydanielT251661 TOTP throttle not enforced cross-wiki (CVE-2020-25827)
 ResolvedReedyT256336 Write and send pre-release announcements for MediaWiki 1.31.9/1.34.3/1.35.0
 ResolvedReedyT256337 Write and send release announcements for MediaWiki 1.31.9/1.34.3/1.35.0
 ResolvedReedyT256338 Update onwiki release notes for 1.31.9/1.34.3
 ResolvedReedyT256339 Update HISTORY in master after 1.31.9/1.34.3
 ResolvedReedyT256340 Tag 1.31.9/1.34.3/1.31.10/1.34.4
 ResolvedReedyT256341 Obtain CVEs for 1.31.9/1.34.3/1.35.0 security releases
 ResolvedsbassettT256342 Write and send supplementary release announcement for extensions and skins with security patches (1.31.9/1.34.3/1.35.0)
 ResolvedSecurityphuedxT262213 XSS on Pages viewed on Mobile (CVE-2020-26120)
 ResolvedsbassettT238075 Alert group Cookie(s) without HttpOnly flag set
 ResolvedSecuritydanielT260485 CentralAuth uses wrong actor ID when locally suppressing the user (CVE-2020-25869)
 DeclinedSecuritydanielT261325 Fix rows in ipblocks that point to a non-existing user in ipb_by_actor field, due to T260485
 ResolvedSecurity• tstarlingT261143 Fix misattribution of block due to bad values in the ipblocks ipb_by_actor field
Restricted Task

Event Timeline

Reedy added projects: Security, Security-Team.Jun 24 2020, 11:46 PM
Reedy subscribed.
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJun 24 2020, 11:46 PM
Reedy added subtasks: T256335: Tracking bug for MediaWiki 1.31.9/1.34.3/1.35.0, T256336: Write and send pre-release announcements for MediaWiki 1.31.9/1.34.3/1.35.0, T256337: Write and send release announcements for MediaWiki 1.31.9/1.34.3/1.35.0, T256338: Update onwiki release notes for 1.31.9/1.34.3, T256339: Update HISTORY in master after 1.31.9/1.34.3, T256340: Tag 1.31.9/1.34.3/1.31.10/1.34.4, T256341: Obtain CVEs for 1.31.9/1.34.3/1.35.0 security releases, T256342: Write and send supplementary release announcement for extensions and skins with security patches (1.31.9/1.34.3/1.35.0).Jun 24 2020, 11:46 PM
Reedy updated the task description. (Show Details)Jun 24 2020, 11:48 PM
Reedy edited projects, added MediaWiki-Releasing; removed Security-Team.Jun 24 2020, 11:51 PM
Reedy set Due Date to Sep 30 2020, 10:00 PM.Jun 25 2020, 12:32 AM
sbassett mentioned this in T256171: Unescaped message used in HTML within LogEventsList (CVE-2020-25815).Jun 26 2020, 6:56 PM
sbassett added a subscriber: Daimona.
sbassett updated the task description. (Show Details)Jun 27 2020, 2:50 AM
Reedy renamed this task from Release MediaWiki 1.31.9/1.34.3 to Release MediaWiki 1.31.9/1.34.3/1.35.1.Aug 26 2020, 4:03 PM
Reedy updated the task description. (Show Details)
Jdforrester-WMF subscribed.Sep 2 2020, 1:14 PM
Jdforrester-WMF added a subtask: Restricted Task.Sep 11 2020, 4:03 PM
Jdforrester-WMF closed subtask Restricted Task as Resolved.
Reedy renamed this task from Release MediaWiki 1.31.9/1.34.3/1.35.1 to Release MediaWiki 1.31.9/1.34.3/1.35.0.Sep 21 2020, 2:37 PM
Reedy updated the task description. (Show Details)
Reedy closed subtask T256336: Write and send pre-release announcements for MediaWiki 1.31.9/1.34.3/1.35.0 as Resolved.Sep 23 2020, 9:12 PM
Reedy closed subtask T256337: Write and send release announcements for MediaWiki 1.31.9/1.34.3/1.35.0 as Resolved.Sep 24 2020, 3:06 PM
Reedy changed the visibility from "acl*security (Project)" to "Public (No Login Required)".
Reedy changed the edit policy from "acl*security (Project)" to "All Users".
DannyS712 subscribed.Sep 24 2020, 4:59 PM
Reedy closed subtask T256340: Tag 1.31.9/1.34.3/1.31.10/1.34.4 as Resolved.Sep 24 2020, 10:10 PM
Reedy closed subtask T256338: Update onwiki release notes for 1.31.9/1.34.3 as Resolved.Sep 24 2020, 10:18 PM
Reedy closed subtask T256339: Update HISTORY in master after 1.31.9/1.34.3 as Resolved.Sep 24 2020, 11:13 PM
Reedy closed subtask T256335: Tracking bug for MediaWiki 1.31.9/1.34.3/1.35.0 as Resolved.
Jdforrester-WMF added a comment.Sep 28 2020, 4:16 PM

Resolved, surely?

Reedy added a comment.Sep 28 2020, 4:37 PM
In T256334#6499264, @Jdforrester-WMF wrote:

Resolved, surely?

Ish, kinda, not completely.

One task to open up (after I've had chance to review the comments for PII etc) and the extension supplemental to come out (in the next couple of days)

sbassett closed subtask T256342: Write and send supplementary release announcement for extensions and skins with security patches (1.31.9/1.34.3/1.35.0) as Resolved.Sep 28 2020, 6:31 PM
DannyS712 added a comment.Nov 10 2020, 12:35 AM
In T256334#6499324, @Reedy wrote:
In T256334#6499264, @Jdforrester-WMF wrote:

Resolved, surely?

Ish, kinda, not completely.

One task to open up (after I've had chance to review the comments for PII etc) and the extension supplemental to come out (in the next couple of days)

{{ping}} I assume the extension supplemental came out. Any update regarding the private task? Or can this be closed?

Reedy closed this task as Resolved.Nov 10 2020, 11:32 AM
Reedy claimed this task.
Reedy triaged this task as Medium priority.
Reedy closed subtask T256341: Obtain CVEs for 1.31.9/1.34.3/1.35.0 security releases as Resolved.
In T256334#6615203, @DannyS712 wrote:
In T256334#6499324, @Reedy wrote:
In T256334#6499264, @Jdforrester-WMF wrote:

Resolved, surely?

Ish, kinda, not completely.

One task to open up (after I've had chance to review the comments for PII etc) and the extension supplemental to come out (in the next couple of days)

{{ping}} I assume the extension supplemental came out. Any update regarding the private task? Or can this be closed?

https://lists.wikimedia.org/pipermail/mediawiki-announce/2020-September/000265.html

Reedy mentioned this in T263802: Release MediaWiki 1.31.11/1.35.1.Dec 15 2020, 1:04 PM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL