meta: Security fix; add missing sanitization of author and authorurl. Thanks, Raúl...

[git.ikiwiki.info.git] / debian / changelog

diff --git a/debian/changelog b/debian/changelog
index 2f352ffa231cc9c885b2f6b25b92fc2fd603673f..fbcd6fac11706a6e4e45cd6f5faf0aa5f1525177 100644 (file)
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,4 +1,48 @@
-ikiwiki (3.20100815.2) UNRELEASED; urgency=low
+ikiwiki (3.20100815.9) stable-security; urgency=high
+
+  * meta: Security fix; add missing sanitization of author and authorurl.
+    CVE-2012-0220 Thanks, Raúl Benencia
+
+ -- Joey Hess <joeyh@debian.org>  Wed, 16 May 2012 19:51:27 -0400
+
+ikiwiki (3.20100815.8) stable-security; urgency=low
+
+  * ikiwiki-mass-rebuild: Fix tty hijacking vulnerability by using su.
+    (Once su's related bug #628843 is fixed.) Thanks, Ludwig Nussel.
+    (CVE-2011-1408)
+  * po: Make po4a warn, not error on a malformed document. (intrigeri)
+
+ -- Joey Hess <joeyh@debian.org>  Wed, 08 Jun 2011 17:34:56 -0400
+
+ikiwiki (3.20100815.7) stable-security; urgency=high
+
+  * meta: Security fix; don't allow alternative stylesheets to be added on
+    pages where the htmlscrubber is enabled. CVE-2011-1401
+
+ -- Joey Hess <joeyh@debian.org>  Mon, 28 Mar 2011 12:35:13 -0400
+
+ikiwiki (3.20100815.6) testing; urgency=low
+
+  * comments: Fix commenting, broken by security fix.
+
+ -- Joey Hess <joeyh@debian.org>  Mon, 24 Jan 2011 16:56:05 -0400
+
+ikiwiki (3.20100815.5) testing; urgency=low
+
+  * comments: Fix XSS security hole due to missing validation of page name.
+    CVE-2011-0428 (Thanks, Dave B.)
+
+ -- Joey Hess <joeyh@debian.org>  Sat, 22 Jan 2011 11:02:59 -0400
+
+ikiwiki (3.20100815.4) testing; urgency=low
+
+  * meta: Fix calling of htmlscrubber to pass the page parameter.
+    The change of the htmlscrubber to look at page rather than destpage
+    caused htmlscrubber_skip to not work for meta directives.
+
+ -- Joey Hess <joeyh@debian.org>  Mon, 29 Nov 2010 14:44:13 -0400
+
+ikiwiki (3.20100815.2) testing; urgency=low
 
   * Bugfix-only cherry-pick release for Debian squeeze.
   * Fix htmlscrubber_skip to be matched on the source page, not the page it is
@@ -21,7 +65,7 @@ ikiwiki (3.20100815.2) UNRELEASED; urgency=low
   * Set isPermaLink="no" for guids in rss feeds. 
   * sortnaturally: Added missing registration of checkconfig hook.
 
- -- Joey Hess <joeyh@debian.org>  Sun, 15 Aug 2010 11:42:55 -0400
+ -- Joey Hess <joeyh@debian.org>  Fri, 12 Nov 2010 11:09:39 -0400
 
 ikiwiki (3.20100815) unstable; urgency=medium