MediaWiki security release - 1.23.7

[Chris Steipp <csteipp () wikimedia org>]

Hi, we fixed a few security bugs in last week's MediaWiki release [1].
Two of them I think should have CVE's:

* bug 71111 / T73111 - A missing csrf check could allow reflected xss
on wikis that allow raw html
(https://phabricator.wikimedia.org/T73111)

* bug 71478 / T73478 - MediaWiki's <cross-domain-policy> mangling
could allow an article editor to inject code into api consumers that
blindly unserialize php representations of the page from the api
(https://phabricator.wikimedia.org/T73478)

Could those be assigned?


[1] - https://lists.wikimedia.org/pipermail/mediawiki-announce/2014-November/000170.html