MediaWiki 1.35.2
9 April 2021
MediaWiki version 1.35.2 is now available (security release).
Upgrading to MediaWiki 1.35.2
MediaWiki 1.35.2 can be upgraded to (or installed) using any of Installatron's products. Use Installatron's optional Automatic Update feature to automatically apply MediaWiki updates as new versions are released, or use Installatron's Clone feature to duplicate an existing MediaWiki install to test the 1.35.2 upgrade prior to applying it live. Get started managing your MediaWiki installations with Installatron
What's New in MediaWiki 1.35.2
Security
- Allow blocked users to access Special:ResetTokens.
- Escape mediastatistics-header-* messages on Special:NewFiles.
- Escape rcfilters-filter-* messages on ChangesList pages.
- Allow user to only apply protection they have right to do so via action=protect.
- Non-admin deleted enwiki page in fast double move.
- ContentModelChange: Check that user cancreate pages.
- Parsoid comment fostering allows for inserting mostly arbitrary <meta> tags.* HTMLFormField: Use non namespaced class name rather than static::class.
Changes
- The confusingly-named User->isLoggedIn() method has been deprecated in favour of the method it wraps, User->isRegistered().
- Upgrade pimple/pimple from 3.3.0 to 3.3.1 for PHP 8.0 support.
- Upgrade seld/jsonlint from 1.7.1 to 1.8.3 for PHP 8.0 support.
- Upgrade doctrine/dbal from 2.10.4 to 3.0.0 for PHP 8.0 support.
- Fix display of Special:Preferences URL in password reset email.
- resourceloader: Give SkinModule 'features' option an extensible default.
- Unknown features shouldn't break style output.
- Make use of CURLMOPT_MAX_HOST_CONNECTIONS conditional on having curl >= 7.30.0.
- DefaultSettings.php: Update $wgPingback documentation.
- Fix docs for LanguageConverter::translate.
- Don't rely on implicit string->int cast in comparison.
- Exif::isSlong: Cast input to float so PHP 8.0 abs() doesn't whine.
- UploadBase: Don't call MimeAnalyzer if mTempPath is null.
- Remove nonfunctional default sampling for WANObjectCache metrics.
- Prevent service injection to LoadExtensionSchemaUpdates hook.
- Hooks: Map dash character to underscore when generating hook names.
- Fix fetching ipblock-exempt within BlockManager::getUserBlock.
- PHPVersionCheck: The PHP Group only supports PHP >= 7.3.0.
- Set empty closures in DatabaseTest to fix PHP 8 tests.
- rdbms: Remove outdated MySQL 4 references and fix doc URLs.
- Special:Contributions reports negative namespace error on PHP 8.
- objectcache: Fix non-numeric string check in HashBagOStuff for PHP 8.
- Fix CacheTime::getCacheExpiry for PHP 8.
- Allow REST API POST handlers to opt out of mandatory SQLite locking.
- MWLBFactory: rename magic HTTP header for opting out of SQLite write lock.
- Fix DeprecationHelperTest on PHP 8.
- Upgrade wikimedia/less.php from 3.0.0 to 3.1.0 for PHP 8.0 support.
- OutputPage: Make $wgDebugRedirects work again.
- registration: Allow reusing cached metadata between wikis.
- CdnCacheUpdate: Send full URL instead of path to Curl for purge.
- Upgrade monolog/monolog from 1.25.3 to 2.2.0 for PHP 8.0 support.
- FileBackend: Do not use SOCKET_ENOENT on windows.
- ApiQueryUserInfo: Allow all uiprops to be requested at once.
- Escape wikitext in the title in invalid title error messages.
- Extend iwlinks.iwl_prefix to VARBINARY(32) on MySQL.
- PHPVersionCheck: Complain about known-bad versions above minimum.
- Upgrade wikimedia/composer-merge-plugin from 1.4.1 to 2.0.1 for Composer 2.0 support.
- Record all used options in metadata.
- Allow usage of Composer 2.0 to install MediaWiki's dependencies.
- skins: Call headElement() after getTemplateData() in SkinMustache.
- Add "Account data" section to user preferences.
- Add list of thumbnail urls to LocalFilePurgeThumbnails hook.
- registration: Allow specifying immovable namespaces in extension.json.
- Maintenance::hasOption and Maintenance::getOption now behave as documented and are not altered by previous calls to these methods.
- Remove page inner join from subquery in SpecialWhatLinksHere.
- signup: added help message for security.
- maintenance: Don't create SearchUpdate in rebuildtextindex.php for page_namespace below 0.
- Mark ParserOptionsTests skipped on PHP 7.4.0-7.4.8.
- Switch to new MediaWiki logo by Serhio Magpie.
- Expand config-pingback-help, link to privacy policy in config-pingback.
- Fix documentation of user-global in $wgRateLimits.
- BackupDumper: Add -o as shortcode for --output.
- Disable DEFER_SET_LENGTH_AND_FLUSH headers to avoid HTTP errors.