diff options
| author | tron <tron> | 2010-04-07 10:21:11 +0000 |
|---|---|---|
| committer | tron <tron> | 2010-04-07 10:21:11 +0000 |
| commit | 9aa1736e178759b958356bbd1a536024aab41f13 (patch) | |
| tree | 947860b8fc5c9cdd8f68d2b897906bb6a67133dc | |
| parent | 91c5dd4c8f760dc45215af84e1ae944a02631b67 (diff) | |
| download | pkgsrc-9aa1736e178759b958356bbd1a536024aab41f13.tar.gz | |
Pullup ticket #3073 - requested by martti
mediawiki: security update
Revisions pulled up:
- www/mediawiki/Makefile 1.11
- www/mediawiki/distinfo 1.7
---
Module Name: pkgsrc
Committed By: martti
Date: Wed Apr 7 05:40:11 UTC 2010
Modified Files:
pkgsrc/www/mediawiki: Makefile distinfo
Log Message:
Updated www/mediawiki to 1.15.3
This is a security and bugfix release of MediaWiki 1.15.3 and MediaWiki
1.16.0beta2.
MediaWiki was found to be vulnerable to login CSRF. An attacker who
controls a user account on the target wiki can force the victim to log
in as the attacker, via a script on an external website. If the wiki is
configured to allow user scripts, say with "$wgAllowUserJs = true" in
LocalSettings.php, then the attacker can proceed to mount a
phishing-style attack against the victim to obtain their password.
Even without user scripting, this attack is a potential nuisance, and so
all public wikis should be upgraded if possible.
Our fix includes a breaking change to the API login action. Any clients
using it will need to be updated. We apologise for making such a
disruptive change in a minor release, but we feel that security is
paramount.
For more details see https://bugzilla.wikimedia.org/show_bug.cgi?id=23076
| -rw-r--r-- | www/mediawiki/Makefile | 4 | ||||
| -rw-r--r-- | www/mediawiki/distinfo | 8 |
2 files changed, 6 insertions, 6 deletions
diff --git a/www/mediawiki/Makefile b/www/mediawiki/Makefile index ed354290124..e04c0a994ed 100644 --- a/www/mediawiki/Makefile +++ b/www/mediawiki/Makefile @@ -1,4 +1,4 @@ -# $NetBSD: Makefile,v 1.9.4.1 2010/03/09 10:51:51 tron Exp $ +# $NetBSD: Makefile,v 1.9.4.2 2010/04/07 10:21:11 tron Exp $ DISTNAME= mediawiki-${VER}.${PVER} CATEGORIES= www @@ -20,7 +20,7 @@ INSTALLATION_DIRS= ${EGDIR} share/mediawiki PKG_INSTALLATION_TYPES= overwrite pkgviews VER= 1.15 -PVER= 2 +PVER= 3 APACHE_USER?= www APACHE_GROUP?= www diff --git a/www/mediawiki/distinfo b/www/mediawiki/distinfo index ac1f33a66e1..3989a448493 100644 --- a/www/mediawiki/distinfo +++ b/www/mediawiki/distinfo @@ -1,5 +1,5 @@ -$NetBSD: distinfo,v 1.5.4.1 2010/03/09 10:51:51 tron Exp $ +$NetBSD: distinfo,v 1.5.4.2 2010/04/07 10:21:11 tron Exp $ -SHA1 (mediawiki-1.15.2.tar.gz) = c1e7e7243a052f3f9719f78573980c16f25da4b2 -RMD160 (mediawiki-1.15.2.tar.gz) = 46171059799d5a74b535523f562d3a5db7066f55 -Size (mediawiki-1.15.2.tar.gz) = 11469228 bytes +SHA1 (mediawiki-1.15.3.tar.gz) = 891bf5fb7479c88fbb4fd155666eafe510b2f92c +RMD160 (mediawiki-1.15.3.tar.gz) = 77e2d446672ab11832b2f913624d3358a3855651 +Size (mediawiki-1.15.3.tar.gz) = 11486661 bytes |