Current configuration on the wiki
Find a file
Kunal Mehta 4b59ce1f25 SECURITY: API: Escape i18n messages in action=feedcontributions
CVE-2025-6591

This is the same issue as CVE-2025-32072 (T386175), except in the
API's feedcontributions module. Escape the "Contributions" and
"colon-separator" messages so administrators cannot inject HTML
into them, triggering a potential XSS in feed readers.

Bug: T392276
Change-Id: Ic590a0d0cfc0a4a1e61859ecc57a175a8f5ec098
2025-06-30 19:58:26 +01:00
.phan structure tests: allow PHP 8.1 syntax and autoload enums 2025-06-18 10:55:15 +01:00
cache In .htaccess deny files, use "Satisfy All" 2025-04-04 13:17:15 +00:00
docs [REST Sandbox] Remove SwaggerUI from MediaWiki Releases 2025-06-30 16:05:49 +01:00
extensions Update git submodules 2025-06-30 14:30:45 +00:00
images
includes SECURITY: API: Escape i18n messages in action=feedcontributions 2025-06-30 19:58:26 +01:00
languages [REST Sandbox] Remove SwaggerUI from MediaWiki Releases 2025-06-30 16:05:49 +01:00
maintenance composer.json: Updated nikic/php-parser from ^4.10.2 to ^5.3.1 2025-06-18 10:54:38 +01:00
mw-config installer: Fix class name in example override 2025-01-25 15:07:10 +00:00
resources [REST Sandbox] Remove SwaggerUI from MediaWiki Releases 2025-06-30 16:05:49 +01:00
skins Update git submodules 2025-06-24 06:32:01 +00:00
tests specials: SpecialTalkPage: Use config from request context 2025-06-28 15:11:13 +00:00
vendor@b96399785b Update git submodules 2025-06-16 09:42:09 +00:00
.dockerignore
.editorconfig Fix .editorconfig for tests/parser/ directory 2024-02-27 17:35:16 +01:00
.eslintignore REST: validate JSON in tests 2024-09-20 15:42:32 +00:00
.eslintrc.json
.fresnel.yml
.git-blame-ignore-revs Add .git-blame-ignore-revs 2024-06-02 23:03:04 +02:00
.gitattributes
.gitignore Branch commit for REL1_43 2024-10-22 12:47:33 -04:00
.gitmessage
.gitmodules Branch commit for REL1_43 2024-10-22 12:47:33 -04:00
.gitreview
.mailmap build: De-duplicate two recent CREDITS additions via mailmap 2024-09-11 10:02:02 -07:00
.phpcs.xml build: Use inline ignore for MediaWiki.Usage.DeprecatedGlobalVariables 2024-09-26 18:15:32 +00:00
.stylelintrc.json
.svgo.config.js
.vsls.json
api.php Namespace includes/context 2024-02-08 11:07:01 -05:00
autoload.php [REST Sandbox] Remove SwaggerUI from MediaWiki Releases 2025-06-30 16:05:49 +01:00
CODE_OF_CONDUCT.md
composer.json composer.json: Updated nikic/php-parser from ^5.3.1 to ^5.5.0 2025-06-18 10:30:59 +00:00
composer.local.json-sample
COPYING
CREDITS build: De-duplicate two recent CREDITS additions via mailmap 2024-09-11 10:02:02 -07:00
DEVELOPERS.md Codex: Allow a local development version to be used 2024-08-22 17:20:24 -07:00
docker-compose.yml dev(docker): Bump mediawiki-web container to dev/bookworm-apache2:1.0.1 2025-01-07 17:02:36 +00:00
FAQ
Gruntfile.js Merge "codex: Provide i18n function and messages" 2024-07-03 07:06:47 +00:00
HISTORY HISTORY: Add point releases 2024-10-01 02:21:50 +01:00
img_auth.php filerepo: extract AuthenticatedFileEntryPoint from img_auth.php 2024-05-16 13:22:00 +02:00
index.php Namespace includes/context 2024-02-08 11:07:01 -05:00
INSTALL INSTALL: Document requirement for bcmath/gmp on 32-bit systems 2025-04-18 15:57:48 +00:00
jsdoc.json Update jsdoc-wmf-theme from 1.0.1 to 1.1.0 2024-06-27 19:29:24 +00:00
load.php ResourceLoader: Follow-up creation of ResourceLoaderEntryPoint 2024-02-22 22:30:39 +00:00
opensearch_desc.php Replace direct use of $wgRestPath with wfScript() 2024-07-01 22:01:32 +00:00
package-lock.json build: Updating npm dependencies 2025-01-06 08:38:45 -05:00
package.json Merge "Update Codex from v1.13.1 to v1.14.0" 2024-10-16 17:26:41 +00:00
phpunit.xml.dist phpunit: Determine what extensions to load in unit tests via config 2023-09-25 23:03:48 +00:00
README.md docs: Link to "Local development quickstart" in README 2024-01-22 13:58:11 +00:00
RELEASE-NOTES-1.43 RELEASE-NOTES-1.43: Update 2025-06-24 21:12:11 +00:00
rest.php Use namespaced classes (1) 2024-06-16 20:18:23 +02:00
SECURITY
thumb.php Use namespaced classes (1) 2024-06-16 20:18:23 +02:00
thumb_handler.php Use namespaced classes (1) 2024-06-16 20:18:23 +02:00
UPGRADE UPGRADE: Update mailing list archive link 2024-04-14 21:36:52 +03:00

MediaWiki

MediaWiki is a free and open-source wiki software package written in PHP. It serves as the platform for Wikipedia and the other Wikimedia projects, used by hundreds of millions of people each month. MediaWiki is localised in over 350 languages and its reliability and robust feature set have earned it a large and vibrant community of third-party users and developers.

MediaWiki is:

  • feature-rich and extensible, both on-wiki and with hundreds of extensions;
  • scalable and suitable for both small and large sites;
  • simple to install, working on most hardware/software combinations; and
  • available in your language.

For system requirements, installation, and upgrade details, see the files RELEASE-NOTES, INSTALL, and UPGRADE.

MediaWiki is the result of global collaboration and cooperation. The CREDITS file lists technical contributors to the project. The COPYING file explains MediaWiki's copyright and license (GNU General Public License, version 2 or later). Many thanks to the Wikimedia community for testing and suggestions.