<?xml version="1.0"?>
<rss xmlns:dc="http://purl.org/dc/elements/1.1/" version="2.0">
  <channel>
    <title>Transition Technology: Ticket #686: MediaWiki 1.19.11 Update</title>
    <link>http://localhost:8080/trac/ticket/686</link>
    <description>&lt;p&gt;
On the &lt;a class="ext-link" href="http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-January/000140.html"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;MediaWiki-announce list&lt;/a&gt;:
&lt;/p&gt;
&lt;blockquote class="citation"&gt;
&lt;p&gt;
I would like to announce the release of MediaWiki 1.22.2, 1.21.5 and 1.19.11.
&lt;/p&gt;
&lt;p&gt;
Your MediaWiki installation is affected by a remote code execution vulnerability if you have enabled file upload support for DjVu (natively supported by MediaWiki) or PDF files (in combination with the PdfHandlerxtension). Neither file type is enabled by default in MediaWiki installations. If you are affected, we strongly urge you to update immediately.
&lt;/p&gt;
&lt;p&gt;
Affected supported versions: All
&lt;/p&gt;
&lt;h2 id="Securityfixes"&gt;Security fixes&lt;/h2&gt;
&lt;ul&gt;&lt;li&gt;Netanel Rubin from Check Point discovered a remote code execution
vulnerability in MediaWiki's thumbnail generation for DjVu files. Internal
review also discovered similar logic in the PdfHandler extension, which
could be exploited in a similar way. (CVE-2014-1610)
&lt;a class="ext-link" href="https://bugzilla.wikimedia.org/show_bug.cgi?id=60339"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://bugzilla.wikimedia.org/show_bug.cgi?id=60339&lt;/a&gt;
&lt;/li&gt;&lt;/ul&gt;&lt;h2 id="BugFixesin1.22.2"&gt;Bug Fixes in 1.22.2&lt;/h2&gt;
&lt;ul&gt;&lt;li&gt;(bug 58253) Check for very old PCRE versions in installer and updater
&lt;/li&gt;&lt;li&gt;(bug 60054) Make WikiPage::$mPreparedEdit public
&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;
Full release notes for 1.19.9:
&lt;/p&gt;
&lt;ul&gt;&lt;li&gt;&lt;a class="ext-link" href="https://www.mediawiki.org/wiki/Release_notes/1.19"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.mediawiki.org/wiki/Release_notes/1.19&lt;/a&gt;
&lt;/li&gt;&lt;/ul&gt;&lt;/blockquote&gt;
</description>
    <language>en-us</language>
    <image>
      <title>Transition Technology</title>
      <url>/trac/chrome/site/TransitionNetwork-Logo-Web-Small.jpg</url>
      <link>http://localhost:8080/trac/ticket/686</link>
    </image>
    <generator>Trac 0.12.5</generator>
    <item>
      
        <dc:creator>chris</dc:creator>

      <pubDate>Wed, 29 Jan 2014 10:26:03 GMT</pubDate>
      <title>hours, status, totalhours changed; resolution set</title>
      <link>http://localhost:8080/trac/ticket/686#comment:1</link>
      <guid isPermaLink="false">http://localhost:8080/trac/ticket/686#comment:1</guid>
      <description>
          &lt;ul&gt;
            &lt;li&gt;&lt;strong&gt;hours&lt;/strong&gt;
                changed from &lt;em&gt;0.0&lt;/em&gt; to &lt;em&gt;0.5&lt;/em&gt;
            &lt;/li&gt;
            &lt;li&gt;&lt;strong&gt;status&lt;/strong&gt;
                changed from &lt;em&gt;new&lt;/em&gt; to &lt;em&gt;closed&lt;/em&gt;
            &lt;/li&gt;
            &lt;li&gt;&lt;strong&gt;resolution&lt;/strong&gt;
                set to &lt;em&gt;fixed&lt;/em&gt;
            &lt;/li&gt;
            &lt;li&gt;&lt;strong&gt;totalhours&lt;/strong&gt;
                changed from &lt;em&gt;0.0&lt;/em&gt; to &lt;em&gt;0.5&lt;/em&gt;
            &lt;/li&gt;
          &lt;/ul&gt;
        &lt;p&gt;
Following the the notes at &lt;a class="wiki" href="http://localhost:8080/trac/wiki/PenguinServer#wiki.transitionnetwork.org"&gt;wiki:PenguinServer#wiki.transitionnetwork.org&lt;/a&gt; and the last upgrade, on &lt;a class="closed ticket" href="http://localhost:8080/trac/ticket/669" title="maintenance: Mediawiki upgrade to 1.19.10 (closed: fixed)"&gt;ticket:669&lt;/a&gt;:
&lt;/p&gt;
&lt;pre class="wiki"&gt;sudo -i
cd /web/wiki.transitionnetwork.org
export MW="1.19.11"
wget http://download.wikimedia.org/mediawiki/1.19/mediawiki-$MW.tar.gz -O mediawiki-$MW.tar.gz
wget http://download.wikimedia.org/mediawiki/1.19/mediawiki-$MW.tar.gz.sig -O mediawiki-$MW.tar.gz.sig
  gpg --verify mediawiki-$MW.tar.gz.sig
  gpg: Signature made Tue Jan 28 01:00:49 2014 GMT using DSA key ID 62D84F01
  gpg: Good signature from "Chris Steipp &amp;lt;csteipp@wikimedia.org&amp;gt;"
  gpg: WARNING: This key is not certified with a trusted signature!
  gpg:          There is no indication that the signature belongs to the owner.
  Primary key fingerprint: 1624 32D9 E81C 1C61 8B30  1EEC EE1F 6634 62D8 4F01
tar -zxvf mediawiki-$MW.tar.gz
rsync -av mediawiki-$MW/ www/
chown root:root -R www/
chown -R www-data:www-data www/cache/
chown -R www-data:www-data www/images/
cd www/maintenance/
php update.php
&lt;/pre&gt;&lt;p&gt;
The version was checked: ​​&lt;a class="ext-link" href="http://wiki.transitionnetwork.org/Special:Version"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;http://wiki.transitionnetwork.org/Special:Version&lt;/a&gt; and everthing seems fine.
&lt;/p&gt;
&lt;p&gt;
I have updated the documentation, moving the &lt;a class="wiki" href="http://localhost:8080/trac/wiki/MediaWiki"&gt;MediaWiki&lt;/a&gt; notes from &lt;a class="wiki" href="http://localhost:8080/trac/wiki/PenguinServer#wiki.transitionnetwork.org"&gt;wiki:PenguinServer#wiki.transitionnetwork.org&lt;/a&gt; to &lt;a class="wiki" href="http://localhost:8080/trac/wiki/MediaWiki"&gt;wiki:MediaWiki&lt;/a&gt;.
&lt;/p&gt;
      </description>
      <category>Ticket</category>
    </item>
 </channel>
</rss>