-ikiwiki (1.46) UNRELEASED; urgency=low
+ikiwiki (1.48) UNRELEASED; urgency=low
+
+ * Fix link() PageSpecs to not just look at the raw link text, but at where
+ that given link points based on the page doing the linking. Note that this
+ could make such PageSpecs match different things than before, if you
+ relied on the old behavior of them only matching the raw link text.
+ * This required changing the match_* interface, adding a third parameter.
+ * Allow link() PageSpecs to match relative, as is allowed with globs.
+ * Add postform option to inline plugin.
+ * Add an bug tracker to the softwaresite example.
+ * Make ikiwiki's stylesheet support printing by hiding parts of the page
+ that shouldn't appear in a printout: Search box, actions bar,
+ blog post form, tags, backlinks, and feed buttons.
+ * Finally fixed the longstanding inline removal bug.
+ * Renamed %oldpagemtime to a more accurately named %pagemtime and fix it to
+ actually store pages' mtimes.
+ * Add "mtime" sort parameter to inline plugin.
+ * Fix mercurial backend to deal with empty commit messages.
+
+ -- Joey Hess <joeyh@debian.org> Sat, 24 Mar 2007 11:14:10 -0400
+
+ikiwiki (1.47) unstable; urgency=low
+
+ * Fix a security hole that allowed insertion of unsafe content via the meta
+ plugins's support for inserting html link and meta tags. Now such content
+ is passed through the htmlscrubber like everything else.
+ * Unfortunatly, that means that some valid uses of those tags are no longer
+ usable, and special case methods needed to be added for including
+ stylesheets, and for doing openid delegation. If you use either of these
+ in your wiki, it will need to be modified. See the meta plugin docs
+ for details.
+
+ -- Joey Hess <joeyh@debian.org> Wed, 21 Mar 2007 14:05:00 -0400
+
+ikiwiki (1.46) unstable; urgency=low
* Fix a bug with inlined create page links, including Discussion links on
blog post pages. The links will now create pages relative to the page that
same time, and let the second person resolve the conflict.
* Applied a patch from Michał to make the mercurial backend pass --quiet to
hg.
+ * Fix a security hole that allowed a web user to insert arbitrary html in
+ the title of a page due to missing escaping of titles in the meta plugin.
- -- Joey Hess <joeyh@debian.org> Sun, 18 Mar 2007 18:22:12 -0400
+ -- Joey Hess <joeyh@debian.org> Wed, 21 Mar 2007 01:51:30 -0400
ikiwiki (1.45) unstable; urgency=low