-ikiwiki (1.46) UNRELEASED; urgency=low
+ikiwiki (1.48) UNRELEASED; urgency=low
+
+ * Fix link() PageSpecs to not just look at the raw link text, but at where
+ that given link points based on the page doing the linking. Note that this
+ could make such PageSpecs match different things than before, if you
+ relied on the old behavior of them only matching the raw link text.
+ * This required changing the match_* interface, adding a third parameter.
+ * Allow link() PageSpecs to match relative, as is allowed with globs.
+ * Add postform option to inline plugin.
+ * Add an bug tracker to the softwaresite example.
+ * Make ikiwiki's stylesheet support printing by hiding parts of the page
+ that shouldn't appear in a printout: Search box, actions bar,
+ blog post form, tags, backlinks, and feed buttons.
+
+ -- Joey Hess <joeyh@debian.org> Wed, 21 Mar 2007 19:46:32 -0400
+
+ikiwiki (1.47) unstable; urgency=low
+
+ * Fix a security hole that allowed insertion of unsafe content via the meta
+ plugins's support for inserting html link and meta tags. Now such content
+ is passed through the htmlscrubber like everything else.
+ * Unfortunatly, that means that some valid uses of those tags are no longer
+ usable, and special case methods needed to be added for including
+ stylesheets, and for doing openid delegation. If you use either of these
+ in your wiki, it will need to be modified. See the meta plugin docs
+ for details.
+
+ -- Joey Hess <joeyh@debian.org> Wed, 21 Mar 2007 14:05:00 -0400
+
+ikiwiki (1.46) unstable; urgency=low
* Fix a bug with inlined create page links, including Discussion links on
blog post pages. The links will now create pages relative to the page that
output the verbose build log to stdout, rather than to the syslog.
* Detect the case of two people independently creating the same page at the
same time, and let the second person resolve the conflict.
+ * Applied a patch from Michał to make the mercurial backend pass --quiet to
+ hg.
+ * Fix a security hole that allowed a web user to insert arbitrary html in
+ the title of a page due to missing escaping of titles in the meta plugin.
- -- Joey Hess <joeyh@debian.org> Sat, 17 Mar 2007 19:56:04 -0400
+ -- Joey Hess <joeyh@debian.org> Wed, 21 Mar 2007 01:51:30 -0400
ikiwiki (1.45) unstable; urgency=low