Fixed OracleUpdater::doPageRestrictionsPKUKFix prefix

Previously OracleUpdater::doPageRestrictionsPKUKFix had the
database prefix hard-coded into the SQL query. This removes
the hard-coded value and replaces it with the actual configured
prefix.

Change-Id: If60f23af7fd238d4c91ebf25b095749345a2718d
updater: Move rev_sha1 addition before convertUserOptions

Execution of the script and addition of rev_sha1 are both 1.19
activities, but for some reason the issue has only shown up in 1.21.

* MysqlUpdater::getCoreUpdateList() declares that 'doMigrateUserOptions'
  should be executed before adding the field rev_sha1 into the revision table
* ConvertUserOptions::execute() calls User::saveSettings()
* User::saveSettings() at its very end calls $this->getUserPage()->invalidateCache()
  and that is where the revision query is joining the party.

Bug: 48820
Change-Id: Id0a6efc33a8c46fdc3e9c294aa2d005d46c7dda0
(cherry picked from commit 070b8b40fb9cc2b4912f9c1b06d93712c0b2ddf3)
Installer: page refresh should refresh list of supported DBs

There's no need to cache _CompiledDBs's value from the first installer load.
Instead, the list should be regenerated on every page load, as it's merely being
used for displaying the user list of DBs to choose from.

This solves a common setup confusion, where user starts with no DB support, gets
a friendly error message, installs php5-mysql as requested, but refreshing the
page won't make the error go away.

Bug: 31533
Change-Id: I2e7e5b4f72e7c11706d491a205e202008e2511da
(cherry picked from commit ed542f41daf10f336a9d32107246dc7394ebfb12)
Purge upstream caches when deleting file assets.

Inform upstream caches when a file asset is deleted by calling
SquidUpdate::purge(). This helps prevent unintentional information leakage in
the event that the asset is being deleted for reasons of license or content.

Bug: 51064
Change-Id: Ibf57e8f32d7dd04b8508a69706be5a40b49e5abd
Release note update for bug 51064.

Change-Id: Ic8070a09f605b8a8c12b0a2f24248d538f4c6206
Merge "Release note update for bug 51064." into REL1_21
test: run autoloader suite

The autoloader tests were not properly registed and would thus never
trigger an error whenever an entry is missing.

Also register PageORMTableForTesting which was missing though it does
not have any impact.

bug: 47750
Change-Id: If31598bb84b8acfc2064630850ebf720f2555129
SECURITY: Sanitize ResourceLoader exception messages

Prevent path disclosure when $wgShowExceptionDetails is false

Bug: 52746
Change-Id: Ia14ae21972192d291cb86dce65568e9e8b4674f7
SECURITY: Prevent tokens in jsonp mode

Add checks to token-returning functions to prevent returning tokens in
jsonp mode. This affects action=tokens, action=login,
action=createaccount, and action=query&list=deletedrevs.

Also, remove the "gettoken" parameter to action=block and
action=unblock, which has been deprecated since 1.20.

Bug: 49090
Change-Id: Ibeaa5c72d8084585092b15935a3f5709104bf7f7
SECURITY: Fix extension detection with 2 .'s

Fix IE6 extension detection, to prevent XSS in the API response.

Bug: 52746
Change-Id: If58a81b62209b36bd143a1766a8a20c9c34dbe3b
Updated release notes and version number

Change-Id: Idc89da165e96377d65be7f4a67805f2bb17920cd
Follow-up 42333412833a - Fix behaviour $wgVerifyMimeType = false;

Bug: 49717
Change-Id: If1d6e8fed575bf2816a10db066ec4e023460ee1e
(cherry picked from commit 337fd7790e8d5e3a9983225c56adcd8ea8d496e7)
(cherry picked from commit dadfe0ae9349dd0bf5e1d3bedc8887289818fda1)
Merge "Fixed OracleUpdater::doPageRestrictionsPKUKFix prefix" into REL1_21
Fix comma errors in various js files (new jshint warning)

Change-Id: I6fdae5f66ef69b6526121cd7b1b2fbb0d9df7a62
Backport compatible message changes from master.

Change-Id: I026d179d5a579043880bb37e134e9b139790bd52
Backport compatible message changes from master.

Change-Id: Ic9c1a35fecf3c09d2cc60057783ebadaf656d6ba
Localisation updates from http://translatewiki.net.

Change-Id: I181ccbf16a9cd792ececf35fb1958cb033447177
SECURITY: Improve css javascript detection

* Forbid vertical tabs
* Convert Fullwidth, sup/sub script, IPA, and repetition unicode to
ascii, for ie6

Bug: 55332
Change-Id: I41a71b5b8fbecadd0f958cf57cc90d4c2fd9366e
SECURITY: Don't cache when a call could autocreate

Fixes for action=raw (used when sites include other site's javascript),
and stashed images.

Bug: 53032
Change-Id: I8f915f6a4756f750c74d9ee9bec58f7ba6c0c827
Update Releasenotes and version number for 1.21.3

Change-Id: Id1c0f85d461f13e32d84fb0a18b18f552323dda6