Fix initSiteStats.php maintenance script

It appears not to have worked for some time, as it either calls a protected
function ($counter->refresh()) or an undefined function
($counter->update()) depending on the parameters specified.

Bug: 65214
Change-Id: Ia7d867792b84c98714ec6dbbfef09745e875c8bc
(cherry picked from commit babe76221c258093cc22029a6188e6cd6783ed00)
PostgreSQL: Fix ORDER BY NULL

MySQL automatically orders by the GROUP BY columns if no ORDER BY
is specified.  You can countermand this by specifying
ORDER BY NULL, which can give speed improvements in some cases,
for example if the GROUP BY was implemented by hashing then a
sort is unneeded and wastes time.

PostgreSQL does not tolerate the ORDER BY NULL syntax,
and does not need an analgous hint because it never does
gratuitious sorting of the nature just discussed.

This patch makes PostgreSQL ignore the ORDER BY NULL clause.

It might be a better approach to find a way to add this clause
specifically to MySQL, rather than to drop it specifically from
other database engines.

SQLite seems to tolerate the MySQL syntax.  Oracle and MSSQL
were not evaluated.

Bug: 67594
Change-Id: Ia9666136edd25e1e0d0728a8b28a92e44d00abc6
(cherry picked from commit ae811ddb6cc4932291cf73ce7768789eb39a33fd)
Preferences: Turn stubthreshold back into a combo box

Currently it's an insanely tall list box. All the other settings on this
page use combo boxes, so we should be consistent.

After it was changed from 'selectorother' to 'select' in I88212703
and support for 'size' in HTMLSelectField was enabled in I7ac345e1,
the size defines the height of the select box instead of the width of
the text input field.

Bug: 68313
Change-Id: Id42a62e78fc2fee741bb02b88dc14cbb1b63635a
(cherry picked from commit 588880c5f0567fca144a37066e87db3712ef32ac)
SECURITY: Prepend jsonp callback with comment

Mitigate CVE-2014-4671 for unpatched flash players

Bug: 68187
Change-Id: I2f46e623c1f541dbbafb6e8333e0929055098b15
Fix for XSS issue in bug 66608

Generate the URL used for loading a new page in Javascript,
instead of relying on the URL in the link that has been clicked
(as that could have been crafted by an attacker).

Bug: 66608
Change-Id: I19e2bf3af017a37c35cbadce9a70194aac693f33
SECURITY: Copy prevent-clickjacking between OutputPage and ParserOutput

Special page transclusion returns an OutputPage, whose metadata is
copied into the ParserOutput, and then later back into an OutputPage.
The "preventClickjacking" flag should be part of that metadata.

Bug: 65778
Change-Id: I17d2720fb94bb383a92059e5adbf6c16ee3e9ef4
Updated release notes and version number to MediaWiki 1.23.2

This is MediaWiki 1.23.2 security and maintenance release.

Change-Id: I2430a602c13a5f64a3b10108085f16aafd0510b2
Merge branch 'REL1_23' of https://gerrit.wikimedia.org/r/p/mediawiki/core into REL1_23
Merge branch 'REL1_23' into REL1_23_custom