= MediaWiki release notes =

Security reminder: MediaWiki does not require PHP's register_globals
setting since version 1.2.0. If you have it on, turn it *off* if you can.

== MediaWiki 1.7.3 ==

February 20, 2007

This is a security and bug-fix update to the Summer 2006 quarterly release.

An XSS injection vulnerability based on Microsoft Internet Explorer's UTF-7
charset autodetection was located in the AJAX support module, affecting MSIE
users on MediaWiki 1.6.x and up when the optional setting $wgUseAjax is
enabled.

If you are using an extension based on the optional Ajax module,
either disable it or upgrade to a version containing the fix:

* 1.9: fixed in 1.9.3
* 1.8: fixed in 1.8.4
* 1.7: fixed in 1.7.3
* 1.6: fixed in 1.6.10

There is no known danger in the default configuration, with $wgUseAjax off.

* Add 'charset' to Content-Type headers on various HTTP error responses
  to forestall additional UTF-7-autodetect XSS issues. PHP sends only
  'text/html' by default when the script didn't specify more details,
  which some inconsiderate browsers consider a license to autodetect
  the deadly, hard-to-escape UTF-7.
    This fixes an issue with the Ajax interface error message on MSIE when
  $wgUseAjax is enabled (not default configuration); this UTF-7 variant
  on a previously fixed attack vector was discovered by Moshe BA from BugSec:
  http://www.bugsec.com/articles.php?Security=24
* Trackback responses now specify XML content type


== MediaWiki 1.7.2 ==

January 9, 2007

* Note about $wgUploadSizeWarning using byte
* Update to German bookstore list (de)
* (bug 6680) Added localisation for Dutch bookstore list (nl)
* (bug 6708) Minor updates to Russian translation (ru)
* (bug 6730) Clearer usage of message 'titlematch' in German translation (de)
* Added direction mark to Special:Listredirects
* XSS fix in AJAX module

An XSS injection vulnerability was located in the AJAX support module,
affecting MediaWiki 1.6.x and up when the optional setting $wgUseAjax
is enabled.

There is no danger in the default configuration, with $wgUseAjax off.

If you are using an extension based on the optional AJAX module,
either disable it or upgrade to a version containing the fix:

* 1.9: fixed in 1.9.0rc2
* 1.8: fixed in 1.8.3
* 1.7: fixed in 1.7.2
* 1.6: fixed in 1.6.9

== MediaWiki 1.7.1 ==

July 8, 2006

MediaWiki 1.7.1 is a security and bugfix maintenance release of the
Summer 2006 snapshot:

A potential HTML/JavaScript-injection vulnerability in a debugging script
has been fixed. Only versions and configurations of PHP vulnerable to the
$GLOBALS overwrite vulnerability are affected.

As a workaround for existing installs, profileinfo.php may simply be deleted
if it's not being used.

* Fix for 'emailconfirmed' implicit user group
* Fix for upgrades on some versions of MySQL 4.0.x
* Fixed potential XSS in profileinfo.php
* Installer now shows clear error message about old PHP versions
  rather than a confusing parse error


== MediaWiki 1.7.0 ==

July 6, 2006

This is the quarterly release snapshot for Summer 2006. While the code
has been running on Wikipedia for some time, installation and upgrade
bits may be less well tested. Bug fix releases may follow in the coming
days or weeks.


MediaWiki is now using a "continuous integration" development model with
quarterly snapshot releases. The latest development code is always kept
"ready to run", and in fact runs our own sites on Wikipedia.

Release branches will continue to receive security updates for about a year
from first release, but nonessential bugfixes and feature development happen
will be made on the development trunk and appear in the next quarterly release.

Those wishing to use the latest code instead of a branch release can obtain
it from source control: http://www.mediawiki.org/wiki/Download_from_SVN


== Compatibility ==

MediaWiki 1.7 requires PHP 5 (5.1 recommended). PHP 4 is no longer supported.

If you are unable to run PHP 5, you may have to stick with 1.6 for now.

MySQL 3.23.x is no longer supported; some older hosts may need to upgrade.
At this time we still recommend 4.0, but 4.1/5.0 will work fine in most cases.

Experimental Oracle support has been dropped as it is unmaintained.


== Upgrading ==

Several changes to the database have been made from 1.6:

* A new "langlinks" table tracks interlanguage links
* A new "filearchive" table stores information on deleted files
* A new "querycache_info" table stores information on query page updates

To ensure that these tables are filled with data, run refreshLinks.php after
the upgrade.

If you are upgrading from MediaWiki 1.4.x or earlier, some major database
changes are made, and there is a slightly higher chance that things could
break. Don't forget to always back up your database before upgrading!

See the file UPGRADE for more detailed upgrade instructions.


== Configuration changes ==

Some configuration options have changed:
* $wgAllowExternalImages now defaults to off for increased security.
* $wgLocalTZoffset was in hours, it is now using minutes.
* Extensions may register special pages via the $wgSpecialPages array
  without forcing an early load of the SpecialPage.php class file.


== Major new features ==

* Deleted files can now be archived and undeleted, if you set up
  an appropriate non-web-accessible directory.
  Set $wgSaveDeletedFiles on and an appropriate directory path in
  $wgFileStore['deleted']['directory']
* Experimental PostgreSQL support has been updated. It may or may
  not be in usable shape; those interested in PostgreSQL are encouraged
  to follow 1.8 development.



== Changes since 1.6 ==

* (bug 5458) Fix double-URL encoding in block log link in contribs and contribs
  link in block log
* (bug 5462) Bogus missing patch warning in updater
* (bug 5461) Use of deprecated "showhideminor" in Special:Recentchangeslinked
* PHP warning when allow_call_time_pass_reference is off
* Update to Finnish localization
* (bug 5467) Link to page histories in watchlist edit mode
* Further additions to Hebrew localisation
* (bug 5476) Invalid xhtml in German localization
* (bug 5479) Id translation for preferences tabs caption
* (bug 5493) Id translation for special pages
* Added skinname and style path parameters to CBT version of MonoBook
* Include subversion revision number in Special:Version if available
* (bug 5344) Fix regression that broke slashes in extension tag parameters
* Improve Special:Log performance on big log sets
* (bug 5507) Changed mediawiki:logouttext from plain to wikitext
* (bug 4760) Prevent creation of entries in protection log when protection
  levels haven't changed
* (bug 861) Show page protection/unprotection events in histories
* (bug 5499) Don't clear the tag strip state when asked not to clear state.
  Fixes regression with use of <ref> in a template breaking <nowiki> etc.
* Minor improvements to English language files
* Display the anon talk page info message on anon talk pages again
  (moved outside the parser cache)
* Optional {{DISPLAYTITLE|title with markup}} magic word
  Deactivated by default, set "$wgAllowDisplayTitle = true" in LocalSettings.php
  to activate
* Cleaned SpecialContributions a bit
* Added a table to track interlanguage links
* (bug 5544) Fix redirect arrow in Special:Listredirects for right-to-left
  languages
* Replace "doubleredirectsarrow" with a content language check that picks the
  appropriate arrow
* (bug 5537) Add stub language file for Samogitian (bat-smg); inherits
  Lithuanian (lt)
* Don't force edit summaries when a user is editing their own user/talk page
* (bug 5510) Warning produced when using {{SUBPAGENAME}} in some namespaces
* (bug 385) Installer support for PostgreSQL, fixes for PG compatibility
* PersistentObject removed; it doesn't do anything and was broken besides.
  All extensions using it have been corrected.
* Propagate ISBN number for Booksources in LanguageNo.php
* (bug 5548) Improvements to Indonesian localisation [patch: Ivan Lanin]
* Add TALKSPACE, SUBJECTSPACE, TALKPAGENAME, SUBJECTPAGENAME (and encoded forms
  for all) magic words
* (bug 5403) Fix Special:Newpages RSS/Atom feeds
* Reject malformed addresses in X-Forwarded-For entries
* (bug 3359) Add hooks on completion of file upload
* (bug 5559) Improve detection of ImageMagick [patch: Greg Turnquist]
* (bug 5475) New pages feeds ignore "limit" argument
* (bug 5184) CSS misapplied to elements in Special:Allmessages due to
  conflicting anchor identifiers
* (bug 5519) Allow sidebar cache to be disabled; disable it by default.
* Maintenance script to import the contents of a text file into a wiki page
* Add $wgReservedUsernames configuration directive to block account creation/use
* (bug 5576) Remove debugging hack in session check
* (bug 5426) Lowercase treatment of titles in rights log leads to broken links
  on Special:Log
* Minor improvements to French localisation files
* (bug 5181) Update "nogomatch" for Slovak
* (bug 5594) Id translation up to # Login and logout pages section
* (bug 5536) Use content language for editing help link
* Improvements to German localisation files
* (bug 5570) Problems using <special page>/parameter link form for long titles
* (bug 3884) Add $user parameter to AddNewUser hook, call it for by-email 
  registrations as well as self-registrations.
* (bug 4327) Report age of cached data sets in query pages
* (bug 4662) Fix Safari check in wikibits.js
* (bug 4663) Edit toolbar enabled in compatible versions of Safari
* (bug 5572) Edit toolbar enabled in compatible versions of Konqueror (3.5+)
* (bug 5235) Edit toolbar tooltips no longer show JavaScript junk in Opera
* Edit toolbar now works in pure XHTML mode (application/xhtml+xml)
* Add watchlist clear function to allow quick purging of all items
* (bug 5625) Additional namespace translations for Welsh
* Add meta tag and JavaScript variables to cached special pages which provides
  the timestamp of the last update, in YYYYMMDDHHMMSS format.
* (bug 5628) More translations for MessagesHr.php
* (bug 5595) Localisation for Bosnian language (bs)
* (bug 2910) Default view preferences for watchlists
* Add "hide bot edits from the watchlist" user preference
* (bug 5250) Introduce Special:Unusedtemplates
* Add user preference setting for an extended watchlist, showing all recent 
  edits up to a certain edit, and not just the latest edit..
* Made MessageRo.php more general
* (bug 5640) Indonesian localisation improvements
* (bug 5592) Actions are logged with the default language for the
   wiki, not the language of the user performing the operation.
* (bug 5644) Error in LanguageBs.php file
* (bug 5646) Compare for identical types in wfElement()
* (bug 5472) Language::userAdjust()->minDiff not initialized on else condition
* (bug 5386) LanguageMk.php: updated namespaces translations
* (bug 5422) Stub for Romani (rmy) language which extends ro
* Fix linktrail for LanguageSr
* (bug 5664) Fix Bosnian linktrail
* (bug 3825) Namespace filtering on Special:Newpages
* (bug 1922) When Special:Wantedpages is cached, mark links to pages
  which have since been created
* (bug 5659) Change grammar hacks for Bosnian Wikimedia namespaces.
  This sort of special casing should be removed and fixed properly.
* Remove useless whitespace from Special:Brokenredirects header
* Treat "allmessagesnotsupporteddb" as wikitext when echoing; change default
  text
* (bug 5497) Regression in HTML normalization in 1.6 (unclosed <li>,<dd>,<dt>)
* (bug 5709) Allow customisation of separator for categories
* (bug 5684) Introduce Special:Randomredirect
* (bug 5611) Add a name attribute to the text box containing source text in
  read-only pages
* Indicate when a protected page is an interface message ("protectedinterface")
* (bug 4259) Indicate when a protected page being edited is an interface message
  ("editinginterface")
* (bug 4834) Fix XHTML output when using $wgMaxTocLevel
* Pass login link to "whitelistedittext" containing 'returnto' parameter
* (bug 5728): mVersion missing from User::__sleep() leading to constant cache
  miss
* Updated maintenance/transstat.php so it can show duplicate messages
* Improvements to update scripts; print out the version, check for superuser
  credentials before attempting a connection, and produce a friendlier error if
  the connection fails
* (bug 5005) Fix XHTML <gallery> output.
* (bug 5315) "Expires: -1" HTTP header made strictly valid (using 1970 date).
* (bug 4825) note in DefaultSettings.php about 'profiling' table creation
* Remove unneeded extra whitespace at top of Special:Categories
* (bug 5679) time units are now using local numerals
* (bug 5751) Updates to Portuguese localisation files
* (bug 5741) Introduce {{NUMBEROFUSERS}} magic word
* (bug 93) <nowiki> tags and tildes in templates
* The returnto parameter is now actually used by SpecialUserlogin.php
* Parser can now know that it is parsing an interface message
* (bug 4737) MediaWiki:Viewcount supports {{PLURAL}} now
* Fix bug in wfMsgExt under PHP 5.1.2
* (bug 5761) Project talk namespace broken in Xal, Os, Udm and Cv
* Rewrite reassignEdits script to be more efficient; support optional updates to
  recent changes table; add reporting and silent modes
* Cleaned up formatNum usage in langfiles
* (bug 5716) Warn when a user tries to upload a file which was previously
  deleted
* (bug 5565) Add a class attribute to the table on Special:Allpages
* "lang=xx" option for parser test cases to set content language
* (bug 5764) Friulian translation updated
* (bug 5757) Fix premature cutoff in LanguageConverter with extra end markers
* (bug 5516) Show appropriate "return to" link on blocked page
* (bug 5377) Do not auto-login when creating an account as another user
* (bug 5284) Special redirect pages should remember parameters
* Suppress 7za output on dumpBackup
* (bug 5338) Reject extra initial colons in title
* (bug 5487) Escape self-closed HTML pair tags
* Add "raw suffix" magic word for some magic words, e.g. {{NUMBEROFUSERS|R}}
  will produce a count minus formatting
* Fix Parser::cleanSig() to use Parser::startExternalParse() and choose an
  appropriate output format given the scope of the clean
* (bug 5593) Change "bureaucrat log" to "rights log"
* Show a boilerplate "(none)" in place of a blank within the log action text for
  user rights
* (bug 137) Commented out translations for copyrightwarning which mention GNU FDL
* (bug 5723) Don't count pages linked to from the MediaWiki namespace as "wanted"
* (bug 5696) Add a third parameter, $3, to "rcnote", passing the current time
  formatted according to the current user's settings
* (bug 5780) Thousands and decimal separators for Norwegian
* Updated initStats maintenance script
* (bug 5767) Fix date formats in Vietnamese locale
* (bug 361) URL in URL, they were almost fixed. Now they are.
* (bug 4876) Add __NEWSECTIONLINK__ magic word to force the "new section" link/tab to
  show up on specific pages on demand
* Bidi-aid on list pages
* (bug 5782) Allow entries in the bad image list to use canonical namespace names
* (bug 5789) Treat "loginreqpagetext" as wikitext
* Sanitizer: now handles nested <li> in <ul> or <ol>
* (bug 5796) We require MySQL >=4.0.14
* Add 'EmailConfirmed' hook
* New findhooks.php script to find undocumented hooks.
* Silently ignore errors on profiling table update.
* (bug 5801) Correct handling of underscores in Special:Listusers
* Clean up Special:Listusers; add an "(all)" label to the group selection box
* (bug 5812) Use appropriate link colour in Special:Mostlinked
* (bug 5802) {{CURRENTMONTHNAME}} variable broken in Vietnamese locale
* (bug 5817) Appropriate handling for Special:Recentchangeslinked where the target
  page doesn't exist
* Special:Randompage now additionally accepts English namespace name as parameter
* (bug 2981) Really fixed linktrail for Tamil (ta)
* Disallow substituting Special pages when included into a page
* (bug 5587) Clean up the languages from references to the Groups special page
* Added new group-X and group-X-member messages
* Rewritten removeUnusedAccounts to be more efficient, print names of inactive
  accounts
* Redirect Special:Userlist to Special:Listusers
* Introduce $wgAllowTitlesInSVG, which allows the <title> attribute in uploaded files
  bearing the image/svg MIME type. Disabled by default due to the vast majority of
  web servers being hideously misconfigured. See DefaultSettings.php for more details.
* Changed default LocalSettings.php to append the previous include path when setting it
* (bug 5837) Use "members" for the value descriptor in Special:Categories,
  Special:Wantedcategories and Special:Mostlinkedcategories.
* (bug 3309) Allow comments when undeleting pages
* Clean up Special:Undelete a bit
* (bug 5805) messages nbytes, ncategories can now use {{plural:}}
* Clean up Special:Imagelist a bit
* (bug 5838) Namespace names for Nds-NL
* (bug 5749) Added Tyvan language files
* (bug 5791) Fix SQL syntax in Special:BrokenRedirects, was causing incorrect data to show
* (bug 5839) Prevent access to Special:Confirmemail for logged-out users
* (bug 5853) Update for Portuguese messages (pt)
* (bug 5851) Use Cyrillic for Kirghiz language name
* (bug 5841) Allow the 'EditFilter' hook to return a non-fatal error message
* (bug 5846) Link to individual group description pages in Special:Listusers
* (bug 5857) Update for German localisation (de)
* (bug 5858) Update for Russian language (ru)
* (bug 5860) Update for Indonesian language (id)
* (bug 1120) Update for Czech language (Cs)
* Added many missing formatNum calls
* Added grammar function to Belarusian (be)
* (bug 5819) Add 'PersonalUrls' hook
* (bug 5862) Update of Belarusian language (be)
* (bug 5886) Update for Portuguese messages (pt)
* (bug 5586) <gallery> treated text as links
* (bug 5878) Update for Indonesian language (id)
* (bug 5697) Update for Malay language (ms)
* (bug 5890) Update for German language (de)
* (bug 5889) Name for Sindhi language should appear as سنڌي
* --force-normal parameter on dump scripts to force check for ICU extension
* (bug 5895) Update for Dutch language (nl)
* (bug 5891) Linktrail for Polish language (pl)
* User::isBureaucrat , User::isDeveloper , User::isSysop deprecated in
  v1.6 now die with a backtrace. They will be removed in v1.8
* dumpTextPass now skips goes to database for entries that were blank in the
  previous dump, as this may indicate a broken dump.
* dumpTextPass progress includes percentage of items prefetched
* dumpTextPass can now use 7zip files for prefetch
* (bug 5915) Update to Indonesian localisation (id)
* (bug 5913) Update for German localisation (de)
* (bug 5905) Plural support for Bosnian localisation (bs)
* Groups which won't hit the rate limiter now configurable with
  $wgRateLimitsExcludedGroups
* (bug 5806) {{plural:}} support instead of "twin" MediaWiki messages
* (bug 5931) Update for Polish language (pl)
* Ignore the user and user talk namespaces on Special:Wantedpages
* Introduce NUMBEROFPAGES magic word
* (bug 5833) Introduce CURRENTVERSION magic word
* (bug 5370) Allow throttling of password reminder requests with the rate limiter
* (bug 5683) Respect parser output marked as uncacheable when saving
* (bug 5918) Links autonumbering now work for all defined protocols
* (bug 5935) Improvement to German localisation (de)
* (bug 5937) Register links from gallery captions with the parent parser output
  object so that link tables receive those updates too
* (bug 5845) Introduce BASEPAGENAME and BASEPAGENAMEE magic words
* (bug 5941) Use content language when getting the administrator page title for
  Special:Statistics
* (bug 5949) Update to Indonesian localisation (id)
* (bug 5862) Update of Belarusian translation (be)
* (bug 5950) Improvements to French localisation
* (bug 5805) {{plural:}} support for counters in some special pages
* (bug 5952) Improvement to German localisation (de)
* Rename conflicting metadata help message to "metadata_help" (was "metadata")
  and treat it as wiki text
* Improve preferences input filtering
* Maintenance script to import multiple files into the wiki
* (bug 5957) Update for Hebrew language (he)
* (bug 5962) Update for Italian language (it)
* (bug 5961) Update for Portuguese localisation (pt)
* (bug 5849) Remove some hard-coded references to "Wikipedia" in messages
* (bug 5967) Improvement to German localisation (de)
* (bug 5962) Update for Italian language (it)
* Suppress images in galleries which appear on the bad image list (when rendering
  for a wiki page; galleries in special pages and categories are unaffected)
* Maintenance script to remove orphaned revisions from the database
* (bug 5991) Update for Russian language (ru)
* (bug 6001) PAGENAMEE and FULLPAGENAMEE don't work in FULLURL and LOCALURL magic
  words
* (bug 5958) Switch Uzbek language name to use latin script
* (bug 839) Add URLENCODE magic word
* (bug 6004) Update for Polish language (pl)
* (bug 5971) Improvement to German localisation (de)
* (bug 4873) Don't overwrite the subtitle navigation when viewing a redirect page
  that isn't current
* (bug 2203) Namespace updates for Thai
* Fix breakage in parser test suite which caused incorrect reporting of the failure of
  {{NUMBEROFFILES}}. Now initialises the site_stats table with some dumb data. Updated
  the expected output for {{NUMBEROFARTICLES}} to reflect this.
* (bug 6009) Use {{ns:project}} in messages where appropriate
* (bug 6012) Update to Indonesian localisation (id)
* (bug 6017) Update list of bookstores in German localisation files
* (bug 5187) Allow programmatically bypassing username validation, for scripts
* (bug 6025) SpecialImport: wrong message when no file selected
* (bug 6015) EditPage: add spacing in the boxes "edit is minor" and "watch this"
* (bug 6018) Userrights: new message when no user specified ('nouserspecified')
* (bug 2015) Add "\sim" to ~ conversion for HTML rendering
* (bug 6029) Improvement to German localisation (de)
* (bug 5015) Update be: magic words
* (bug 3974) Add parameter for site URL to "passwordremindertext"
* (bug 6039) Update for Portuguese localisation (pt)
* (bug 764) Add CREATE TEMPORARY TABLES to default database permissions
* Big update to Swedish localisation (sv)
* Use appropriate HTML functions to create the tool links on image pages, so they don't
  look garbled when tidy isn't on
* (bug 5511) Fix URL-encoding of usernames in links on Special:Ipblocklist
* (bug 6046) Update to Indonesian localisation (id) #15
* (bug 5523) $wgNoFollowNsExceptions to allow disabling rel="nofollow" in
  specially-selected namespaces.
* (bug 6055) Fix for HTML/JS injection bug in variable handler (found by Nick Jenkins)
* Reordered wiki table handling and __TOC__ extraction in the parser to better
  handle some overlapping tag cases.
* Only the first __TOC__ is now turned into a TOC
* (bug 4610) Indicate patrolled status on watchlists and allow users to mark
  changes as patrolled using the diff links there
* Add 'DiffViewHeader' hook called before diff page output
* (bug 6051) Improvement to German localisation (de)
* (bug 6054) Update to Indonesian localisation (id) #16
* Add {{CURRENTTIMESTAMP}} magic word
* (bug 6061) Improper escaping in some html forms
* (bug 6065) Remove underscore when using NAMESPACE and TALKSPACE magics.
* (bug 6074) Correct squid purging of offsite upload URLs
* To simplify the lives of extension developers, the logging type arrays
  can now be appended to directly by an extension setup function. It is
  no longer necessary to write four separate functions just to add a
  custom log type.
* (bug 6057) Count "licenses" as a message (and show it in Special:Allmessages)
* Added $wgGrammarForms global
* Fixed hardcoded 'done.' when removing watchlist entries.
* (bug 5962) Update for Italian language (it)
* (bug 6086) Remove vestigial attempt to call Article::validate()
* wfHostname() function for consistent server hostname use in debug messages
* Send thumbnailing error messages to 'thumbnail' log group
* wfShellexec() now accepts an optional parameter to receive the exit code
* Failed, but not zero-length, thumbnail renderings are now removed.
  Should help clean up when rsvg fails in weird ways.
* (bug 6081) Change description for Turkmen language
* Increase robustness of parser placeholders; fixes some glitches when
  adjacent to identifier-ish constructs such as URLs.
* Shut up the parser test whining about files in a temp directory.
* (bug 6098) Add Aragonese language support (an)
* (bug 6101) Update for Russian language (ru)
* Add $wgIgnoreImageErrors to suppress error messages for thumbnail rendering
  problems. If errors are transitory, this should reduce annoying messages
  making it into cached display.
* (bug 6103) Wrap self-links in a CSS class ("selflink")
* (bug 6102) For consistency with other markup, normalize all HTML-encoded
  character entities in URLs, not just ampersands. This allows use of eg
  &#61; when making URLs for template parameters.
* Markup anality: escape </ as <\/ in toolbar javascript for pure correctness
  under HTML-compatible browsers.
* (bug 5077) Added hook 'BeforePageDisplay' to SkinTemplate::outputPage
* Replace fatally changed 'uploadnewversion' with 'uploadnewversion-linktext'
* (bug 472) Syndication feeds for the last few edits of page history
* Format edit comments in Recent Changes feed
* Switch incorrectly ordered column headers on Recent Changes feed diffs
* (bug 6117) Use message for history feed description, add German localization
* (bug 1017) fixed thumbnails of animated gifs.
* Add APC as object caching option
* Update to Albanian localization (sq)
* (bug 6099) Introduce {{DIRECTIONMARK}} magic word (with {{DIRMARK}} as an alias)
* Use optimized php5-only microtime()
* Add possibility to store local message cache as PHP executable script
* Fix profiling table definition
* (bug 6040) Run pre-save transform before calculating the diff. when doing a
  "show changes" operation in the editor
* (bug 4033) Respect $wgStyleDirectory when checking available skins
* Remove hideous backslashes from MessagesBr.php
* Fix APC object cache issues, add functionality to installer
* (bug 6133) Update strip state as we work. This mostly fixes extensions
  used in Cite.php <ref> tags when Tidy is on.
* (bug 6139) Workaround for transclusion oddities in Vietnamese upload text
* (bug 6136) Update to Catalan language (ca)
* Update to Japanese localization (ja)
* Add /usr/local/bin to the diff3 search paths in the installer
* (bug 6106) Update to Indonesian localisation (id) #17
* (bug 6125) Add links to edit old versions to diff views
* (bug 5127) Auto edit summary when creating/editing redirect page
* (bug 3926) Introduce {{#language:}} magic word
* Fix section links from edit comments for [[:Image:Bla.jpg]] in section titles
* (bug 6126) Allow fallback to customized primary language when user language
  message contains '-'; fixes licenses selector on Commons configuration after
  recent addition of the message to Messages.php
* (bug 5527) Batch up job queue insertions for, hopefully, better survivability
  of lock contention etc. Duplicates are now removed at pop time instead of
  at insert time.
* When showing the "blah has been undeleted" page, make sure it's a blue link
* parserTests.php accepts a --file parameter to run an alternate test sutie
* parser tests can now test extensions using !!hooks sections
* Fix oddity with open tag parameters getting stuck on </li>
* (bug 5384) Fix <!-- comments --> in <ref> extension
* Nesting of different tag extensions and comments should now work more
  consistently and more safely. A cleaner, one-pass tag strip lets the
  'outer' tag either take source (<nowiki>-style) or pass it down to
  further parsing (<ref>-style). There should no longer be surprise
  expansion of foreign extensions inside HTML output, or differences
  in behavior based on the order tags are loaded.
* (bug 885) Pre-save transform no longer silently appends close tags
* Pre-save transform no longer changes the case of close tags
* (bug 6164) Fix regression with <gallery> resetting <ref> state
* Hackaround for IE 7 wrapping bug in MonoBook footer
* New message sp-newimages-showfrom replaces rclistfrom on special:newimages
* Improve handling of ;: definition list construct with overlapping or
  nested HTML tags
* (bug 6171) Fix sanitizing of HTML-elements with an optional closing
  tag. The sanitizer still needs to learn how to make well-formed XML
  in this case.
* Fix fatal error when specifying illegal name for manual thumbnail
* (bug 6184) Use shinier Linker::userLink() to make user links in
  Special:Undelete
* (bug 6170) Update for Kashubian translation (csb)
* (bug 6191) Update to Indonesian translation (id) #18
* (bug 6114) Update to Walloon localization (wa)
* Added $wgNamespaceRobotPolicies to allow customisation of robot policies on a 
  per-namespace basis.
* Add <ol> to the list of block elements for doBlockLevels; avoids <p>s being
  interspersed into your ordered lists.
* (bug 5021) Transcluding the same special page twice now works
* Add 'SiteNoticeBefore' and 'SiteNoticeAfter' hooks
* (bug 6182) Date passed in "sp-newimages-showfrom" not adjusted to user time
  preferences
* (bug 2587) Fix for section editing with comment prefix
* (bug 2607) Fix for section editing with mix of wiki and HTML headings
* (bug 3342) Fix for section editing with headings wrapped in <noinclude>
* (bug 3476) Fix for section editing with faux headings in extensions
* (bug 5272) Fix for section editing with HTML-heading subsections
* Fix for bogus wiki headings improperly detected with following text
* Fix for HTML headings improperly not detected with preceding/following text
* Section extraction and replacement functions merged into one implementation
  on the Parser object, so they can't get out of sync with each other.
* Edit security precautions in raw HTML mode, etc
* (bug 6197) Update to Indonesian translation (id) #19
* (bug 6175) Improvement to German translation (de)
* Redirect Special:Logs to Special:Log
* (bug 6206) Linktrail for Swedish localization (se)
* (bug 3202) Attributes now allowed on <pre> tags
* Sanitizer::validateTagAttributes now available to discard illegal/unsafe
  attribute values from an array.
* (bug 3837) Leave <center> as is instead of doing an unsafe text replacement
  to <div class="center">. <center> is perfectly valid in the target doctype
  (XHTML 1.0 Transitional), while the replacement didn't catch all cases and
  could even result in invalid output from valid input. 
* (bug 4280) Use 'noindex,nofollow' instead of 'noindex,follow' for default
  meta robots tag on diff view and special pages. Should reduce impact of
  robots on scrolling special pages, diffs etc on sites where robots.txt
  doesn't forbid access.
* Regression fix: suppress warning about session failure when clicking to
  edit with 'preview on first edit' enabled.
* (bug 6230) Regression fix: <nowiki> in [URL link text]
* Added AutoLoader.php, which loads classes without need of require_once()
* (bug 5981) Add plural function Slovenian (sl)
* (bug 5945) Introduce {{CONTENTLANGUAGE}} magic word
* {{PLURAL}} can now take up to five forms
* (bug 6243) Fix email for usernames containing dots when using PEAR::Mail
* Remove a number of needless {{ns:project}}-type transforms from messages files. These
  usages already have separate label text. Such transforms are wasteful on each page view.
* Update to Yiddish localization (yi)
* (bug 6254) Update to Indonesian translation (id) #20
* (bug 6255) Fix transclusions starting with "#" or "*" in HTML attributes
* Whitespace now normalized more or less properly in HTML attributes
* Fix regression(?) in behavior of initial-whitespace-pre in <center>
* (bug 6260) Update to Interlingua localization (ia)
* Update to Vlax Romany localization (rmy)
* Update to Latin translation (la)
* Update to Dutch translation (nl)
* Avoid some notices in page history with bad input
* Use double quoted consistently on attributes in linker output; preparing
  for new normalization code when tidy not in use
* Replace "nogomatch" with "noexactmatch" and place the magic colon in the messages
  themselves. Some minor tweaks to the actual message content.
* Introduce $wgContentNamespaces which allows for articles to exist in namespaces other
  than the main namespace, and still be counted as valid content in the site statistics.
* (bug 5932) Introduce {{PAGESINNAMESPACE}} magic word
* Disable $wgAllowExternalImages by default.
* (bug 2700) Nice things like link completion and signatures now work in <gallery> tags.
* Cancel output buffering in StreamFile; when used inside gzip buffering this
  could cause funny timeout behavior as the Content-Length was wrong.
* Return correct content-type header with 304 responses for StreamFile;
  it confuses Safari if you let it return "text/html".
* (bug 6280) Correct GRAMMAR for Slovenian localisation (sl)
* (bug 6162) Change date format for Dutch Low Saxon (nds-nl)
* (bug 6296) Update to Indonesian localisation (id) #21
* Introduce EditFormPreloadText hook, see docs/hooks.txt for more information
* (bug 4054) Add "boteditletter" to recent changes flags
* Update to Catalan localization (ca)
* (bug 2099) Deleted image files can now be archived and undeleted.
  Set $wgSaveDeletedFiles on and an appropriate directory path in
  $wgFileStore['deleted']['directory']
* (bug 6324) Fix regression in enhanced RC alignment
* Introduce {{NUMBEROFADMINS}} magic word
* Update to Slovak translation (sk)
* Update to Alemannic localization (gsw)
* (bug 6300) Bug fixes for sr: variants
* namespaceDupes.php can now accept an arbitrary prefix, for checking rogue
  interwikis and such. Not yet fully automated.
* (bug 6344) Add Special:Uncategorizedimages page
* (bug 6357) Update to Russian translation (ru)
* Workaround possible bug in Firefox nightlies by properly removing the
  Content-Encoding header instead of sending explicit 'identity' value
  in StreamFile
* (bug 6304) Show timestamp for current revision in diff pages
* Vertically align current version with old version header in diff display
* (bug 6174) Remove redundant "emailforlost" message 
* (bug 6189) Show an error to an unprivilleged user trying to create account
* (bug 6365) Show user information in the "old revision" navigation links
* Introduce 'FetchChangesList' hook; see docs/hooks.txt for more information
* (bug 6345) Update to Indonesian localisation (id) #22
* (bug 6279) Add genitive month names to Slovenian localisation
* (bug 6351) Update to German translation (de)
* Respect language directionality when displaying arrow in Special:Brokenredirects
* Remove unused "validation" table definitions from the schema files
* (bug 6398) Work around apparent PCRE bug breaking section editing when
  massively-indented preformatted text immediately followed a header
* (bug 6392) Fix misbehaving <br /> in preferences form
* Add translated magic words to Hebrew localization
* (bug 6396) Change name for Chuvash language
* Introduce optional (off by default) language selector bar for user login
  and registration. Customisable via the "loginlanguagelinks" message, the
  links will preserve "returnto" values. If the user creates an account while
  using such a link, then the language in use will be saved as their language
  preference.
* Make sure '~~~' '~~~~' '~~~~~' are removed in Nickname preference.
* Rename "ipusuccess" to "unblocked", change the format (now wiki text)
* (bug 2316) Add "caption" attribute to <gallery> tag
* Allow setting the skin object that ImageGallery will use; needed during parse
  operations (the skin must come from the ParserOptions, not $wgUser)
* Fix notice in MacBinary detection debug data for files of certain lengths
* (bug 6131) Add type detection for DjVu files, allowing them to be uploaded
  with validity checking and size detection. No inline thumbnailing yet,
  but could be added in the future.
* (bug 6423) Don't update newtalk flag if page content didn't change (null edits
  were causing the newtalk flag to trigger inappropriately)
* Parser functions are now set using magic words.
* (bug 6428) Incorrect form action URL on Special:Newimages with hidebots = 0 set
* (bug 4990) Show page source to blocked users on edits, or their modified version
  if blocked during an edit
* (bug 5903) When requesting the raw source of a non-existent message page,
  return blank content (as opposed to the message key)
* Improve default blank content of MediaWiki:Common.css and MediaWiki:Monobook.css
* (bug 6434) Allow customisation of submit button text on Special:Export
* (bug 6314) Add user tool links on page histories
* Fix display of file-type icons in galleries when $wgIgnoreImageErrors is off
* (bug 6438) Update to Indonesian translation (id) #23
* Adding the language code parameter to the hook "LanguageGetMagic", to allow
  localizble extensions magic words.
* Update to Romanian translation (ro)
* Update to Esperanto translation (eo)
* Check for preg_match() existence when installing and die out whining about PCRE
  if it's not there, instead of throwing a fatal error
* (bug 672) Add MathAfterTexvc hook
* Update to Piedmontese localization (pms)
* dumpBackup can optionally compress via dbzip2
* (bug 2483) Run link updates on change via XML import
* (bug 2481) List imported pages during Special:Import
* (bug 2482) Log and RC entries for Special:Import events
* Allow fetching all revisions from transwiki Special:Import
* Allow fetching all revisions from Special:Export GET request
* Disable output buffering on Special:Export; should help with streaming
  large numbers of history items.
* Allow setting a maximum number of revisions for history Special:Export;
  pages with more than $wgExportMaxHistory revisions are excluded from
  export when history is requested.
* Fix transwiki import of pages with space in name
* Save null edit when importing pages through Special:Import
* Update to Korean translation (ko)
* Show a more specific message when an anonymous user tries to access Special:Watchlist
* (bug 3278) Paging links in Special:Prefixindex
* Added Latvian localization (lv)
* (bug 6472) Fix regression in Special:Export with multiple pages
* Update to Macedonian translation (mk)
* Allow page moves over historyless self-redirects. Such are usually created
  as part of namespace rearrangements, and it's easier to clean them up if
  we can move over them.
* Show some error results in moveBatch.php
* (bug 6479) Allow specification of the skin to use during HTML dumps
* (bug 6461) Link to page histories in Special:Newpages
* (bug 6484) Don't do message transformations when preloading messages for editing
* (bug 6201) Treat spaces as underscores in parameters to {{ns:}}
* (bug 6006) Allow hiding the password change fields using an authentication plugin
* (bug 6489) Use appropriate link colour on Special:Shortpages
* Added formatnum magic word
* Added Javanese localization (jv)
* (bug 6491) Apply bad image list in category galleries
* (bug 6488) Show relevant log fragment in Special:Movepage
* Fix potential PHP notice in Special:Blockme when $wgBlockOpenProxies is true
* Use mysql_real_escape_string instead of addslashes for string escaping in
  the MySQL Database class. This may fix some rare breakage with binary fields.
  Note that MediaWiki does not support the multibyte character sets where a
  "dumb" byte replacement can be actively dangerous; UTF-8 is always safe
  in this regard due to the bit patterns which make head and tail bytes
  distinct.
* (bug 6497) Use $wgMetaNamespaceTalk for Esperanto if set
* (bug 6498) Use localized forms for image size in Special:Undelete
* (bug 6485) Update to Indonesian translation (id) #24
* Extension messages translation is now possible.
* Add target namespace override selector for transwiki imports.
  $wgImportTargetNamespace specifies the default, to be used for
  Wiktionary's 'Transwiki:' namespace etc.
* (bug 6506) Update to German localisation (de)
* (bug 502) Avoid silly tabs on bad title by using virtual special page
* (bug 6511) Add diff links to old revision navigation bar
* (bug 6511) Replace 'oldrevisionnavigation' message with 'old-revision-navigation'
* Fix regression in Polish genitive month forms
* (bug 4037) Make input handling in Special:Allpages and Special:Prefixindex
  more consistent: Accept just a namespace prefix and a colon, reject input
  with interwiki prefixes, otherwise do what Title::makeTitleSafe() does.
* (bug 6516) Update to Russian translation
* New 'allpagesbadtitle' message for Special:Allpages, based on 'badtitletext'.
* Rename "searchquery" to "searchsubtitle" and support wiki text in it
* Introduce updateArticleCount maintenance script which uses a better check that
  reflects what Article::isCountable() tests for
* Introduce 'BadImage' hook; see docs/hooks.txt for more information
* Add "searchsubtitleinvalid" message for searches that are not valid titles.
* (bug 5962) Update to Italian localisation
* (bug 6530) Update to Indonesian localisation (id) #25
* (bug 6523) Fix SVG issue in rebuildImages.php
* (bug 6512) Link to page-specific logs on page histories
* (bug 6504) Allow configuring session name with $wgSessionName
* (bug 6185) Add standard user tool links to log page views
* Update to Venetian translation (vec)
* Update to Slovenian translation (sl)
* Add standard user tool links to deleted revision list
* Separate out EditPage's getContent bits from regular Article getContent.
  Cleans up read-only-mode warning on empty pages and neats up some code.
* (bug 6565) Strict JavaScript writing
* (bug 6570) Update to Indonesian localisation (id) #26
* Added Telugu translation (te)
* Update to Catalan translation (ca)
* (bug 6560) Avoid PHP notice when trimming ISBN whitespace
* Added namespace translation to Kannada (ka)
* (bug 6566) Improve input validation on timestamp conversion
* Implicit group "emailconfirmed" for all users whose email addresses are confirmed
* (bug 6577) Avoid multiline parser breakage on <pre> with newline in attribute


=== Caveats ===

Some output, particularly involving user-supplied inline HTML, may not
produce 100% valid or well-formed XHTML output. Testers are welcome to
set $wgMimeType = "application/xhtml+xml"; to test for remaining problem
cases, but this is not recommended on live sites. (This must be set for
MathML to display properly in Mozilla.)


For notes on 1.5.x and older releases, see HISTORY.


=== Online documentation ===

Documentation for both end-users and site administrators is currently being
built up on Meta-Wikipedia, and is covered under the GNU Free Documentation
License:

  http://www.mediawiki.org/wiki/Documentation


=== Mailing list ===

A MediaWiki-l mailing list has been set up distinct from the Wikipedia
wikitech-l list:

  http://mail.wikimedia.org/mailman/listinfo/mediawiki-l

A low-traffic announcements-only list is also available:

  http://mail.wikimedia.org/mailman/listinfo/mediawiki-announce

It's highly recommended that you sign up for one of these lists if you're
going to run a public MediaWiki, so you can be notified of security fixes.


=== IRC help ===

There's usually someone online in #mediawiki on irc.freenode.net
