X-Git-Url: http://git.vanrenterghem.biz/git.ikiwiki.info.git/blobdiff_plain/bc06a212dbc0dd2e3fe8d27b1988f6309077e0b0..60cb2ac458dc8dea3b6a72abe52dcb1cd05617a4:/debian/changelog?ds=sidebyside

diff --git a/debian/changelog b/debian/changelog
index 21b0e1fbb..a92e3711e 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,4 +1,29 @@
-ikiwiki (3.20170109) UNRELEASED; urgency=medium
+ikiwiki (3.20170112) UNRELEASED; urgency=medium
+
+  * t/git-cgi.t: Wait 1 second before doing a revert that should work.
+    This hopefully fixes a race condition in which the test failed
+    around 6% of the time. (Closes: 862494)
+  * Guard against set-but-empty REMOTE_USER CGI variable on
+    misconfigured nginx servers, and in general treat sessions with
+    a set-but-empty name as if they were not signed in.
+  * When the CGI fails, print the error to stderr, not "Died"
+
+ -- Simon McVittie <smcv@debian.org>  Sun, 14 May 2017 15:34:52 +0100
+
+ikiwiki (3.20170111) unstable; urgency=high
+
+  * passwordauth: prevent authentication bypass via multiple name
+    parameters (CVE-2017-0356, OVE-20170111-0001)
+  * passwordauth: avoid userinfo forgery via repeated email parameter
+    (also in the scope of CVE-2017-0356)
+  * CGI, attachment, passwordauth: harden against repeated parameters
+    (not believed to have been a vulnerability)
+  * remove: make it clearer that repeated page parameter is OK here
+  * t/passwordauth.t: new automated test for passwordauth
+
+ -- Simon McVittie <smcv@debian.org>  Wed, 11 Jan 2017 18:16:53 +0000
+
+ikiwiki (3.20170110) unstable; urgency=medium
 
   [ Amitai Schleier ]
   * wrappers: Correctly escape quotes in git_wrapper_background_command
@@ -36,8 +61,12 @@ ikiwiki (3.20170109) UNRELEASED; urgency=medium
   * d/ikiwiki.lintian-overrides: override script-not-executable warnings
   * d/ikiwiki.lintian-overrides: silence false positive spelling warning
     for Moin Moin
+  * d/ikiwiki.doc-base: register the documentation with doc-base
+  * d/control: set libmagickcore-6.q16-3-extra as preferred
+    build-dependency, with virtual package libmagickcore-extra as an
+    alternative, to help autopkgtest to do the right thing
 
- -- Simon McVittie <smcv@debian.org>  Mon, 09 Jan 2017 14:33:19 +0000
+ -- Simon McVittie <smcv@debian.org>  Tue, 10 Jan 2017 13:22:01 +0000
 
 ikiwiki (3.20161229.1) unstable; urgency=medium