fixed wrong version number in HISTORY

Change-Id: I0e702b7b3ea886ba725eb83dde0e0ad9eb6e2f38
Follow-up 42333412833a - Fix behaviour $wgVerifyMimeType = false;

Bug: 49717
Change-Id: If1d6e8fed575bf2816a10db066ec4e023460ee1e
(cherry picked from commit 337fd7790e8d5e3a9983225c56adcd8ea8d496e7)
(cherry picked from commit dadfe0ae9349dd0bf5e1d3bedc8887289818fda1)
(cherry picked from commit adcf34af1273dd5868b21f4268d56f856b4403e5)
(cherry picked from commit 622bc8a465e1f4df719841a2e75fb098f66e87ec)
Merge "fixed wrong version number in HISTORY" into REL1_19
Backport compatible message changes from master.

Change-Id: Ic78ae1370c357fe7ac62146143e2ad7f71d1b3fa
Add missing entry to messages.inc

Change-Id: I86a562abc2e5414a3f3f2348e1022adf2f6dbf98
Localisation updates from http://translatewiki.net.

Change-Id: I133262ff2cc2c49fe3dac5ef5e72cd417ca9cf48
let us easily override PHPUnit version

The new --with-phpunitdir let us specify a git checkout of PHPUnit. That
will ease regression testing of the upstream new version. Usage is
straightforward:

Checkout PHPUnit from git as instructed on:
https://github.com/sebastianbergmann/phpunit#readme

Invoke our test suite with:
 $ cd maintenance/tests
 $ php phpunit.php --with-phpunitdir /path/you/just/checked/out

Cherry-picked from 3b9a3678b35ba6c2c4158d230393161a37f21e86

Change-Id: I8a9af0deac4dd74e3c8bde73535555c54ac83766
SECURITY: Improve css javascript detection

* Forbid vertical tabs
* Convert Fullwidth, sup/sub script, IPA, and repetition unicode to
ascii, for ie6

Bug: 55332
Change-Id: I41a71b5b8fbecadd0f958cf57cc90d4c2fd9366e
SECURITY: Don't cache when a call could autocreate

Fixes for action=raw (used when sites include other site's javascript),
and stashed images.

Bug: 53032
Change-Id: I8f915f6a4756f750c74d9ee9bec58f7ba6c0c827
Update Releasenotes and version number for 1.19.9

Change-Id: Ibde7ab8b24d49e11181d11c2fafb622a71bbaa42
Localisation updates from https://translatewiki.net.

Change-Id: Ic4a641e79ec03aeeb2179f37b22d9d1f9b50a471
Localisation updates from https://translatewiki.net.

Change-Id: I31323f04d30ce66260cd8bd8c2c3686a26f5b5e6
Localisation updates from https://translatewiki.net.

Change-Id: Id5b2c34e7aec7224351dc540b4df6f352d023204
Localisation updates from https://translatewiki.net.

Change-Id: Ieacc870fe5975cce211eae01015c424830c62027
Localisation updates from http://translatewiki.net.

Change-Id: I3c575a64b93ea5107b26e6a4b0a30fbabf2305d7
SECURITY: Fix RevDel log entry information leaks

DELETED_ACTION is supposed to hide the target of the log entry. But a
few places weren't doing this properly.

This fixes:
* API list=logevents no longer returns the pageid when the target is
  hidden.
* Enhanced RecentChanges no longer includes the log target page in the
  CSS class. This should also make the CSS class actually useful.
* Watchlist no longer shows log entries with DELETED_ACTION unless the
  user has deletedhistory, and with SUPPRESSED_ACTION unless the user
  has suppressrevision.

Bug: 58699
Change-Id: I4d7fe418089c60c6289650f644ef5c777fcb1e1e
SECURITY: Return error on invalid XML for SVGs

Return an error from UploadBase::detectScriptInSvg when the svg has
XML that cannot be parsed. Usually the XML is invalid, or the parser has
run out of memory trying to parse the file.

This patch is rebased on top of bug 57550.

Bug: 58553
Change-Id: I5069dee0c2f71e1a449ccc2a8d84eb3081839678
SECURITY: Disallow -o-link in styles

Opera will execute javascript from -o-link css attributes.

Bug: 58472
Change-Id: I8dd82fde3e38a62ad5107d7f657fd3328c05b77e
SECURITY: Don't normalize U+FF3C to \

Bug: 58088
Change-Id: I3bb23a173120fbbb60795094cf2d26657751642f
SECURITY: Disallow stylesheets in svg

Bug: 57550
Change-Id: I80452f98048ef565d06b45f78d8baccdafdf6186