-ikiwiki (3.20150330) UNRELEASED; urgency=medium
+ikiwiki (3.20170111.1) stretch-security; urgency=high
+
+ * aggregate: Use LWPx::ParanoidAgent if available.
+ Previously blogspam, openid and pinger used this module if available,
+ but aggregate did not. This prevents server-side request forgery or
+ local file disclosure, and mitigates denial of service when slow
+ "tarpit" URLs are accessed.
+ (CVE-2019-9187)
+ * blogspam, openid, pinger: Use a HTTP proxy if configured, even if
+ LWPx::ParanoidAgent is installed.
+ Previously, only aggregate would obey proxy configuration. If a proxy
+ is used, the proxy (not ikiwiki) is responsible for preventing attacks
+ like CVE-2019-9187.
+ * aggregate, blogspam, openid, pinger: Do not access non-http, non-https
+ URLs.
+ Previously, these plugins would have allowed non-HTTP-based requests if
+ LWPx::ParanoidAgent was not installed. Preventing file URIs avoids local
+ file disclosure, and preventing other rarely-used URI schemes like
+ gopher mitigates request forgery attacks.
+ * aggregate, openid, pinger: Document LWPx::ParanoidAgent as strongly
+ recommended.
+ These plugins can request attacker-controlled URLs in some site
+ configurations.
+ * blogspam: Document LWPx::ParanoidAgent as desirable.
+ This plugin doesn't request attacker-controlled URLs, so it's
+ non-critical here.
+ * blogspam, openid, pinger: Consistently use cookiejar if configured.
+ Previously, these plugins would only obey this configuration if
+ LWPx::ParanoidAgent was not installed, but this appears to have been
+ unintended.
+
+ -- Simon McVittie <smcv@debian.org> Tue, 26 Feb 2019 22:57:58 +0000
+
+ikiwiki (3.20170111) unstable; urgency=high
+
+ * passwordauth: prevent authentication bypass via multiple name
+ parameters (CVE-2017-0356, OVE-20170111-0001)
+ * passwordauth: avoid userinfo forgery via repeated email parameter
+ (also in the scope of CVE-2017-0356)
+ * CGI, attachment, passwordauth: harden against repeated parameters
+ (not believed to have been a vulnerability)
+ * remove: make it clearer that repeated page parameter is OK here
+ * t/passwordauth.t: new automated test for passwordauth
+
+ -- Simon McVittie <smcv@debian.org> Wed, 11 Jan 2017 18:16:53 +0000
+
+ikiwiki (3.20170110) unstable; urgency=medium
+
+ [ Amitai Schleier ]
+ * wrappers: Correctly escape quotes in git_wrapper_background_command
+
+ [ Simon McVittie ]
+ * git: use an explicit function parameter for the directory to work
+ in. Previously, we used global state that was not restored correctly
+ on catching exceptions, causing an unintended log message
+ "cannot chdir to .../ikiwiki-temp-working: No such file or directory"
+ with versions >= 3.20161229 when an attempt to revert a change fails
+ or is disallowed
+ * git: don't run "git rev-list ... -- -- ..." which would select the
+ wrong commits if a file named literally "--" is present in the
+ repository
+ * check_canchange: log "bad file name whatever", not literal string
+ "bad file name %s"
+ * t/git-cgi.t: fix a race condition that made the test fail
+ intermittently
+ * t/git-cgi.t: be more careful to provide a syntactically valid
+ author/committer name and email, hopefully fixing this test on
+ ci.debian.net
+ * templates, comments, passwordauth: use rel=nofollow microformat
+ for dynamic URLs
+ * templates: use rel=nofollow microformat for comment authors
+ * news: use Debian security tracker instead of MITRE for security
+ references. Thanks, anarcat
+ * Set package format to 3.0 (native)
+ * d/copyright: re-order to put more specific stanzas later, to get the
+ intended interpretation
+ * d/source/lintian-overrides: override obsolete-url-in-packaging for
+ OpenID Selector, which does not seem to have any more current URL
+ (and in any case our version is a fork)
+ * docwiki.setup: exclude TourBusStop from offline documentation.
+ It does not make much sense there.
+ * d/ikiwiki.lintian-overrides: override script-not-executable warnings
+ * d/ikiwiki.lintian-overrides: silence false positive spelling warning
+ for Moin Moin
+ * d/ikiwiki.doc-base: register the documentation with doc-base
+ * d/control: set libmagickcore-6.q16-3-extra as preferred
+ build-dependency, with virtual package libmagickcore-extra as an
+ alternative, to help autopkgtest to do the right thing
+
+ -- Simon McVittie <smcv@debian.org> Tue, 10 Jan 2017 13:22:01 +0000
+
+ikiwiki (3.20161229.1) unstable; urgency=medium
+
+ * git: Attribute reverts to the user doing the revert, not the wiki
+ itself.
+ * git: Do not disable the commit hook while preparing a revert.
+
+ -- Simon McVittie <smcv@debian.org> Thu, 29 Dec 2016 20:46:24 +0000
+
+ikiwiki (3.20161229) unstable; urgency=medium
+
+ * Security: force CGI::FormBuilder->field to scalar context where
+ necessary, avoiding unintended function argument injection
+ analogous to CVE-2014-1572. In ikiwiki this could be used to
+ forge commit metadata, but thankfully nothing more serious.
+ (CVE-2016-9646)
+ * Security: try revert operations in a temporary working tree before
+ approving them. Previously, automatic rename detection could result in
+ a revert writing outside the wiki srcdir or altering a file that the
+ reverting user should not be able to alter, an authorization bypass.
+ (CVE-2016-10026 represents the original vulnerability.)
+ The incomplete fix released in 3.20161219 was not effective for git
+ versions prior to 2.8.0rc0.
+ (CVE-2016-9645 represents that incomplete solution.)
+ * Add CVE references for CVE-2016-10026
+ * Add automated test for using the CGI with git, including
+ CVE-2016-10026
+ - Build-depend on libipc-run-perl for better build-time test coverage
+ * Add missing ikiwiki.setup for the manual test for CVE-2016-10026
+ * git: don't issue a warning if the rcsinfo CGI parameter is undefined
+ * git: do not fail to commit changes with a recent git version
+ and an anonymous committer
+
+ -- Simon McVittie <smcv@debian.org> Thu, 29 Dec 2016 17:36:15 +0000
+
+ikiwiki (3.20161219) unstable; urgency=medium
+
+ [ Joey Hess ]
+ * inline: Prevent creating a file named ".mdwn" when the
+ postform is submitted with an empty title.
+
+ [ Simon McVittie ]
+ * Security: tell `git revert` not to follow renames. If it does, then
+ renaming a file can result in a revert writing outside the wiki srcdir
+ or altering a file that the reverting user should not be able to alter,
+ an authorization bypass. Thanks, intrigeri. (CVE-2016-10026)
+ * cgitemplate: remove some dead code. Thanks, blipvert
+ * Restrict CSS matches against header class to not break
+ Pandoc tables with header rows. Thanks, karsk
+ * Make pagestats output more deterministic. Thanks, intrigeri
+
+ -- Simon McVittie <smcv@debian.org> Mon, 19 Dec 2016 20:34:23 +0000
+
+ikiwiki (3.20160905) unstable; urgency=medium
+
+ [ Joey Hess ]
+ * Fix installation when prefix includes a string metacharacter.
+ Thanks, Sam Hathaway.
+
+ [ Simon McVittie ]
+ * Use git log --no-renames to generate recentchanges, fixing the git
+ test-case with git 2.9 (Closes: #835612)
+
+ -- Simon McVittie <smcv@debian.org> Mon, 05 Sep 2016 21:26:19 +0100
+
+ikiwiki (3.20160728) unstable; urgency=medium
+
+ * Explicitly remove current working directory from Perl's library
+ search path, mitigating CVE-2016-1238 (see #588017)
+ * wrappers: allocate new environment dynamically, so we won't overrun
+ the array if third-party plugins add multiple environment variables.
+ * Standards-Version: 3.9.8 (no changes required)
+
+ -- Simon McVittie <smcv@debian.org> Thu, 28 Jul 2016 10:41:56 +0100
+
+ikiwiki (3.20160509) unstable; urgency=high
+
+ [ Amitai Schlair ]
+ * img: ignore the case of the extension when detecting image format,
+ fixing the regression that *.JPG etc. would not be displayed
+ since 3.20160506
+
+ [ Simon McVittie ]
+ * img: parse img_allowed_formats case-insensitively, as was done in
+ 3.20141016.3
+ * inline: restore backwards compat for show=-1 syntax, which
+ worked before 3.20160121
+ * Remove a spurious changelog entry from 3.20160506 (the relevant
+ change was already in 3.20150614)
+ * Add CVE-2016-4561 reference to 3.20160506 changelog
+ * Set high urgency to get the CVE-2016-4561 fix and CVE-2016-3714
+ mitigation into testing
+
+ -- Simon McVittie <smcv@debian.org> Mon, 09 May 2016 21:57:09 +0100
+
+ikiwiki (3.20160506) unstable; urgency=medium
+
+ [ Simon McVittie ]
+ * HTML-escape error messages, in one case avoiding potential cross-site
+ scripting (CVE-2016-4561, OVE-20160505-0012)
+ * Mitigate ImageMagick vulnerabilities such as CVE-2016-3714:
+ - img: force common Web formats to be interpreted according to extension,
+ so that "allowed_attachments: '*.jpg'" does what one might expect
+ - img: restrict to JPEG, PNG and GIF images by default, again mitigating
+ CVE-2016-3714 and similar vulnerabilities
+ - img: check that the magic number matches what we would expect from
+ the extension before giving common formats to ImageMagick
+ * d/control: use https for Homepage
+ * d/control: add Vcs-Browser
+
+ [ Joey Hess ]
+ * img: Add back support for SVG images, bypassing ImageMagick and
+ simply passing the SVG through to the browser, which is supported by all
+ commonly used browsers these days.
+ SVG scaling by img directives has subtly changed; where before
+ size=wxh would preserve aspect ratio, this cannot be done when passing
+ them through and so specifying both a width and height can change
+ the SVG's aspect ratio.
+ * loginselector: When only openid and emailauth are enabled, but
+ passwordauth is not, avoid showing a "Other" box which opens an
+ empty form.
+
+ [ Amitai Schlair ]
+ * mdwn: Process .md like .mdwn, but disallow web creation.
+
+ [ Florian Wagner ]
+ * git: Correctly handle filenames starting with a dash in add/rm/mv.
+
+ -- Simon McVittie <smcv@debian.org> Fri, 06 May 2016 07:54:26 +0100
+
+ikiwiki (3.20160121) unstable; urgency=medium
+
+ [ Amitai Schlair ]
+ * meta: Fix [[!meta name=foo]] by closing the open quote.
+ * Avoid unescaped "{" in regular expressions
+ * meta test: Add tests for many behaviors of the directive.
+ * img test: Bail gracefully when ImageMagick is not present.
+
+ [ Joey Hess ]
+ * emailauth: Added emailauth_sender config.
+ * Modified page.tmpl to to set html lang= and dir= when
+ values have been specified for them, which the po plugin does.
+ * Specifically license the javascript underlay under the permissive
+ basewiki license.
+
+ [ Simon McVittie ]
+ * git: if no committer identity is known, set it to
+ "IkiWiki <ikiwiki.info>" in .git/config. This resolves commit errors
+ in versions of git that require a non-trivial committer identity.
+ * inline, trail: rename show, feedshow parameters to limit, feedlimit
+ (with backwards compatibility)
+ * pagestats: add "show" option to show meta fields. Thanks, Louis
+ * inline: force RSS <comments> to be a fully absolute URL as required
+ by the W3C validator. Please use Atom feeds if relative URLs are
+ desirable on your site.
+ * inline: add <atom:link rel="self"> to RSS feeds as recommended by
+ the W3C validator
+ * inline: do not produce links containing /./ or /../
+ * syslog: accept and encode UTF-8 messages
+ * syslog: don't fail to log if the wiki name contains %s
+ * Change dependencies from transitional package perlmagick
+ to libimage-magick-perl (Closes: #789221)
+ * debian/copyright: update for the rename of openid-selector to
+ login-selector
+ * d/control: remove leading article from Description
+ (lintian: description-synopsis-starts-with-article)
+ * d/control: Standards-Version: 3.9.6, no changes required
+ * Wrap and sort control files (wrap-and-sort -abst)
+ * Silence "used only once: possible typo" warnings for variables
+ that are part of modules' APIs
+ * Run autopkgtest tests using autodep8 and the pkg-perl team's
+ infrastructure
+ * Add enough build-dependencies to run all tests, except for
+ non-git VCSs
+ * tests: consistently use done_testing instead of no_plan
+ * t/img.t: do not spuriously skip
+ * img test: skip testing PDFs if unsupported
+ * img test: use the right filenames when testing that deletion occurs
+
+ -- Simon McVittie <smcv@debian.org> Thu, 21 Jan 2016 09:53:07 +0000
+
+ikiwiki (3.20150614) unstable; urgency=medium
+
+ * inline: change default sort order from age to "age title" for
+ determinism, partially fixing deterministic build for git-annex,
+ ikiwiki-hosting etc. (Closes: #785757)
+ * img: avoid ImageMagick misinterpreting filenames containing a colon
+ * img test: set old timestamp on source file that will change, so that
+ the test will pass even if it takes less than 1 second
+
+ -- Simon McVittie <smcv@debian.org> Sun, 14 Jun 2015 18:13:23 +0100
+
+ikiwiki (3.20150610) unstable; urgency=low
[ Joey Hess ]
* New emailauth plugin lets users log in, without any registration,
if the link text is identical
* Add a $config{deterministic} option and use it for the docwiki
* haiku: if deterministic build is requested, return a hard-coded haiku
- * If deterministic build is requested, return a hard-coded haiku
+ * polygen: if deterministic build is requested, use a well-known random seed
- -- Joey Hess <id@joeyh.name> Tue, 28 Apr 2015 12:24:08 -0400
+ -- Simon McVittie <smcv@debian.org> Wed, 10 Jun 2015 21:56:36 +0100
ikiwiki (3.20150329) experimental; urgency=high