| Index: trunk/phase3/HISTORY |
| — | — | @@ -1155,6 +1155,9 @@ |
| 1156 | 1156 | * (bug 16343) Non-existing, but in use, category pages can be "go" match hits |
| 1157 | 1157 | * Fixed a CSS validation issue which allowed external images to be included |
| 1158 | 1158 | into wikis where that is disallowed by configuration. |
| | 1159 | +* Fixed a data leakage vulnerability for private wikis using img_auth.php or |
| | 1160 | + similar image access authentication schemes. Check user permissions before |
| | 1161 | + streaming out scaled images from thumb.php. |
| 1159 | 1162 | |
| 1160 | 1163 | == API changes in 1.15 == |
| 1161 | 1164 | * (bug 16858) Revamped list=deletedrevs to make listing deleted contributions |