Add sequence support for upsert in DatabaseOracle

In the same way as in selectInsert

Bug: 53710
Change-Id: I26f891da808ecdc932e29eebda71df4c17a29617
(cherry picked from commit 3d0f393ced80206053e18f893a17fbb81be14c8d)
SECURITY: Make token comparison constant time

It seems like our token comparison would be vulnerable to timing
attacks. This will take constant time.

Bug: 61346
Change-Id: I2a9e89120f7092015495e638c6fa9f67adc9b84f
(cherry picked from commit 74ce391e9c115320e74c06772ee4fcb610ae33c4)
SECURITY: API: Don't find links in the middle of api.php links

Bug: 61362
Change-Id: Idf985e4e69c2f11778a8a90503914678441cb3fb
(cherry picked from commit 55cd620157d884af855459f1f7903b0427c992ce)
SECURITY: Disallow non-whitelisted namespaces

Disallow uploading non-whitelisted namespaces. Also disallow iframe
elements.

User will get an error including the namespace name if they use a non-
whitelisted namespace.

Bug: 60771
Change-Id: Id5c022543184b19b77ad32d9a8a0c2dbbc5e9038
Merge "SECURITY: Make token comparison constant time" into REL1_22
Merge "SECURITY: Disallow non-whitelisted namespaces" into REL1_22
Updated Release Notes and version number for 1.22.3

This is the MW1.22.3 maintenance release

Change-Id: I9f400338f7f450b097a13fd9932e2b2ec17b5ffb
Updated release notes

Release notes are now readable without the context of the according bugs

Change-Id: I21dc8c11de264cb461d78f5c09932290df1f5d80
1.22.4 release notes and version update

Change-Id: Ib9ef58a076902307be94ea34ff74049b95452fc2
Link to existing login help page by default from helplogin-url

Detailed rationale discussed on bugzilla, bug 53888 and parent,
where consensus on the design was gained.

Using https link per Brion et al. in comments and bug 54835,
with new keys for the messages in order to avoid any conflict
with existing messages. (The translations of the removed messages
will be automatically removed by localisation updates.)

https://www.mediawiki.org/wiki/Help:Logging_in was improved by Lloffiwr
and now also marked for translation. The link is ready for future
translations thanks to the use of the standard Special:MyLanguage, hence
the message is made ignored to allow customisations only locally.

Bug: 53888
Change-Id: I8cefafbcd3bd1d6a03cec7cf1d0efdf607fec21d
Make MySQLi work with non-standard port

Other than mysql_connect, mysqli_real_connect expects an explicit
port parameter. So we need to parse the port out of $realServer. Note it
is not possible to just use $wgDBport, since that is set to 5432 as a
default and would break all existing sites using mysqli on standard port.

This change is IPv6 safe.

Bug: 58153
Change-Id: I58e690ef2803e205f324a142fbcbd96cc87510f1
Set a title for the context during import on the cli

Bug: 62467
Change-Id: I9e0b6a219ea4176f9a3d14b8dbbea08b36c76c59
(cherry picked from commit 2bae4c1cf44473f00283cc09ef8dff38d2aa4241)
mediawiki.js: Fix documentation breakage

* Unformatted code and unclosed <media> tag.
  Depending on which versions of other libs are installed, this
  error can occur. Current version (v4.x) in production doesn't
  require this yet. But local environment with the same version
  does. And the next version of jsduck (v5.x) will consistently
  work this way for compliance with Markdown.

* Simplified @link while at it to use the cleaner implied link
  instead like we do elsewhere ({@link} should rarely be
  used directly).

* Add /** @class */ because half the file was no longer indexed
  as part of mw (instead became part of mw.Message after 4f23099)

* Index the private mw#log as log_ instead because it clashes
  with the public mw#log. This should've clashed in 4f23099, but
  didn't because the other one was seen as part of mw.Message
  by the test.

Change-Id: Ic5b8c5c743ecdb1509652c3655d83e501f6fa9ee
(cherry picked from commit 176e3e44a01dc5d5b020f276649123d743458d8f)
Add link to PD help translatable pages from sidebar

Reuses the existing helppage default message and
adds it to ignored messages as Special:MyLanguage
is used and translations have to be removed:
this does not bother customised local links.

Now using HTTPS URL to mediawiki.org per Brion
on bug 54835. This slightly increases the footprint
of the change but should keep everything functionally
equivalent. The sidebar is not bothered by full URLs,
except in self-defeating tests which are also fixed here.

Bug: 53887
Change-Id: I999b97729536dbab4a3a5efd8d6f86527f031948
Merge "Make MySQLi work with non-standard port" into REL1_22
Fix custom local MediaWiki:Helppage values

Followup to 3a6ea89d4aa4a0fbc36a209fa13b1c6134110ca9

Change-Id: I7effec352d263f536d1d1763e9cd56d2f5154f13
(cherry picked from commit dbede6aad31752fdfe317f7eb66fb1c47c4ec5d4)
Merge "Set a title for the context during import on the cli" into REL1_22
update RELEASE-NOTES-1.22 for bug 60543

also adding myself to CREDITS

Change-Id: I5b4477144f76748faf741bf6ef153b69f6d41ac0
remove duplicates from release notes

they came in from a recent manual rebase of an old change, but they are
already listed in the section

Change-Id: Icb4df1b57f5da949d6f35062877838d115ad7c26
SECURITY: Add CSRF token on Special:ChangePassword

Use a login token when logged out user is using Special:ChangePassword
(should only happen when a user is forced to reset their password to
complete the login process).

Logged in users are not logged in as an effect of resetting their
password, and for them, the edit token check should be sufficient.

Bug: 62497
Change-Id: I08afed3e1aeeb8c97d24fe9858a3ba2c03e92adf