Aurora
Adminer
Auto Root
WP Admin
cPanel Reset
Anti Backdoor
Root
var
softaculous
mw19
Upload
New Folder
New File
Name
Size
Permissions
Actions
..
-
-
-
Upload File
Select File
New Folder
Folder Name
New File
File Name
Add WordPress Admin
Database Host
Database Name
Database User
Database Password
Admin Username
Admin Password
cPanel Password Reset
Email Address
Edit: changelog.txt
= MediaWiki 1.43 = PHP 8.1 workboard: https://phabricator.wikimedia.org/tag/php_8.1_support/ PHP 8.2 workboard: https://phabricator.wikimedia.org/tag/php_8.2_support/ PHP 8.3 workboard: https://phabricator.wikimedia.org/tag/php_8.3_support/ PHP 8.4 workboard: https://phabricator.wikimedia.org/tag/php_8.4_support/ PHP 8.5 workboard: https://phabricator.wikimedia.org/tag/php_8.5_support/ == MediaWiki 1.43.9 == This is a security and maintenance release of the MediaWiki 1.43 branch. === Changes since 1.43.8 === * Localisation updates. * (T419192) Actions: Fix incorrect variable shadowing. * (T421659) Installer: Skip dropIndex() when table does not exists. * (T413545, T422879) Update wikimedia/parsoid to 0.20.8. * (T423185) HashSiteStore: Don't trigger PHP 8.5 warnings if the Site has no globalID. * Make CacheTime/ParserOutput JsonCodecable; deprecate older json classes. * ParserOutput: Add JsonCodec hints for TOCData and WarningMsgs. * (T414805) Media: Re-apply Use previous step for non-standard width between steps and original. * (T418745, T423895) Media: Fallback to the largest standard size if an overly large one is requested. * (T328921) Drop various PHP 7.4/8.0 support hacks, no longer needed. * (T261260) Re-add preloading of classes used in the header callback. * (T261260) Limit preloading workaround for autoload bug to PHP<8.6. * Upload: Avoid null array key in UploadBase::getMaxUploadSize. * (T395204) Unify logging of IP / user agent / etc on sensitive operations. * (T423502) AuthManager: Log status changes from SecuritySensitiveOperationStatusHook call. * (T419768) RawAction: Restrict content type to javascript. * HTMLForm: Add 'type' => 'button'. * (T395204) Update GetSecurityLogContext @since tags for backports. * (T402792, T414805, T416620, T418178) DjvuHandler: Make it follow thumb steps. * TextContentHandler::fillParserOutput: Drop old support for Content::getHtml, no longer needed. * (T410934) Remove noop xml_parser_free() call. * Drop empty ids. * (T425742) ApiQueryInfo: Pass an empty string instead of null to EditFormPreloadText hook. * (T424114) Media: Improve $wgThumbnailSteps docs. * resetUserEmail: Log email change to authentication log. * resetUserEmail: Add reason option for email change. * resetUserEmail: Log more events from script. * changePassword/resetUserEmail: Invalidate user sessions upon password change. * (T426861) composer.json: Updated symfony/yaml from 5.4.45 to 5.4.52. * (T366986) Parser: Improve recursive lock error message. * Add GitHub to $wgGitRepositoryViewers. * (T425818) changePassword: Log password change to authentication log. * changePassword: Add reason option for password change. * (T429826) Updated guzzlehttp/guzzle from 7.10.0 to 7.12.1. * (T423617) Check the target url for redirects are allowed. * (T429965) Updated guzzlehttp/guzzle from 7.12.1 to 7.12.3. * (T389161) Client-side date/time formatter library. * (T382781) Changed Levantine Arabic numerals to Western numerals. * (T382781) [PHP 8.4] Ensure Levantine Arabic numerals stay as Western numerals. * (T383047) UserMailer: hack: preserve multiple error callbacks. * (T383047) Mail: Extract sendWithMailFunction() from UserMailer::send(). * (T429720) FileRepo: Fix typos in schema compatibility checks. * (T383047) Mail: Log PHP mail() send failures with recipient count. * (T425406, CVE-2026-58036) SECURITY: Fix ApiQueryUsers leaking status of private user conditions for user. * (T422306, CVE-2026-58028) SECURITY: Disallow user JS in pretty-print api.php responses. * (T427235, CVE-2026-58033) SECURITY: Exclude rev-deleted usernames from distinct authors query. * (T426867, CVE-2026-58032) SECURITY: mw.Api.getErrorMessage: Treat formatversion=1 as text. * (T299359, CVE-2026-58026) SECURITY: Make sure the actual title that's being transcluded is includable. * (T422085, CVE-2026-58024) SECURITY: Restrict interwiki user lookup in ApiUserrights. * (T422676, CVE-2026-58029) SECURITY: Check for editmyprivateinfo right in more places. * (T422995, CVE-2026-58037) SECURITY: LogFormatter: 'raw' parameter format is no longer raw HTML. * (T422244, CVE-2026-58025) SECURITY: Safely unserialize log entry parameters. == MediaWiki 1.43.8 == This is a maintenance release of the MediaWiki 1.43 branch. === Changes since 1.43.7 === * Fixed backport issues. == MediaWiki 1.43.7 == This is a security and maintenance release of the MediaWiki 1.43 branch. === Changes since 1.43.6 === * Localisation updates. * (T386108) Upgrade pear/pear-core-minimal to v1.10.17. * (T412194) Upgrading justinrainbow/json-schema (5.3.0 => 5.3.1). * (T413538) MultiHttpClient: Remove curl_close() call. * (T413545) Upgrading wikimedia/parsoid (v0.20.4 => v0.20.5). * (T411213) Updated wikimedia/less.php from 5.1.2 to 5.5.0. * (T413565) Search: Replace deprecated SplObjectStorage methods. * Mime: Change mime type video/x-matroska to video/matroska. * Fix incorrect uses of ScopedCallback objects. * profiler: Correct function types documentation. * (T413582) ShellboxClientFactory: Handle $service being null in getUrl(). * (T413672) EtcdConfigTest: Add return value for some MultiHttpClient mocks. * (T413675) DBConnRefTest: Add a temporary variable for return value in testRoleExceptions. * (T413580) LanguageCodeTest: Remove unnecessary null assertion. * Allow wikimedia/testing-access-wrapper ^4.0.0. * Logging: Handle possible null as type for LogPage. * (T411019) Logging: Set default for log type on dropdown via LogEventsList. * (T413690) libs: Fix closure detection in MemoizedCallable. * (T378563) [BlockManager] Don't assume autoblocks have ::getParentBlockId. * (T378563) Fix bug in BlockManager::getUniqueBlocks. * (T413923) Don't use null offsets in BlockManager::getUniqueBlocks. * SiteConfiguration: Optimize processSetting for default-only case. * SiteConfiguration: Use \array_key_exists(). * SiteConfiguration: Use use function syntax. * Config: Use use function array_key_exists some more. * (T413924, T413925) tests: PHP 8.5 compatibility in AuthManager tests. * (T381842) Fix core contributions special page tests for legacy Vector. * (T380518) ContributionsSpecialPage: Call IndexPager::getBody if no results. * (T385876) Improve direction of user name used in title in Special:Contributions. * (T413573) [php8.4] Use DOMCompat::innerHTML() instead of Element::nodeValue. * build: Upgrade PHPUnit from 9.6.19 to 9.6.21. * (T413673) tests: Fix PHP8.5 error when casting float(INF) as integer. * (T414355) Fix PHP 8.5 deprecation warnings in IcuCollation. * (T413674) ParamValidator: Suppress cast warning in IntegerDef. * (T413577) Parser: Ignore long user provided int in Sanitizer::decodeCharReferences. * (T413576) Rdbms: Get strings from SQLPlatform::getDatabaseAndTableIdentifier. * (T413579) Site: Handle non-stored Site objects in SiteList. * (T413920) tests: Mock some functions in OutputPageTest. * (T413926) Do not attempt to get handler for unknown file types. * (T413919) tests: Use real TitleFormatter in LinkBatchTest. * (T413930) User: Add fallback 'default' to User::getDatePreference. * (T413934) JobQueueGroup: avoid PHP 8.5 deprecation from null array offsets. * (T413922) Rdbms: Handle null from DatabaseDomain::getDatabase in LBFactoryMulti. * (T413901) Media: Remove deprecated imagedestroy. * (T413931) tests: Set module name in ApiBaseTest::doGetParameterFromSettings. * rdbms::assertTransactionRoundStage: Show transaction name if available. * (T414350) Language: Handle NAN coercion to string in formatting numbers. * (T414336) Disable process timeout for Composer phpunit script. * (T413575) libs>XhprofData: Handle use of NULLs as array keys for PHP8.5. * tests: Use TestingAccessWrapper to run some protected or private methods. * (T406744) tests: Don't use ReflectionProperty::setAccessible(), it's a no-op now. * tests: Improve mocked ParserOptions in ParsoidOutputAccessTest. * (T415443) Upgrading mck89/peast (v1.16.3 => v1.17.4). * Update guzzlehttp/guzzle to 7.9.3. * (T414196) Upgraded guzzlehttp/guzzle. * (T413918) tests: Mock value for RangeChronologicalPager::getTimestampField. * (T413921) LinksUpdate: Handle nullable el_to_path column in ExternalLinksUpdate. * (T413926) Upload: Do not attempt to get handler for unknown file types. * File: Ensure mime type is set for LocalFile::getMimeType. * (T413917) Specials: Use empty string as missing type on Special:RevisionDelete. * (T415723) Updated phpunit/phpunit from 9.6.21 to 9.6.33. * Update phpunit/phpunit from 9.6.33 to 9.6.34. * Update wikimedia/parsoid to 0.20.6 and wikimedia/remex-html to 4.1.2. * (T416050) Update psy/psysh to ^0.12.19. * FileRepo: Add 'userAgent' option in ForeignAPIRepo for wgForeignFileRepos. * (T417390) mediawiki.util: Don't throw in addSubtitle if the skin lacks a subtitle. * (T413545) Update wikimedia/parsoid to 0.20.7. * Make MessageValue JsonCodecable instead of JsonDeserializable. * Forward-compatibility patch for MessageValue serialization hints. * [tests] Add forward-compatibility alias for JsonDeserializableSubClass. * (T367584) JsonCodec/ParserCache: Forward-compatibility test cases. * (T414884) PostgresInstaller: Handle null password in openConnectionToAnyDB. * Forward compatibility with ParserOutput::getTitle(). * (T360589) Introduce thumbnail steps. * (T360589) media: Make SvgHandler respect physicalWidth when building URL for thumb. * (T414805, T418745, T418346) WebPHandler: Allow the original being served on the web. * (T411013) mediawiki.util: Add adjustThumbWidthForSteps for step sizing in JS. * (T411013) mediawiki.util,FileRepo: Improve adjustThumbWidthForSteps test coverage. * (T411125) Round to original file width if there is no steep between that & requested. * (T411125) File: Allow scaling up vectorized images to larger sizes. * (T360589, T415598) Move handling of ThumbnailSteps to media handlers. * (T416518) Disable Composer audit.block-insecure option. * (T419183) ParserOutputFlags: add HAS_SLOT_HEADERS. * (T419479) sql: Mark pl_target_id as non-nullable in abstract schema. * (T329183, T417691) Clarify documentation for action=query&list=tags. * (T391524) EditPage: Handle MWException when serializing the preloaded content. * (T417819) ParserOutputFlags: Back-port new flags added in 1.46 for forward compat. * (T382566) Installer: Fix db type radio button. * (T384147, CVE-2026-34092) SECURITY: Block UI elements in 'tools'-sidebar shows presence of an autoblocked IP. * (T410429, CVE-2026-34088) SECURITY: RecentChanges entries expose suppressed content via generated log page html. * (T411305, CVE-2026-34091) SECURITY: User localization leaked by AbuseFilter + EventStream. * (T411366, CVE-2026-34090) SECURITY: Suggested investigations: Handle suppressed usernames. * (T414547, CVE-2026-34093) SECURITY: Special:UserRights allows viewing user rights from private wiki. * (T416090, CVE-2026-34094) SECURITY: Customized help link for page protection indicator is relative to subpage name, because the link target is missing the "/wiki/" prefix. * (T419192, CVE-2026-34095) SECURITY: action=raw with Special:Mypage subpage title responds with "Content-Type) SECURITY: text/html" on ctype=text/javascript request. == MediaWiki 1.43.6 == This is a security and maintenance release of the MediaWiki 1.43 branch. === Changes since 1.43.5 === * Localisation updates. * (T394396) Revert "SECURITY: Escape rawElement $content". * (T394059) DeduplicateStyles: Only transform possible style nodes. * UserGroupManager: Use MainConfigNames::PrivilegedGroups rather than string literal. * (T406391) RemexCompatFormatter: Don't encode HTML entities in raw-text elements. * (T402438) api: Allow ApiResult to override imagerepository key in prop=imageinfo. * ParserOutput: Add default values for JSON deserialization. * (T355853, T407172) Make the login and signup forms wider. * (T292868) Forward-compatibility: allow output flags to be serialized in `OutputFlags`. * ResourceLoader: Update cssjanus/cssjanus to wikimedia/cssjanus. * (T85085) Improve CSS checking in SVG filter. * (T405064) Fix the premature loop exit in Parser.cleanUpTocLine. * (T407289) i18n: deprecate double-underscore magic words which don't start/end with __. * i18n: all behavior switches should start/end with __ (part 2). * (T407289) i18n: Remove deprecated behavior switches without underscores in et/sh-latn/vep. * (T407770) Add symfony/polyfill-php84 and symfony/polyfill-php85. * maintenance/getConfiguration.php: Fix null warning and serialize error. * (T328605) ApiParse: Introduce prop=tocdata as replacement for prop=sections. * (T406283) ApiSandbox: Use POST when we have long URL. * (T401987, T401995, CVE-2025-67484) SECURITY: Disable xslt option by default. * (T410913) SpecialVersion: Fix "Cannot use bool as array" warning. * (T410928) resourceloader: Fix null offset in ClientHtml module sorting. * (T410934) Remove noop xml_parser_free() calls. * (T410920) Language: Prevent passing '' to ord() in ucfirst(). * (T410912) Language: Fix "ord(): Providing a string that is not one byte long is deprecated." * (T410912) MessageCache: Fix "ord(): Providing a string that is not one byte long is deprecated." * (T410920) Language: Prevent passing '' to ord() in lcfirst(). * (T410963) Upgrade wikimedia/xmp-reader from 0.9.4 to 0.10.2. * (T411016) Upgrading wikimedia/cldr-plural-rule-parser (v2.0.0 => v3.0.0). * (T411075) Api: Initialise reference variable. * (T411018) IndexPager: Set '' as default value for 'order'. * (T410914) Language: Fix PHP 8.5 warnings for NAN/INF string coercion in formatNumInternal. * (T410914) Language: Fix PHP 8.5 warnings for NAN/INF string coercion in parseFormattedNumber. * (T338103, T411214) ApiResult: Fix "ord(): Providing a string that is not one byte long is deprecated." * (T356544) Replace uses of Xml::fieldset(), deprecated since 1.42. * (T393790) htmlform: Fix rendering contents for cloner fields. * (T391882) HTMLFormFieldCloner: Fix multiple bugs related to conditional states. * (T406374) htmlform: Load ooui before infusing field cloner buttons. * (T411199) initEditCount: Fix count for users with no edits. * (T411827) SpecialPageFactory: Handle resolveAlias() returning null in getPage() and exists(). * (T411968) Installer: Do not use null as array offset. * Add support for HTTP/3 in MultiHttpClient. * (T295568) mediawiki.jqueryMsg: Support self-closing HTML tags. * (T411968) EditResultBuilder: Do not use null as array offset. * Add http/3 to runMulti in MultiHttpClient * (T406639, CVE-2025-67477) SECURITY: Escape word-separator message in Special:ApiSandbox. * (T406664, CVE-2025-67475) SECURITY: Escape square brackets in autocomment links. * (T385403, CVE-2025-67478) SECURITY: Always escape commas in mail encoded-words. * (T407131, CVE-2025-67479) SECURITY: Sanitizer: disallow underscore and wide underscore in data-* attribute names. * (T401053, CVE-2025-67480) SECURITY: Check read permissions in ApiQueryRevisionsBase. * (T409226, CVE-2025-67483) SECURITY: mediawiki.page.preview: Escape 'comma-separator' between multiple protection levels. * (T251032, CVE-2025-67481) SECURITY: Disallow 'style' attribute in client-side messages (jqueryMsg). == MediaWiki 1.43.5 == This is a security and maintenance release of the MediaWiki 1.43 branch. === Changes since MediaWiki 1.43.4 === * Add missing backport for Extension:DiscussionTools. * Add missing backport for Extension:Thanks. * (T406322, CVE-2025-11261) SECURITY: Escape system messages in mw.language.listToText.