Page MenuHomePhabricator
Create Task
Maniphest T292226

Release MediaWiki 1.35.5/1.36.3/1.37.1
Closed, ResolvedPublic
Actions

Description

Previous release work: T285404: Release MediaWiki 1.31.16/1.35.4/1.36.2

Tracking for activities actually pertaining to making the release of MediaWiki 1.35.5/1.36.3/1.37.1

Related Objects
Search...

StatusSubtypeAssignedTask
 ResolvedReedyT292226 Release MediaWiki 1.35.5/1.36.3/1.37.1
 ResolvedReedyT292227 Tracking bug for MediaWiki 1.35.5/1.36.3/1.37.1
 ResolvedSecuritymatmarexT293589 CVE-2021-44855: Blind Stored XSS via Upload Image via URL
 ResolvedSecurity• nnikkhouiT292763 CVE-2021-44854: Rest API incorrectly publicly caches results from private wikis
 ResolvedSecurityUrbanecmT294686 Special:Nuke isn't working at all
 ResolvedSecuritymatmarexT271037 CVE-2021-44856: Title blocked in AbuseFilter can be created via Special:ChangeContentModel due to the mishandling of EditFilterMergedContent hook return value
 ResolvedSecurityLegoktmT297322 CVE-2021-44857, CVE-2021-44858: Unauthorized users can undo edits on any protected page and view contents of private wikis using mcrundo
ResolvedSecurityLegoktmT297574 CVE-2021-45038: Unauthorized users can access private wiki contents using rollback action
 ResolvedSecuritytaaviT297416 Restrict access to most actions on $wgWhitelistRead pages on private wikis
 OpenFeatureNoneT34716 $wgWhitelistRead leaks username data (Because it allows viewing ?action=history)
Restricted Task
 ResolvedReedyT292229 Write and send pre-release announcements for MediaWiki 1.35.5/1.36.3/1.37.1
 ResolvedReedyT292230 Write and send release announcements for MediaWiki 1.35.5/1.36.3/1.37.1
 ResolvedSecurityLegoktmT297541 Publish FAQ for undo security bug
 ResolvedReedyT292231 Tag 1.35.5/1.36.3/1.37.1
 ResolvedReedyT292232 Update onwiki news and Module:Version
 ResolvedReedyT292233 Update onwiki release notes for 1.35.5/1.36.3/1.37.1
 ResolvedReedyT292234 Update Wikidata Q83
 ResolvedReedyT292235 Update HISTORY in master after 1.35.5/1.36.3/1.37.1
 ResolvedMstylesT292236 Write and send supplementary release announcement for extensions and skins with security patches (1.35.5/1.36.3/1.37.1)
 ResolvedSecuritysbassettT292351 CVE-2021-41118: ReDOS in DPL3
 ResolvedSecurityZabeT292795 XSS vulnerability in Special:CheckUserLog (CVE-2021-46150)
 ResolvedSecurityCparleT293556 Stored XSS via WikibaseMediaInfo caption fields at commons.wikimedia.org (CVE-2021-46146)
 ResolvedSecurityNoneT293341 MassEditRegex is Vulnerable to CSRF Attacks (CVE-2021-46147)
 ResolvedSecurity• santhoshT293749 /w/api.php?action=languagesearch denial of service (CVE-2021-46149)
 ResolvedSecurityphuedxT290808 Users with no NDA can access confidential information at testwiki's SecurePoll instance (CVE-2021-46148)
 ResolvedSecurityUrbanecmT294693 XSS on page information Wikibase central description (CVE-2021-45473)
 ResolvedSecuritythiemowmdeT296605 XSS in Special:ImportFile URL (CVE-2021-45474)
 ResolvedSecurityLucas_Werkmeister_WMDET296578 Globally blocked IPs can edit EntitySchema items (CVE-2021-45471)
 ResolvedSecurityLucas_Werkmeister_WMDET297570 XSS in Wikibase using formatter URL (CVE-2021-45472)

Event Timeline

Reedy added projects: Security, MediaWiki-Releasing.Sep 30 2021, 6:37 PM
Reedy subscribed.
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptSep 30 2021, 6:37 PM
Reedy added subtasks: T292227: Tracking bug for MediaWiki 1.35.5/1.36.3/1.37.1, Restricted Task, T292229: Write and send pre-release announcements for MediaWiki 1.35.5/1.36.3/1.37.1, T292230: Write and send release announcements for MediaWiki 1.35.5/1.36.3/1.37.1, T292231: Tag 1.35.5/1.36.3/1.37.1, T292232: Update onwiki news and Module:Version, T292233: Update onwiki release notes for 1.35.5/1.36.3/1.37.1, T292234: Update Wikidata Q83, T292235: Update HISTORY in master after 1.35.5/1.36.3/1.37.1, T292236: Write and send supplementary release announcement for extensions and skins with security patches (1.35.5/1.36.3/1.37.1).Sep 30 2021, 6:37 PM
Reedy renamed this task from Release MediaWiki 1.31.16/1.35.4/1.36.2 to Release MediaWiki 1.35.5/1.36.3.Sep 30 2021, 6:44 PM
Reedy updated the task description. (Show Details)
DannyS712 updated the task description. (Show Details)Sep 30 2021, 7:16 PM
sbassett mentioned this in T293589: CVE-2021-44855: Blind Stored XSS via Upload Image via URL.Oct 18 2021, 8:45 PM
Reedy renamed this task from Release MediaWiki 1.35.5/1.36.3 to Release MediaWiki 1.35.5/1.36.3/1.37.1.Nov 24 2021, 5:19 PM
Reedy updated the task description. (Show Details)
sbassett mentioned this in T271037: CVE-2021-44856: Title blocked in AbuseFilter can be created via Special:ChangeContentModel due to the mishandling of EditFilterMergedContent hook return value.Dec 6 2021, 10:23 PM
Reedy changed the status of subtask Restricted Task from Open to In Progress.Dec 10 2021, 7:46 PM
Reedy changed the status of subtask T292229: Write and send pre-release announcements for MediaWiki 1.35.5/1.36.3/1.37.1 from Open to In Progress.
Reedy changed the status of subtask T292230: Write and send release announcements for MediaWiki 1.35.5/1.36.3/1.37.1 from Open to In Progress.
Reedy changed the status of subtask T292227: Tracking bug for MediaWiki 1.35.5/1.36.3/1.37.1 from Open to In Progress.Dec 10 2021, 8:10 PM
Reedy changed the task status from Open to In Progress.Dec 13 2021, 2:59 AM
Reedy triaged this task as Medium priority.
Reedy closed subtask T292229: Write and send pre-release announcements for MediaWiki 1.35.5/1.36.3/1.37.1 as Resolved.Dec 13 2021, 9:42 PM
Reedy closed subtask Restricted Task as Resolved.Dec 14 2021, 9:59 PM
Reedy closed subtask T292230: Write and send release announcements for MediaWiki 1.35.5/1.36.3/1.37.1 as Resolved.Dec 15 2021, 7:28 PM
Reedy closed subtask T292232: Update onwiki news and Module:Version as Resolved.Dec 15 2021, 7:42 PM
Reedy closed subtask T292234: Update Wikidata Q83 as Resolved.
Reedy changed the visibility from "acl*security (Project)" to "Public (No Login Required)".Dec 15 2021, 7:56 PM
Reedy changed the edit policy from "acl*security (Project)" to "All Users".
Reedy changed the status of subtask T292231: Tag 1.35.5/1.36.3/1.37.1 from Open to In Progress.Dec 15 2021, 8:29 PM
Reedy closed subtask T292231: Tag 1.35.5/1.36.3/1.37.1 as Resolved.Dec 15 2021, 8:48 PM
Reedy closed subtask T292233: Update onwiki release notes for 1.35.5/1.36.3/1.37.1 as Resolved.Dec 15 2021, 8:58 PM
Reedy changed the status of subtask T292235: Update HISTORY in master after 1.35.5/1.36.3/1.37.1 from Open to In Progress.Dec 15 2021, 9:09 PM
Reedy closed subtask T292235: Update HISTORY in master after 1.35.5/1.36.3/1.37.1 as Resolved.Dec 15 2021, 9:28 PM
Reedy closed subtask T292227: Tracking bug for MediaWiki 1.35.5/1.36.3/1.37.1 as Resolved.Dec 22 2021, 1:32 AM
• WikiChain claimed this task.Dec 23 2021, 2:55 PM
• WikiChain set Due Date to Dec 22 2021, 4:00 PM.
• WikiChain set the point value for this task to 285404.
• WikiChain awarded a token.
Aklapper removed • WikiChain as the assignee of this task.Dec 23 2021, 3:02 PM
Aklapper removed the point value for this task.
Aklapper removed Due Date.
Aklapper added a subscriber: • WikiChain.
Aklapper removed a subscriber: • WikiChain.
sbassett closed subtask T292236: Write and send supplementary release announcement for extensions and skins with security patches (1.35.5/1.36.3/1.37.1) as Resolved.Jan 11 2022, 3:06 PM
Reedy closed this task as Resolved.Mar 20 2022, 12:43 PM
Reedy claimed this task.
Reedy mentioned this in T297829: Release MediaWiki 1.35.6/1.36.4/1.37.2.
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL