diff options
authortron <>2010-04-07 10:21:11 +0000
committertron <>2010-04-07 10:21:11 +0000
commitb39e0a40d1a4c285ea65ed2d7b3fb52901933eea (patch)
parentf2a9fb29ce285f6ad6e8e8125e7f9cddf87006c3 (diff)
Pullup ticket #3073 - requested by martti
mediawiki: security update Revisions pulled up: - www/mediawiki/Makefile 1.11 - www/mediawiki/distinfo 1.7 --- Module Name: pkgsrc Committed By: martti Date: Wed Apr 7 05:40:11 UTC 2010 Modified Files: pkgsrc/www/mediawiki: Makefile distinfo Log Message: Updated www/mediawiki to 1.15.3 This is a security and bugfix release of MediaWiki 1.15.3 and MediaWiki 1.16.0beta2. MediaWiki was found to be vulnerable to login CSRF. An attacker who controls a user account on the target wiki can force the victim to log in as the attacker, via a script on an external website. If the wiki is configured to allow user scripts, say with "$wgAllowUserJs = true" in LocalSettings.php, then the attacker can proceed to mount a phishing-style attack against the victim to obtain their password. Even without user scripting, this attack is a potential nuisance, and so all public wikis should be upgraded if possible. Our fix includes a breaking change to the API login action. Any clients using it will need to be updated. We apologise for making such a disruptive change in a minor release, but we feel that security is paramount. For more details see
2 files changed, 6 insertions, 6 deletions
diff --git a/www/mediawiki/Makefile b/www/mediawiki/Makefile
index ed354290124..e04c0a994ed 100644
--- a/www/mediawiki/Makefile
+++ b/www/mediawiki/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 2010/03/09 10:51:51 tron Exp $
+# $NetBSD: Makefile,v 2010/04/07 10:21:11 tron Exp $
DISTNAME= mediawiki-${VER}.${PVER}
@@ -20,7 +20,7 @@ INSTALLATION_DIRS= ${EGDIR} share/mediawiki
PKG_INSTALLATION_TYPES= overwrite pkgviews
VER= 1.15
-PVER= 2
+PVER= 3
diff --git a/www/mediawiki/distinfo b/www/mediawiki/distinfo
index ac1f33a66e1..3989a448493 100644
--- a/www/mediawiki/distinfo
+++ b/www/mediawiki/distinfo
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 2010/03/09 10:51:51 tron Exp $
+$NetBSD: distinfo,v 2010/04/07 10:21:11 tron Exp $
-SHA1 (mediawiki-1.15.2.tar.gz) = c1e7e7243a052f3f9719f78573980c16f25da4b2
-RMD160 (mediawiki-1.15.2.tar.gz) = 46171059799d5a74b535523f562d3a5db7066f55
-Size (mediawiki-1.15.2.tar.gz) = 11469228 bytes
+SHA1 (mediawiki-1.15.3.tar.gz) = 891bf5fb7479c88fbb4fd155666eafe510b2f92c
+RMD160 (mediawiki-1.15.3.tar.gz) = 77e2d446672ab11832b2f913624d3358a3855651
+Size (mediawiki-1.15.3.tar.gz) = 11486661 bytes