Mailing List Archive

MediaWiki stable release 2003-11-17 (security update)
New release contains a number of bug fixes (see release notes) and an
important security update (see below). All sites are strongly
encouraged to upgrade, or use the workarounds described below.

Release notes:


Previous versions of MediaWiki contained a flaw that could be exploited
in some configurations to execute arbitrary PHP code on the server if
the *.php files are located in a web-accessible directory and are
runnable through the PHP interpreter. This likely includes most

If you can't upgrade immediately, you should be able to easily
substantially reduce the risk by doing one or more of the following:

* Leave just LocalSettings.php and the *.phtml files exposed to the
web, moving the other *.php files into a directory that's not exposed
to the web; set $IP to point to this directory in LocalSettings.php.
* Remove the "$IP/" or "{$IP}/" from all include() and include_once()
statements, keeping the *.php and *.phtml files in one place.

* Explicitly disallow access to all the *.php files in the web server.

* Configure the server to run only *.phtml files through PHP, and not
*.php. (If you do this, be sure your database passwords are not exposed
through LocalSettings.php!)

-- brion vibber (brion @
Re: MediaWiki stable release 2003-11-17 (security update) [ In reply to ]
Since the release I've uncovered and fixed some new errors in the
maintenance scripts; also some old bugs in are now
fixed. If you need to use these, you can pull the fixed versions out of
CVS (-r stable) or grab an updated copy of the maintenance directory
alone here:

If you're not rebuilding your link tables, recentchanges, or search
index, you can ignore this.

-- brion vibber (brion @