From: Simon McVittie <smcv@debian.org>
Date: Wed, 11 Jan 2017 18:37:53 +0000 (+0000)
Subject: Merge branch 'master' into debian-jessie-backports
X-Git-Tag: debian/3.20170111_bpo8+1~1
X-Git-Url: http://git.vanrenterghem.biz/git.ikiwiki.info.git/commitdiff_plain/f3c282dff58dfb04d144297cbe24e9d0a585da11

Merge branch 'master' into debian-jessie-backports
---

f3c282dff58dfb04d144297cbe24e9d0a585da11
diff --cc debian/changelog
index 52902a2a2,14045a961..5046bf12e
--- a/debian/changelog
+++ b/debian/changelog
@@@ -1,12 -1,61 +1,70 @@@
+ ikiwiki (3.20170111) unstable; urgency=high
+ 
+   * passwordauth: prevent authentication bypass via multiple name
+     parameters (CVE-2017-0356, OVE-20170111-0001)
+   * passwordauth: avoid userinfo forgery via repeated email parameter
+     (also in the scope of CVE-2017-0356)
+   * CGI, attachment, passwordauth: harden against repeated parameters
+     (not believed to have been a vulnerability)
+   * remove: make it clearer that repeated page parameter is OK here
+   * t/passwordauth.t: new automated test for passwordauth
+ 
+  -- Simon McVittie <smcv@debian.org>  Wed, 11 Jan 2017 18:16:53 +0000
+ 
+ ikiwiki (3.20170110) unstable; urgency=medium
+ 
+   [ Amitai Schleier ]
+   * wrappers: Correctly escape quotes in git_wrapper_background_command
+ 
+   [ Simon McVittie ]
+   * git: use an explicit function parameter for the directory to work
+     in. Previously, we used global state that was not restored correctly
+     on catching exceptions, causing an unintended log message
+     "cannot chdir to .../ikiwiki-temp-working: No such file or directory"
+     with versions >= 3.20161229 when an attempt to revert a change fails
+     or is disallowed
+   * git: don't run "git rev-list ... -- -- ..." which would select the
+     wrong commits if a file named literally "--" is present in the
+     repository
+   * check_canchange: log "bad file name whatever", not literal string
+     "bad file name %s"
+   * t/git-cgi.t: fix a race condition that made the test fail
+     intermittently
+   * t/git-cgi.t: be more careful to provide a syntactically valid
+     author/committer name and email, hopefully fixing this test on
+     ci.debian.net
+   * templates, comments, passwordauth: use rel=nofollow microformat
+     for dynamic URLs
+   * templates: use rel=nofollow microformat for comment authors
+   * news: use Debian security tracker instead of MITRE for security
+     references. Thanks, anarcat
+   * Set package format to 3.0 (native)
+   * d/copyright: re-order to put more specific stanzas later, to get the
+     intended interpretation
+   * d/source/lintian-overrides: override obsolete-url-in-packaging for
+     OpenID Selector, which does not seem to have any more current URL
+     (and in any case our version is a fork)
+   * docwiki.setup: exclude TourBusStop from offline documentation.
+     It does not make much sense there.
+   * d/ikiwiki.lintian-overrides: override script-not-executable warnings
+   * d/ikiwiki.lintian-overrides: silence false positive spelling warning
+     for Moin Moin
+   * d/ikiwiki.doc-base: register the documentation with doc-base
+   * d/control: set libmagickcore-6.q16-3-extra as preferred
+     build-dependency, with virtual package libmagickcore-extra as an
+     alternative, to help autopkgtest to do the right thing
+ 
+  -- Simon McVittie <smcv@debian.org>  Tue, 10 Jan 2017 13:22:01 +0000
+ 
 +ikiwiki (3.20161229.1~bpo8+1) jessie-backports; urgency=medium
 +
 +  * Rebuild for jessie-backports
 +    - debian/tests/control: set INSTALLED_TESTS=1 here,
 +      pkg-perl-autopkgtest in jessie didn't support
 +      debian/tests/pkg-perl/smoke-env
 +
 + -- Simon McVittie <smcv@debian.org>  Thu, 29 Dec 2016 20:48:10 +0000
 +
  ikiwiki (3.20161229.1) unstable; urgency=medium
  
    * git: Attribute reverts to the user doing the revert, not the wiki