[pkgsrc/pkgsrc-2009Q4]: pkgsrc/www/mediawiki Pullup ticket #3073 - requested ...

[tron <tron%pkgsrc.org@localhost>]

details:   https://anonhg.NetBSD.org/pkgsrc/rev/4c8690b4f98a
branches:  pkgsrc-2009Q4
changeset: 569306:4c8690b4f98a
user:      tron <tron%pkgsrc.org@localhost>
date:      Wed Apr 07 10:21:11 2010 +0000

description:
Pullup ticket #3073 - requested by martti
mediawiki: security update

Revisions pulled up:
- www/mediawiki/Makefile                1.11
- www/mediawiki/distinfo                1.7
---
Module Name:    pkgsrc
Committed By:   martti
Date:           Wed Apr  7 05:40:11 UTC 2010

Modified Files:
        pkgsrc/www/mediawiki: Makefile distinfo

Log Message:
Updated www/mediawiki to 1.15.3

This is a security and bugfix release of MediaWiki 1.15.3 and MediaWiki
1.16.0beta2.

MediaWiki was found to be vulnerable to login CSRF. An attacker who
controls a user account on the target wiki can force the victim to log
in as the attacker, via a script on an external website. If the wiki is
configured to allow user scripts, say with "$wgAllowUserJs = true" in
LocalSettings.php, then the attacker can proceed to mount a
phishing-style attack against the victim to obtain their password.

Even without user scripting, this attack is a potential nuisance, and so
all public wikis should be upgraded if possible.

Our fix includes a breaking change to the API login action. Any clients
using it will need to be updated. We apologise for making such a
disruptive change in a minor release, but we feel that security is
paramount.

For more details see https://bugzilla.wikimedia.org/show_bug.cgi?id=23076

diffstat:

 www/mediawiki/Makefile |  4 ++--
 www/mediawiki/distinfo |  8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diffs (31 lines):

diff -r c06932cf8860 -r 4c8690b4f98a www/mediawiki/Makefile
--- a/www/mediawiki/Makefile    Wed Apr 07 10:10:50 2010 +0000
+++ b/www/mediawiki/Makefile    Wed Apr 07 10:21:11 2010 +0000
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.9.4.1 2010/03/09 10:51:51 tron Exp $
+# $NetBSD: Makefile,v 1.9.4.2 2010/04/07 10:21:11 tron Exp $
 
 DISTNAME=      mediawiki-${VER}.${PVER}
 CATEGORIES=    www
@@ -20,7 +20,7 @@
 
 PKG_INSTALLATION_TYPES=        overwrite pkgviews
 VER=                   1.15
-PVER=                  2
+PVER=                  3
 
 APACHE_USER?=          www
 APACHE_GROUP?=         www
diff -r c06932cf8860 -r 4c8690b4f98a www/mediawiki/distinfo
--- a/www/mediawiki/distinfo    Wed Apr 07 10:10:50 2010 +0000
+++ b/www/mediawiki/distinfo    Wed Apr 07 10:21:11 2010 +0000
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.5.4.1 2010/03/09 10:51:51 tron Exp $
+$NetBSD: distinfo,v 1.5.4.2 2010/04/07 10:21:11 tron Exp $
 
-SHA1 (mediawiki-1.15.2.tar.gz) = c1e7e7243a052f3f9719f78573980c16f25da4b2
-RMD160 (mediawiki-1.15.2.tar.gz) = 46171059799d5a74b535523f562d3a5db7066f55
-Size (mediawiki-1.15.2.tar.gz) = 11469228 bytes
+SHA1 (mediawiki-1.15.3.tar.gz) = 891bf5fb7479c88fbb4fd155666eafe510b2f92c
+RMD160 (mediawiki-1.15.3.tar.gz) = 77e2d446672ab11832b2f913624d3358a3855651
+Size (mediawiki-1.15.3.tar.gz) = 11486661 bytes