Disable external entities in XMLReader

Temporarily disable loading entities in XMLReader when calling read()
with libxml_disable_entity_loader(true).

bug: 46859

Change-Id: I0b2ef270f15c7b4da17edee680bf7e2410919915
Sanitize $limitReport before outputting

Prevents possible injection of "-->" and other HTML by extensions using
the ParserLimitReport hook.

(cherry-picked from 69f96f65dd99e54b84e489e7d957b7526653474c)

Bug: 46084
Change-Id: Id97b6668da6df3e5e4c0acefffa00c82cac3c44a
Disable external entities in Import

Temporarily disable loading entities in XMLReader when calling read()
during import.

bug: 47251

Change-Id: I0b39386e6cf4ec0244aab8ebc4095922511e2964
Updated release notes and version number

Change-Id: Ie497090ba774bbace342eb5cb4cd0809e8d9a8ed
Merge "Sanitize $limitReport before outputting" into REL1_20
Merge "Disable external entities in XMLReader" into REL1_20
Merge "Updated release notes and version number" into REL1_20
jshint: Allow global mw to be set in mediawiki.js

In master this has been cleaned up, but in REL1_20 we still used
the 'mw' global directly in a bunch of placed so we need to tell
jshint that it is okay for it to be set in mediawiki.js

It is currently complaining about redefinition because of this.

Change-Id: Ifb55efae5f4ff10ffe1873bdf02d43aa2d61857a
Make wfSuppressWarnings kill E_STRICT in PHP 5.4+

Since PHP 5.4+ E_STRICT is now included in E_ALL. Hence
wfSuppressWarnings was not filtering E_STRICT.

There was some complaints on project:support_desk about
timezone warnings popping up. See also bug 43092

Change-Id: Ie1ace158dac1733e6b2b2c1d533004d9bcab8c80
Release notes for wfSuppressWarnings change I backported to 1.20

See gerrit change 44165. I did the same thing for 1.19, since
no one told me I did it wrong (yay!) now doing it for 1.20.

Using separate commit for release notes in order to use
cherry-pick for the actual commit. Have no idea if that is
important or not.

Change-Id: I5b28b78d161653ce7e8da37be50c406e992b7354
Remove svnstat stuff used in Doxygen generation

Change-Id: I9d8db5fae6e0c99d59fcb9a43d7ed4aab953c300
mwdocgen.php: Implement --version option.

So that the job that runs it can pass along what it should
display (e.g. branch, tag, hash etc. whatever is appropiate
for the context of that run).

Change-Id: I1d5b6266e49a71672b0a53069e6ea6bb4658c3d2
Backport compatible message changes from master.

Change-Id: I6eb886b2ead3d2cc2a96c18f43c98da0c65ce999
Localisation updates from http://translatewiki.net.

Change-Id: I7a4199a1793fe9db51db5bf4eb592fe532c75406
SECURITY: Check SVG xml encoding against whitelist

Some browsers will interpret obscure xml encodings as UTF-8, while
PHP/expat will interpret the given encoding in the xml declaration.


bug: 47304
Change-Id: I3b311a7078d977ae89c51e95e625d79fba183cfc
Add hook AbortChangePassword to Special:ChangePassword

Adds a consistent method for authentication extensions to block
password changing operations.

Bug: 46590
Change-Id: I3469e90a958c4fb0f24cafd67de5590d3cc2f075
Updated release notes and version number

Change-Id: I8003f2a8a9d71eccf403d9d162ce9f3e583f0a46
(bug 31044) Make ResourceLoader behave in read-only mode

When the database is in read-only mode or writes fail for some other
reason, ResourceLoader should make every attempt to still serve JS and
CSS correctly.

* Surround a bunch of DB write code in MessageBlobStore.php in try-catch
  blocks.
* Surround the DB write in ResourceLoaderFileModule.php in a try-catch
  block rather than checking wfReadOnly(), because the DB may fail for
  other reasons.
* In ResourceLoader::respond() and helpers, set a short cache timeout on
  responses that include commented-out error messages.

Change-Id: Idc83a0fe042806263f9337c40ade8c38c56aa3cd
Merge branch 'REL1_20' of https://gerrit.wikimedia.org/r/p/mediawiki/core into REL1_20