comments: Fix XSS security hole due to missing validation of page name.

[ikiwiki.git] / debian / changelog

diff --git a/debian/changelog b/debian/changelog
index ea6356f724145940221eafff66e7905cf90c673d..0165a240bb0dc85d69387c197e682945573f7bc9 100644 (file)
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,4 +1,32 @@
-ikiwiki (3.20101202) UNRELEASED; urgency=low
+ikiwiki (3.20110106) UNRELEASED; urgency=low
+
+  * inline: Pass feed titles to templates and add title and rel attributes
+    to feed links. (Giuseppe Bilotta)
+  * inline: Use class rather than id for feedlinks and blogform.
+    (Giuseppe Bilotta)
+  * comments: Fix XSS security hole due to missing validation of page name.
+
+ -- Joey Hess <joeyh@debian.org>  Thu, 06 Jan 2011 14:41:34 -0400
+
+ikiwiki (3.20110105) unstable; urgency=low
+
+  * tag: Do not include tagbase in rss/atom category tags. (Giuseppe Bilotta)
+  * tag: Improve display of tags with a slash in their names.
+    (Giuseppe Bilotta)
+  * Fix redirect to use a full url. Was broken (in theory) by baseurl
+    changes in last release.
+  * Fix `<base>` output by cgi to have a full url again, broken by last
+    release.
+  * Fix permalinks to recentchanges items and comments, broken by last
+    release.
+  * Export three cgi env vars needed for CGI->url to work. Fixed
+    openid breakage from last release.
+  * Removed `IkiWiki::misctemplate()` function. Any plugins using
+    it should use `IkiWiki::cgitemplate()` instead.
+
+ -- Joey Hess <joeyh@debian.org>  Wed, 05 Jan 2011 17:33:05 -0400
+
+ikiwiki (3.20101231) unstable; urgency=low
 
   * Better support for serving the same site on multiple urls. (Such as
     a http and a https url, or a ipv4 and an ipv6 url.)
@@ -12,8 +40,25 @@ ikiwiki (3.20101202) UNRELEASED; urgency=low
   * inline: Display feed buttons for nested inlines, linking to the inlined
     page's feed. (Giuseppe Bilotta)
   * goldtype: New theme, based on blueview, contributed by Lars Wirzenius.
-
- -- Joey Hess <joeyh@debian.org>  Mon, 29 Nov 2010 14:44:13 -0400
+  * po: do not override homepage title when it was overridden. (intrigeri)
+  * Set HTML::Template's parent_global_vars option to allow using parameters
+    like title_overridden that do not appear on the template. (intrigeri)
+    (See https://rt.cpan.org/Public/Bug/Display.html?id=64158)
+  * inline: Force an absolute page location when the inline postform is used.
+  * editpage, comment: Clean up title when editing or creating a page or
+    comment.
+  * teximg: Use `\[` and `\]` instead of not recommended `$$`. (Paul Menzel)
+    Closes: #596084
+  * monotone: Improve version parsing to support patch and development
+    versions of the monotone binary. (tommyd3mdi)
+  * highlight: Support highlight 3.2+svn19 (note that released version 3.2
+    is not supported). Closes: #605779 (David Bremner)
+  * Add a second parameter to the rcs_diff hook, and avoid bloating memory
+    reading in enormous commits.
+  * git: Fix bug involving attempting to web revert a commit that included
+    changes to attachments.
+
+ -- Joey Hess <joeyh@debian.org>  Fri, 31 Dec 2010 21:23:37 -0400
 
 ikiwiki (3.20101201) unstable; urgency=low