Closing dump buffers on stream end

Change-Id: I7bef095f2f9189fb20064da4fd09ed4caa7a90e5
* (bug 34212) ApiBlock/ApiUnblock allow action to take place without a token parameter present

* (bug 35317) CSRF in Special:Upload
Revert r56793, which removed the CSRF check for Special:Upload for normal file
uploads. Cross-site posting of file uploads without user interaction has been
possible since at least as early as Chrome 8 (late 2010) and Firefox 6 (mid
2011).

Commonist has used api.php since version 0.4.0 (April 2010), and the API
already requires an edit token, so Commonist 0.4.0+ is not affected by this
change.

* (bug 34907) Fix for CSRF vulnerability due to mw.user.tokens. Patch by Roan
Kattouw and Tim Starling.
* Filter out private modules early in ResourceLoader::makeResponse() and just
pretend they weren't specified. This means these modules cannot be loaded
through load.php . This filtering must not happen in makeModuleResponse(),
because that would break inlining.
* Force inlining of private modules in OutputPage::makeResourceLoaderLink(),
disregarding $wgResourceLoaderInlinePrivateModules
* Remove $wgResourceLoaderInlinePrivateModules
* Remove special treatment of private modules ($private) in
ResourceLoader::makeResponse() and sendResponseHeaders(), because we're not
allowing private modules to be loaded through here any more
* Remove identity checks in ResourceLoaderUserOptionsModule and
ResourceLoaderUserCSSPrefsModule, they didn't make a lot of sense before but
they're certainly useless now.
* Factored out error comment construction in ResourceLoader.php and stripped
comment terminations from exception messages. I didn't find an XSS
vulnerability but it looked scary.

Patchset2:
 Removes whitespace error that prevented automatic merge by Gerrit:
 includes/resourceloader/ResourceLoaderUserOptionsModule.php

Change-Id: I2dec8b8caf9db3c64919763865cc10cccdd6a1a3
Was causing Notice: Array to string conversion in .../includes/api/ApiBase.php on line 285 and examples of list=allimages are not displayed properly

Change-Id: I4fde14245ac19716957beb634a274c3a6042d776
Merge "Closing dump buffers on stream end"
* (bug 35446) Using "{{nse:}}" with an invalid namespace name no longer throws a PHP warning

Change-Id: I8e7611cdb03558af13ec5b96e02857ff5b16b571
Use local context to get messages

Change-Id: Ibbe6cd92ad3057742a6193471971fb11244e843b
Sync HISTORY with RELEASE-NOTES from REL1_18

Change-Id: Iedb39de2c357ecb5b36bcb277722825d89a86031
First half of fix for bug #30332 ("API spamblocklist error should provide *all* blocked URLs, not just one").

Allow spamPageWithContent() to accept an array of matches, rather than just one.

Not dependent on other half of fix.

Change-Id: I75faac51f24bbb2569b36bc2e44f3cd5c43b1bd7
Merge "First half of fix for bug #30332 ("API spamblocklist error should provide *all* blocked URLs, not just one")."
Merge "Sync HISTORY with RELEASE-NOTES from REL1_18"
Fix typo in comment

Change-Id: Ia0af1e53c11c371f70dd60acdf5d32485bd8b3bc
Merge "Fix typo in comment"
Revert previous commit: accidental branch merge

This reverts commit 685fffec2049e1e152105dae919b58ed8876d04e, reversing
changes made to 59a68b48a74763af58ad7d62820ae1e7b0639476.

Change-Id: I5ed9f66e6afd5004ed5ee0f00e46888359376689
Fix typo in comment

Change-Id: I5861982d91a32b5f65c250dde38fc5ce8f5c2693
[FileBackend]
* Added FileJournal class to log file changes for file backends. This can be used for migrations (like moving to Swift), syncing mirror repos, consistency checks, finishing/reverting operation batches, and such. The default journal is the "null" journal, which simply does nothing.
* Added the optional schema change required for using the DBFileJournal (MySQL, SQLite).

Change-Id: I33c9f9a598ba1f164c862b9dc3c718f9172db02b
Split hashar's patchset2 into its own commit

* updated FileBackend constructor documentation
* squash change 3321 (r113742)

Change-Id: I6bb054ac6aaeee38a03880558c918963138330c4
Use local context to get messages

Change-Id: I2c6fad30e2c4eaebf1223d94820dae917231e882
Fix language names:

* ab - suggested at ab.wikipedia.org village pump.
* bh - added a clarification about the name in a comment.
* bug - improved the name.
* ckb - added a clarification about the name in a comment.
* dz - changed the name in the comment.
* ike-latn - capitalized the Latin name.
* inh - only the Cyrillic name is needed.
* ks - consistent slash usage.
* mo - added a comment saying that it's deprecated.
* new - fixed the name in the comment.
* pi - fixed the native name according to the Wikipedia article and the dictionaries i have.
* tg-latn - capitalized the Latin name.
* tly - capitalized the Cyrillic name.
* ug-latn - removed unneeded LRM.
* uz - fixed the apostrophe.
* vep - fixed the apostrophe.

Change-Id: Ibd3d145426d71d46393ab330ac9ee63a4c737041
Improved the comment about Special:Contributions.

It was prompted by an IRC discussion with SrikanthLogic,
who found the comment hard to understand.

Change-Id: Idd686257bc4d44f93e06b5645bdc1531bb2b4a2e
Merge "Use local context to get messages"