MediaWiki Security and Maintenance Release 1.23.5

[chris]

Announcement ​email:

I would like to announce the release of MediaWiki 1.19.20, 1.22.12 and 1.23.5. This is a security release. Download links are given at the end of this email.

Security

• (bug 70672) SECURITY: OutputPage: Remove separation of css and js module allowance.

Full release notes for 1.23.5: <​https://www.mediawiki.org/wiki/Release_notes/1.23>

[chris]

Following the MediaWiki#Updates notes:

sudo -i
cd /web/wiki.transitionnetwork.org
export MW="1.23.5"
wget http://releases.wikimedia.org/mediawiki/1.23/mediawiki-$MW.tar.gz -O mediawiki-$MW.tar.gz
wget http://releases.wikimedia.org/mediawiki/1.23/mediawiki-$MW.tar.gz.sig -O mediawiki-$MW.tar.gz.sig
gpg --verify mediawiki-$MW.tar.gz.sig 
tar -zxvf mediawiki-$MW.tar.gz
rsync -av mediawiki-$MW/ www/
chown root:root -R www/
chown -R www-data:www-data www/cache/
chown -R www-data:www-data www/images/
cd www/maintenance/
php update.php 
cd /web/wiki.transitionnetwork.org
rm mediawiki-$MW.tar.gz mediawiki-$MW.tar.gz.sig
rm -rf mediawiki-$MW

I tested the site and it all seems to be fine.

I also checked the sources.list for Parsoid as I didn't recall any updates for that and the line we had didn't match the ​install instructions so I updated /etc/apt/sources.list.d/parsoid.list to:

deb [arch=amd64] http://parsoid.wmflabs.org:8080/deb wmf-production main

Imported the new GPG key:

gpg --keyserver subkeys.pgp.net --recv-keys 00A5E8C26BF6E273
  gpg: requesting key 6BF6E273 from hkp server subkeys.pgp.net
  gpg: key 6BF6E273: public key "Parsoid <parsoid@wikimedia.org>" imported
  gpg: Total number processed: 1
  gpg:               imported: 1  (RSA: 1)
gpg -a --export 6BF6E273 | apt-key add -
OK

There wasn't an updated after doing the above.

[chris]

Closing ticket as this is resolved.