Fixed OracleUpdater::doPageRestrictionsPKUKFix prefix

Previously OracleUpdater::doPageRestrictionsPKUKFix had the
database prefix hard-coded into the SQL query. This removes
the hard-coded value and replaces it with the actual configured
prefix.

Change-Id: If60f23af7fd238d4c91ebf25b095749345a2718d
Follow-up 42333412833a - Fix behaviour $wgVerifyMimeType = false;

Bug: 49717
Change-Id: If1d6e8fed575bf2816a10db066ec4e023460ee1e
(cherry picked from commit 337fd7790e8d5e3a9983225c56adcd8ea8d496e7)
(cherry picked from commit dadfe0ae9349dd0bf5e1d3bedc8887289818fda1)
Merge "Fixed OracleUpdater::doPageRestrictionsPKUKFix prefix" into REL1_21
Fix comma errors in various js files (new jshint warning)

Change-Id: I6fdae5f66ef69b6526121cd7b1b2fbb0d9df7a62
Backport compatible message changes from master.

Change-Id: I026d179d5a579043880bb37e134e9b139790bd52
Backport compatible message changes from master.

Change-Id: Ic9c1a35fecf3c09d2cc60057783ebadaf656d6ba
Localisation updates from http://translatewiki.net.

Change-Id: I181ccbf16a9cd792ececf35fb1958cb033447177
SECURITY: Improve css javascript detection

* Forbid vertical tabs
* Convert Fullwidth, sup/sub script, IPA, and repetition unicode to
ascii, for ie6

Bug: 55332
Change-Id: I41a71b5b8fbecadd0f958cf57cc90d4c2fd9366e
SECURITY: Don't cache when a call could autocreate

Fixes for action=raw (used when sites include other site's javascript),
and stashed images.

Bug: 53032
Change-Id: I8f915f6a4756f750c74d9ee9bec58f7ba6c0c827
Update Releasenotes and version number for 1.21.3

Change-Id: Id1c0f85d461f13e32d84fb0a18b18f552323dda6
Localisation updates from https://translatewiki.net.

Change-Id: I6b3e25f3647f0ccfa1767f9f747b26f9092333fd
Localisation updates from http://translatewiki.net.

Change-Id: I3ceeb3321498553521c833d65d6b6b899912f4fd
Fix typo in Release Notes

Change-Id: I5b9728f3c4ce2bf53b06f2d5d0121205ccb4d5b2
SECURITY: Fix RevDel log entry information leaks

DELETED_ACTION is supposed to hide the target of the log entry. But a
few places weren't doing this properly.

This fixes:
* API list=logevents no longer returns the pageid when the target is
  hidden.
* Enhanced RecentChanges no longer includes the log target page in the
  CSS class. This should also make the CSS class actually useful.
* Watchlist no longer shows log entries with DELETED_ACTION unless the
  user has deletedhistory, and with SUPPRESSED_ACTION unless the user
  has suppressrevision.

Bug: 58699
Change-Id: I28e8b38a3204f29d83a4ae30c237abada79e1b1f
SECURITY: Return error on invalid XML for SVGs

Return an error from UploadBase::detectScriptInSvg when the svg has
XML that cannot be parsed. Usually the XML is invalid, or the parser has
run out of memory trying to parse the file.

This patch is rebased on top of bug 57550.

Bug: 58553
Change-Id: I1e84deb09be39d82e8e577f33bd655e9653e9a4b
SECURITY: Disallow -o-link in styles

Opera will execute javascript from -o-link css attributes.

Bug: 58472
Change-Id: I72ad1a0d7e6f9e3d5f51a46c3e4d8a428051de2e
SECURITY: Don't normalize U+FF3C to \

Bug: 58088
Change-Id: If2494d2beca3fff8e3b855a95dee9b35bfda4b03
SECURITY: Disallow stylesheets in svg

Bug: 57550
Change-Id: I114d040314be6c31ec1f7dbbba0b6760e95b3f86
Update Releasenotes and version number for 1.21.4

Change-Id: I941730963b7546ddc8cf0d2a9ca4c2c4aa939b8c
Merge tag '1.21.4' into farset-production

Security Release 1.21.4