-ikiwiki (3.20100815.2) UNRELEASED; urgency=low
+ikiwiki (3.20110124) UNRELEASED; urgency=low
+ * comments: Fix commenting, broken by security fix.
+
+ -- Joey Hess <joeyh@debian.org> Mon, 24 Jan 2011 16:56:05 -0400
+
+ikiwiki (3.20100815.5) testing; urgency=low
+
+ * comments: Fix XSS security hole due to missing validation of page name.
+ CVE-2011-0428 (Thanks, Dave B.)
+
+ -- Joey Hess <joeyh@debian.org> Sat, 22 Jan 2011 11:02:59 -0400
+
+ikiwiki (3.20100815.4) testing; urgency=low
+
+ * meta: Fix calling of htmlscrubber to pass the page parameter.
+ The change of the htmlscrubber to look at page rather than destpage
+ caused htmlscrubber_skip to not work for meta directives.
+
+ -- Joey Hess <joeyh@debian.org> Mon, 29 Nov 2010 14:44:13 -0400
+
+ikiwiki (3.20100815.2) testing; urgency=low
+
+ * Bugfix-only cherry-pick release for Debian squeeze.
+ * Fix htmlscrubber_skip to be matched on the source page, not the page it is
+ inlined into. Should allow setting to "* and !comment(*)" to scrub
+ comments, but leave your blog posts unscrubbed, etc. CVE-2010-1673
+ * comments: Make postcomment() pagespec work when previewing a comment,
+ including during moderation. CVE-2010-1673
+ * comments: Make comment() pagespec also match comments that are being
+ posted. CVE-2010-1673
* openid: Syntax tweak to the javascript code to make it work with MSIE 7
(and MSIE 8 in compat mode). Thanks to Iain McLaren for reporting
the bug and providing access to debug it.
* websetup: Fix defaults of checkboxes in advanced mode.
* Fix test suite failure on other side of date line.
* Set isPermaLink="no" for guids in rss feeds.
- * Fix htmlscrubber_skip to be matched on the source page, not the page it is
- inlined into. Should allow setting to "* and !comment(*)" to scrub
- comments, but leave your blog posts unscrubbed, etc.
- * comments: Make postcomment() pagespec work when previewing a comment,
- including during moderation.
- * comments: Make comment() pagespec also match comments that are being
- posted.
+ * sortnaturally: Added missing registration of checkconfig hook.
- -- Joey Hess <joeyh@debian.org> Sun, 15 Aug 2010 11:42:55 -0400
+ -- Joey Hess <joeyh@debian.org> Fri, 12 Nov 2010 11:09:39 -0400
ikiwiki (3.20100815) unstable; urgency=medium