SECURITY: Make token comparison constant time

It seems like our token comparison would be vulnerable to timing
attacks. This will take constant time.

Bug: 61346
Change-Id: I2a9e89120f7092015495e638c6fa9f67adc9b84f
(cherry picked from commit 74ce391e9c115320e74c06772ee4fcb610ae33c4)
SECURITY: API: Don't find links in the middle of api.php links

Bug: 61362
Change-Id: Idf985e4e69c2f11778a8a90503914678441cb3fb
(cherry picked from commit 55cd620157d884af855459f1f7903b0427c992ce)
SECURITY: Disallow non-whitelisted namespaces

Disallow uploading non-whitelisted namespaces. Also disallow iframe
elements.

User will get an error including the namespace name if they use a non-
whitelisted namespace.

Bug: 60771
Change-Id: Id5c022543184b19b77ad32d9a8a0c2dbbc5e9038
Merge "SECURITY: Disallow non-whitelisted namespaces" into REL1_21
Merge "SECURITY: Make token comparison constant time" into REL1_21
Updated Release notes and version number for 1.21.6

This is MW1.21.6 security release

Change-Id: I03be84667f06b7b311ddf47a17ff58817f469f13
Updated Release notes

Release notes are now readable without the context of the bug. Also
removed whitespace

Change-Id: I699a10effd7a5b1fad25b70b2b69ffc2bae133f6
1.21.7 release notes and version update

Change-Id: Ibaf890a55e5beb8827b36fc2c05b12b3f4f6d624
Set a title for the context during import on the cli

Bug: 62467
Change-Id: I9e0b6a219ea4176f9a3d14b8dbbea08b36c76c59
(cherry picked from commit 2bae4c1cf44473f00283cc09ef8dff38d2aa4241)
SECURITY: Add CSRF token on Special:ChangePassword

Use a login token when logged out user is using Special:ChangePassword
(should only happen when a user is forced to reset their password to
complete the login process).

Logged in users are not logged in as an effect of resetting their
password, and for them, the edit token check should be sufficient.

Bug: 62497
Change-Id: I08afed3e1aeeb8c97d24fe9858a3ba2c03e92adf
Updated release notes and version number for MediaWiki 1.21.8

This is MediaWiki 1.21.8 security and maintenance release

Change-Id: I73eda2cffbbf31728dc771181d948f6c45b6b5c1
Make MagicWordArray compatible with PCRE 8.34+

In PCRE 8.34, a subpattern's name must not start with a digit; work around
this by replacing digits in the synonym's index with letters. Amazingly,
this part of the name seems to have the sole purpose of ensuring uniqueness;
none of the matching functions actually use it for anything.

Adding a single-letter prefix was considered, though it would risk breaking
extension code that may have used 29- or 30- character magic word IDs.
(PCRE limits subpattern names to 32 characters.) Likewise, moving the magic
word's ID to the front would not work if it were to start with a digit.

Bug: 58640
Change-Id: Ic69f9000addbf18c4747105187e6f13191828fbb
SECURITY: escape sortKey in pageInfo

DEFAULTSORT isn't escaped before being added to the action=info table.

Bug: 63251
Change-Id: I087bfde8cbc69c3507f68ee3cb6e22aba0ffa7db
Updated release notes and version number for MediaWiki 1.21.9

This is MediaWiki 1.21.9 security and maintenance release

Change-Id: I3c00db1352537170ae36218010c66b9215ddd6c3
Add space between two feed links

When more than one feed link was given, the links was concat without a
space, which looks odd. Adding now a space, between each link in the
toolbox.

Bug: 36356
Change-Id: Iaf61c88dde0a92c475a60c005e13222eb7618eef
(cherry picked from commit 853877f93af5056dc3162a7fc83957681674ca0c)
SECURITY: Don't parse usernames as wikitext

On Special:PasswordReset, don't parse the username as wikitext since
the wikitext is parsed according to the wiki's configuration (might
include wgRawHtml), and the wiki may be private.

Bug: 65501
Change-Id: Ic3e5d42e1be5acc42ba89ae853c5ecbfec04fa91
Updated release notes and version number for MediaWiki 1.21.10

This is MediaWiki 1.21.10 security and maintenance release.

Change-Id: If72f1d29771f7a02c3eedee871d1dd0040abd317