| Index: branches/REL1_16/phase3/HISTORY |
| — | — | @@ -278,6 +278,9 @@ |
| 279 | 279 | * (bug 16343) Non-existing, but in use, category pages can be "go" match hits |
| 280 | 280 | * Fixed a CSS validation issue which allowed external images to be included |
| 281 | 281 | into wikis where that is disallowed by configuration. |
| | 282 | +* Fixed a data leakage vulnerability for private wikis using img_auth.php or |
| | 283 | + similar image access authentication schemes. Check user permissions before |
| | 284 | + streaming out scaled images from thumb.php. |
| 282 | 285 | |
| 283 | 286 | == API changes in 1.15 == |
| 284 | 287 | * (bug 16858) Revamped list=deletedrevs to make listing deleted contributions |